Vyblor Privacy Policy
In operating Vyblor (vyblor.com, the "Service"), Haechiwood (the "Company") complies with applicable laws, including the Personal Information Protection Act (개인정보 보호법), and establishes this Privacy Policy as follows to protect users' personal information.
1. Personal Information Processed and How It Is Collected
| Category | Items | Collection method |
|---|---|---|
| Sign-up and login (required) | Email address, email verification records, login session information | Entered directly by the user; generated in the course of using the Service |
| Social login (optional, when the feature is offered) | Social account identifier, email, name, profile image | Provided by the social service the user connects |
| Orders (required) | Service name (or product name), URL for which the Video is produced, aspect ratio, language, content to highlight (optional), consent records (the documents and versions consented to, and the date and time) | Entered directly by the user |
| Payment (required, for paid orders) | Payment service provider transaction number, payment amount, payment date and time, payment status, card issuer name, part of the masked card number, and, for recurring payments, the billing key identifier issued by the payment service provider | Provided by the payment service provider. The Company does not collect or store the full card number, expiry date or password. |
| Free applications (required) | Email, name or nickname, Threads username, service name, URL, one-line description, launch status, consent records | Entered directly by the user in the application form (Google Forms) |
| Revision requests and inquiries | Content of the request, content of email exchanges | Entered or sent directly by the user |
| Production output | Delivered Video, representative image, copy for sharing | Generated in the course of providing the Service |
| Automatically collected | IP address, access date and time, browser and device information, Service usage records, referral source (UTM values, referral link code, previous page address), cookies | Automatically generated and collected in the course of using the Service |
The web page at the URL entered may publicly display other people's information (for example, the names of reviewers). The Company processes the publicly available content of that page only to the extent necessary to produce the Video, and does not use the reviewer's name or username when quoting a review.
2. Purposes of Processing Personal Information
- Member management: identity verification through email verification, login, account linking, and prevention of fraudulent use
- Provision of the Service: Video production, review, delivery, handling of revision requests, and order status updates
- Payments and refunds: payment confirmation, processing of recurring payments (when that service is offered), refunds, and retention of transaction records
- Customer support: handling of inquiries and complaints, and dispute resolution
- Showcase publication management: posting the Videos of users who have consented to showcase publication, and processing withdrawals of that consent
- Service improvement and statistics: visit and order statistics by referral source, and improvement of service quality. Statistics are used in a form that does not identify individuals.
- Marketing (only with separate consent): sending advertising information such as news about the official launch, discounts and new features
3. Retention and Use Periods
The Company destroys personal information without delay once the purpose of processing has been achieved. However, in the following cases the information is retained for the period stated.
| Item | Retention period | Basis |
|---|---|---|
| Member information | Until withdrawal of membership | Service agreement |
| Records of contracts or withdrawal of orders | 5 years | Act on the Consumer Protection in Electronic Commerce, Etc. (전자상거래 등에서의 소비자보호에 관한 법률) |
| Records of payment and supply of goods and services | 5 years | Same Act |
| Records of consumer complaints or dispute handling | 3 years | Same Act |
| Records of labeling and advertising | 6 months | Same Act |
| Service access records (logs, IP addresses) | 3 months | Protection of Communications Secrets Act (통신비밀보호법) |
| Free application information | 1 year after the end of the test, or until a deletion request | User consent |
| Delivered Video files | At least 90 days from the date of delivery, then deleted. Videos consented to for showcase publication are kept until that consent is withdrawn. | Service agreement, user consent |
| Consent records (the documents and versions consented to) | Until the end of the retention period for the contract records related to that consent | Same Act |
| Marketing consent information | Until the consent is withdrawn or membership is withdrawn | User consent |
| Referral source cookie (vb_attr) | 90 days | Stored on the user's device |
4. Outsourcing of Personal Information Processing
To provide the Service smoothly, the Company outsources personal information processing tasks as follows. In its outsourcing contracts, the Company provides for the prohibition of processing beyond the outsourced tasks, technical and managerial safeguards, restrictions on re-outsourcing, management and supervision of the processor, compensation for damages and the like, and it supervises whether the processors handle personal information securely.
| Processor | Outsourced task |
|---|---|
| Contabo GmbH | Hosting of the Service's servers and database (server location: Japan) |
| Cloudflare, Inc. | Website delivery and security (CDN, tunnel), storage of Video and backup files (R2), cookieless visit statistics |
| Google LLC | Customer inquiry email ([email protected], Google Workspace), free application form (Google Forms) |
| Korea PortOne Co., Ltd. (코리아포트원 주식회사, PortOne) | Payment integration and processing of payment information |
| Danal Co., Ltd. (주식회사 다날) | Credit card payment processing, issuance and management of recurring payment billing keys (when that service is offered) |
| Anthropic PBC | Producing the Video by using artificial intelligence to analyze the publicly available web page content at the URL entered by the user |
5. Overseas Transfer of Personal Information
To provide the Service, the Company transfers personal information overseas (overseas outsourcing of processing and storage) as set out below. This is outsourcing of processing and storage necessary to perform the contract with the data subject under Article 28-8(1)3 of the Personal Information Protection Act, and the Company gives notice of it by disclosing it in this Policy.
| Recipient (contact) | Destination country | Date, time and method of transfer | Items transferred | Purpose of transfer | Retention and use period |
|---|---|---|---|---|---|
| Contabo GmbH ([email protected]) | Japan (servers), Germany (legal entity) | Transmitted over the network when the Service is used | All member, order, payment and usage records listed in Section 1 | Hosting of servers and database | Same as the retention periods in Section 3 |
| Cloudflare, Inc. ([email protected]) | The United States and other countries where Cloudflare data centers are located | Transmitted over the network when the Service is used | IP address, request information, Video and representative image files, database backup files | Website delivery and security, file storage, visit statistics | Files: same as the retention periods in Section 3; backups: 60 days |
| Google LLC (Google privacy contact page) | United States | Transmitted over the network when an application form is submitted and when emails are sent or received | Free application information, content of inquiry emails | Receiving free applications, handling customer inquiries | Same as the retention periods in Section 3 |
| Anthropic PBC ([email protected]) | United States | Transmitted over the network at the time of Video production | The URL entered and the content of that public web page, the service name, the content to highlight. Contact information such as email addresses is not sent. | Video production using artificial intelligence | Subject to Anthropic's API data retention policy |
How to refuse overseas transfer, and its effect: Users may refuse the overseas transfer. To refuse, a user may refrain from signing up or ordering, or may request withdrawal of membership at [email protected]. However, because the overseas transfers above are essential to providing the Service, a user who refuses cannot use the Service.
6. Provision of Personal Information to Third Parties
The Company processes users' personal information only within the scope of the purposes in Section 2, and does not provide it to third parties except in the cases set out in Articles 17 and 18 of the Personal Information Protection Act, such as with the user's consent or under a special provision of law.
7. Rights and Obligations of Data Subjects and Legal Representatives, and How to Exercise Them
- Users may at any time request access to, correction of, deletion of, or suspension of processing of their personal information, or withdraw their consent.
- Requests may be made on the Service screen or by email ([email protected]), and the Company takes action without delay (within 10 days) and informs the user of the result.
- Deletion cannot be requested for information that the law requires to be retained; in that case the Company informs the user of the reason.
- A person exercising rights through a representative must submit a power of attorney.
- The Company does not accept sign-ups or orders from children under the age of 14.
8. Destruction of Personal Information
- The Company destroys personal information without delay once its retention period has expired or the purpose of processing has been achieved.
- Electronic files are deleted by methods that make recovery impossible, and paper documents are shredded or incinerated.
- Information that must continue to be retained under the law is stored separately from other information.
9. Measures to Ensure the Security of Personal Information
The Company takes the following measures.
- Managerial measures: minimizing the number of personal information handlers, and establishing an internal management plan
- Technical measures: encryption in transit (HTTPS), strong authentication for administrator accounts (password and two-factor authentication), separate server-side storage of secret keys and payment keys, access rights management, retention of access records, and regular database backups
- Physical measures: operating servers in facilities subject to the data center operator's access controls
- The Company does not store payment card numbers; payment information is entered directly in the payment service provider's payment window.
10. Installation, Operation and Refusal of Cookies and Other Automatic Collection Tools
- The Company uses the following cookies.
- Login session cookie: keeps the user logged in. It expires when the user logs out or the session ends.
- Referral source cookie (vb_attr): records which link (UTM values, referral link code, previous page address) the user arrived through, in order to produce statistics by referral source. It is used only on the Company's domain and expires after 90 days.
- Language setting cookie: remembers the language selected (Korean, English or Japanese).
- For visit statistics, the Company uses Cloudflare Web Analytics, which does not use cookies.
- The Company does not use third-party cookies for advertising purposes.
- How to refuse: Users can refuse or delete cookies in their browser settings. For example, in Chrome: Settings → Privacy and security → Third-party cookies / Delete browsing data; in Safari: Settings → Privacy. If the login session cookie is refused, features that require login cannot be used.
11. Transmission of Advertising Information
The Company sends advertising information by email only to users who have given separate consent, and each transmission includes an "(Advertisement)" label and instructions on how to opt out. The Company does not send advertising information between 9 p.m. and 8 a.m. the following day without separate consent. The Company reconfirms the user's consent to receive such information every 2 years from the date the consent was given.
12. Chief Privacy Officer
The Company designates a Chief Privacy Officer to oversee personal information processing tasks and to handle related complaints and remedies.
- Chief Privacy Officer: Changhee Lee
- Contact: [email protected]
13. Remedies for Infringement of Rights
Users may contact the following bodies for remedies or counseling concerning infringement of personal information.
- Personal Information Dispute Mediation Committee: 1833-6972 (www.kopico.go.kr)
- Personal Information Infringement Report Center: 118, no area code (privacy.kisa.or.kr)
- Supreme Prosecutors' Office: 1301, no area code (www.spo.go.kr)
- Korean National Police Agency: 182, no area code (ecrm.police.go.kr)
14. Changes to this Privacy Policy and Access to Previous Versions
- If the content of this Policy changes, the Company announces the change on the Service screen from 7 days before it takes effect. Changes that are material to users' rights, such as changes to the items collected, the purposes of use or provision to third parties, are announced from 30 days before they take effect and notified by email.
- The Company retains previous versions of this Privacy Policy without deleting them, and users can view them under "View previous versions" on the Service screen.
Addendum
This Privacy Policy takes effect on 2026-10-15.
Language
This is a translation. If this English version and the Korean version differ, the Korean version prevails.