- Applies to: the GyeokSang website (gyeoksang.com and its subpaths)
GyeokSang (“we”, “us”) processes the personal information of website visitors as described below, in compliance with the Personal Information Protection Act of the Republic of Korea and other applicable laws. This policy covers the website only. Personal information processed inside the programs we distribute (GyeokSangSee, GyeokSangCam, GyeokSangCut, etc.) is governed by each program’s End User License Agreement (EULA) and its notices.
1. What we process, why, on what basis, and for how long
We process only the minimum personal information needed for the purposes below. If a purpose changes, we will tell you in advance and ask for consent again where the law requires it.
| Category | Items | Purpose | Legal basis | Retention |
|---|---|---|---|---|
| Development / AI video request form | Required: name (or company/organization name), email address, request type, request details. Optional: phone number, budget range, desired schedule, reference links | Reviewing and answering requests, quotes and consultation | Your consent | 3 years from our last reply (or from receipt if there was no reply). If a contract is signed, contract records 5 years (Section 2) |
| Email inquiries (including license purchase inquiries) | Email address, name (if given), inquiry content and attachments | Answering inquiries, license information | Action at your request | 3 years after the inquiry is closed |
| Information generated automatically when you visit | IP address, access time, requested URL, browser and OS information, referrer, download requests | Delivering the website and files, security, preventing abuse and spam, troubleshooting | Our legitimate interests | We do not store these separately. They follow our hosting provider’s (Cloudflare) retention [to confirm: Cloudflare retention period] |
| Usage statistics (cookies, etc.) | See the table in Section 7 | Understanding usage, improving the website | Our legitimate interests; consent for visitors from the EEA, UK and Switzerland | See Section 7 |
| Browser settings | Chosen language, display mode (light/dark), cookie choice | Remembering the settings you chose | Your request | Stored only in your browser and never sent to us. You can clear them at any time |
- You may refuse consent for the request form. If you do, you cannot use the form, but you can still contact us by email and use the rest of the website.
- We do not collect national ID numbers, sensitive information or payment information on the website. Please do not include such information in your request or attachments.
- The website has no member accounts.
2. Destruction of personal information
- When the retention period ends or the purpose is achieved, we destroy the information without delay (within 5 days).
- Where the law requires us to keep information, we keep it separately and only for that period:
- Request and inquiry records: 3 years (based on the retention period for consumer complaint and dispute records under the Korean Act on Consumer Protection in Electronic Commerce)
- Records of contracts, withdrawal of offers and payments: 5 years (same Act, if a contract is signed)
- Website visit records: 3 months (Korean Protection of Communications Secrets Act, where needed to answer lawful requests from investigative authorities)
- Electronic files are deleted so that they cannot be recovered; paper documents are shredded or incinerated. Records deleted from the request form storage (Cloudflare D1) remain in recovery records for up to 7 days before being permanently erased.
3. Disclosure to third parties
We do not provide personal information to third parties, except with your separate consent, where a law specifically provides for it, or where it is unavoidable to meet a legal obligation.
4. Service providers and international transfers
We entrust processing to the companies below to run the website. Their servers are outside the Republic of Korea, so personal information is transferred abroad. We use contracts (each provider’s data processing terms) to ensure the information is handled safely.
| Recipient (contact) | Country | Service | Items transferred | When and how | Retention |
|---|---|---|---|---|---|
| Cloudflare, Inc. (privacyquestions@cloudflare.com) | Request forms: Asia-Pacific region (the exact country is chosen by Cloudflare) / Website delivery: United States and countries where Cloudflare data centers are located | Website hosting and delivery, program file delivery, storing request forms (D1), spam prevention (Turnstile), cookieless visit statistics (Web Analytics) | Information generated when you visit, request form contents | Sent over the network when you visit or submit the form | Until the retention period in Section 1 ends (deleted when the service ends) |
| Google LLC (https://support.google.com/policies/contact/general_privacy_form) | United States [to confirm: processing countries] | Usage statistics (Google Tag Manager, Google Analytics 4), receiving email inquiries (Gmail) | Google items in Section 7, email inquiry contents | Sent over the network when you visit; when we receive your email | Statistics: 14 months / Email: retention in Section 1 |
| Microsoft Corporation (https://aka.ms/privacyresponse) | United States [to confirm: processing countries] | On-page behavior analysis (Microsoft Clarity) | Clarity items in Section 7 | Sent over the network when you visit | Session recordings 30 days; heatmaps and other statistics up to 9 months |
- Basis: entrustment and storage needed to conclude and perform a contract, disclosed in this policy (Article 28-8(1)(3) of the Korean Personal Information Protection Act). Usage statistics are processed on the basis of our legitimate interests [사람 검토 필요: basis for this transfer].
- How to refuse and what happens: you can refuse transfers for usage statistics (Google Analytics, Clarity) as described in Section 7, with no effect on your use of the website. Transfers for hosting (Cloudflare) are essential to delivering the website, so refusing them means you cannot use it. You can email us instead of using the request form.
- If these services or recipients change, we will update this policy.
5. Your rights and how to exercise them
- You may at any time ask to access, correct, delete, or stop the processing of your personal information, or withdraw your consent.
- Send your request to the email in Section 10. To verify your identity, please write from the email address you used for your request or inquiry; we may ask for the minimum confirmation needed. There is no fee.
- We will act on your request and reply within 10 days of receiving it. If the law requires us to refuse or delay, we will tell you why and how to object.
- You may also make a request through a legal representative or an authorized agent, who must provide a power of attorney.
- Information that another law requires us to keep cannot be deleted during that period.
6. Children
The request form is intended for people aged 14 or older. We do not collect personal information from children under 14 without consent from their legal guardian, and if we learn that we have, we delete it without delay. Guardians may contact us at Section 10 to access or delete their child’s information.
7. Cookies and similar technologies
- We use cookies and similar technologies to understand how the website is used and to improve it.
| Tool | Provider | Purpose | Data collected | Cookies (duration) |
|---|---|---|---|---|
| Cloudflare Web Analytics | Cloudflare, Inc. | Counting visits and measuring page speed | Pages visited, country, browser and device type, performance metrics | None |
| Google Tag Manager | Google LLC | Loading the statistics tools below and passing on your consent status | IP address, browser information | No cookies of its own [to confirm] |
| Google Analytics 4 | Google LLC | Analyzing visit paths and usage statistics | Pages visited, referral source, approximate location, device and browser information, time of use, cookie identifier | _ga, ga* (up to 2 years) |
| Microsoft Clarity | Microsoft Corporation | Analyzing clicks, scrolling and other on-page behavior to fix usability problems | Clicks, scrolling, mouse movement, session recordings, device and browser information, cookie identifier. Text typed into input fields is masked and not collected | _clck (1 year), _clsk (1 day), etc. [to confirm: durations] |
- We do not try to identify individuals from this information, do not use it for targeted advertising, and do not sell personal information.
- How to refuse
- Visitors from the European Economic Area (EEA), the UK and Switzerland can accept or refuse on the notice shown on the first visit. Google Analytics and Clarity cookies are not used before consent.
- All visitors can turn statistics cookies off at any time under “Cookie settings” at the bottom of the page.
- If your browser sends a Global Privacy Control (GPC) signal, we treat it as refusing statistics cookies.
- You can block or delete cookies in your browser settings (Chrome: Settings > Privacy and security > Third-party cookies / Edge: Settings > Cookies and site permissions / Safari: Settings > Privacy / Firefox: Settings > Privacy & Security).
- Google Analytics opt-out browser add-on: https://tools.google.com/dlpage/gaoptout
- Refusing cookies does not limit your use of the website or program downloads.
8. Behavioral information
Records of pages visited, clicks and scrolling in Section 7 may count as online behavioral information. We use it only for statistics to improve the website; we do not use it for targeted advertising or provide it to advertising companies. Retention and how to refuse are the same as in Section 7. If we ever show advertising, we will update this policy first.
9. Security measures
- Administrative: we keep the number of people handling personal information to a minimum and process it according to this policy.
- Technical: all traffic is encrypted with HTTPS. Only authorized staff can access the request form storage and admin accounts, which use two-factor authentication. We use protection against spam and automated submissions.
- Physical: personal information is stored in our service providers’ data centers; we do not keep it on separate servers or on paper.
10. Privacy officer and contact
| Privacy officer | Hara Lee, Management Headquarters |
| hirand777@gmail.com | |
| Department handling access and other requests | Management Headquarters (hirand777@gmail.com) |
Please contact us for any privacy question, complaint or remedy; we will answer and act without delay.
11. Remedies (Republic of Korea)
For advice or dispute resolution about privacy infringement, you can contact:
- Personal Information Dispute Mediation Committee: 1833-6972 (www.kopico.go.kr)
- Personal Information Infringement Report Center: 118 (privacy.kisa.or.kr)
- Supreme Prosecutors’ Office: 1301 (www.spo.go.kr)
- Korean National Police Agency: 182 (ecrm.police.go.kr)
12. Additional information by region
12-1. Visitors in the EEA, UK and Switzerland
- Controller: GyeokSang, 406, 9, Eonju-ro 148-gil, Gangnam-gu, Seoul, Republic of Korea, hirand777@gmail.com
- Legal bases (GDPR Article 6): request form and inquiries: steps taken at your request before entering into a contract (6(1)(b)); access records and security: legitimate interests (6(1)(f)); statistics cookies: consent (6(1)(a)).
- Transfers: the Republic of Korea is covered by adequacy decisions of the European Commission and the UK. Transfers to our US service providers rely on the EU-U.S. Data Privacy Framework certification or Standard Contractual Clauses [to confirm: each provider’s current status].
- Your rights: access, rectification, erasure, restriction, portability, objection, and withdrawal of consent (without affecting processing before withdrawal). You have the right to lodge a complaint with the supervisory authority where you live or work.
- Providing personal information in the request form is not a legal or contractual requirement; without it, you cannot use the form. We do not use automated decision-making, including profiling.
- EU representative: [사람 검토 필요: whether one is required under GDPR Article 27]
12-2. Visitors in the United States (including California)
- Categories collected in the past 12 months: identifiers (name, email address, IP address, cookie identifier), internet activity (pages visited, clicks), approximate location, and any professional or business information you write in a request. Sources, purposes, retention and recipients are as in Sections 1, 4 and 7.
- We do not sell personal information or share it for cross-context behavioral advertising. We do not collect sensitive personal information.
- You have the right to know, to delete, to correct, and to opt out of sale or sharing, and you will not be discriminated against for exercising these rights. Make requests as in Section 5, yourself or through an authorized agent.
- We honor GPC signals as described in Section 7. We do not respond separately to browser Do Not Track signals.
- The website is not directed at children under 13, and we do not knowingly collect their personal information.
12-3. Visitors in Japan
- Business operator: GyeokSang, address as in 12-1, the representative’s name will be provided without delay on request
- Purposes of use are as in Section 1. You may request notification of the purposes of use, disclosure, correction, addition or deletion, suspension of use or erasure, suspension of third-party provision, and disclosure of third-party provision records for retained personal data. Send requests to the email in Section 10; there is no fee.
- Provision to third parties in foreign countries: personal data is processed in the Republic of Korea and the United States (the companies in Section 4). The recipients are contractually required to take measures equivalent to those required by the Japanese Act on the Protection of Personal Information, and we will explain those measures on request. Information on each country’s personal information protection system is available from materials published by Japan’s Personal Information Protection Commission.
- Our security measures are as in Section 9, taken after understanding the personal information protection systems of the foreign countries involved (Republic of Korea, United States).
- Complaints and inquiries: the contact in Section 10.
12-4. Visitors in China
- Personal information handler: GyeokSang, address and contact as in 12-1.
- Purposes, methods, items and retention are as in Sections 1 and 7. We do not process sensitive personal information.
- Cross-border provision: we are located in the Republic of Korea, so information you provide is processed outside China (in the Republic of Korea and, through the companies in Section 4, in the United States). Recipients’ names, contacts, purposes, methods and items are as in Section 4. The request form asks for separate consent to this cross-border provision. You may also ask us, via Section 10, to help you exercise your rights against those recipients.
- Your rights: to know and decide, to access and copy, to correct and supplement, to delete, to restrict or refuse processing, to data portability, to withdraw consent, and to have our processing rules explained. Close relatives of a deceased user may exercise rights within the scope set by law.
- We do not process personal information of minors under 14 without consent from their parent or guardian.
- Dedicated office or representative in China: [사람 검토 필요: whether one is required under PIPL Article 53]
13. Changes to this policy
- We will announce changes on the website at least 7 days before they take effect. Changes that are unfavorable to you or significant, such as collecting new items or adding new recipients abroad, will be announced at least 30 days in advance, and we will ask for consent again where the law requires it.
- Previous versions remain available on the website.
14. Language
This policy is available in Korean, English, Japanese and Simplified Chinese. If a translation differs from the Korean original, the Korean original prevails, unless the laws of the country where you live provide otherwise.
Addendum
This policy takes effect on October 11, 2026. (Version 1.0)