ShyStella Privacy Policy
ShyStella (the "Company") values users' personal information and strives to comply with the Personal Information Protection Act of the Republic of Korea and global privacy standards (including GDPR and CCPA).
1. Categories of Personal Information Collected
The Company collects the following information during account registration and service use:
- Required: Email address, password (stored in encrypted form), country of residence, service usage records, access logs, cookies, access IP information, and device information
- For paid payments: Card issuer information and payment records (processed through payment service providers; the Company does not directly store card numbers)
- Optional: Nickname and profile image
2. Purposes of Collection and Use
- Confirming intent to register and identifying users
- Providing services and managing virtual goods (HSKZ)
- Preventing violations of laws and these Terms (fraudulent use)
- Handling customer inquiries and delivering notices
3. Retention and Use Period
As a rule, the Company destroys personal information without delay when a user withdraws membership. However, the following information is retained for certain periods in accordance with applicable laws and internal policies.
- Retention under applicable laws (based on Korean law)
- Records regarding contracts or withdrawal of subscriptions: 5 years
- Records regarding payment and supply of goods/services: 5 years
- Records regarding consumer complaints or dispute resolution: 3 years
- Login records (Protection of Communications Secrets Act): 3 months
- Fraud prevention
- Registration information of users who engaged in fraudulent use (e.g., hashed email values): retained for 1 year after withdrawal
4. Outsourcing and Cross-Border Transfer
To provide global services, the Company outsources personal information processing as follows, and accordingly users' personal information may be transferred to the Republic of Korea or third countries (including Japan).
| Entrusted Company | Location (Country) | Entrusted Task (Purpose) | Data Transferred | Timing and Method of Transfer | Retention Period | Contact |
|---|---|---|---|---|---|---|
| Supabase, Inc. | Singapore, United States | Cloud DB operation and data storage | All stored personal information including ID and email | Network transfer during service use | Until account withdrawal or contract termination | privacy@supabase.com |
| Netlify, Inc. | United States (USA) | Website hosting, deployment automation, traffic management, and security (CDN) | Access logs (IP address, browser information), cookies, deployed website data | Network transfer during service access/deployment | Until account withdrawal or outsourcing contract termination | privacy@netlify.com |
5. Users' Rights
Users may at any time access or correct their personal information and request withdrawal of consent for collection/use or account cancellation (membership withdrawal).
- Email inquiry: privacy@shystella.com
6. Use of Cookies
The Company uses cookies to store and retrieve usage information from time to time in order to provide personalized services. Users may refuse cookie storage through browser settings; however, some services requiring login may be difficult to use in such cases.
7. Chief Privacy Officer
The Company designates the following person in charge of personal information protection to oversee related matters, handle complaints, and provide remedies.
- Person in charge: Gyubin Park
- Email: hotaru@shystella.com
8. Prior Notice of Revisions
If this Privacy Policy is added, deleted, or modified, the Company will provide notice through the website's "Notices" section at least 7 days before the revision takes effect.
- Announcement Date: February 12, 2026
- Effective Date: February 12, 2026