Privacy Policy

인노드 (the "Company") complies with the Personal Information Protection Act, the Act on Promotion of Information and Communications Network Utilization and Information Protection, and other applicable laws of the Republic of Korea, and establishes and publishes this Privacy Policy to protect users' personal data.

Article 1 (Personal Data Collected)

The Company collects the following personal data to provide the Panohaus service.

1. At registration (required): email address, password (stored as a hash only; the plaintext is never stored), nickname or name, preferred language
2. At social login (required): the unique identifier provided by Kakao or Google, email address, and profile name. If Kakao login does not provide an email address, the user enters one directly.
3. At payment: payment amount, payment method type, authorization result, order number, receipt URL, card issuer, and the last 4 digits of the card number. Full card numbers, expiry dates, CVC codes, and other card details are processed directly by the payment gateway and are never collected or stored by the Company.
4. At business bank-transfer payment: business name, business registration number, representative's name, business address, and the email address for the tax invoice
5. At software license activation: device identifier (a hash of the machine id), PC name, operating system, software version, connecting IP address, and time of the last license check
6. At customer inquiries: email address, the content of the inquiry, and any attachments
7. Generated automatically during use: access logs, IP address, browser information, cookies, and service usage records (downloads, payments, device linking and unlinking, consent records)
8. Marketing (optional): email address, consent status, and time of consent

Article 2 (How Personal Data Is Collected)

The Company collects personal data in the following ways.

1. Entered directly by the user on this website's registration, checkout, bank-transfer request, and support inquiry pages
2. Provided by Kakao or Google, with the user's consent, at social login
3. Transmitted automatically when the Panohaus software communicates with the server for license verification
4. Received from the payment gateway as payment results
5. Generated automatically as logs during use of the service

Article 3 (Purposes of Use)

The Company uses collected personal data only for the following purposes.

1. Account management: identifying members, verifying identity, login, password reset, preventing fraudulent use, and delivering notices
2. License management: granting entitlements according to plan and purchases, activating and deactivating devices, enforcing device limits, and detecting abuse such as license sharing or circumvention
3. Payment and settlement: processing subscription and one-time payments, recurring billing, refunds, issuing receipts and tax invoices, and notifying payment failures
4. Customer support: responding to inquiries, handling disputes, and sending notices and renewal reminders
5. Legal compliance: retaining transaction records and filing taxes as required by the Act on Consumer Protection in Electronic Commerce and other laws
6. Service improvement: analyzing usage statistics and diagnosing errors in a form that does not identify individuals
7. Marketing (with optional consent): sending emails about new features and promotions. Declining does not restrict use of the service, and consent may be withdrawn at any time.

Article 4 (Retention Period)

1. The Company destroys personal data without delay when the user deletes their account or when the purpose of collection has been fulfilled.
2. Where retention is required by law, the Company retains the relevant data for the periods below and does not use it for any other purpose.
   • Records on contracts and withdrawal of offers: 5 years (Act on Consumer Protection in Electronic Commerce)
   • Records on payment and supply of goods or services: 5 years (Act on Consumer Protection in Electronic Commerce)
   • Records on consumer complaints and dispute handling: 3 years (Act on Consumer Protection in Electronic Commerce)
   • Records on labeling and advertising: 6 months (Act on Consumer Protection in Electronic Commerce)
   • Access records (access logs, IP addresses): 3 months (Protection of Communications Secrets Act)
   • Transaction evidence under tax law: 5 years (Framework Act on National Taxes and related laws)
3. When an account is deleted, identifying data such as email address and name is irreversibly masked, the password hash and social identifiers are deleted, and all linked devices are deactivated. Payment records remain linked to the masked account for the periods in paragraph 2.
4. A device that has not contacted the server for 30 days or more is automatically deactivated. Records of deactivated devices are kept for up to 1 year for abuse detection and then destroyed.

Article 5 (Provision to Third Parties)

The Company does not, as a rule, provide users' personal data to third parties. Exceptions are:

1. where the user has separately consented in advance; or
2. where required by law, or where an investigative agency requests it following the procedures and methods prescribed by law.

Article 6 (Outsourcing of Processing)

1. The Company outsources the following processing tasks to provide the service.
   • Payment processing and recurring billing: Toss Payments Co., Ltd.
   • Service servers, database and file storage: Hostinger International Limited
   • Email delivery (verification, receipts, renewal notices): Resend, Inc.
   • Receiving and storing customer support emails: Google LLC (Google Workspace)
2. In each outsourcing contract, the Company specifies compliance with data protection instructions, confidentiality, prohibition of onward transfer, and liability for incidents as required by the Personal Information Protection Act, and supervises the processor.
3. Changes to processors are disclosed through this Policy.

Article 7 (Cross-Border Transfer)

1. To perform the service contract, the Company entrusts and stores personal data outside the Republic of Korea as follows (Personal Information Protection Act, Article 28-8(1)(3)).

2. You may refuse the cross-border transfer. Because this processing is necessary to provide the service, refusing may limit sign-up and use of the service. To refuse, delete your account or write to privacy@panohaus.com.
3. Changes to recipients or countries are announced through this Policy.

Article 8 (Rights of Data Subjects)

1. Users may exercise the following rights at any time.
   • Request access to their personal data
   • Request correction of errors
   • Request deletion or suspension of processing
   • Withdraw optional consent, such as marketing consent
   • Delete their account
2. Email address, name, language, and marketing preference can be changed directly on the settings page of My Account, and account deletion can be requested on the same page. If the user has an active subscription, the Company first guides the user to cancel it.
3. Other requests may be sent to privacy@panohaus.com. The Company acts on the request within 10 days of verifying the user's identity and informs the user of the result.
4. Rights may also be exercised through a legal representative, in which case the Company may request documents proving the authorization.
5. Data that must be retained by law is kept for the required period even if deletion is requested.

Article 9 (Cookies)

1. The Company uses session cookies to keep users logged in and for security. Session cookies are essential to the service; if they are refused, features that require login cannot be used.
2. The Company may use cookies from analytics tools to analyze usage statistics. Analytics cookies are optional, and users may refuse or delete cookies in their browser settings.
3. The Company does not use third-party tracking cookies for advertising.

Article 10 (Security Measures)

The Company takes the following measures to protect personal data.

1. Encryption: passwords are stored with a one-way hash algorithm, device identifiers are hashed, and all network traffic is encrypted with TLS. License tokens are stored only as hashes.
2. Access control: access to systems that process personal data is limited to the minimum number of staff, and administrator access is separately authenticated and logged.
3. Access logging: access records and administrator actions on processing systems are retained and protected against tampering.
4. Technical measures: security headers, rate limiting, input validation, vulnerability checks, and masking of email addresses, card data, and tokens in logs.
5. Internal management: privacy training and an internal management plan.

Article 11 (Children Under 14)

The Company does not accept registrations from children under 14 years of age and does not knowingly collect their personal data. If the Company learns that data of a child under 14 has been collected, it destroys the data without delay.

Article 12 (Privacy Officer)

The Company designates the following privacy officer to oversee personal data processing and to handle complaints and remedies.

• Privacy officer: 정윤창
• Email: privacy@panohaus.com
• Phone: 010-4972-5196

Users who need to report or consult on a privacy violation may also contact the Personal Information Infringement Report Center (privacy.kisa.or.kr, 118), the Personal Information Dispute Mediation Committee (kopico.go.kr, 1833-6972), the Supreme Prosecutors' Office Cyber Investigation Division (1301), or the National Police Agency Cyber Bureau (ecrm.police.go.kr, 182).

Article 13 (Changes to This Policy)

1. When this Policy is added to, deleted from, or amended, the Company posts the change on this website at least 7 days before it takes effect. Changes that materially affect users' rights, such as changes to the data collected or the purposes of use, are announced at least 30 days in advance and also notified by email.
2. This Policy takes effect on October 13, 2026.