Privacy Policy

Article 1 (Purposes of Processing)

Article 2 (Items Processed)

1. (1) The Company processes the following personal information.
   1. 1. Sign-up (required): ID, password and nickname
   2. 2. Information generated automatically while using the service: IP address, access time, service usage records (game activity, chat, messages and posts) and cookies
   3. 3. When sending gold or items to another member: the IP address at the time of sending
   4. 4. When applying for a review of a gold transfer above the daily limit (a large transfer): the recipient character, the amount, the reason and any additional details or appeal written, and the result of the review
   5. 5. When accessing the service: the country of connection determined from the IP address (if you connect from outside Korea, that country's flag appears on your citizen card; you can turn this off in Settings)
   6. 6. When paying for or using Cash: the IP address at that time
   7. 7. When uploading a picture to use as a portrait or a national flag (optional): the uploaded picture
   8. 8. When turning on browser or app notifications (optional): the identifier of the browser or device that receives them (push token) and the language used for notifications
   9. 9. When filing a complaint, a defence or an appeal in the in-game court: the text written, and the evidence photos uploaded with their descriptions
   10. 10. When paying for paid services: order number, product, amount, payment time and payment identifier
   11. 11. When paying by direct bank transfer: the sender name, the amount and the time of the request
   12. 12. When requesting a refund: the email address used for the request and, for refunds by bank transfer, the bank name, account number and account holder
   13. 13. When arriving through a promotion link: a value made from the IP address that cannot be turned back into it, the address viewed before arriving and, if the visitor then signs up, the account created
2. (2) The Company does not collect resident registration numbers, phone numbers or addresses, and does not collect names other than the sender name given for a direct bank transfer and the account holder given for a refund account. Payment details such as card numbers and account passwords are received and processed directly by the payment processor and are not stored by the Company.
3. (3) The Company does not accept sign-ups from children under 14.

Article 3 (Processing and Retention Period)

1. (1) The Company keeps and uses personal information until the member leaves, and destroys it without delay when they do.
2. (2) However, the following information is kept for the period set by law.
   1. 1. Records of contracts, withdrawals and the like: 5 years (Act on Consumer Protection in Electronic Commerce)
   2. 2. Records of payments and supply of goods: 5 years (Act on Consumer Protection in Electronic Commerce)
   3. 3. Records of consumer complaints and dispute handling: 3 years (Act on Consumer Protection in Electronic Commerce)
   4. 4. Access logs: 3 months (Protection of Communications Secrets Act)
3. (3) Information kept under paragraph (2) is used only to confirm that the transaction took place, and not for any other purpose.
4. (4) The following information is erased as set out below even before the member leaves.
   1. 1. Uploaded pictures: a picture rejected in review, a picture withdrawn because a new one was uploaded while it awaited review, and a picture taken down by an operator are erased at once.
   2. 2. Browser and app notification identifiers: erased when notifications are turned off, and also when the browser or device has not been confirmed again for 60 days.
   3. 3. IP addresses recorded when paying for or using Cash: erased 5 years after the day they were recorded.
5. (5) Records of visits through promotion links are kept for as long as the promotion scheme runs, so that the same connection is not counted twice. These records hold only the value that cannot be turned back into an IP address, not the IP address itself.

Article 4 (Procedure and Method of Destruction)

1. (1) The Company destroys personal information without delay once the retention period ends or the purpose has been achieved and the information is no longer needed.
2. (2) Information in electronic files is deleted in a way that cannot be recovered.
3. (3) When a member leaves, their ID and nickname are replaced with unidentifiable values, and the password, IP address records, pictures uploaded as portraits, browser and app notification identifiers, the country of connection, and the reasons, details and appeals written for large transfer reviews are erased. Character names and trade records entangled with other members' records (including the amounts and results of large transfer reviews), and IP addresses recorded when paying for or using Cash, remain for the retention purpose in Article 3(2).
4. (4) Posts and messages written before leaving, and case records of the in-game court (complaints, defences, evidence photos and judgments), are entangled with other members' records and remain after the member leaves. A national flag picture remains as that nation's.

Article 5 (Provision to Third Parties)

1. (1) The Company does not provide personal information to third parties without the data subject's consent.
2. (2) However, it may provide information in cases falling under Articles 17 and 18 of the Personal Information Protection Act, such as a request from an investigative agency under procedures set by law.

Article 6 (Outsourcing of Processing)

1. (1) To provide the service smoothly, the Company outsources the processing of personal information as follows.
   1. 1. Toss Payments Co., Ltd.: processing and cancelling payments such as card payments, bank transfers and simple payments
   2. 2. Cloudflare, Inc.: website delivery and security (blocking malicious access). Transfers abroad are described in Article 7.
   3. 3. UCHAT (uchat.io): providing the in-game chat. When you use the chat, your character name and nation, a chat identifier made from your account number, your level and the address of your portrait image are passed to UCHAT, and UCHAT processes the chat messages and connection information (such as IP addresses).
   4. 4. Google LLC (Firebase Cloud Messaging): delivering browser and app notifications. The browser or device identifier (push token) of members who turned notifications on and the title and content of each notification are passed to it. Transfers abroad are described in Article 7.
   5. 5. Groq LLC: artificial intelligence processing used by the in-game court to read evidence photos, review complaints and try cases, and to review large transfers. The complaint and defence text, the evidence photos with their descriptions, the name of the accused character, a summary of that character's earlier guilty judgments, and, for large transfer reviews, the reason, additional details and appeal written, the amount, the sender's gold income over the last 30 days, a summary of transactions between the two characters and the recipient's account age and level are passed to it. Character names are not passed for large transfer reviews. Transfers abroad are described in Article 7.
2. (2) Payments made in the app are processed directly by Google LLC (Google Play) under its contract with the member. The Company receives only the order number and purchase verification value needed to confirm the payment.
3. (3) The Company requires processors by contract to handle personal information safely and manages and supervises them so they do not process it beyond the outsourced work.
4. (4) If a processor or the outsourced work changes, the Company amends this Privacy Policy and gives notice.

Article 7 (Transfer Abroad)

1. (1) To deliver the service reliably and block malicious access, the Company outsources processing of personal information abroad as follows.
   1. 1. Recipient: Cloudflare, Inc. (privacy inquiries: privacyquestions@cloudflare.com)
   2. 2. Countries: the United States and other countries where Cloudflare operates data centres
   3. 3. When and how: transmitted over the network each time the service is accessed
   4. 4. Items: IP address, access records and other information sent in the course of accessing the service
   5. 5. Purpose: fast delivery of the website and detection and blocking of security threats
   6. 6. Retention: until the purpose of the outsourcing is achieved (under Cloudflare's privacy policy)
2. (2) To deliver notifications to members who turned browser or app notifications on, the Company outsources processing of personal information abroad as follows.
   1. 1. Recipient: Google LLC (privacy inquiries: firebase.google.com/support/privacy/dpo)
   2. 2. Countries: the United States and other countries where Google operates facilities
   3. 3. When and how: transmitted over the network when notifications are turned on and each time a notification is sent
   4. 4. Items: the browser or device identifier (push token) and the title and content of the notification (for a message notification, the sender's character name and the beginning of the message)
   5. 5. Purpose: delivering browser and app notifications
   6. 6. Retention: until the purpose of the outsourcing is achieved (under Google's privacy policy)
3. (3) To review and try complaints in the in-game court and to review large transfers, the Company outsources processing of personal information abroad as follows.
   1. 1. Recipient: Groq LLC (privacy inquiries: privacy@groq.com)
   2. 2. Countries: the United States and other countries where Groq operates processing facilities
   3. 3. When and how: transmitted over the network each time an evidence photo is read, a complaint is reviewed or tried, or a large transfer is reviewed
   4. 4. Items: the complaint and defence text, the evidence photos with their descriptions, the name of the accused character, a summary of that character's earlier guilty judgments, and, for large transfer reviews, the reason, additional details and appeal written, the amount, the sender's gold income over the last 30 days, a summary of transactions between the two characters and the recipient's account age and level
   5. 5. Purpose: reading evidence photos, reviewing complaints, trying cases and reviewing large transfers with artificial intelligence
   6. 6. Retention: until the purpose of the outsourcing is achieved (under Groq's privacy policy)
4. (4) To show ads in the app, the Company has an advertising provider process personal information abroad as follows.
   1. 1. Recipient: Google LLC (Google AdMob; privacy inquiries: googlekrsupport@google.com)
   2. 2. Countries: the United States and other countries where Google operates facilities
   3. 3. When and how: transmitted over the network by Google's ad tool built into the app each time a member watches an ad in the app
   4. 4. Items: advertising identifiers (advertising ID and app set ID), the IP address of the connection, diagnostic information about the device and app, and ad view and click records
   5. 5. Purpose: showing ads (including targeted ads), measuring ad performance and preventing misuse
   6. 6. Retention: under Google's privacy policy
5. (5) Data subjects may refuse the transfer abroad. However, as the service is delivered only through Cloudflare, refusing that transfer means the service cannot be used. The transfer to Google LLC for notifications can be refused by not turning browser or app notifications on or by turning them off, the transfer to Google LLC for ads by not watching ads in the app, and the transfer to Groq LLC by not filing a complaint or a defence in the in-game court and not applying for a large transfer review. However, in a case brought by another member's complaint the name of the accused character is passed along, and in a large transfer review applied for by another member a summary of transactions between the two characters and the recipient's account age and level are passed along.

Article 8 (Rights of Data Subjects and Legal Representatives)

1. (1) Data subjects may at any time ask the Company to let them view, correct or delete their personal information, stop processing it, or withdraw consent.
2. (2) These rights can be exercised directly on the settings screen or by writing to incode@gmail.com, and the Company acts without delay.
3. (3) When a data subject asks for correction or deletion, the Company does not use or provide the information until it has finished acting on the request.
4. (4) Rights may also be exercised through a legal representative or an authorised person.
5. (5) Deletion cannot be requested for personal information that other laws designate for collection.

Article 9 (Security Measures)

Article 10 (Automatic Collection Devices (Cookies))

1. (1) The Company uses cookies for the following purposes.
   1. 1. Keeping you signed in (deleted when you sign out)
   2. 2. Remembering the language you chose
   3. 3. Remembering the screen style you chose
   4. 4. Remembering the promotion link you arrived through (used to pick the inviting member's nation first when you create a character; deleted after 3 days or once you create a character)
   5. 5. Blocking malicious access by the security service (Cloudflare)
   6. 6. Keeping in-game chat (UCHAT) settings and connection (stored on this site by UCHAT)
2. (2) Data subjects can refuse cookies in their browser settings. If cookies are refused, however, sign-in is not kept and the service may be hard to use.

Article 11 (Behavioural Information)

1. (1) The Company does not itself collect behavioural information for targeted advertising or similar purposes.
2. (2) However, when a member watches an ad in the app, Google LLC (Google AdMob), which shows the ad, collects behavioural information as follows.
   1. 1. Items: advertising identifier (advertising ID) and ad view and click records
   2. 2. How: collected automatically by Google's ad tool built into the app while the member watches an ad
   3. 3. Purpose: showing ads matched to the member's interests and measuring ad performance
   4. 4. Retention: under Google's privacy policy
3. (3) Members can refuse targeted ads by resetting or deleting their advertising ID in the ads menu of their phone settings (for example, Settings > Google > Ads). If you do not watch ads in the app, this collection does not take place.
4. (4) In addition, the in-game chat window is provided by UCHAT, and when it loads, UCHAT also loads collection tools of NAVER Corporation used for usage statistics and advertising. Information these tools collect is governed by the privacy policies of UCHAT and NAVER Corporation.
5. (5) On wide screens the chat window opens together with the game screen of signed-in members; on phones it loads when the member opens the chat. Refusing third-party cookies in your browser settings reduces what these tools can collect.

Article 12 (Privacy Officer)

1. (1) The Company has appointed the following Privacy Officer to oversee the processing of personal information and to handle complaints and remedies of data subjects.
   1. 1. Privacy Officer: Kim Daeeun (representative, Gideon Media Contents)
   2. 2. Contact: incode@gmail.com
2. (2) Data subjects may bring inquiries, complaints, requests for remedies and requests to view personal information to the Privacy Officer, and the Company answers and acts without delay.

Article 13 (Remedies for Infringement)

Article 14 (Changes to This Policy)