개인정보처리방침 Privacy Policy

1. Information We Collect

1. During Registration and Service Use
   • Required: Email address, password, name or nickname
   • Optional: Contact phone number
   • When using social login (Google, Naver): email address, name (nickname), and account identifier provided by the respective provider
2. During Paid Service Use and Payment
   • Payment information (partial credit card number, payment authorization number, and other information provided through the payment gateway)
   • Billing address information (when necessary)
3. Information Automatically Generated and Collected During Service Use
   • IP address, cookies, access logs, service usage records, device information (browser type, OS information, etc.)
   • Visit records for usage statistics are collected with the IP address processed into an irreversible hashed (pseudonymized) form.

2. Collection Methods

• Directly entered by users during registration, login (including social login), inquiries, payments, and paid service applications
• Automatically generated and collected during service use
• Through customer service inquiries (email, phone, etc.)

The Company uses collected personal information for the following purposes:

1. Member Management
   • Verification of registration intent and identity confirmation
   • Account management, password recovery, delivery of notices and service-related information
2. Service Provision and Operation
   • Providing services such as GIF/WEBP editor, image/text/video editing tools, etc.
   • Service quality improvement and new feature development through usage analysis
3. Paid Service Payment and Settlement
   • Paid service provision and payment processing, payment history confirmation, cancellation and refund processing
4. Customer Support and Complaint Handling
   • Responding to inquiries, handling service-related complaints and disputes
5. Security and Stability
   • Prevention of fraudulent use, account theft prevention, log management for stable service operation

1. The Company destroys personal information without delay once the purpose of collection and use has been fulfilled.
2. However, the following information may be retained for a certain period in accordance with applicable laws:
   • Under the Act on Consumer Protection in Electronic Commerce
   • Records related to contracts or withdrawal of offers: 5 years
   • Records related to payment and supply of goods: 5 years
   • Records related to consumer complaints or dispute resolution: 3 years
   • Under the Protection of Communications Secrets Act
   • Records related to service use such as access logs: 3 months or more
3. Personal information is destroyed without delay after the above retention periods have expired.

1. The Company does not, in principle, provide users' personal information to third parties.
2. However, personal information may be provided in the following exceptional cases:
   • When the user has given prior consent
   • When required by law or when requested by investigative agencies or courts through lawful procedures
3. When the Company provides information to third parties, it will notify users in advance of the recipient, items provided, purpose of use, and retention period, and obtain consent.

1. The Company entrusts personal information processing tasks as follows for smooth service provision:
   • PortOne Korea, Inc. and NHN KCP Corp.: Payment processing, payment gateway, and settlement — payment method information and payment records (entrustment period: until membership withdrawal or termination of the entrustment contract, subject to statutory retention periods)
   • Overseas processors (server hosting and email delivery) are described in Article 5-2 (Cross-Border Transfer of Personal Information).
2. When entering into entrustment contracts, the Company specifies necessary provisions for safe management of personal information in accordance with the Personal Information Protection Act, and manages and supervises the entrusted companies.
3. If entrusted companies or entrustment details change, the Company will disclose the changes through this Privacy Policy.

The Company entrusts the processing and storage of personal information to the following overseas companies to the extent necessary for service provision. All transferred information is transmitted over encrypted connections (TLS).

1. DigitalOcean, LLC (Singapore)
   • Purpose: Service server hosting and data storage
   • Items: All information collected under this policy, including member information (email, name, etc.), payment records, and service usage records
   • Timing and method: Continuously transmitted and stored over the network during service use
   • Retention period: Until membership withdrawal or termination of the entrustment contract (subject to statutory retention periods)
2. Resend, Inc. (United States)
   • Purpose: Delivery of verification and notification emails
   • Items: Email address, name (nickname)
   • Timing and method: Transmitted over the network at the time of email delivery
   • Retention period: Deleted after short-term retention in accordance with the processor's retention policy following delivery

Users may refuse the cross-border transfer of their personal information by contacting the Privacy Officer listed in Article 12. However, as these transfers are essential to service provision, refusal may limit the use of all or part of the service.

1. Users may request access to, correction, deletion, or suspension of processing of their personal information at any time.
2. These rights may be exercised through the account settings page within the service or by contacting the Privacy Officer listed in Article 12 below.
3. When a user makes such a request, the Company will take necessary measures without delay. However, access to or deletion of certain personal information may be restricted as provided by applicable laws.
4. Upon account deletion, the Company will destroy personal information without delay, except for information required to be retained for a certain period under applicable laws and internal policies.

1. Destruction Procedures
   • When the purpose of collecting and using personal information has been achieved or the retention period has expired, the information is transferred to a separate database (or a separate filing system for paper records) and destroyed after a certain period in accordance with internal policies and applicable laws.
2. Destruction Methods
   • Electronic files: Deleted using technical methods that make recovery and reproduction impossible
   • Printed materials and documents: Destroyed by shredding or incineration

The Company takes the following measures to ensure the safe processing of personal information:

1. Administrative Measures
   • Minimizing access rights to personal information and conducting regular reviews
   • Providing personal information protection training (as needed/regularly)
2. Technical Measures
   • Encrypted storage of passwords and sensitive information
   • Installation and regular updates of security programs
   • System protection measures to prevent hacking and malware
3. Physical Measures
   • Access control to servers and related systems
   • Safe storage of printed materials and documents containing personal information

1. The Company may use cookies for user convenience and service quality improvement.
2. Cookies are small pieces of information sent by the website server to the user's browser and may be stored on the user's device.
3. Users may refuse to store cookies or delete stored cookies through browser settings. However, refusing to use cookies may result in some limitations in service use.

The Company does not, in principle, provide services to children under 14 years of age and does not intentionally collect personal information from children under 14. If the Company becomes aware that personal information of a child under 14 has been collected, it will delete the information without delay.

1. The Company may change this Privacy Policy due to amendments in applicable laws or changes in service content.
2. When changing the Privacy Policy, the Company will specify the changes and effective date and post a notice on the website at least 7 days prior to the change.
3. Users are advised to review the updated Privacy Policy. Continued use of the service after changes may be deemed as consent to the modifications.

The Company has designated a Privacy Officer as follows to protect users' personal information and handle complaints related to personal information:

For inquiries, complaints, or damage relief related to personal information protection, please contact us using the information above. The Company will respond and process your request without delay.

Other Remedies for Infringement of Rights

If you need to report or consult on personal information infringement, you may contact the following organizations (Korean government agencies):

• Personal Information Infringement Report Center: privacy.kr / 118 (no area code)
• Personal Information Dispute Mediation Committee: kopico.go.kr / 1833-6972
• Supreme Prosecutors' Office Cyber Investigation Division: spo.go.kr / 1301
• National Police Agency Cyber Bureau: ecrm.police.go.kr / 182