TOIU (the “Company”) establishes and publishes this Privacy Policy under Korea's Personal Information Protection Act to protect users' personal information and promptly address privacy inquiries and complaints. It applies to the Company's website (https://www.toiucorp.com), software license purchases, issuance and authentication, and email subscriptions.
1. Purposes, information processed and collection methods
The Company processes only the minimum personal information necessary to provide its services as follows.
| Category | Purpose | Personal information processed | Collection method and legal basis |
|---|---|---|---|
| License purchase and payment | Order creation, payment verification, license issuance and delivery, transaction verification and inquiries | Email address, order number, purchased product, payment provider, currency, amount and status, provider order/transaction identifiers, payment link, order verification credentials, notification language | User entries and choices at checkout, Company-generated orders and provider responses/payment notifications. Processing to conclude or perform a contract (Act Article 15(1)(4)) |
| License issuance and authentication | Buyer and entitlement verification, device registration, duplicate use and validity checks | Email, license key, software, issuance time, expiry if applicable, authenticated device identifier (HWID) | Company license issuance and software authentication requests; contract performance |
| Telegram Stars payments | Payment user identification, linking orders and payments, payment approval | Order information above plus Telegram user ID, pre-checkout query ID and Telegram payment identifier | Telegram pre-checkout queries and completed-payment notifications; contract performance only when this method is used |
| Email subscriptions | Subscription registration and management, confirmation, Company/product news and advertising in the selected language | Email, subscription language, registration time and IP address, Company-generated subscription identifier | Subscription applications and automatically generated/collected information on application; consent to personal information collection/use and advertising (Act Article 15(1)(1), Article 50 of the Act on Promotion of Information and Communications Network Utilization and Information Protection) |
| Website display and requests | Language/theme preferences, payment progress restoration, request handling and troubleshooting | Language/theme settings, browser language, country code if provided, IP address, request path, access/processing times, results and error logs. Payment progress may include email, order number and order verification credentials | Browser cookies/local storage, request headers and server logs; service provision and safe operation |
| Inquiries and exercise of rights | Purchase, authentication and subscription support; access, correction, deletion and suspension requests | Reply email/contact, inquiry contents, user-provided order/license information and handling history | Direct provision by email, telephone or similar means |
License authentication receives the email address, license key, device identifier and software name. The identifier of the first successfully authenticated device is registered and compared with later requests. It distinguishes devices; authentication does not receive users' file contents or documents.
Payment details entered at checkout, including card numbers, PINs and security codes, are handled by the selected provider and are not stored in the Company's order/license databases. For Eximbay, the email address and its part before @ as the buyer display name are sent; the Company does not separately request the buyer's legal name.
Personal information is not used for other purposes. If purposes change, the Company takes required measures, including separate consent, under Article 18 of the Act.
2. Retention and use periods
Information is retained as needed for its purpose and destroyed promptly when that purpose or retention period ends. Information subject to statutory retention is kept until that obligation expires.
| Category | Retention and use period |
|---|---|
| Purchase/payment records | Statutory periods below; information still needed for licensing is used during license administration |
| License information including email, key and registered device identifier | While the license is valid and authentication is provided. Unlimited licenses: while the licensing relationship continues; on termination or deletion request, statutory retention duties are checked |
| Email subscriptions | Until unsubscribe or withdrawal of collection/use consent. Advertising stops and subscription information without statutory retention duties is destroyed |
| Customer inquiries | Until resolved; consumer complaint/dispute records follow the statutory periods below |
| Unpaid orders | 7 days from creation, after which payment verification and troubleshooting purposes are deemed fulfilled and the records are destroyed |
| Server access/error and license issuance/email sending operational logs | 1 year from creation. Issuance logs may contain emails and license keys; sending error logs may also contain related information |
| Cookies and browser local storage | Periods in Section 7 |
Electronic commerce records are retained as follows, limited to necessary information such as emails, order/payment/supply details and related inquiries and handling records.
| Record | Period | Basis |
|---|---|---|
| Contracts and withdrawal | 5 years | Article 6, Enforcement Decree of the Act on Consumer Protection in Electronic Commerce |
| Payment and supply of goods/services | 5 years | Article 6 of the same Decree |
| Consumer complaints/disputes | 3 years | Article 6 of the same Decree |
| Representations and advertisements | 6 months | Article 6 of the same Decree, where records contain personal information |
Statutory records are stored separately from other-purpose information or access/use is restricted, and they are used only for retention purposes.
3. Disclosure to third parties
The Company does not sell personal information or provide it for external businesses' advertising/marketing. Necessary disclosure occurs only where Articles 17 and 18 of the Act permit it, such as user consent or specific legal provisions.
Order/payment information is exchanged with the selected payment provider for approval and verification, as detailed in Section 4. Information providers collect directly from users and its purposes follow their own privacy policies and checkout notices.
For lawful requests to submit information, the Company checks their basis and scope and may provide the minimum necessary. Other third-party disclosures follow applicable procedures after notifying recipients, purposes, items and retention periods.
4. Processing entrusted to service providers and payment integration
The following businesses process information for website operation, email delivery and payments.
| Service provider | Entrusted work | Information processed |
|---|---|---|
| Vultr (The Constant Company, LLC) | Website/database hosting; production server: Seoul, Republic of Korea | Stored orders, licenses, subscriptions and server logs |
| Google LLC (Gmail SMTP relay) | License and subscription confirmation emails | Recipient email, subject, body and sending information. License emails include the key, product, tier and platform |
| Toss Payments Co., Ltd. | Domestic payment approval/verification | See below |
| Eximbay Co., Ltd. | International card approval/verification | See below |
| PayPal Pte. Ltd. | PayPal approval/verification | See below |
| Telegram | Telegram Stars approval/verification | See below |
Under Article 26 of the Act, contracts specify purpose limitations, technical/administrative safeguards, limits on subcontracting, supervision and liability, and the Company supervises secure processing. Changes to tasks or providers are promptly published in this policy.
Only information necessary for the selected payment method is transmitted, not purchase information to every provider.
| Provider | Main information sent | Main information received/stored |
|---|---|---|
| Toss Payments | Order number, product name, amount, payment identifiers needed for verification and return URLs | Payment identifier, verified status, amount and currency |
| Eximbay | Email, display name from the email part before @, order number, product name, amount, currency, notification/return URLs and mobile status | Transaction identifier, verified status, amount and currency |
| PayPal | Order number, product name, amount, currency and return URLs | PayPal order/transaction identifiers, payment links and verification results |
| Telegram Stars | Order number, product name, amount, currency and approval results | Telegram user ID, pre-checkout query ID, payment identifier, payment links and verification results |
Providers' retention follows their own policies. Information received/stored by the Company follows Section 2.
5. International transfers
Website and database production servers are in Seoul, Republic of Korea. Information sent to external providers for email and international payments may be processed abroad.
Transfers are based on Article 28-8(1)(3) of the Act: entrusted processing/storage necessary to conclude or perform users' contracts for software licenses and notification emails. Publication here satisfies statutory notice requirements for items, countries, timing/methods, recipient names/contacts, purposes, retention, and refusal methods and consequences.
| Recipient and contact | Information | Timing/method | Purpose | Countries | Retention/use |
|---|---|---|---|---|---|
| Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA. Privacy inquiries: https://support.google.com/policies/contact/general_privacy_form | Recipient email, subject, body and sending information; body may contain a license key | On sending, over TLS-encrypted SMTP | Email delivery | USA and other Google data center countries | Periods in Google's privacy policy and data processing terms |
| PayPal Pte. Ltd., 5 Temasek Boulevard #09-01 Suntec Tower 5, Singapore 038985. Korean representative: PayPal Korea Services LLC, 02-737-5775, skrprivacy@paypal.com | Order number, product name, amount, currency, return URLs and transaction identifiers | On order creation/verification via HTTPS API for this payment method | Order creation and payment approval/verification | Singapore and USA | As necessary for legal/regulatory obligations under PayPal's privacy policy |
| Telegram Messenger Inc. / Telegram FZ-LLC, Business Central Towers, Dubai, UAE. Privacy contacts: https://telegram.org/privacy | Order number, product name, amount, currency, payment request identifiers and approval results | On payment link creation/approval via HTTPS API for this method | Payment link creation and approval | UAE and Telegram data center countries | Period in Telegram's privacy policy |
Google's mail service and overseas providers PayPal/Telegram process information only within the Company's delegated work. Information they collect directly to operate users' own accounts during payment is not a Company transfer and follows their policies.
The Company contracts with recipients on protection, including data processing addenda, and manages safeguards equivalent to legal standards under Article 28-8(4). Additional transfers requiring separate consent are explained and consented to; publishing this policy does not replace that consent.
Users may request transfers to stop using Section 9's contacts. This may limit overseas payment methods or externally delivered emails; the Company explains effects and possible alternatives. Unsubscribing stops future newsletters.
6. Destruction procedures and methods
Information without statutory retention duties is promptly destroyed on unsubscribe, consent withdrawal, retention expiry or fulfillment of its purpose. Legally retained information is separated into another database or storage and destroyed when the required period expires.
Electronic files are technically deleted to prevent restoration or reproduction; any paper documents are shredded or incinerated. Unpaid orders and operational logs are automatically deleted under Section 2. Entrusted information is also managed for destruction under contracts and law.
7. Cookies, local storage and external resources
Browser storage maintains language/theme and payment progress. The website contains no advertising tracking cookies or collection code for external analytics such as Google Analytics.
| Storage/item | Purpose and contents | Retention/deletion |
|---|---|---|
| Language/theme cookies | Selected language and light/dark theme | Up to 1 year after saving/updating; users can delete them in their browser |
| Language/theme local storage | Apply preferences on later visits | No automatic expiry; removed when users delete site data |
| Payment progress local storage | Restore order status on return from payment; may include email, order number, verification credentials, product, provider, amount, currency and progress | Deleted on confirmed completion, cancellation or opening a new checkout for the product. After the displayed 5-minute validity, incomplete orders are removed when the page checks expiry; closing the page may prevent immediate automatic deletion |
Separately from browser payment progress, incomplete server orders are destroyed after 7 days under Section 2.
Users may block cookies or delete cookies/local storage in browser privacy/site-data settings. Blocking storage may affect preferences or order verification after external payments. Deleting browser storage does not delete server purchase, license or subscription information; requests for that information follow Section 8.
The website and notification emails load external fonts from jsDelivr. Loading these on a visit or email opening may disclose IP address, resource requests and browser/mail-client connection information to the provider. Payment functions also communicate with the selected provider's external SDK or payment page. External payment/resource providers' processing follows their own policies.
8. User rights and how to exercise them
Users may request access, correction/deletion, suspension and withdrawal of consent at any time. Legal representatives or authorized agents may act under law, submitting a power of attorney using Form 11 of the Enforcement Rules of the Personal Information Protection Act. After proportionate identity/authority checks, the Company processes requests and reports results within 10 days.
Requests can use Section 9's email or telephone. Providing the purchase/subscription email and request details helps prompt handling.
Unsubscribe or refuse advertising using the email footer's unsubscribe link or by emailing the subscribed address and request to toiu@toiucorp.com. Advertising stops after processing. Replies to the send-only noreply@toiucorp.com are not handled; use the contact above.
Email subscriptions and advertising are optional. Refusal or unsubscribe does not affect website browsing or license purchase/authentication. Purchase/authentication email and device identifiers are necessary for those services, so refusal or deletion may restrict license delivery/authentication. Purchase email addresses are not automatically added to newsletters.
Unsubscribe does not delete purchases or licenses. Essential transaction/license notices, such as payment confirmation and keys, are sent independently of newsletter consent. Other statutory retention may limit deletion or suspension; the Company explains the reason.
9. Privacy officer and contacts
The Company appoints the following privacy officer to oversee processing, handle inquiries and complaints, and provide remedies.
| Item | Details |
|---|---|
| Business | TOIU |
| Privacy officer | Kim Bom (Representative) |
| toiu@toiucorp.com | |
| Telephone | 070-8080-4820 |
| Address | Room 501-J521, 5F, 61 Daehak-ro 12-gil, Jongno-gu, Seoul, Republic of Korea (03086) |
Privacy infringement reports or advice may also be requested from:
- Privacy Infringement Reporting Center (Korea Internet & Security Agency): 118 in Korea, https://privacy.kisa.or.kr
- Personal Information Dispute Mediation Committee: 1833-6972, https://www.kopico.go.kr
- Supreme Prosecutors' Office Cyber Investigation Division: 1301 in Korea, https://www.spo.go.kr
- Korean National Police Agency Cyber Investigation Bureau: 182 in Korea, https://ecrm.police.go.kr
10. Security safeguards
Under Article 29 of the Act and the Standards for Ensuring the Safety of Personal Information, the Company takes these measures:
- Encryption in transit: HTTPS for website/authentication requests and TLS for external payment APIs and email delivery.
- Stored credentials: order verification credentials are stored as hashes, not plaintext, and checked on verification requests.
- Access control: access to personal information/license databases and logs is limited to the minimum necessary staff, with permissions managed.
- Access logs: access to personal information systems is logged and retained for at least 1 year.
- Retention management: information past Section 2's retention periods is automatically deleted.
Users should also protect email addresses, keys and order verification information from disclosure to others.
11. Policy changes
This policy applies from its effective date. Changes to purposes/items, retention, outsourcing, disclosure or international transfers due to laws, policies or services are announced with their effective date at least 7 days beforehand. Changes materially affecting user rights are announced 30 days beforehand; separate consent procedures are followed where required.
- Publication date: October 18, 2026
- Effective date: October 18, 2026
12. Member accounts and login
To register, authenticate and identify members and prevent abuse, we process email, a password hash, internal user ID, chosen language, registration and last-login times, and the accepted terms version and time. Email registration uses information entered by the user and email verification. Processing is necessary to enter into and perform the membership contract under Article 15(1)(4) of the Act. Plaintext passwords are not stored.
When you choose Google login, Google’s consent and authentication flow supplies the Google account identifier (sub), verified email, display name and profile image URL, which we save or update in users. We never receive your Google password. Google access tokens are used temporarily to verify the account and are not stored in the database. Information Google processes directly is subject to its privacy policy.
For email verification we temporarily store the email, hashes of the six-digit code and browser verification token, expiry and failed-attempt count. Codes expire in 10 minutes, may be resent after 60 seconds and require replacement after five failures. Verification records are deleted on successful registration. Sections 4 and 5 on Google Gmail SMTP relay and overseas transfers also apply to verification emails.
The HttpOnly cookie toiu_session lasts 30 days; toiu_verification and toiu_oauth_state last 10 minutes each. The server stores session-token hashes, user IDs, expiries and login-request verification data. Logout revokes the current session. Hashed IP addresses and request counters for abuse prevention are used for up to 15 minutes. Expired temporary verification, session and rate-limit records are cleared at server startup or the next authentication request. Blocking cookies can prevent registration and login.
Account information is retained until membership withdrawal. You may request withdrawal, access, correction or deletion at toiu@toiucorp.com. After verifying identity, we delete the account and sessions while separately retaining legally required purchase or dispute records under Section 2. Registration or Google login does not subscribe you to newsletters or advertising.