This list forms part of Section 7 of the Theori Privacy Policy and has the same effect as the policy itself. It is published under Article 26(2) (disclosure of processing entrustment) and Article 28-8(2) (disclosure for cross-border transfers) of the Korean Personal Information Protection Act, and satisfies the recipient disclosure required by GDPR Art. 13(1)(e) and the CCPA.
When a service provider is added or changed, we update this list and record the change in the revision history on the Previous Policies page.
The sub-processors that process Customer Data are listed separately on our Trust Center, as provided in Section 7 of the DPA.
Questions about this list, or about a specific provider on it, go to privacy@theori.io. Each provider's own privacy notice is available from that provider; we will point you to it on request.
Last updated: September 30, 2026
1. Service Providers Processing Data in Korea
The following service providers process personal data within the Republic of Korea. We do not ourselves transfer this data outside Korea. Where a provider engages its own sub-processors or transfers data overseas to operate its service, we treat those third parties as subject to disclosure under Article 26(2) of the Personal Information Protection Act and add them to this list as they are identified.
1. Service Providers Processing Data in Korea
Service Provider
Processing Activities
Applicable Service
Amazon Web Services Korea LLC
Cloud infrastructure and data storage (Seoul Region)
Xint Web, aprism, Dreamhack, ChainLight
NICE Information Service Co., Ltd.
Mobile identity verification services
Dreamhack
Viva Republica, Inc. (Toss)
Payment processing services
Dreamhack
Korea Post
Delivery of CTF prizes and event rewards
Dreamhack
Kakao Corporation
Delivery of CTF prizes and event rewards
Dreamhack
Channel Corporation
Customer support (live chat)
Xint Web
inblog Inc.
Corporate blog platform operation and blog usage analytics
Theori blog
Doodlin Inc. (GreetingHR)
Recruitment application intake and hiring management
Theori careers site
2. Overseas Service Providers and Cross-Border Transfers
The following providers are organized by function. Each acts on our documented instructions under a written agreement requiring appropriate security measures.
Why some providers show "Republic of Korea" as the destination. Where a single function uses both Korean and overseas providers (for example, AWS Seoul and AWS US regions for cloud infrastructure), we list them side by side so you can see the actual data flow. Providers whose destination is the Republic of Korea are not cross-border transfers.
Advertising and marketing providers are engaged only where you have given prior consent — see our Cookie Policy.
(a) Inter-Entity Transfers (Theori Korea ↔ Theori, Inc.)
(a) Inter-Entity Transfers (Theori Korea ↔ Theori, Inc.)
Transfer Direction
Recipient
Destination Country
Data Transferred
Purpose
Retention Period
Korea → US
Theori, Inc.
United States
Personal data related to product inquiries
Overseas business entity (Theori, Inc.) operations
1 year after inquiry resolution
US → Korea
Theori Korea
Republic of Korea
Personal data related to product inquiries; application data for Theori, Inc. roles
Processing by Korea-based group security/support functions
1 year after inquiry resolution (application data for Theori, Inc. roles is kept for the period set out in Privacy Policy Section 2.2)
(b) Cloud Infrastructure
(b) Cloud Infrastructure
Recipient
Destination Country
Data Transferred
Purpose
Retention Period
Amazon Web Services Korea LLC
Republic of Korea (Seoul)
Service data
Cloud infrastructure and data storage
Until service agreement terminates
Amazon Web Services, Inc.
United States (Virginia)
Service data
Cloud infrastructure and data storage
Until service agreement terminates
Webflow, Inc.
United States
Website access information
xint.io landing page hosting
Until service agreement terminates
When Korean users access Xint Code, data is transferred to the United States (Virginia). When US users access Xint Web or aprism, data is transferred to Korea (Seoul).
Name, card number, payment amount, expiration date
International payment processing
Until service agreement terminates
(i) AI Services
(i) AI Services
Recipient
Destination Country
Data Transferred
Purpose
Retention Period
Anthropic PBC (Claude API)
United States
Code, prompts
AI-powered security analysis
ZDR applied (not used for training)
OpenAI, Inc. (GPT API)
United States
Code, prompts
AI-powered security analysis
ZDR applied (not used for training)
Google LLC (Gemini API)
United States
Code, prompts
AI-powered security analysis
ZDR applied (not used for training)
Amazon Web Services, Inc. (Bedrock)
United States (Virginia)
Code, prompts
AI-powered security analysis
ZDR applied (not used for training)
Amazon Web Services Korea LLC (Bedrock)
Republic of Korea (Seoul)
Code, prompts
AI-powered security analysis
ZDR applied (not used for training)
(j) Web Analytics / Product Analytics
(j) Web Analytics / Product Analytics
Recipient
Destination Country
Data Transferred
Purpose
Retention Period
Google LLC (GA4)
United States
Cookies, service usage records, IP address
Web usage statistical analysis
12 months
PostHog, Inc.
United States
Cookies, service usage records, age range, gender
Product analytics and UX improvement
12 months
Microsoft Corporation (Clarity)
United States
Cookies, on-screen interaction records, IP address
Usage pattern analysis and UX improvement
12 months
RudderStack, Inc.
United States
Cookies, event records, IP address
Event collection and data integration
12 months
(k) Error Tracking / Infrastructure Monitoring
(k) Error Tracking / Infrastructure Monitoring
Recipient
Destination Country
Data Transferred
Purpose
Retention Period
Functional Software, Inc. (Sentry)
United States
IP address, device information, error logs
Error tracking and performance monitoring
90 days
Datadog, Inc.
United States
IP address, service logs
Infrastructure monitoring
12 months
(l) Advertising / Marketing
(l) Advertising / Marketing
Recipient
Destination Country
Data Transferred
Purpose
Retention Period
Google LLC (Google Ads and AdSense)
United States
Cookies, behavioral data
Targeted advertising
Until service agreement terminates
LinkedIn Corporation
United States
Cookies, behavioral data
Advertising and lead tracking
Until service agreement terminates
Google LLC (embedded YouTube)
United States
Viewing history, cookies
Embedded video playback and viewing-based recommendations or advertising
Until service agreement terminates
(m) Security / Bot Prevention
(m) Security / Bot Prevention
Recipient
Destination Country
Data Transferred
Purpose
Retention Period
Google LLC (reCAPTCHA)
United States
User behavior data
Bot prevention
Until service agreement terminates
Cloudflare, Inc.
United States
IP address, request metadata, bot management cookies
Bot prevention and traffic protection
Until service agreement terminates
(n) Business Tools / HR
(n) Business Tools / HR
Recipient
Destination Country
Data Transferred
Purpose
Retention Period
Google LLC (Workspace)
United States
Email, business documents
Business communications
Until service agreement terminates
Anthropic PBC (Claude)
United States
Business documents, information entered while performing work
Work assistance (e.g., reviewing security system settings)
ZDR applied (not used for training)
Gusto, Inc.
United States
Employee name, contact details, salary, bank account
HR/payroll/recruitment (North America entity)
Until service agreement terminates
Intuit Inc. (QuickBooks)
United States
Payment/accounting information
Accounting and payment processing (North America entity)
Until service agreement terminates
(o) Recruitment
This section lists the service provider for the Theori, Inc. job board for roles based outside Korea (https://jobs.ashbyhq.com/Theori), which we added under Privacy Policy Ver. 1.1 (effective October 5, 2026). The data collected and the retention periods are set out in Section 2.2 of the Privacy Policy.
(o) Recruitment
Recipient
Destination Country
Data Transferred
Purpose
Retention Period
Ashby, Inc.
United States
Name, email, résumé, place of residence, application answers, LinkedIn profile URL (optional), interview recordings, transcripts and summaries (with consent), device and browser information, IP address, form interaction data, geolocation (where the browser has already allowed it)
Recruitment intake, applicant tracking and fraud prevention for Theori, Inc. roles (North America entity)
After the hiring decision, for the record-keeping period or the time limit for hiring-related claims under the law of the country where the role is based (no longer than 1 year; 4 years for California residents; until final resolution if a charge or lawsuit is filed)
General Information on International Transfers
How and when these transfers take place, and how you may object to them, are described in Privacy Policy Section 7.2.
For any further questions, contact our Data Protection Officer at privacy@theori.io.
We update this list whenever a service provider changes or is added. How we announce those updates is set out in Privacy Policy Section 15.