Privacy Policy

2. Data categories, purposes, and retention

The default retention policy is until account closure. Personal data that becomes unnecessary because its processing purpose has been fulfilled earlier is to be deleted without delay.

Records that must be retained under other applicable laws are to be retained separately for the relevant statutory purposes and periods. This default does not mean that all unnecessary material will be kept until account closure.

The exact statutory records and actual deletion procedures for temporary material, results, and backups must be finalized before publication.

Temporary and retained uploads have different lifecycles. Software defaults alone are not an operational retention commitment, and we do not represent that every file is automatically deleted after the same interval.

The following categories must be checked against actual operations before publication. Not every category is required from every customer.

Membership and authentication

Data: Account identifiers, email addresses, and information needed for authentication.
Purpose: Identity verification and access management.
To finalize: Required fields, authentication records, legal bases, retention exceptions, and deletion procedures.

Service contracts

Data: Customer-to-account links, subscription status, and consent and withdrawal records.
Purpose: Contract performance and permission and consent management.
To finalize: Actual fields and applicable statutory retention requirements.

Customer-selected material

Data: Selected code, documents, logs, paths and other information needed for processing, and analysis results.
Purpose: Source selection, summarization, and supporting evidence.
To finalize: Personal data involved and actual deletion timing for temporary and retained material, results, and backups.

Usage and security records

Data: Request identifiers, usage and cost records, and connection and error records actually collected.
Purpose: Usage administration, security, and incident handling.
To finalize: Actual recorded fields, including whether IP addresses are collected, legal bases, retention periods, and access permissions.

Inquiries and disputes

Data: Contact details and information submitted in support inquiries.
Purpose: Customer support and dispute handling.
To finalize: Intake channels, collected fields, and retention periods.

3. Data processing when Google and Apple sign-in are introduced

Google and Apple sign-in are being prepared. Google sign-in is being designed to process the account’s stable identifier, email address, email verification status, and other information necessary for identification.

The requested scopes are openid and email. This sign-in does not request access to Google Tasks, Gmail, or Drive content.

Before Apple sign-in is introduced, we will confirm and disclose the actual requested and received fields, including the account identifier and email where supplied. A relay email address may be used with Apple’s Hide My Email feature.

Existing account linking is being designed to require identity verification and an explicit linking process, rather than automatically merging accounts because email addresses match.

The actual fields, processing timing, and retention periods must be finalized in this policy and the relevant screens before availability.

Do not send Google or Apple passwords to Prism support.

4. Transfers, processors, third-party disclosures, and international transfers

Server-based processing of authorized material and the use of external AI services may involve different processing locations and recipients. Processing by service providers, disclosure to independent third parties, and international transfers must be assessed separately.

Before publication, identify the actual hosting, authentication, email, AI, and website providers. Disclose the applicable recipient legal entities, tasks, countries, transferred data, purposes, timing, methods, retention periods, and legal bases.

Where consent is required, explain how to refuse and the effect on the service. Do not state that there are no disclosures or international transfers before the actual recipients and conditions are confirmed.

Operational and contractual conditions must be checked so that the use of Google user data and transfers to other apps comply with the Google API Services User Data Policy and applicable Limited Use requirements.

Advertising use and AI training use must also be explicitly addressed before publication, based on actual processor contracts and data flows. This draft does not establish that those contracts or settings have already been verified.

5. Deletion procedures and methods

Personal data that is no longer necessary because of account closure or fulfillment of its processing purpose is to be deleted without delay. Statutory retention obligations are handled separately.

Procedures covering actual customer material, records, and backups must be finalized and verified before publication. Any records retained by law must be identified together with the applicable legal bases and retention periods.

Before publication, confirm the methods used to securely delete electronic records, the deletion schedules for temporary and retained material and backups, and whether paper records exist and how they are destroyed.

Account closure does not mean that every backup or statutorily retained record is deleted immediately. The actual procedures and applicable exceptions must be clearly disclosed.

6. Your rights and how to exercise them

Under applicable law, you may request access to, correction or deletion of, or suspension of processing of your personal data, and you may withdraw consent.

Requests are handled after verifying your identity or the authority of your representative. Where legal restrictions apply, the reasons must be explained.

Account closure, unlinking a sign-in provider, and deletion of records retained under statutory obligations may involve different procedures.

Send privacy rights requests to sales@softmate.kr.

Identity verification methods, handling procedures, response periods, and procedures for authorized representatives must be finalized before publication.

Do not include passwords, verification codes, API keys, or other secrets in your inquiry.

7. Safeguards and automatic collection

Service policies include account-based access controls and authorized file access and masking. The technical, organizational, and physical safeguards actually implemented, storage locations, and access procedures must be confirmed before publication.

We do not promise that all information is encrypted or that a data breach is impossible.

Login sessions and authentication cookies must be assessed separately from analytics or advertising tools added by the website operator.

Before publication, disclose the cookies, connection records, and other automatic collection actually used, together with their purposes, retention periods, refusal methods, and the consequences of refusal.

This Google Sites version uses manual links to switch between Korean and English. Automatic browser-language detection and storage of a language preference are not enabled here.