Cestdi Privacy Policy

1. Information collected

a. At sign-up

• Email sign-up: email address, password, name or company name, mobile phone number
• Social login (Google): Google account email, name, profile image, locale (language setting)

b. When requesting a review

• Source code file to be reviewed (ZIP)
• Information derived during analysis, such as file name, file size, and code size

c. At payment

• Depositor name, date and time, and payment amount
• When requesting a tax invoice: copy of business registration certificate, email address for the tax invoice

d. In the course of using the Service

• Service usage records, access logs, IP address
• Consultation message contents, progress history
• Device information (device type, operating system, browser type and version)
• Cookies and session information
• Quote and review report history

e. Customer inquiries

• Name, email address, inquiry contents, attachments

2. Methods of collection

• Entered directly by the user at sign-up, while using the Service, or when requesting a tax invoice
• Provided by a third-party identity provider when using social login such as Google
• Generated and collected automatically while the Service is used
• Provided voluntarily by the user through customer inquiries, events, etc.

3. Sensitive information and unique identifiers

The Company does not collect sensitive information or unique identifiers such as resident registration numbers or passport numbers. Business registration numbers are used only for issuing tax invoices.

4. Children under 14

The Company does not accept sign-ups from children under the age of 14 and does not collect their personal information.

The Company uses the personal information it collects for the following purposes.

1. Confirming intent to sign up, identifying members, and preventing misuse
2. Verifying identity for the provision and use of the Service, and preventing unlawful or fraudulent use
3. Analyzing submitted code, producing quotes, performing reviews, and delivering reports
4. Confirming deposits, processing refunds, and issuing tax invoices
5. Delivering notices, responding to consultations and inquiries, handling complaints, and keeping records for dispute resolution
6. Analyzing usage statistics, improving the Service, and developing new services
7. Complying with legal obligations and verifying compliance with the Terms of Service
8. (With optional consent) Providing marketing information such as new services, events, and promotions. Users may withdraw consent at any time through settings within the Service or by contacting customer support.

① The Company retains and uses personal information for the period the Service is provided from the date of sign-up, and destroys it without delay upon a withdrawal request or once the purpose of collection and use has been achieved.

② However, information that must be retained under applicable laws is kept for the required period.

③ Quotes, review reports, and consultation records created while using the Service are kept until the member withdraws and are deleted upon withdrawal.

① In principle, the Company does not provide users’ personal information to outside parties, except in the following cases.

1. Where the user has given prior consent
2. Where required by law, or where an investigative agency requests it for investigative purposes in accordance with the procedures and methods prescribed by law

② The Company does not currently provide users’ personal information to any third party. If such provision becomes necessary in the future, the Company will obtain separate consent from users.

① To provide the Service, the Company outsources the processing of personal information as set out below, part of which takes place outside Korea.

② Cross-border transfers occur to the extent necessary to provide the Service; the time of transfer is the time of use and the method is transmission over a network. Users may refuse cross-border transfers, in which case use of the Service will be restricted.

③ When entering into outsourcing agreements, the Company specifies in writing, in accordance with Article 26 of the Personal Information Protection Act, the prohibition on processing beyond the outsourced purpose, technical and managerial safeguards, restrictions on sub-outsourcing, supervision of the processor, and liability for damages, and supervises whether the processor handles personal information safely.

④ When a processor is added, changed, or removed, the Company updates and publishes this Policy, and for changes that materially affect users’ rights, provides separate notice by email.

① When personal information becomes unnecessary, such as upon expiry of the retention period or achievement of the processing purpose, the Company destroys it without delay.

② The procedures and methods of destruction are as follows.

a. Procedure

After the purpose is achieved, information entered by the user is moved to a separate database and stored for a certain period in accordance with internal policy and applicable laws, or destroyed immediately. Information moved to that database is not used for any other purpose unless required by law.

b. Method

• Electronic files: permanently deleted using technical methods that prevent the records from being recovered
• Printed documents: shredded or incinerated

① Users and their legal representatives may exercise the following rights against the Company at any time.

1. Request access to personal information
2. Request correction or deletion of personal information
3. Request suspension of processing
4. Request withdrawal of membership and deletion of personal information

② Rights under paragraph 1 may be exercised by emailing the Privacy Officer designated in Article 10, and the Company will act within the period prescribed by law (within 10 days).

③ Where a user requests correction of an error in their personal information, the Company will not use or provide that information until the correction is completed.

① The Company uses cookies only to keep users logged in and to store language settings. It does not use cookies or external analytics tools for advertising, behavioral analysis, or personalized content.

② A cookie is a small piece of information sent by a website server to the user’s browser, which may be stored on the user’s computer.

③ Cookies are used for the following purposes.

1. Maintaining login status and identifying the user
2. Storing language settings

④ Users may refuse or delete cookies through their browser settings. However, refusing the authentication session cookie prevents login from being maintained and restricts use of the Service.

⑤ How to refuse cookies

• Chrome: Settings → Privacy and security → Cookies and other site data
• Safari: Preferences → Privacy → Cookies and website data
• Edge: Settings → Cookies and site permissions → Manage and delete cookies and site data

The Company takes the following measures to secure personal information.

1. Managerial: limiting access to personal information to operators, and establishing and implementing an internal management plan
2. Technical: one-way encryption of passwords, TLS encryption in transit, storage of uploaded files in a private bucket with access restricted via signed URLs, and administrator access control
3. Physical: personal information is stored in the data centers of the cloud provider (Supabase), and physical access control follows that provider’s security policy

① The Company designates the following Privacy Officer to take overall responsibility for the processing of personal information and to handle users’ complaints and remedies relating to it.

▶ Privacy Officer

• Name: Minpyo Song
• Title: CEO
• Email: cestdi09@gmail.com

② Users may direct all inquiries, complaints, and requests for remedies concerning personal information arising from use of the Service to the Privacy Officer, and the Company will respond and act without delay.

Users may contact the following organizations for remedies or counseling regarding infringement of personal information.

1. Personal Information Dispute Mediation Committee: 1833-6972 / www.kopico.go.kr
2. Personal Information Infringement Report Center: 118 / privacy.kisa.or.kr
3. Supreme Prosecutors’ Office Cybercrime Investigation Unit: 1301 / www.spo.go.kr
4. National Police Agency Cyber Bureau: 182 / ecrm.cyber.go.kr

① This Policy applies from its effective date. Additions, deletions, or corrections made under applicable laws or Company policy will be announced through notices within the Service at least 7 days before they take effect.

② Changes that materially affect users’ rights, such as those concerning collection and use, provision to third parties, or outsourcing, will be announced at least 30 days before they take effect, and the Company may seek renewed consent from users where necessary.