Privacy Policy
CLEVI Inc. | Draft v1.0 | Effective date: [September 1, 2026] CLEVI Inc. (the “Company”) values your personal information and complies with the Act on Promotion of Information and Communications Network Utilization and Information Protection. This Privacy Policy may change from time to time due to changes in government laws and guidelines or the Company's internal policies. The Company establishes the procedures necessary to continually improve its Privacy Policy. This Privacy Policy explains the purposes and methods for which the personal information you provide is used and the measures taken to protect it.
Article 1 (Consent to the Collection of Personal Information)
The Company provides a procedure allowing users to click an “Agree” or “Cancel” button regarding its collection and use of personal information or its Terms of Service. Clicking “Agree” is considered consent to the collection of personal information.
Article 2 (Purposes of Using Personal Information)
1. Registration, identity verification, login, account security and membership management
2. Providing platform features, managing usage history and settings, responding to failures and improving quality
3. Managing subscription applications, changes and cancellations, automatic payments, and credit purchases, use, restoration and expiration
4. Creating orders, verifying payment approval, cancelling or partially cancelling payments, processing refunds and providing receipts
5. Handling customer inquiries, complaints, payment and refund objections, and disputes
6. Preventing and responding to account theft, fraudulent payments, abnormal access and security incidents
7. Providing information about events, benefits and new features where separate consent has been obtained
Article 3 (Personal Information Processed and Retention Periods)
| Category | Information processed | Purpose | Retention period |
|---|---|---|---|
| Registration | Email, encrypted password, name or nickname | Member identification, login and account management | Until membership withdrawal |
| Optional information | Mobile phone number, company name, department and position | Communication and organizational account management | Until membership withdrawal or deletion |
| Subscription | Member number, product, fees, start date, billing cycle, next payment date, cancellation date and status | Subscription applications, renewals, changes and cancellations | 5 years after the contract ends |
| Payment | Order number, payment amount, payment method type, payment processor, payment key, approval number, approval and cancellation times, status and receipt information | Payment approval, cancellation, refunds and transaction history | 5 years from payment |
| Recurring payment | Billing key identifier, payment method type, card issuer, masked card information and recurring payment status | Executing and managing automatic payments | 5 years after the subscription ends or the statutory period |
| Credits | Paid and free balances, purchase, use, restoration, refund and expiration history, transaction numbers and order numbers | Managing balances and transaction records | Until membership withdrawal; payment-linked records for 5 years |
| Refund | Request date, reason, estimated and final amounts, credits recovered, processing status and history | Determining refund eligibility and processing refunds | 5 years after refund processing |
| Exceptional bank-account refunds | Bank name, account number and account holder's name | Refunds when cancellation through the original payment method is difficult | Destroyed without delay after the refund is completed |
| Customer inquiries | Name, email, contact details, inquiry, attachments and response | Consultation, complaints and dispute resolution | 3 years after processing is completed |
| Automatically generated information | IP address, access time, browser, operating system and device information, cookies, usage records, and error and security logs | Security, failure analysis and prevention of misuse | 3 months |
| Marketing | Email, mobile phone number, consent status and time of consent | Event and benefit announcements | Until consent is withdrawn or membership ends |
The Company does not directly store raw payment credentials such as full card numbers, card PINs or CVCs. These are processed through the payment page or payment widget provided by the payment processor.
Article 4 (Retention Required by Applicable Laws)
The Company destroys personal information without delay once its processing purpose has been achieved or its retention period has expired. If applicable laws require retention for a specified period, the information is stored separately for that period.
| Record | Retention period |
|---|---|
| Records concerning labeling and advertising | 6 months |
| Records concerning contracts or withdrawal of offers | 5 years |
| Records concerning payment and provision of services | 5 years |
| Records concerning consumer complaints or dispute resolution | 3 years |
| Computer communication or internet log records and access-location tracing data | 3 months |
Personal information retained by law is stored separately from general operational information and is not used for other purposes. In particular, internet log records and access-location tracing data under the Protection of Communications Secrets Act are managed according to the retention standards prescribed by applicable laws.
Article 5 (Methods of Collecting Personal Information)
1. Registration and entry of account information
2. Purchasing subscriptions or credit products
3. Receiving payment, cancellation and refund processing results from payment processors
4. Customer service inquiries and objections
5. Access, usage and security records generated automatically while visiting the website or using the platform, regardless of membership
6. Participation in events or surveys to which the member has separately consented
Article 6 (Provision of Personal Information to Third Parties)
1. In principle, the Company uses personal information within the scope of its processing purposes and does not provide it to third parties without the data subject's prior consent.
2. Information may be provided to the extent permitted by applicable laws when the data subject consents, a law specifically provides for it, or a competent authority makes a request through lawful procedures.
3. If information is provided to a third party, the Company separately discloses the recipient, purpose, information provided and retention period, and obtains any necessary consent.
Article 7 (Outsourcing of Personal Information Processing)
| Processor | Outsourced work |
|---|---|
| Toss Payments Co., Ltd. | Electronic payments, authentication of recurring payment methods, verification of payment approval, payment cancellation and refunds, and receipt processing |
When entering into outsourcing agreements, the Company includes provisions prohibiting processing for other purposes, managing access rights, ensuring security, restricting subcontracting, allocating responsibility for incidents, and providing management and supervision.
Article 8 (Destruction of Personal Information)
1. The Company destroys personal information without delay once its retention period has expired or its processing purpose has been achieved.
2. Information that must be retained under applicable laws is stored in a separate database or segregated storage space.
3. Electronic files are deleted using methods that make recovery or reproduction difficult, and paper documents are shredded or incinerated.
4. Backup data is deleted according to the established backup cycle and is not used for other purposes before deletion.
Article 9 (Data Subject Rights and How to Exercise Them)
1. Data subjects may request confirmation of whether their personal information is processed and access to it.
2. They may request correction or deletion of their personal information.
3. They may request suspension of processing and withdraw consent.
4. They may request membership withdrawal through account settings or customer service.
5. Where an automated decision significantly affects their rights or obligations, they may reject it or request an explanation in accordance with applicable laws.
6. After verifying the identity of the individual or an authorized representative, the Company processes requests within the periods and according to the procedures prescribed by law.
How to exercise rights: account settings, customer service email [[email protected]], privacy officer [Jinsol Kim], or mail [A-3004, Keumkang Penterium IX Tower, 27 Dongtancheomdansaneop 1-ro, Dongtan-gu, Hwaseong-si, Gyeonggi-do, Republic of Korea (Yeongcheon-dong)]
Article 10 (Right to Refuse Consent)
1. Data subjects have the right to refuse consent to the collection and use of personal information.
2. Refusing processing of required information may restrict registration, payment or provision of the relevant features.
3. Refusing processing of optional information or marketing information does not disadvantage users in their basic use of the platform.
4. Marketing consent may be withdrawn at any time through account settings or the unsubscribe function.
Article 11 (Personal Information of Children Under 14)
1. In principle, the Company does not accept registration by children under 14.
2. If the Company discovers that a child's personal information was collected without the consent of a legal representative, it deletes that information without delay.
3. If services are offered to children under 14 in the future, a separate procedure for obtaining legal representative consent will be established.
Article 12 (Cookies and Automatic Collection Mechanisms)
1. The Company may automatically collect information generated during service use, such as IP addresses, access times and access records, when users visit the website, regardless of membership. This information is processed for service security, prevention of abnormal access and misuse, failure analysis and compliance with applicable laws. The Company may use cookies to maintain login sessions, provide security, store user preferences and analyze errors.
2. Data subjects may allow or refuse cookie storage through their browser settings.
3. Blocking essential cookies may restrict login or use of some features.
4. If behavioral information is collected for personalized advertising, the information collected, methods, purposes, retention periods and opt-out methods are disclosed separately.
5. If personalized advertising is not operated, the following wording applies: “The Company does not collect behavioral information to provide personalized advertising by tracking users' online activities.”
6. Internet Explorer browser: [Tools] > [Internet Options] > [Privacy] tab > change [Settings]
7. Chrome browser: upper-right menu [Settings] > [Advanced] > [Content settings] > [Cookies] settings
8. To understand how the website is used, the Company records for each page view the registered organisation of the visitor’s network, the country (and, where available, the region and city), the page viewed, the domain of the referring site, the time of access and the type of device (desktop, phone or tablet). These access records do not store IP addresses or browser identifiers, and neither is sent to any external service to identify the organisation. To group one visitor’s views within a single day, only a one-way hash combining the IP address, browser information, a secret value and the date is kept; this value changes every day and cannot be used to re-identify any individual. Access records are deleted automatically 90 days after collection and are not provided to third parties.
Article 13 (Measures to Ensure the Security of Personal Information)
1. Establishing and reviewing an internal personal information protection management plan
2. Minimizing personnel handling personal information and providing regular training
3. Restricting access rights to the scope necessary for work
4. Encrypting passwords and key authentication information
5. Encrypting data in transit
6. Retaining access records and preventing tampering
7. Blocking intrusions and detecting abnormal access
8. Checking vulnerabilities and applying security updates
9. Operating backup and recovery procedures
10. Managing and supervising personal information processors
Article 14 (Automated Decisions)
1. The Company's current principle is not to make decisions that significantly affect data subjects' rights or obligations solely through automated means.
2. If automated decision features are introduced in the future, the Company will disclose the decision criteria and procedures, the main information processed, and how to reject decisions or request explanations.
3. Automated systems may be used to detect payment fraud or security risks, but significant measures such as permanent account suspension or refund refusal are additionally reviewed by personnel where necessary.
Article 15 (Privacy Officer and Responsible Department)
| Category | Details |
|---|---|
| Privacy officer | Jinsol Kim |
| Dedicated email | [email protected] |
| Phone number | 1551-4096 |
| Responsible department | Research and Development Team 1 |
Article 16 (Remedies for Infringement of Rights)
Personal Information Infringement Report Center (operated by the Korea Internet & Security Agency)
- Responsibilities: reports of personal information infringements and requests for consultation
- Website: privacy.kisa.or.kr
- Phone: 118 (without an area code)
- Address: Personal Information Infringement Report Center, 3rd floor, 9 Jinheung-gil, Naju-si, Jeollanam-do 58324, Republic of Korea (301-2 Bitgaram-dong)
Personal Information Dispute Mediation Committee
Responsibilities: applications for personal information dispute mediation and collective dispute mediation (civil resolution)
Website: www.kopico.go.kr
Phone: 1833-6972 (without an area code)
Address: 4th floor, Government Complex Seoul, 209 Sejong-daero, Jongno-gu, Seoul 03171, Republic of Korea
Cybercrime Investigation Division, Supreme Prosecutors' Office
http://www.spo.go.kr
Cyber Bureau, Korean National Police Agency
http://cyberbureau.police.go.kr
Article 17 (Changes to the Privacy Policy)
1. The Company may amend this Privacy Policy when laws, operating methods or personal information processing practices change.
2. Material changes are announced through the platform at least 7 days before the effective date.
3. Changes that significantly affect data subjects' rights, such as changes to collection and use purposes, third-party provision or overseas transfers, are announced at least 30 days in advance, and separate consent is obtained where necessary.
4. Previous privacy policies are retained separately so that data subjects can review them.
Article 18 (Announcement and Effective Dates)
| Item | Details |
|---|---|
| Announcement date | [September 1, 2026] |
| Effective date | [September 1, 2026] |
| Version | v1.0 |