Privacy Policy
What personal information we collect and why, how long we keep it, and the rights you can exercise.
General
Core16 Co., Ltd. (the "Company") complies with the Personal Information Protection Act of Korea and related laws. This Policy explains how personal information is processed in the Eventology web service and desktop application (the "Service").
1. Information We Process and Why
| Category | Items | Purpose |
|---|---|---|
| Sign-up and account management | (Required) email, social login account identifier (Google) / (Optional) name, profile image, organization, job title — we do not collect or store passwords | Identifying you, managing your account, checking plan access, sending notices, preventing misuse |
| Paid subscriptions (Starter, Pro, Advanced) | Paddle customer ID, subscription ID, status, plan and billing cycle, next billing date, country (card and other payment details are handled by Paddle and never received by the Company) | Granting plan access, subscription management, refunds and disputes |
| Alerts and reports | Alert email addresses you enter, Microsoft Teams and Slack channel details, webhook URLs, report recipient email addresses | Sending the alerts and scheduled reports you set up |
| Customer inquiries | Email, name, content of the inquiry | Responding to inquiries and handling disputes |
| Collected automatically | IP address, access times, browser and OS type, Service usage records, error logs | Service stability, security and fraud prevention, statistics |
The Company does not collect resident registration numbers or other unique identifiers, or sensitive information. Service content such as market data and event data contains no personal information.
2. Retention Period
The Company destroys personal information without delay when you delete your account or when the purpose of processing has been achieved. However, the following information is retained for the periods required by law.
| Information retained | Legal basis | Period |
|---|---|---|
| Records of contracts and withdrawals of orders | Act on Consumer Protection in Electronic Commerce | 5 years |
| Records of payments and supply of goods/services | Act on Consumer Protection in Electronic Commerce | 5 years |
| Records of consumer complaints and disputes | Act on Consumer Protection in Electronic Commerce | 3 years |
| Records of labelling and advertising | Act on Consumer Protection in Electronic Commerce | 6 months |
| Service access logs | Protection of Communications Secrets Act | 3 months |
3. Provision to Third Parties
The Company does not provide personal information to third parties except as permitted under Articles 17 and 18 of the Personal Information Protection Act, such as with your consent or where specifically required by law.
4. Processors
To provide the Service, the Company entrusts the following processing tasks. Under its contracts with these processors, the Company requires that personal information be handled securely as required by law, and supervises the processors.
| Processor | Task |
|---|---|
| Google LLC (Google Cloud) | Operating the Service servers (API) and infrastructure |
| Supabase, Inc. | Database operation (storing accounts, alert settings, etc.) |
| Supabase, Inc. (Supabase Auth) | Member authentication (sign-in) and storing account information |
| Google LLC (Google Sign-In) | Social login authentication |
| Vercel Inc. | Website hosting and delivery |
Payments are processed by Paddle.com Market Limited ("Paddle.com") as Merchant of Record. Paddle processes payment, billing and tax information as an independent controller under its own privacy policy (paddle.com/legal/privacy). The Company receives from Paddle only what it needs to manage subscriptions (customer ID, subscription status, plan, country).
5. International Transfers
To provide the Service, the Company transfers (stores) personal information outside Korea as follows. Transfers take place over the network whenever you use the Service. You may refuse the transfer, but you will then be unable to use the Service.
| Recipient (contact) | Country | Items transferred | Purpose and retention |
|---|---|---|---|
| Supabase, Inc. (privacy@supabase.io) | United States | Member account (email, social login identifier), subscription status, alert and report settings | Member authentication and database operation / until account deletion or the end of the processing contract |
| Paddle.com Market Limited (Paddle privacy contact) | United Kingdom (including other places where Paddle processes data, such as the United States) | Email and country entered at checkout, Company account identifier (to link the subscription) | Payment, tax, receipt and refund processing / Paddle's statutory retention periods |
| Google LLC (Google Cloud privacy contact) | United States | Request data generated while using the Service, access logs | Server operation / until the end of the processing contract (logs: 3 months) |
| Vercel Inc. (privacy@vercel.com) | United States | Request data and access logs when visiting the website | Website hosting / until the end of the processing contract |
6. Destruction Procedure and Method
- Procedure: personal information whose retention period has expired, or whose purpose has been achieved, is destroyed without delay (within 5 days). Information kept by law is stored separately and destroyed when its period ends.
- Method: electronic files are deleted using technical methods that prevent recovery; printed materials are shredded or incinerated.
7. Your Rights and How to Exercise Them
- You may at any time request access to, correction or deletion of, or suspension of processing of your personal information, and withdraw your consent.
- You can exercise these rights in your account settings in the Service or by emailing the Chief Privacy Officer. The Company will act within 10 days and inform you of the result.
- You may exercise your rights through a representative, who must submit a power of attorney.
- You cannot request deletion of information that the law requires us to retain, and requests to suspend processing may be refused as permitted by law.
8. Security Measures
- Administrative: an internal management plan, minimizing and training staff who handle personal information
- Technical: no passwords stored (social login only), encryption in transit (TLS), database access control (row-level security policies), server credentials kept server-side only, retention of access records and protection against tampering
- Physical: use of certified data centers operated by cloud providers
10. Children Under 14
The Service is not directed at children under 14, and we do not accept sign-ups from them.
11. Chief Privacy Officer
| Item | Details |
|---|---|
| Name / Title | Haejeong Yang / CIO |
| hjyang@coresixteen.com | |
| Phone | +82-70-4225-0201 |
12. Remedies
If you need to report or seek advice on a privacy violation, you can contact the following Korean agencies.
- Personal Information Dispute Mediation Committee: 1833-6972 (www.kopico.go.kr)
- Personal Information Infringement Report Center: 118 (privacy.kisa.or.kr)
- Supreme Prosecutors' Office: 1301 (www.spo.go.kr)
- Korean National Police Agency: 182 (ecrm.police.go.kr)
13. Changes to This Policy
This Policy applies from November 13, 2026. If it changes, we will announce the change on the Service at least 7 days before it takes effect (30 days for material changes).