Privacy Policy

Article 1 (Purpose of Personal Information Processing)

Popup Studio Korea Ltd. (hereinafter referred to as the "Company") collects only the minimum personal information necessary to provide the Bkend service (hereinafter referred to as the "Service"), and the collected personal information is processed only for the purposes of service provision, member management, service improvement, and legal obligations.

Article 2 (Personal Information Collected)

Information Collected During Registration

• Required: Email address, password, name
• Optional: Phone number, profile image
• Agreement records: Date of consent, IP address, browser information

Information Collected During Service Use

• Profile information: Nickname, gender, bio, social media links
• Settings: Language, timezone, theme preferences
• Notification settings: Service notification and marketing notification preferences
• Organization and project information: Organization name, project name, role information

Automatically Collected Information

• Access logs: IP address, access time, browser type
• Device information: Operating system, screen resolution
• Cookies: Language settings, authentication tokens (local storage)
• Error logs: Error information collected through Sentry (excluding personally identifiable information)

Article 3 (Purpose of Personal Information Processing)

• Service provision and contract fulfillment: Member authentication, service access management
• Member management: Member identification, prevention of fraudulent use, dispute resolution
• Service improvement: Service usage statistics, personalized service provision
• Customer support: Inquiry response, notice delivery
• Legal obligations: Information retention in accordance with applicable laws

Article 4 (Retention Period of Personal Information)

In principle, the Company destroys personal information without delay after the purpose of collection and use is achieved. However, information that needs to be retained in accordance with applicable laws shall be retained for the relevant period:

• Records on contracts or withdrawal of subscription: 5 years (Electronic Commerce Act)
• Records on payment and supply of goods: 5 years (Electronic Commerce Act)
• Login records: 3 months (Protection of Communications Secrets Act)

Article 5 (Provision of Personal Information to Third Parties)

In principle, the Company does not provide users' personal information to third parties. However, exceptions apply in the following cases:

• When the user has given prior consent
• When required by law or when requested by investigative agencies in accordance with legal procedures

Article 6 (Delegation of Personal Information Processing)

The Company delegates personal information processing as follows for service provision:

Article 7 (Rights of Data Subjects and How to Exercise Them)

Users may exercise the following rights at any time:

• Right to access: You can request access to your personal information.
• Right to correction/deletion: You can request correction or deletion of inaccurate information.
• Right to suspend processing: You can request suspension of personal information processing.
• Right to data portability: You can request that your personal information be transferred to another processor.
• Right to withdraw consent: You can withdraw consent to the collection and use of personal information.

Article 8 (Destruction of Personal Information)

The Company destroys personal information without delay when it becomes unnecessary due to expiration of the retention period or achievement of the processing purpose.

• Electronic files: Permanently deleted in a manner that makes recovery impossible
• Documents, printouts, and written materials: Shredded or incinerated

Article 9 (Security Measures for Personal Information)

The Company takes the following measures to ensure the security of personal information:

• Technical measures: Password encryption, encrypted storage and transmission of personal information, operation of firewalls and intrusion detection systems
• Administrative measures: Minimization of personal information access rights, regular security training
• Physical measures: Data center access control
• Access record management: Retention and inspection of personal information processing system access records

Article 10 (Cookies and Behavioral Information)

The Company uses the minimum cookies and local storage necessary for service use:

• Language setting cookie (NEXT_LOCALE): Stores user's language preference
• Authentication token (Local Storage): JWT token storage for maintaining login status

Article 11 (Personal Information of Children Under 14)

The Company does not collect personal information from children under 14 years of age. If a child under 14 wishes to register for the Service, parental consent is required.

Article 12 (International Transfer of Personal Information)

The Company may transfer personal information overseas for service provision. In such cases, protective measures in accordance with the Personal Information Protection Act and related laws will be taken, and information about the transferred data, destination country, and purpose of transfer will be notified in advance.

Article 13 (Changes to Privacy Policy)

This Privacy Policy may be amended due to changes in laws or services. Changes will be announced through the Service at least 7 days before the effective date, and significant changes will be announced at least 30 days in advance.

Article 14 (Data Protection Officer)

Article 15 (Personal Information Grievance Consultation)

If you need consultation or to report personal information infringement, please contact the following organizations:

• Personal Information Infringement Report Center (privacy.kisa.or.kr / 118)
• Supreme Prosecutors' Office Cyber Investigation Division (www.spo.go.kr / 1301)
• National Police Agency Cyber Security Bureau (cyberbureau.police.go.kr / 182)