Privacy Policy
Effective Date: [To be entered upon business registration and service launch]
[Operator name to be entered after business registration] (hereinafter "Operator") provides the Knitify Chart service (hereinafter "Service") in compliance with the Personal Information Protection Act and other applicable laws, and establishes and discloses the following Privacy Policy to protect users' personal information.
1. Personal Information Collected and Collection Methods
- Collected upon Google login: email address, name, profile photo
- Generated or collected during use of the Service: username (nickname), avatar image, chart and project data, like and report records
- Collected automatically: access logs (IP address, date and time of access), cookies
- The Service uses only Google account authentication and therefore does not collect passwords.
- The Service does not collect personal information from children under the age of 14. Users under 14 are not permitted to register.
2. Purposes of Processing
- Member identification and authentication, including login
- Provision and operation of the Service, and improvement of features
- Processing subscription payments and providing payment-related notices
- Prevention of unauthorized use and action against violations of the Terms of Service
- Delivery of important service-related notices and announcements
- Compliance with legal obligations
3. Retention Period
Upon account withdrawal, personal information is destroyed without delay after a 30-day recovery grace period. If a member requests restoration during the grace period, the data will be restored.
However, where retention is required under applicable laws, information will be retained for the following periods.
- Records relating to contracts or withdrawal of subscriptions: 5 years (Act on the Consumer Protection in Electronic Commerce)
- Records relating to payment of fees and supply of goods or services: 5 years (Act on the Consumer Protection in Electronic Commerce)
- Records relating to consumer complaints or dispute resolution: 3 years (Act on the Consumer Protection in Electronic Commerce)
- Access logs: 3 months (Protection of Communications Secrets Act)
4. Provision to Third Parties
As a rule, the Operator does not provide users' personal information to third parties. Exceptions apply where specifically required by law or where a law enforcement authority requests information through procedures prescribed by law.
5. Outsourcing and Cross-Border Transfer
The Operator outsources the processing of personal information as set out below for the purpose of providing the Service. As the processors' servers are located outside Korea, personal information is transferred abroad. Cross-border transfers are based on Article 28-8(1)3 of the Personal Information Protection Act of Korea (outsourcing or storage necessary for the performance of a contract), and the details are disclosed below.
| Recipient (Contact) | Country | Items Transferred | Timing and Method | Purpose and Retention |
|---|---|---|---|---|
| Supabase Inc. (supabase.com) | [To be confirmed after hosting region selection] | All items listed in Section 1 | Transmitted via network upon use of the Service | Operation of database and authentication infrastructure / Until 30 days after account withdrawal or termination of the processing agreement |
| Google LLC (policies.google.com) | United States | Email address, name, profile photo | Transmitted upon Google login | Social login authentication / Until account withdrawal |
| [To be confirmed after payment processor selection] | [To be confirmed] | [Payment-related information] | [Transmitted upon subscription payment] | [Payment processing / statutory retention period] |
6. Destruction Procedure and Method
Personal information for which the retention period has expired or the processing purpose has been achieved is destroyed without delay. Information in electronic file form is deleted by means that prevent recovery.
7. Rights of Data Subjects
- Users may at any time request access to, correction of, deletion of, or suspension of processing of their personal information.
- Profile information may be directly edited on the settings page, and account withdrawal may also be performed directly on the settings page.
- For all other requests, please contact [email protected] and action will be taken without delay.
8. Cookies and Local Storage
- The Service uses cookies to maintain login sessions. Cookies may be refused through browser settings; however, in that case, features requiring login will not be available.
- Certain information such as language preferences and editor settings is stored only on the user's device in the browser's local storage (localStorage) and is not transmitted to the server.
9. Security Measures
- Encryption of transmission channels (HTTPS)
- Database access control (row-level security policies)
- Collection of only the minimum personal information necessary for the provision of the Service
10. Privacy Officer
Name: [To be entered] / Contact: [email protected]
Users may submit inquiries, complaints, or requests for remedies regarding personal information to the contact above. Reports of personal information infringement may also be submitted to the Personal Information Infringement Report Center (privacy.kisa.or.kr, dial 118 in Korea).
11. Changes to This Policy
If the contents of this Policy are added to, deleted from, or modified, notice will be given through in-service announcements at least 7 days before the effective date of the change.
This Policy applies from [effective date to be entered].