This list forms part of Section 7 of the Theori Privacy Policy and has the same effect as the policy itself. It is published under Article 26(2) (disclosure of processing entrustment) and Article 28-8(2) (disclosure for cross-border transfers) of the Korean Personal Information Protection Act, and satisfies the recipient disclosure required by GDPR Art. 13(1)(e) and the CCPA.
When a service provider is added or changed, we update this list and record the change in the revision history on the Previous Policies page.
The sub-processors that process Customer Data are listed separately on our Trust Center, as provided in Section 7 of the DPA.
Questions about this list, or about a specific provider on it, go to privacy@theori.io. Each provider's own privacy notice is available from that provider; we will point you to it on request.
Last updated: August 4, 2026
1. Service Providers Processing Data in Korea
The following service providers process personal data within the Republic of Korea. We do not ourselves transfer this data outside Korea. Where a provider engages its own sub-processors or transfers data overseas to operate its service, we treat those third parties as subject to disclosure under Article 26(2) of the Personal Information Protection Act and add them to this list as they are identified.
1. Service Providers Processing Data in Korea
Service Provider
Processing Activities
Applicable Service
Amazon Web Services Korea LLC
Cloud infrastructure and data storage (Seoul Region)
Xint Web, aprism, Dreamhack, ChainLight
NICE Information Service Co., Ltd.
Mobile identity verification services
Dreamhack
Viva Republica, Inc. (Toss)
Payment processing services
Dreamhack
Korea Post
Delivery of CTF prizes and event rewards
Dreamhack
Kakao Corporation
Delivery of CTF prizes and event rewards
Dreamhack
Channel Corporation
Customer support (live chat)
Xint Web
inblog Inc.
Corporate blog platform operation and blog usage analytics
Theori blog
Doodlin Inc. (GreetingHR)
Recruitment application intake and hiring management
Theori careers site
2. Overseas Service Providers and Cross-Border Transfers
The following providers are organized by function. Each acts on our documented instructions under a written agreement requiring appropriate security measures.
Why some providers show "Republic of Korea" as the destination. Where a single function uses both Korean and overseas providers (for example, AWS Seoul and AWS US regions for cloud infrastructure), we list them side by side so you can see the actual data flow. Providers whose destination is the Republic of Korea are not cross-border transfers.
Advertising and marketing providers are engaged only where you have given prior consent — see our Cookie Policy.
(a) Inter-Entity Transfers (Theori Korea ↔ Theori, Inc.)
(a) Inter-Entity Transfers (Theori Korea ↔ Theori, Inc.)
Transfer Direction
Recipient
Destination Country
Data Transferred
Purpose
Retention Period
Korea → US
Theori, Inc.
United States
Personal data related to product inquiries
Overseas business entity (Theori, Inc.) operations
1 year after inquiry resolution
US → Korea
Theori Korea
Republic of Korea
Personal data related to product inquiries
Processing by Korea-based group security/support functions
1 year after inquiry resolution
(b) Cloud Infrastructure
(b) Cloud Infrastructure
Recipient
Destination Country
Data Transferred
Purpose
Retention Period
Amazon Web Services Korea LLC
Republic of Korea (Seoul)
Service data
Cloud infrastructure and data storage
Until service agreement terminates
Amazon Web Services, Inc.
United States (Virginia)
Service data
Cloud infrastructure and data storage
Until service agreement terminates
Webflow, Inc.
United States
Website access information
xint.io landing page hosting
Until service agreement terminates
When Korean users access Xint Code, data is transferred to the United States (Virginia). When US users access Xint Web or aprism, data is transferred to Korea (Seoul).
Cookies, on-screen interaction records, IP address
Usage pattern analysis and UX improvement
12 months
RudderStack, Inc.
United States
Cookies, event records, IP address
Event collection and data integration
12 months
(k) Error Tracking / Infrastructure Monitoring
(k) Error Tracking / Infrastructure Monitoring
Recipient
Destination Country
Data Transferred
Purpose
Retention Period
Functional Software, Inc. (Sentry)
United States
IP address, device information, error logs
Error tracking and performance monitoring
90 days
Datadog, Inc.
United States
IP address, service logs
Infrastructure monitoring
12 months
(l) Advertising / Marketing
(l) Advertising / Marketing
Recipient
Destination Country
Data Transferred
Purpose
Retention Period
Google LLC (Google Ads and AdSense)
United States
Cookies, behavioral data
Targeted advertising
Until service agreement terminates
LinkedIn Corporation
United States
Cookies, behavioral data
Advertising and lead tracking
Until service agreement terminates
Google LLC (embedded YouTube)
United States
Viewing history, cookies
Embedded video playback and viewing-based recommendations or advertising
Until service agreement terminates
(m) Security / Bot Prevention
(m) Security / Bot Prevention
Recipient
Destination Country
Data Transferred
Purpose
Retention Period
Google LLC (reCAPTCHA)
United States
User behavior data
Bot prevention
Until service agreement terminates
Cloudflare, Inc.
United States
IP address, request metadata, bot management cookies
Bot prevention and traffic protection
Until service agreement terminates
(n) Business Tools / HR
(n) Business Tools / HR
Recipient
Destination Country
Data Transferred
Purpose
Retention Period
Google LLC (Workspace)
United States
Email, business documents
Business communications
Until service agreement terminates
Gusto, Inc.
United States
Employee name, contact details, salary, bank account
HR/payroll/recruitment (North America entity)
Until service agreement terminates
Intuit Inc. (QuickBooks)
United States
Payment/accounting information
Accounting and payment processing (North America entity)
Until service agreement terminates
(o) Web Font Delivery (CDN)
Our websites, including this privacy policy page, load their body typeface from the CDN below. The request is made by your browser, so your IP address and browser information are disclosed to the CDN; we do not separately transfer personal data to it.