APYWA Privacy Policy
This English version is provided for convenience. In the event of any conflict, the Korean version prevails.
APYLab Co., Ltd. (the "Company") complies with the Personal Information Protection Act of Korea and related laws, and processes personal data as follows.
1. Data Collected and Method
| Category | Data | Method |
|---|---|---|
| Email sign-up | Email address, password (hashed), nickname | Sign-up form |
| Social sign-up (Google, Kakao) | Social account identifier, email address, nickname, profile image URL | Provided with your consent via the social provider |
| Service use | Watchlist assets, alert settings, language, consent history (time, version) | Generated during use |
| Automatically | Access IP, sign-up IP, browser/device info, access time, referrer/UTM, cookies | Generated on access |
| Paid services (when introduced) | Payment approval number, partial payment-method info (issuer, masked number), date and amount — full card numbers are held by the payment provider, not the Company | Payment screen / provider |
| Inquiries / B2B requests | Company (organization), contact name, title/team, email, phone, services of interest, number of assets to monitor, message | Inquiry form |
2. Purposes
- Member identification and authentication, provision of member services, account management
- Delivery of watchlist alerts (rating changes, caution designations) and reports
- Payment, settlement, refunds and invoicing for paid services
- Responding to inquiries, delivering notices, and statistical analysis for service improvement (traffic sources, conversion, etc.)
- (With optional consent) marketing and event communications
- Preventing misuse and fulfilling legal obligations
3. Retention
Personal data is deleted without delay upon account deletion, except where retention is required for the following periods.
| Records | Period | Basis |
|---|---|---|
| Contracts and withdrawal of offers | 5 years | Act on Consumer Protection in Electronic Commerce |
| Payments and supply of goods/services | 5 years | Act on Consumer Protection in Electronic Commerce |
| Consumer complaints and dispute handling | 3 years | Act on Consumer Protection in Electronic Commerce |
| Access logs (login records, IP) | 3 months — afterwards only de-identified statistics are kept | Protection of Communications Secrets Act |
| Inquiry / B2B request records | 3 years after the inquiry is closed | Act on Consumer Protection in Electronic Commerce |
| Consent history | 5 years after deletion | Company policy (dispute readiness) |
4. Provision to Third Parties
The Company does not provide personal data to third parties, except with your separate consent or upon lawful request by authorities under applicable law.
5. Processors and Cross-border Transfer
| Processor | Task | Location |
|---|---|---|
| Amazon Web Services, Inc. | Infrastructure and data storage | Republic of Korea (Seoul region) |
| Google LLC (Google Workspace) | Verification and alert email delivery | United States — recipient email address is transmitted when sending |
| Google LLC, Kakao Corp. | Social login authentication | When you choose social login |
| Cloudflare, Inc. (Turnstile) | Bot protection on sign-up and inquiry forms | United States — IP address and browser information are transmitted when those forms are used |
| Google LLC (Google Analytics) | Usage analytics | United States — cookie identifiers, device and behavioral data |
| NAVER Corp. (NAVER Analytics) | Usage analytics | Republic of Korea |
| Payment gateway (PG) such as Toss Payments Co., Ltd. — processor name updated upon contract | Subscription payment approval and cancellation, recurring-billing key management, payment-method storage, sales-slip issuance | Republic of Korea (for overseas cards, authorization data is sent to the card network and acquirer) |
6. Your Rights
- You may access, correct, delete or suspend processing of your personal data at any time, edit it in My Page, or delete your account.
- Marketing consent can be withdrawn at any time in My Page or via the unsubscribe link in emails.
- Requests may be sent to the Privacy Officer below and will be handled without delay.
7. Destruction
Data whose retention period has expired or whose purpose has been achieved is destroyed without delay — electronic files irrecoverably, paper documents by shredding or incineration.
8. Security Measures
- Passwords are stored with one-way hashing (bcrypt).
- Data in transit is encrypted with TLS; access is minimized and access logs are retained.
- Staff handling personal data are limited and trained regularly.
9. Cookies
Cookies are used for login persistence, language preference, traffic-source attribution and usage analytics (Google Analytics, Naver Analytics). You may refuse cookies in your browser; some features such as staying logged in may then be limited.
10. Privacy Officer
| Privacy Officer | Jaikeun Lee (CEO) |
|---|---|
| contact@apylab.io | |
| Address | APYLab Co., Ltd., Room 104, Floor 1, Yujung Cultural Foundation, 180 Bangbae-ro, Seocho-gu, Seoul Special City, Republic of Korea |
11. Changes to this Policy
Changes are announced at least 7 days before taking effect (30 days for changes materially affecting your rights).
Addendum
This Policy takes effect on 2026-11-01.