Privacy Policy

Article 1 (Purposes of processing)

The Company processes personal data for the purposes below. If a purpose changes, it takes the steps Article 18 of the Personal Information Protection Act requires, such as obtaining separate consent.

• Account management: confirming sign-up requests, identifying users, two-step verification, preventing misuse
• Providing the Service: preview and production deployments, running databases, files and scheduled jobs, sending notifications
• Paid services: payment and renewals, settlement, withdrawals and refunds, tax invoices
• Support: handling inquiries and complaints, sending notices
• Improving the Service: usage statistics, aggregated so that no individual can be identified
• Marketing: launch and discount news only to those who separately consented (an optional box on the paid-plan waitlist, applied only after email confirmation)

Article 2 (Data processed and how it is collected)

• Sign-up (required): email, password (stored as an irreversible hash), name / (optional) a note with the sign-up request
• With two-step verification: the authenticator secret (encrypted) and recovery codes (hashed)
• Paid plans: billing email, payment history (amount, time, product, transaction id), and for business customers the company name, business registration number and tax-invoice email. Card numbers and other payment-method data are never collected or stored by the Company; the payment processor handles them directly.
• Paid-plan waitlist: email / (optional) name, team size, a note about plans, marketing consent
• Generated automatically while using the Service: IP address, access time, browser and OS details, cookies, usage records (audit logs)
• Collected through: sign-up, request and checkout forms, automatic generation during use, and payment results received from processors

Article 3 (Retention periods)

The Company deletes personal data without delay once its purpose is fulfilled, except that data the law requires to be kept is stored separately for the periods below.

• Account data: until the account is deleted
• Records of contracts and withdrawals: 5 years (Electronic Commerce Act Article 6 and its Enforcement Decree)
• Records of payment and supply: 5 years (same Act)
• Records of consumer complaints and disputes: 3 years (same Act)
• Tax invoices and transaction evidence: 5 years (Framework Act on National Taxes Article 85-3)
• Access records (sign-in records, IP addresses): 3 months (Protection of Communications Secrets Act Article 15-2)
• Paid-plan waitlist entries: until the launch notice is sent or 2 years after the request, whichever comes first

Article 4 (Destruction)

Personal data whose retention period has ended or whose purpose has been fulfilled is destroyed within 5 days [to confirm: how the destruction runs in operations]. Data kept under a legal obligation is stored apart from other data and destroyed when that period ends.

Electronic files are deleted so they cannot be recovered, and data inside backups is deleted when that backup’s retention cycle ends. Paper records are shredded or incinerated.

Article 5 (Provision to third parties)

The Company provides personal data to third parties only in the cases Articles 17 and 18 of the Personal Information Protection Act allow, such as the data subject’s consent or a specific legal provision. No personal data is currently provided to third parties. Requests from investigative authorities are honoured only through the procedures the law sets, such as a warrant.

Article 6 (Processors)

The Company entrusts the processing below to the following processors. Under Article 26 of the Act, each contract sets out in writing the ban on processing for other purposes, technical and organisational safeguards, limits on sub-processing, supervision and liability, and the Company supervises each processor. Any change is published in this Policy without delay.

• Korea PortOne Co., Ltd. (PortOne) — domestic payment integration and relaying payment requests and results
• Payment gateway (PG) — domestic payment approval and cancellation, handling payment-method data [PG name to be added once contracted — to confirm]
• Gabia Inc. (Hiworks) — console emails (sign-up request confirmation, approval or rejection notices, security alerts)
• NHN Cloud Corp. (NHN Cloud Email) — service notification and authentication emails [applies from when it is introduced — to confirm]
• Cloudflare, Inc. — website delivery (CDN), DNS, blocking security threats (overseas transfer: Article 7)
• [To confirm] Server and database infrastructure — the Service runs on server clusters the Company operates; the provider and country of the underlying facilities will be added after operational confirmation.

Article 7 (Overseas transfers)

Under Article 28-8(1)3 of the Act (entrustment or storage needed to conclude and perform the contract and disclosed in this Policy), personal data is transferred abroad as follows. Each item lists the recipient, country, when and how, data, purpose, retention and how to refuse.

• Paddle.com Market Limited (United Kingdom, contact privacy@paddle.com [to confirm]) — sent over the network from the checkout when a user outside Korea pays — email, country and postcode, payment history, transaction id (payment-method data is collected by Paddle directly) — processing overseas payments; taxes and refunds as Merchant of Record — per Paddle’s privacy policy and record-keeping laws — not transferred if overseas payment is not used, in which case overseas payment is unavailable.
• Cloudflare, Inc. (United States, contact privacyquestions@cloudflare.com [to confirm]) — sent over the network on every visit — IP address, request details (address, browser) — website delivery and blocking threats such as denial-of-service attacks — a short period under Cloudflare’s policy [to confirm] — access to the Service goes through Cloudflare, so refusing means the Service cannot be used.
• Slack Technologies, LLC (United States) — only if a user connects Slack to workspace notifications, sent when an event occurs — the notification (project and event names, the actor’s display name) — delivering notifications the user asked for — per Slack’s policy — not transferred if Slack is not connected or the connection is removed in the console.

Article 8 (Rights of data subjects and how to exercise them)

Data subjects may at any time request access to, correction or deletion of, or suspension of processing of their personal data, or withdraw consent, by email to the privacy officer below (security settings such as two-step verification and the password can be changed directly in the console’s account security page). The Company acts within 10 days and reports the result. Marketing consent can be withdrawn by resubmitting the paid-plan waitlist form with consent unchecked, or by the same email. [To confirm] Console screens for viewing, correcting and deleting your own data will be provided before launch.

Requests may also be made through a representative (a legal guardian or an authorised person) with a power of attorney. Data the law requires to be kept cannot be deleted, and requests may be limited in the cases Articles 35 to 37 of the Act set out, such as a risk to another person’s life, body or property; the reason is then given.

Article 9 (Security measures)

Under Article 29 of the Act and the Standards for Personal Information Security Measures, the Company takes the following measures.

• Organisational: an internal management plan, the fewest possible staff with access, and regular training
• Technical: one-way hashing of passwords, encrypted storage of two-step secrets and service secrets, encryption of all traffic (HTTPS), two-step verification required for sensitive administrator functions (reading audit logs, showcase review, module administration, changing business information), least-privilege access with change records. [To confirm] Mandatory two-step verification for every administrator account will be stated once the operational setting is confirmed.
• Access records: administrator actions and access to personal data (audit logs) kept with tamper-protection (a hash chain) and reviewed. [To confirm] The retention period (at least one year) will be fixed once the operational retention setting is confirmed.
• No stored payment-method data: card numbers are handled by the payment processor and never stored on the Company’s servers

Article 10 (Cookies)

The Company uses only cookies the Service needs to work. It does not use advertising cookies or tools that track behaviour across other sites.

• hangar-lang — remembers the chosen display language (1 year)
• Sign-in session cookies — keep the console session and prevent forged requests (deleted on sign-out or expiry)
• hangar_env — remembers the environment (preview or production) chosen in the console (1 year)
• hangar_connect — ties an AI-tool connection approval to this browser so it cannot be hijacked (10 minutes)
• How to refuse: block cookies in your browser settings (e.g. Chrome — Settings > Privacy and security > Third-party cookies; Safari — Settings > Privacy). Refusing session cookies makes signing in to the console impossible.

Article 11 (Children under 14)

The Service is not directed at children under 14 and sign-up assumes the user is at least 14. If the Company learns it has collected a child’s personal data, it destroys it without delay. [To confirm] Whether the sign-up screen includes an age check will be settled before launch.

Article 12 (End users of services run on Hangar)

Personal data that visitors or members of a web service a user runs on Hangar (including its database, sign-in and file storage) enter there is controlled by the user who runs that service; the Company processes it only as that user’s processor, to the extent needed to provide the Service. Requests about that data, such as access or deletion, should go to the operator of that service.

Article 13 (Privacy officer and complaints)

The Company designates the privacy officer below to oversee personal data processing and handle complaints and remedies (Article 31 of the Act). Access requests and complaints can be sent to the contact below.

Article 14 (Remedies for infringement)

For remedies or advice on personal data infringement, you can contact the following (in Korea).

• Personal Information Dispute Mediation Committee: 1833-6972, www.kopico.go.kr
• Personal Information Infringement Report Center (KISA): 118, privacy.kisa.or.kr
• Supreme Prosecutors’ Office Cyber Investigation Division: 1301, www.spo.go.kr
• Korean National Police Agency Cyber Bureau: 182, ecrm.police.go.kr

Article 15 (Notice for users outside Korea — GDPR, UK GDPR, CCPA)

Personal data of residents of the EEA, the UK and Switzerland is processed on the legal bases of performing a contract, consent, and the Company’s legitimate interests. They may exercise the rights in Article 8 (access, rectification, erasure, restriction, portability and objection) in the same way, and may complain to the supervisory authority of their country.

[Legal review required] The basis for overseas transfers (adequacy decisions, standard contractual clauses) and whether an EU representative under GDPR Article 27 is required depend on the scale of processing and will be settled after review by counsel.

Under the California Consumer Privacy Act (CCPA), the Company does not sell users’ personal information or share it for targeted advertising. California residents may request access to, deletion of or correction of the personal information the Company holds about them.

Article 16 (Changes to this Policy)

This Policy applies from the effective date shown at the top. Additions, deletions or changes are announced on the Service 7 days before they take effect, and changes material to users’ rights — such as the data collected, the purposes or provision to third parties — 30 days before. Earlier versions are listed in the revision history below.