Privacy Policy
2026.10.28IDeA Ocean Inc. ("the Company") processes the personal information of METHEUS users in accordance with the Personal Information Protection Act of Korea and other applicable laws. This policy explains what we process, why, and for how long. It applies to the METHEUS software (desktop app), the METHEUS Console (console.metheus.ai), METHEUS accounts, and this site (metheus.ai). However, inquiries submitted through this site and the IDeAOcean website (ideaocean.ai) are covered by the IDeAOcean website's privacy policy.
1. Personal information we process
We process only the personal information needed to provide the service.
| Category | Items | When and how |
|---|---|---|
| Account (required) | Email address | Entered with an email verification code when you sign up or log in, or when you connect a Google account (we store only the email address) |
| Profile (optional) | Name, company, job role | If you enter them during onboarding or in Console settings |
| Consent records | Whether you agreed to work-data collection and use, when you agreed, and when you completed onboarding | If you choose during onboarding or in Console settings |
| Organization workspaces | Workspace name, members and roles, email addresses of invitees, records of invitations, cancellations and member removals | When you create an organization workspace or invite members |
| User content | AI conversations (prompts, answers and tool-run records), attachments, project files and notes, canvas documents, design-candidate records, images uploaded to create 3D models | When you enter or upload them while using the service |
| Usage records (automatic) | AI usage (model used, token counts, cost), compute-job records (status, time, usage), in-app tool-use records (tool name, part of the input, the reason written by the AI, result or error, duration), app usage records (buttons and menus clicked and their windows, launch, installation and connection steps and results, lost connections, logins, errors, startup reports (startup steps, error details and part of the app log)) | Automatically while you use the service |
| Connection data (automatic) | IP address, access time, requested address, login cookies, browser information, app and device information (app and OS versions, installed and connected CAD information, regional settings), a randomly generated device identifier, sign-up source information (first page and time of visit, referring site, campaign, language) | Automatically when the site, Console or app communicates with our servers |
We do not collect resident registration numbers or other unique identifiers, nor sensitive information.
2. Purposes of processing
We process personal information only for the purposes below and follow the required procedures if a purpose changes.
Creating accounts and logging in, verifying your identity (sending email verification codes), and preventing unauthorized logins and automated sign-ups
Providing the METHEUS service — AI design conversations, CAD integration, design and analysis computation — and saving the results
Operating organization workspaces (sending invitation emails, managing permissions, keeping management records)
Managing usage allowances and showing usage
Service announcements and notices of important changes
Responding to inquiries, analyzing errors, handling outages, and usage analysis to improve the service (Article 8)
AI training, if you agree to work-data collection and use (Article 8)
Site visit analytics and app usage analytics (Article 11)
We process the following only with your consent: profile information, work-data collection and use (AI training), and, in the European Economic Area, the United Kingdom and Switzerland, visit-analytics and sign-up source cookies and app usage analytics. We process everything else without consent to provide and operate the service. We use personal information for additional purposes (analysis to improve the service) only where it is related to the original purpose, you can expect it, it does not unfairly harm your interests and the necessary safeguards are in place, and our Chief Privacy Officer reviews this.
3. Retention period
We keep personal information only for the periods below and destroy it without delay when the period ends.
| Items | Retention |
|---|---|
| Account information (email address, name, company, job role) | Deleted (anonymized) immediately when you delete your account |
| User content, usage records (except in-app tool-use records and app usage records), consent records | Kept for 30 days after you delete your account, then destroyed — to allow recovery from accidental deletion and to handle disputes |
| Organization workspace information (including members, invitations and management records) | Destroyed 30 days after the workspace is closed |
| Invitation links | Expire 7 days after they are sent |
| Email verification codes | Expire 10 minutes after issue |
| Images uploaded to create 3D models, and the results | Deleted automatically after 7 days |
| Canvas (web CAD) documents | Deleted automatically 90 days after the last save |
| In-app tool-use records, app usage records, app and device information and device identifier | Deleted 1 year after they occur (to see yearly trends). When you delete your account, your email is removed right away |
| Sign-up source information | Deleted when you delete your account |
| Access logs | 3 months (Protection of Communications Secrets Act) |
Conversations you delete yourself are destroyed at that time. Information that another law requires us to keep is stored separately and only for that period.
4. How we destroy personal information
We destroy personal information without delay when its retention period ends or its purpose has been achieved.
Electronic files are deleted so that they cannot be recovered. We do not keep service personal information on paper.
Deleted information may remain in disaster-recovery backups for up to 30 days before it is removed with them.
5. Provision to third parties
We do not provide your personal information to third parties, except where you consent, where a law specifically requires it, or where the Personal Information Protection Act otherwise permits.
Owners and admins of an organization workspace can see the email addresses of invitees and management records in order to invite and manage members.
Conversation records are not shown to the owner or other members of an organization workspace. However, files you upload to a team project, and files and project notes the AI saves to it, can be seen by anyone with access to that project.
6. Outsourcing of processing
Account information, conversation records and usage records are stored on our company servers in the Republic of Korea (Amazon Web Services Seoul region). We outsource the tasks below to provide the service. Our contracts require the contractors to handle personal information securely, and we supervise them. We will update this policy if a contractor or task changes.
| Contractor | Task | Location |
|---|---|---|
| Amazon Web Services, Inc. | Operating our company servers (storing and backing up account, conversation and usage records), Sending verification codes and invitation emails (Amazon SES), design and analysis computation, the AI work environment, storing canvas documents, keeping operational logs | Republic of Korea (Seoul region) |
| Cloudflare, Inc. | Relaying and securing connections to the service, preventing automated sign-ups | Overseas — see Article 7 |
| Vercel Inc. | Serving this site (metheus.ai) and the Console (hosting) | Overseas — see Article 7 |
| OpenRouter, Inc. | Generating AI responses | Overseas — see Article 7 |
| Anthropic PBC | Service usage analysis (under our company agreement — not used for training) | Overseas — see Article 7 |
| Google LLC | Site visit analytics (Google Analytics) | Overseas — see Article 7 |
7. Transfer of personal information overseas
To perform our service contract we transfer personal information overseas (outsourced processing and storage) as below, and disclose it in this policy under Article 28-8(1) of the Personal Information Protection Act.
| Recipient (contact) | Country | Items | When and how | Purpose | Retention |
|---|---|---|---|---|---|
| OpenRouter, Inc. (privacy@openrouter.ai) | United States | AI conversations, attachments and images, CAD view captures, project notes | Sent over an encrypted connection each time you use AI features | Generating AI responses (forwarding requests to the provider of the model you choose) | Per each provider's policy after the request is processed |
| Anthropic PBC (privacy@anthropic.com) | United States | Usage-analysis material (account identifier and profile, summarized usage records, feedback, conversations and design results — excluding those of people who opted out) | Sent over an encrypted connection when we run the analysis | Service usage analysis | Per Anthropic's commercial terms after the request is processed (not used for training) |
| Cloudflare, Inc. (dpo@cloudflare.com) | United States and other countries where Cloudflare's network operates | Connection data (IP address, requested address, etc.) and traffic to and from our servers | Sent over the network each time you connect to the service | Relaying and securing connections, preventing automated sign-ups | Per Cloudflare's policy after processing |
| Vercel Inc. (privacy@vercel.com) | United States | Connection data (IP address, requested address, browser information) | Sent over the network when you visit the site or Console | Serving the site and Console | Per Vercel's policy after processing |
| Google LLC (support.google.com/policies) | United States | Site visit records (cookie identifiers, pages visited, device and browser information) | Sent from your browser when you visit the site | Site visit analytics | Per Google's policy |
Depending on the model you choose, OpenRouter forwards requests to OpenAI, Microsoft (Azure), Google (Vertex AI), Amazon (Bedrock), xAI, Fireworks AI, Deep Infra, Relace and Mistral AI; these providers process data in the United States and other countries, not limited to a specific country. Web search sends only search queries and addresses to Exa Labs (headquartered in the United States). The items transferred, timing and retention are the same as for OpenRouter. Where a model supports it, we configure requests so that providers do not retain the data or use it for training.
How to refuse and what happens: generating AI responses, relaying connections and serving pages are core to the service, so refusing these transfers means you cannot use the service. You can then delete your account or ask us to stop processing at contact@ideaocean.ai. You can refuse site visit analytics as described in Article 11 and service usage analysis as described in Article 8 without any restriction on using the service.
8. AI features and work data
When you use AI features, the conversation and attachments you enter, captures of the CAD view you are working on, and project notes are sent to AI model providers (Article 7). Please do not include confidential information or other people's personal information.
Analysis to improve the service: authorized Company staff and AI review conversations (including attachments), design results and usage records to understand how the service is used and where it falls short. We may use the AI provider in Article 7 for this analysis, use it only to improve the service and never to disadvantage you. To exclude your conversations and design results from this analysis, let us know at contact@ideaocean.ai.
Consent to work-data collection and use (optional): if you agree, we may use your work data (conversations, tool-use records, design results) for AI training, and in return we double your daily and weekly usage allowance. You can use the service without restriction if you do not agree.
You can withdraw your consent at any time in Console settings or by writing to contact@ideaocean.ai. After you withdraw, we no longer use your work data for AI training and your usage allowance returns to normal.
The METHEUS app sends tool-use records and app usage records (Article 1) to our servers, and we use them to analyze errors, improve features and understand how the app is used. Records from before you log in are sent after you log in, and if the app has trouble starting, it sends startup information and part of the error log even if you are not logged in.
Authorized Company staff may view stored conversations and project files to the extent necessary to operate the service, handle outages and errors, prevent misuse, respond to inquiries and analyze how to improve the service.
Feedback, star ratings and startup reports sent from the app are stored in the METHEUS Hub feedback inbox and follow the METHEUS Hub Privacy Policy.
9. Rights of data subjects and legal representatives
You may request access to, correction, deletion, or suspension of processing of your personal information at any time.
You can edit your name, company and job role, and delete your account, yourself in Console settings. For other requests, write to contact@ideaocean.ai and we will act without delay.
You may exercise these rights through a legal representative or an authorized agent, who must submit a power of attorney.
Requests for access or suspension may be limited under Articles 35(4) and 37(2) of the Personal Information Protection Act, and you cannot request deletion of information that another law designates for collection.
We verify that the person making a request is the data subject or a legitimate representative.
10. Security measures
Under Article 29 of the Personal Information Protection Act we take the following measures.
Encryption in transit: all traffic between the site, Console, app and our servers is encrypted with HTTPS (TLS).
Login protection: we do not use passwords — only one-time email verification codes and Google login — and we store login session data encrypted.
Access control: only authorized staff can access systems that process personal information, and we keep that group small.
An internal management plan and regular self-audits (once a year)
11. Cookies and similar technologies
Staying logged in: we use essential cookies to keep you logged in (up to 30 days). If you block them, features that require login will not work.
Site settings: we store site settings such as your language and your choice in the cookie notice in cookies and your browser's local storage.
Visit analytics: we analyze site visits with Google Analytics cookies. In the European Economic Area, the United Kingdom and Switzerland we use them only with your consent.
App usage analytics: we store a random device identifier in the app to group app usage records from the same PC. In the European Economic Area, the United Kingdom and Switzerland we use it only if you turn on "Send usage data" in the app settings.
Sign-up source: we keep how you first arrived at the site in a cookie (90 days) and save it to your account when you sign up. In the European Economic Area, the United Kingdom and Switzerland we use it only with your consent.
How to refuse: you can block cookies in your browser settings, and you can opt out of visit analytics with the Google Analytics Opt-out Browser Add-on (tools.google.com/dlpage/gaoptout). Turning off "Send usage data" in the app settings stops app usage analytics and deletes the device identifier. Tool-use records needed to operate the service continue to be processed.
12. Children under 14
Children under 14 cannot create an account, and we do not collect personal information from children under 14.
13. Chief Privacy Officer
For questions, complaints or remedies regarding the processing of personal information, contact our Chief Privacy Officer below. We will respond and act without delay.
Name: Jungho Kim
Title: CEO
Email: contact@ideaocean.ai
14. Remedies for infringement
If you are not satisfied with our response or need further help, you can contact the organizations below, which are independent of the Company.
Personal Information Infringement Report Center (KISA): 118 (no area code), privacy.kisa.or.kr
Personal Information Dispute Mediation Committee: 1833-6972 (no area code), www.kopico.go.kr
Cyber Investigation Department, Supreme Prosecutors' Office: 1301 (no area code), www.spo.go.kr
Cyber Bureau, Korean National Police Agency: 182 (no area code), ecrm.police.go.kr
15. Changes to this policy
This policy takes effect on October 28, 2026.
The previous policy applied on October 27, 2026, and earlier versions from October 22, 2026 to October 26, 2026, from October 13, 2026 to October 21, 2026, from September 29, 2026 to October 12, 2026, and from July 6, 2026 to September 28, 2026.
We will announce changes at least 7 days before they take effect (30 days for changes unfavorable to users).