Privacy Policy

The Company (Divine Company; Business Registration No. 572-19-01127; address: 713 Bugaksan-ro, Bldg. 3, Rm. 307, Seongbuk-gu, Seoul, Republic of Korea) acts as the data controller for the personal information of users who sign up for the Service and is responsible for its processing. For the representative, telephone number, email and other specific business details, please refer to the business information the Company publishes within the Service. With respect to visitor personal information collected through the Company's behavioral-analytics tool (collector) that a user installs on the user's own website or service, the user (tenant) is the data controller, and the Company acts solely as a processor handling such data on the user's instructions. In that case, the primary responsibility for providing a privacy notice to visitors and for responding to data-subject requests lies with the user.

The Company processes the following personal information to provide the Service. (1) Membership sign-up information: name or contact person's name, ID, password (stored encrypted), email, mobile number, and business details of the affiliated entity (trade name, business registration number, etc.). (2) Payment information: identifiers of the payment method used for recurring subscription billing, and authorization/transaction records handled by the payment gateway (sensitive payment data such as full card numbers is processed by the payment gateway and, as a rule, is not retained by the Company). (3) Service usage records: access logs, IP address, device/browser information, and in-service activity history. (4) Visitor behavioral data: page views, clicks, events and similar behavioral data collected through the collector installed by users (governed separately under Section 3). The Company does not collect sensitive information beyond the scope permitted by applicable law in the course of providing the Service.

The Service provides functionality to collect and analyze visitor behavioral data (page views, clicks, scrolls, conversion events, approximate access environment, etc.) through a collection script (collector; collection domain t.statlane.kr) that users install on their own websites. The data controller for such data is the user (tenant) that installs and operates it, and the Company processes it as a processor in accordance with the user's instructions. Collection of visitor data is premised on a consent gate that the user implements on the user's own website, and collection and use that require consent under applicable law take place only where the visitor's consent has been confirmed. For the session replay feature available on the PREMIUM plan, by default all input fields (including passwords and payment information) and text patterns in the form of card numbers, resident registration numbers, phone numbers, and email addresses are automatically masked at the collector (client) before storage, and this masking is enforced client-side. Other personal information rendered as plain text on the screen is protected only within the scope of the masking selectors and blocked areas that the user designates, and the Company does not additionally re-mask received replay data on the server. Users are therefore responsible for designating masking and blocking selectors for sensitive areas.

The Company processes personal information for the following purposes, each on a corresponding legal basis. (1) Sign-up, identity verification, provision of the Service, and performance of the service agreement: performance of a contract (PIPA Art. 15(1)(iv)). (2) Payment, settlement and refunds for paid plans: performance of a contract and compliance with legal obligations (including the Act on Consumer Protection in Electronic Commerce). (3) Optional processing such as marketing communications and granular analytics or add-on features: the data subject's consent (PIPA Art. 15(1)(i)). (4) Prevention of fraudulent use, security and stable operation: processing necessary to achieve the Company's legitimate interests where those interests manifestly override the rights of the data subject and do not exceed a reasonably related scope (PIPA Art. 15(1)(vi)). (5) Statistical analysis for service improvement: pseudonymized/statistical processing for statistical purposes (PIPA Art. 28-2 and related provisions), carried out in a form that does not identify any specific individual. (6) Compliance with legal obligations and handling of disputes: compliance with legal obligations and the Company's legitimate interests. Where processing is based on consent, the data subject may withdraw consent at any time, and such withdrawal does not affect the lawfulness of processing carried out beforehand.

The Company uses cookies and similar technologies (such as local storage) to keep users logged in, save user preferences, and analyze and improve the quality of the Service. Users may allow or refuse the storage of cookies through their web browser settings; if cookie storage is refused, the use of certain features such as staying logged in may be limited. For details on the types, purposes and retention periods of the cookies and identifiers used by the collector installed on a user's website, and on how visitors can exercise their choices, please refer to the separate Cookie Policy published by the Company.

As a rule, the Company does not provide personal information to third parties without the user's consent, and provides it only where specifically permitted by law or where the data subject has consented. However, to the extent necessary to provide the Service, the Company entrusts processing tasks as follows. (1) Payment processing: payment gateway (PG) providers for billing and settlement of paid plans. (2) Infrastructure operation: cloud providers for data storage and service hosting (domestic region). (3) Generative and analytics features: AI providers for content generation and analytical inference (see Section 7). The Company enters into data-processing agreements with its processors in accordance with applicable law and supervises them with respect to the prohibition of use beyond the entrusted purpose, safety measures, and restrictions on sub-processing. The specific names and locations of the above processors (cloud infrastructure providers, payment gateway providers, and AI inference providers) and the nature of the entrusted work are published as an annex to this Policy (a processor roster incorporated as part of this Policy) and will be confirmed and disclosed at the launch of the commercial Service. Any change to the content of the entrusted tasks or the roster of processors will be disclosed through this Policy without delay.

The Company stores all user and visitor data, including personal information, within a domestic (Republic of Korea) region and does not store or retain personal information overseas. However, to perform certain generative and analytics features (for example, processing analytical queries or handling images uploaded by users), the minimum data necessary to achieve the processing purpose is transiently transmitted to and computed by a generative-AI inference provider located in the United States, after which it is discarded upon return of the result. This is a cross-border transfer of entrusted processing and storage necessary to perform the contract and to enhance the convenience of data subjects under Article 28-8(1)3 of the Personal Information Protection Act, carried out without separate consent of data subjects by disclosing the matters in each item of Article 28-8(2) in this Policy. Pursuant to Article 28-8(2), the Company discloses the following. (i) Categories of personal information transferred: the minimum data necessary to perform the feature, such as data contained in the analytical query requested by the user, samples of visitor comments/text, and images uploaded by the user. (ii) Destination country, timing, and method of transfer: to the United States, at the time the relevant AI feature is invoked, transiently over an encrypted channel in a manner that does not involve storage. (iii) Transferee: a generative-AI inference provider located in the United States. The transferee's specific legal name and contact details will be confirmed at the launch of the commercial Service and published and disclosed as an annex to this Policy (a data-processing disclosure incorporated as part of this Policy). (iv) Purpose of use and retention/use period of the transferee: limited to performing the generation/analysis inference requested by the user; the data is discarded immediately upon completion of processing and is not separately stored or retained. (v) Method, procedure, and effect of refusing the cross-border transfer: the user may refuse the above transfer by choosing not to use the AI analysis/generation features, in which case use of those AI features is restricted; refusal may be made by not enabling the relevant feature in the Service settings or by request through the contact channel the Company publishes. Until the transferee's legal name and contact details are confirmed and disclosed, the Company does not enable the function of transferring personal information to the United States. In addition, certain stateless computations may be performed in a Japan region during operation of the Service, but only as transient computation that does not involve storage of data.

As a rule, the Company destroys personal information without delay once the purpose of processing has been achieved, and applies the following retention periods. (1) Member account information: until membership withdrawal. Upon withdrawal, account identifiers are irreversibly anonymized (de-identified), and, except for information subject to a statutory retention obligation, destroyed. However, anonymized records for fraud prevention and statistical purposes may be retained in a form that does not identify any individual. (2) Service usage records and event data: 13 months from the date of collection. (3) Session replay data: 3 months from the date of collection. (4) Payment and transaction records: 5 years, in accordance with the Act on Consumer Protection in Electronic Commerce and other applicable laws. Where a law prescribes a different retention period, that period takes precedence. The specific basis for the retention period (TTL) of each data type is available in the data-retention disclosure table the Company provides within the Service.

The Company implements the administrative, technical and physical safeguards required by applicable law to process personal information securely. (1) Administrative measures: minimizing the number of personnel handling personal information, managing and periodically reviewing access privileges, and establishing and implementing an internal management plan. (2) Technical measures: one-way hashing of authentication data such as passwords, encryption of data at rest and in transit, access control and retention of access logs, and operation of intrusion prevention and detection systems. (3) Data minimization and exposure control: for behavioral data such as session replay, by default all input fields and card-number, resident-registration-number, phone, and email patterns are automatically masked client-side, plain-text personal information on the screen is protected within the scope of the masking/blocking selectors the user designates, and data is minimized to what is necessary for the analytical purpose. The Company continuously reviews and improves these measures; however, due to the nature of transmission over the internet, absolute security cannot be guaranteed.

The analytics and estimation features the Company provides within the Service produce aggregated statistics and predictive or estimated metrics to assist users' decision-making; the Company does not, on its own, make individual automated decisions that produce legal or similarly significant effects on data subjects. Segmentation and estimation based on visitor behavioral data are likewise statistical in nature and are not intended to effect automated dispositions regarding any specific individual. Data subjects may, to the extent recognized by applicable law, request an explanation of and object to automated decisions.

The Service is a B2B service intended for business and professional users; it is not directed to children under the age of 14 and does not collect the personal information of children under 14. If the Company becomes aware that the personal information of a child under 14 has been collected without the consent of a legal guardian, it will destroy that information without delay. Where a user operates a service directed to children on the user's own website, the responsibility for complying with laws on children's privacy and obtaining legal-guardian consent lies with that user as the data controller.

The Company has designated a Data Protection Officer as follows to oversee personal-information processing and to handle inquiries and complaints from data subjects. Data Protection Officer: Chanwoo Jang; email: info@statlane.kr; phone: +82 10-2848-8955. Data subjects may direct all privacy-related inquiries, complaints, and requests for remedy arising from use of the Service to the Data Protection Officer, and the Company will respond and act without delay. Where a data subject requires consultation or dispute mediation regarding a privacy infringement, assistance may be sought from the following bodies: the Personal Information Dispute Mediation Committee (www.kopico.go.kr); the Privacy Infringement Report Center and Personal Information Protection Commission counseling (dial 118 without an area code, privacy.kr); and the cyber investigation units of the Supreme Prosecutors' Office and the National Police Agency.

This Privacy Policy may be amended in response to changes in law, the Service, or Company policy. Where the Company amends this Policy, it will provide advance notice, specifying the changes and their effective date, through in-service notices and similar means. For amendments that materially affect data subjects' rights, the Company will give notice at least 30 days in advance as required by applicable law and, where necessary, obtain renewed consent. The amended Policy takes effect on the announced effective date.