Effective date
1. Data controller and scope
RubyOn Studio (operator: Han Seung Sik) processes the personal information needed for shotsuda registration and community services. This policy applies to the shotsuda website, posts, private messages and related management features.
We obtain consent to collect and use required information at registration. Information members later submit themselves is processed as needed to provide the relevant feature, ensure service safety and handle disputes. New purposes or processing requiring separate consent are explained before they apply.
2. Information processed and purposes
- Registration and account management: We process email, nickname, a one-way hash if a password is set, the time and document version of consent to the terms and personal information collection and use, and the time of confirmation of being at least 14. These are used for login, account identification, password resets and consent verification. Date of birth and resident registration numbers are not collected during signup. When you sign up or connect an account with Kakao, we use the login provider, Kakao user ID, and the email and nickname provided by Kakao to identify your account and confirm the login connection. We do not collect your Kakao password.
- Optional profile: Avatar images and file information submitted by members are used to identify authors and provide profiles. Basic features are available without an avatar.
- Product-story activity: We process posts, comments, replies, reactions, favorites, product names, links, descriptions, photos, optional purchase prices and dates, visibility, attachments, and creation or edit times.
- Private messages, notifications and blocking: Senders, recipients, private message content, sending and reading times, notifications and blocking relationships are used to provide these features.
- Reports, management and rights protection: Report subjects and reasons, reasons and outcomes of posting restrictions, content hiding and appeals, management records, inquiries and contact details are used for report review, management accountability and protection of rights.
- Authentication and security: Authentication token hashes, authentication, expiry and revocation times, session cookies and access request information are used to maintain login and prevent abnormal access. Request limits use a hash calculated from a member identifier or access IP. Depending on the environment, servers may retain access and error records including request time and IP. During Kakao login, we temporarily retain the user ID, email, nickname, and the status of authentication, registration and connection. Separate email verification processes verification information for the code, its sending time and the number of attempts. Kakao access tokens are used temporarily to verify user information and are not stored in the database.
Content and attachments written by members may contain personal information. Do not upload other people's information without permission or submit sensitive information the service does not need. Passwords are stored as one-way hashes, not plaintext.
3. Retention and deletion
Account identifiers are used to provide the account from registration until deletion. On deletion, the email and nickname are replaced with anonymous identifiers; passwords, password reset information and persistent login information are invalidated. The avatar and derived images are removed through deletion tasks. Kakao account connections are removed on disconnection or account deletion. The user ID needed to remove the connection at Kakao may be retained until that cleanup is complete. Temporary registration and connection information is cleared periodically after it expires.
Document versions and times of consent to the terms and personal information collection and use, and the time of confirmation of being at least 14, remain in the deleted account record. This verifies the confirmations and consent given at registration; it does not mean the former email and nickname are retained.
Posts, comments, and existing private messages remain after account deletion to preserve context, with the author shown as a deleted member. Personal information members wrote in that content and attachments are not automatically erased. Delete posts and comments you want removed before deleting your account. For your personal information remaining in private messages that cannot be deleted on screen or in content you cannot access, request necessary action through the contact below. Former members can also make requests.
Deleting a post marks the post, its comments and attachments for deletion. Deleting a comment may leave an empty record for the reply structure, but its body and attachments are marked for deletion. Replacing or deleting an avatar also marks its old file and derivatives for deletion. Failed file deletions are retried.
Reports, appeals and management records are kept as needed to handle the matter and disputes; information is deleted or anonymized once its purpose ends. If legal retention duties or ongoing proceedings apply, the information, basis and period are managed separately. Account deletion alone does not mean all management records are published or used for another purpose.
Access and error logs and expired or revoked authentication records are managed as needed to investigate operational and security issues. Records no longer needed are cleared after reviewing member requests and security needs.
If backups are maintained for recovery, access is restricted and they are cleared once their retention purpose ends. Deletions and account withdrawals are also reflected during recovery.
Electronic information is deleted irrecoverably or processed to prevent identification. Printed material, if any, is destroyed appropriately, such as by shredding.
5. Processing service providers and international transfers
Information systems are used for server operation, file storage and password reset emails. If personal information processing is outsourced, we verify the provider, work assigned and necessary safeguards and disclose them in this policy.
If personal information is transferred through overseas servers or providers, required details, including items, country, time and method, recipient, purpose, retention and refusal methods, are separately disclosed and a lawful basis established under applicable laws. Provider or transfer condition changes are reflected in this policy.
To prevent automated signups, we use Cloudflare Turnstile. Cloudflare evaluates signals including the client IP address, TLS fingerprint, browser User-Agent, sitekey and associated origin to detect bots. Details about how this information is processed are available in Cloudflare Turnstile Privacy Addendum.
6. Members' rights and how to exercise them
Members may change email and nickname, delete an avatar, change passwords and delete their accounts in account settings. My posts and comments lets members view their accessible content and edit or delete it within their permissions. Editing may be limited during posting restrictions or read-only status.
Rights under applicable laws, including access, correction, deletion, suspension of processing and withdrawal of consent, may be requested through the email below. Requests are possible after account deletion or without login; we check only minimal materials needed to verify identity and protect others' rights. Representatives may submit materials verifying lawful authorization.
If law provides grounds to limit or defer a request, we explain the reasons and available actions. Stopping processing of information essential to a feature may limit its use.
shotsuda currently does not accept registration from children under 14 or operate a legal guardian consent procedure. If we learn that a child under 14's personal information was processed during registration, we take necessary actions such as restricting registration and deleting information.
8. Safeguards and automated decisions
We apply necessary safeguards including account authentication, permission checks, one-way password hashing, transmission protection, request limits and upload access restrictions. Operational permissions are limited by role, and sensitive inputs are managed to avoid unnecessary retention in operational logs.
Administrators review rule violation reports and posting restrictions or content hiding. Request limits, authentication expiry apply automatically under set conditions. Questions may be sent to the contact below.
9. Responsible person and remedies
The person responsible for personal information protection is Han Seung Sik; the operating entity is RubyOn Studio. Send privacy inquiries and requests to exercise rights to info@rubyon.co.kr.
For external advice or dispute mediation, contact Personal Information Infringement Report Center (118, without an area code in Korea) or Personal Information Dispute Mediation Committee (1833-6972).
10. Changes to the policy
Changes to personal information processing will be announced with details, reasons and the effective date. Separate consent is obtained before applying changes that require it. The effective date of this document appears at the top.
RubyOn Studio · Operator: Han Seung Sik
info@rubyon.co.kr