Privacy Policy

1. Personal Data Collected and How

The Company collects only the minimum data needed to provide the Service. What is collected depends on how the Service is used.

a. Registration and sign-in

• Google sign-in: email address, name, profile image
• Kakao sign-in: nickname, profile image (no email address is collected)
• Email sign-in: email address
• All methods: account creation time, interface language, sign-in session identifier

b. Notifications

• A notification email address entered by the user and confirmed through a verification link
• Whether the user has consented to marketing messages, and when

c. Payment for Paid Services

• Payment identifiers: order number, amount, payment method type, authorization time, and the transaction and payment-method identifiers issued by the payment gateway
• The Company does not store payment instrument details such as card numbers or expiry dates. Those are held by the payment gateway; the Company stores only the identifier used to request payment.
• The Company does not store the name or phone number required for payment. They are retrieved from the payment gateway at the time of the charge and are not retained.

d. Source-code purchases (available without an account)

• Purchaser's email address, purchaser's GitHub username, order number, amount

e. Data generated through use of the Service

• Feature usage records: which feature was used, when, whether it succeeded, and for artificial-intelligence features, the number of tokens processed
• Email delivery records: the type of message sent and when, and the reason on failure
• Abuse-prevention records: values used to count requests. Email addresses and IP addresses are not stored as such; only values that cannot be reversed are stored.

2. Purposes of Processing

The Company processes personal data only for the following purposes.

• Identifying members, signing them in, and managing accounts
• Providing Paid Services, billing, and processing refunds
• Transactional notices (payment outcomes, expiry of access, refund confirmations, and similar)
• Delivering purchased products (such as granting access to a private repository)
• Checking usage limits by plan
• Preventing abuse and fraudulent use
• Responding to enquiries and handling disputes
• Sending marketing messages, only where separate consent has been given

3. Retention Period

The Company destroys personal data without delay once the purpose of processing is achieved, except where the following retention periods apply.

• Account data: until the member withdraws
• Under the Act on the Consumer Protection in Electronic Commerce — records of contracts and withdrawal of subscription: 5 years; records of payment and supply of goods: 5 years; records of consumer complaints and dispute handling: 3 years; records of labelling and advertising: 6 months
• Under the Protection of Communications Secrets Act — access logs: 3 months
• Under tax law including the Value-Added Tax Act — transaction records: 5 years
• Marketing consent records: until consent is withdrawn. The Company re-confirms consent every 2 years from the date it was given.
• Abuse-prevention records: deleted once the relevant window has passed

4. Provision to Third Parties

The Company does not provide users' personal data to third parties, except:

• where the user has consented in advance;
• where required by law, or where an investigative authority has requested it under the procedures and methods prescribed by law;
• for source-code purchases, the GitHub username entered by the purchaser is passed to GitHub in order to grant repository access. This processing is necessary for the purchaser to receive the product.

5. Processors

The Company entrusts the following processing in order to provide the Service. Each engagement is governed by a written agreement covering the secure handling of personal data.

• Supabase — database operation (stored in the Seoul, Republic of Korea region)
• Vercel — hosting and operation of the Service
• PortOne Inc. — payment integration and processing of payment data
• Payment gateways (Toss Payments, KG Inicis, and others) — authorization and cancellation of payments
• Resend — delivery of notification email
• Google LLC and Kakao Corp. — social sign-in authentication
• GitHub, Inc. — delivery of source-code products
• Artificial-intelligence providers including OpenAI and Anthropic — processing for artificial-intelligence features

6. Transfer of Personal Data Overseas

Some of the processors listed above are located outside the Republic of Korea. The items transferred and the purposes are as set out in Section 5, and transfer occurs at the time the Service is used.

When an artificial-intelligence feature is used, the content the user submits is transmitted to that provider's servers for processing. Please take care not to enter personal or sensitive information.

A user may refuse the overseas transfer. In that case, the relevant feature cannot be used.

7. Users' Rights and How to Exercise Them

A user may at any time request access to, correction of, deletion of, or suspension of processing of their personal data.

After signing in, a user can review and change their notification email address and marketing consent directly in the settings page. Other requests may be sent to plunxo.support@gmail.com; the Company acts on them within 10 days of receipt.

Marketing messages can be unsubscribed without signing in, immediately, using the unsubscribe link at the foot of each message. Unsubscribing applies only to marketing messages; transactional notices such as payment outcomes continue to be sent, as they are notices required to perform the agreement.

Where a user is under 14 years of age, the consent of a legal representative is required, and the legal representative may exercise that child's rights.

8. Destruction of Personal Data

The Company destroys personal data without delay once the retention period has passed or the purpose of processing has been achieved.

Data in electronic form is deleted by means that make recovery impossible; data printed on paper is shredded or incinerated.

Data that must be retained by law is kept separately from other personal data.

9. Security Measures

The Company takes the following measures.

• Limiting the number of personnel with access to personal data, and managing access rights separately by role
• Encryption in transit (HTTPS)
• Passwordless authentication — the Company does not store users' passwords
• Storing authentication tokens and abuse-prevention records in a form that cannot be reversed
• Retaining access logs for the production environment

10. Use of Cookies

The Company uses cookies to keep users signed in and to remember the interface language.

The Company does not use advertising or tracking cookies.

A user may refuse cookies in their browser settings. In that case, sign-in will not persist.

11. Data Protection Officer and Contact

The Company has designated a data protection officer responsible for personal data processing and for handling user complaints and remedies.

• Data protection officer: (not yet registered)
• Contact: plunxo.support@gmail.com / (not yet registered)

12. Remedies for Infringement

To report or seek advice about an infringement of personal data rights, the following bodies may be contacted.

• Personal Information Infringement Report Centre — privacy.kisa.or.kr (118)
• Personal Information Dispute Mediation Committee — kopico.go.kr (1833-6972)
• Supreme Prosecutors' Office, Cybercrime Investigation Division — spo.go.kr (1301)
• National Police Agency, National Office of Investigation — ecrm.police.go.kr (182)

13. Changes to This Policy

Where this Policy is changed, the Company announces the changes and their effective date within the Service.

Where a change is disadvantageous to users, or concerns a material matter, it is announced at least 30 days before it takes effect.

14. Governing Language

This English text is provided for convenience. The Korean version of this Policy is the operative version; where the two differ in meaning, the Korean version governs.