Privacy Policy

1. Personal data we process and how we collect it

We process only the minimum data needed to provide our services. The website has no sign-up, no forms, and no cookies.

• Inquiry emails (only if you send one): your email address and whatever you include, such as your name, company, phone number, and inquiry
• When a consulting contract is signed: contact person's name, email address, phone number, business registration details (company name, registration number, representative, address), and invoicing details
• Generated automatically when you visit the website: IP address, access time, requested path, browser information (User-Agent), and referring page (Referer)

2. Purposes of processing

We use the data only for the purposes below. If a purpose changes, we take the steps the Personal Information Protection Act requires, such as obtaining separate consent.

• Handling inquiries: reviewing and replying, and scheduling the free diagnostic call
• Performing contracts: delivering consulting and deliverables, billing, and issuing tax invoices
• Service security: detecting and blocking abnormal access, and analyzing incidents

3. Retention periods

Data is destroyed without delay once the periods below end.

• Inquiry emails: 90 days after our last reply, or until the contract ends if the inquiry leads to one
• Contract and transaction records (company name, registration number, representative, address, contact person's name and details, tax invoices): 5 years from the statutory tax filing deadline (Framework Act on National Taxes Art. 85-3; VAT Act Art. 71)
• Access logs: up to 27 weeks (about six months) after creation, then deleted automatically

4. Destruction procedure and method

Data whose retention period has ended or whose purpose has been achieved is destroyed within 5 days. Data that other laws require us to keep is stored separately and used only for that purpose.

Electronic files are deleted from storage, with emails also removed from the trash. Access logs are deleted automatically by the server's log rotation. The Company does not keep paper documents containing personal data.

5. Provision to third parties

We do not provide your personal data to third parties, except where a law specifically requires it or an investigative authority requests it following legal procedures.

6. Outsourcing of processing

To operate the service, we outsource the processing tasks below. We check that each processor's terms set out its obligations to protect personal data.

• Cloudflare, Inc.: domain DNS, website delivery (CDN and proxy), and email forwarding
• Google LLC (Gmail): storing and sending business email

7. International transfer

The processors above process and store data on servers outside Korea (in the United States and other countries where they operate data centers), so personal data is transferred abroad as follows.

• Recipients (contact) and country: Cloudflare, Inc. (United States, [email protected]); Google LLC (United States, support.google.com/policies/contact/general_privacy_form)
• Data transferred: for Cloudflare, connection data (IP address, access time, requested path, User-Agent, Referer) and incoming email; for Google, inquiry and contract emails and their contents
• When and how: transmitted over the network when you visit the website or exchange email with us
• Purpose: website delivery and security, and receiving, storing, and sending email
• Retention: same as Section 3, and destroyed when the outsourcing contract ends; operational logs each company keeps itself follow that company's privacy policy.
• Their policies: cloudflare.com/privacypolicy, policies.google.com/privacy

If you do not want your data transferred abroad, do not send us email; in that case we cannot receive or answer inquiries by email. Transmitting connection data is necessary to use the website, so if you refuse it you cannot use the website.

8. Your rights and how to exercise them

You may exercise the following rights over your personal data at any time.

• Request access to, correction of, deletion of, or suspension of processing of your data
• Withdraw consent (for example, ask us to delete a stored inquiry email)

Send your request to the privacy officer's email. You may also act through a legal representative or an authorized agent; if so, please include a power of attorney. We will act on your request and tell you the result within 10 days of receiving it, and if we refuse a request we will tell you why and how to object. Data that other laws require us to keep cannot be deleted on request.

9. Security measures

We take the following measures to prevent loss, theft, leakage, or alteration of personal data.

• Encryption in transit: the website is served over HTTPS only, with HSTS.
• Access control: the server blocks password logins and direct administrator logins and accepts SSH keys only. The firewall opens only the ports that are needed.
• Intrusion blocking: repeated abnormal access is blocked automatically (fail2ban).
• Minimal access: only the representative handles personal data.
• No third-party scripts: the website has no external analytics, advertising, or tracking scripts.

10. Automatic collection tools

We do not use cookies, advertising identifiers, or behavioral tracking tools. The web server does automatically record the access logs described in Section 1; these are necessary to run the website and cannot be opted out of separately.

11. Children under 14

Our services are for businesses, and we do not knowingly collect personal data from children under 14.

12. Privacy officer

We have designated the following person to oversee personal data processing and handle related inquiries and complaints.

• Privacy officer and complaints handling: Representative of ploro
• Contact: [email protected]

13. Remedies for infringement

For advice or to report an infringement of your personal data, you can contact the following Korean authorities.

• Personal Information Infringement Report Center (KISA): 118 (in Korea), privacy.kisa.or.kr
• Personal Information Dispute Mediation Committee: 1833-6972, www.kopico.go.kr
• Supreme Prosecutors' Office: 1301 (in Korea), www.spo.go.kr
• Korean National Police Agency, Cyber Bureau: 182 (in Korea), ecrm.police.go.kr

14. Effective date and change history

This policy takes effect on September 24, 2026. We will post changes on this page 7 days before they take effect, and material changes unfavorable to users 30 days in advance. If the Korean and English versions differ, the Korean version prevails.

• 2026-09-24: expanded sections on data processed, destruction, outsourcing, international transfer, security measures, remedies, and more; hosting changed to a self-operated server behind a Cloudflare proxy
• 2026-04-25: first published