Privacy Policy

Effective Date: 2026-07-17 · Personal Information Processor: Windsoft (CEO Kim Soon-jung)

Windsoft (hereinafter "the Company") establishes and discloses the following privacy policy to protect the personal information of data subjects and to promptly handle related grievances in accordance with Article 30 of the Personal Information Protection Act.

Article 1 (Items of Personal Information Collected and Collection Methods)

Membership Registration (Required)	Email address, password (stored in encrypted form), verification of being over 14 years old, records of agreement to terms and collection of personal information
Membership Registration (Optional)	Name, consent to receive marketing information
When using a license (Automatically collected)	Device identifier (one-way encrypted hash value), activation and login date/time, product usage information
When submitting inquiries	Name, email address, inquiry content
During service use Automatically generated	IP address, login date/time, browser/device information, service usage records

Collection methods: Collected through website membership registration and inquiry forms, and during license authentication when software products are executed.

Payment information(Card number, account number, etc.) is directly collected and processed by the payment agency (PG company), and the Company does not store it. The Company only receives and stores the payment results (order number, payment amount, payment date/time, payment method).

Article 2 (Purpose of Processing Personal Information)

Member Management — Identification and authentication of members, account management, prevention of registration under the age of 14, delivery of notices
License Management — Issuance and verification of licenses, checking compliance with license usage, prevention of unauthorized use
Payment — Fulfillment of purchase contracts, payment verification, handling of withdrawal of subscription and refunds
Customer Support — Receipt and response to inquiries, handling complaints, retention of records for dispute resolution
Marketing (only for those who opted in) — Information on new products, updates, and events

Article 3 (Processing and Retention Period of Personal Information)

The company retains personal information until the member withdraws and destroys it without delay upon withdrawal. However, if retention is required by relevant laws, it is kept for the following periods.

Records related to contracts or withdrawal of subscription	5 years (Electronic Commerce Act)
Records related to payment and supply of goods	5 years (Electronic Commerce Act)
Records related to consumer complaints or dispute resolution	3 years (Electronic Commerce Act)
Records related to labeling and advertising	6 months (Electronic Commerce Act)
Connection records related to service usage	3 months (Protection of Communications Secrets Act)

Information on consent to receive marketing As soon as consent is withdrawn We will stop processing the relevant purposes.

Article 4 (Provision of Personal Information to Third Parties)

The company processes the personal information of data subjects only within the scope specified in Article 2, and provides it to a third party only in cases corresponding to the data subject's consent, special provisions of law, etc., in accordance with Articles 17 and 18 of the Personal Information Protection Act.

Currently, the company does not provide the personal information of data subjects to third parties.

Article 5 (Consignment of Personal Information Processing)

For smooth service provision, the company outsources personal information processing tasks as follows.

Server Hosting	SmileServe (iwinv) — Provides infrastructure for service operation · Until the end of the consignment contract
Email Sending	Kakao Corporation — Sends authentication emails, license notices, and inquiry responses · Until the end of the consignment contract

When concluding a consignment contract, the company specifies in the contract, in accordance with Article 26 of the Personal Information Protection Act, the prohibition of personal information processing for purposes other than performing consigned tasks, technical and administrative protection measures, restriction on re-consignment, etc., and supervises whether the trustee complies with them. If the contents of the consigned tasks or the trustee change, it will be disclosed through this policy.

Article 6 (Overseas Transfer of Personal Information)

The company is not currently transferring personal information overseas. Kakao Corporation, which we consigned email sending to, is a domestic company, and the related processing is understood to be conducted domestically.

However, if it becomes necessary to transfer personal information overseas for future service provision, the company shall provide the recipient of the transfer, the items of personal information to be transferred, the country to which it is transferred, the date and method of transfer, as well as the purpose of use and retention/use period of the recipient. Notified in advance through this policyAnd, in cases required by law, we will obtain separate consent from the data subject.

Article 7 (Procedures and Methods for Destroying Personal Information)

When the company no longer needs personal information, such as when the retention period has expired or the purpose of processing has been achieved Without delay (within 5 days from the date the reason occurs) The personal information will be destroyed.
In cases where it must be preserved according to other laws, the relevant personal information by moving it to a separate database or by changing the storage location Preserve.
Disposal method — Information in electronic file form is deleted using technical methods that make it unrecoverable, and paper documents are shredded or incinerated.

Article 8 (Rights, Obligations, and Methods of Exercise of Data Subjects and Legal Representatives)

The data subject can at any time with respect to the company Access, Correction, Deletion, and Suspension of Personal InformationYou can request.
Exercise of rights My PageYou can do it directly at the <place>, or request it via email or phone to the person responsible for personal information protection. The company will take action without delay.
data subject You can withdraw your consent to receive marketing information at any time on My PageI can do it.
When the information subject requests correction of personal information errors, the company will not use or provide the personal information until the correction is completed.
The exercise of rights may be done through a legal representative or an authorized person, and in this case, a power of attorney must be submitted.
Requests for access, correction, deletion, or suspension of processing may be restricted in accordance with the provisions of the "Personal Information Protection Act."

Article 9 (Measures to Ensure the Safety of Personal Information)

Password encryption — Passwords are stored using one-way encryption (bcrypt)so that the company cannot know the original text.
Handling of device identifiers — Hardware information is not stored in its original form but converted into a hash valueand stored.
Encryption during transmission — Personal information is encrypted and transmitted via HTTPS.
Access control — Access rights to the personal information processing system are granted only to a minimum number of personnel.
Session protection — Automatic logout occurs if there is no activity for 30 minutes.
Retention of access records — Service usage records are kept to prevent alteration or falsification.

Article 10 (Installation, Operation, and Refusal of Automatic Personal Information Collection Devices)

The company uses browser storage (localStorage) and cookiesto maintain login status.
This information is Used only for the purpose of maintaining login sessions and not for collecting advertising or behavioral information.
Data subjects can refuse to store cookies in their browser settings, but if they do, usage of services that require login will be restricted.It is possible.

Article 11 (Personal Information of Children Under 14)

The company We do not accept membership registration for children under 14. At the time of registration, we verify that the member is 14 years or older, and if it is confirmed that they are under 14, the personal information of the corresponding account will be promptly destroyed.

Article 12 (Person Responsible for Personal Information Protection and Access Requests)

The company is responsible for overseeing all tasks related to the processing of personal information and has designated the following personal information protection officer to handle complaints, remedies, and other matters related to personal information processing.

Personal Information Protection Officer	Kim Soon-jung (CEO of Windsoft)
Email	windsoft@kakao.com
Phone	070-7566-0599

Data subjects can contact the above for all inquiries, complaints, remedies, and access requests related to personal information protection, and the company will respond and handle them without delay.

Article 13 (Remedies for Infringement of Rights)

Data subjects can apply to the following organizations for dispute resolution or consultation to receive remedies for personal information infringement.

Personal Information Dispute Mediation Committee	1833-6972 · www.kopico.go.kr
Personal Information Infringement Reporting Center	(Without area code) 118 · privacy.kisa.or.kr
Supreme Prosecutors' Office Cyber Investigation Division	(Without area code) 1301 · www.spo.go.kr
National Police Agency Cyber Investigation Bureau	(Without area code) 182 · ecrm.police.go.kr

In addition, a person whose rights or interests are infringed due to a disposition or inaction by the head of a public institution in response to the data subject's request regarding Article 35 (Access), Article 36 (Correction/Deletion), or Article 37 (Suspension of Processing) of the "Personal Information Protection Act" may file an administrative appeal in accordance with the Administrative Appeals Act.

Article 14 (Changes to the Privacy Policy)

This privacy policy applies from the effective date, and in case content is added, deleted, or modified due to laws or service changes, the implementation of the changes Since 7 days ago will be notified through notices. However, in the case of changes that have a significant impact on the rights of data subjects, notice will be given 30 days in advance, they will be notified.

Supplementary Provisions

This policy will take effect on July 17, 2026.

※ Check before enforcement

• Article 6 (Overseas Transfer) — Currently, mail sending is switched to Kakao Mail (smtp.kakao.com, domestic company)and is recorded as having no overseas transfer. If the mail sending service is changed to an overseas provider in the future, this article must be updated in a table format specifying the recipient, country, and items at that time.

• When the PG company is confirmed, — the payment gateway must be added to the table in Article 5. If omitted before payment integration, there may be issues with review and legal violations.

• This policy is a draft based on legal provisions, and prior to enforcement, legal reviewis recommended.

Return to Home · Return to Sign Up