개인정보처리방침 Privacy Policy

Article 1 (Items and Methods of Personal Information Collection)

(1) The Company collects the following personal information for service provision:

(2) The Company collects personal information through the following methods:

1. Automatic collection during service use with user consent
2. Direct input by users (e.g., setting a nickname)
3. Information received through social account linking (Google Sign-In, Apple Sign-In)
4. Information received through app stores (App Store, Google Play) during in-app purchases
5. Collection through emails and posts during customer inquiries and event participation
6. Provision from partner companies (for advertising performance measurement, etc.)

Article 2 (Purposes of Collection and Use of Personal Information)

The Company uses collected personal information for the following purposes:

1. Service Provision and Operation: Providing game services, account creation and management, identity verification and authentication, game data storage and synchronization, in-app payment processing and purchase history management
2. User Management: Identity verification for service use, prevention of fraudulent use, prevention of unauthorized access, confirmation of registration intent, record keeping for dispute resolution, delivery of notices
3. Service Improvement and Development: Analysis of service usage statistics, development of new services and improvement of existing services, optimization of user experience, bug detection and error correction
4. Marketing and Advertising: Providing event information and participation opportunities, personalized advertising, advertising performance measurement and analysis, service-related announcements and notifications
5. Safe Service Operation: Detection and prevention of hacking, cheating, abusing and other fraudulent activities, account theft prevention, system security maintenance
6. Legal Compliance: Fulfillment of obligations under relevant laws and regulations, response to legal disputes

Article 3 (Retention and Use Period of Personal Information)

(1) The Company destroys personal information without delay once the purpose of collection and use has been achieved. However, if retention is required under relevant laws and regulations, the Company retains personal information for the period prescribed by such laws.

(2) Retention periods under relevant laws and regulations are as follows:

(3) If a user has not used the Service for more than one year, the Company will either destroy or separately store and manage such user's personal information in accordance with Article 39-6 of the Personal Information Protection Act. In such cases, the Company will notify the user in advance.

Article 4 (Destruction Procedures and Methods of Personal Information)

(1) The Company destroys personal information without delay when it becomes unnecessary, such as when the retention period has expired or the processing purpose has been achieved.

(2) If personal information must be retained under other laws despite the expiration of the consented retention period or achievement of the processing purpose, the information is transferred to a separate database (DB) or stored in a different location for retention.

(3) The procedures and methods for destroying personal information are as follows:

1. Destruction Procedure: The Company selects personal information for which destruction reasons have arisen and destroys the personal information with the approval of the Company's Privacy Officer.
2. Destruction Methods:
   • Electronic files: Deleted using technical methods that make records irrecoverable (low-level formatting, overwriting, etc.)
   • Paper documents: Shredded with a paper shredder or incinerated

Article 5 (Provision of Personal Information to Third Parties)

(1) The Company uses users' personal information within the scope specified in Article 2 and does not use it beyond that scope or provide it to third parties without prior consent, in principle.

(2) However, exceptions are made in the following cases:

1. When the user has given prior consent to provision to third parties
2. When required by law, or when requested by an investigative agency in accordance with procedures and methods prescribed by law for investigation purposes
3. When personal information is provided in a form that does not identify specific individuals for the purpose of statistical compilation and academic research
4. When necessary for billing settlements related to service provision

(3) Currently, the Company does not provide users' personal information to third parties. If third-party provision becomes necessary in the future, the Company will notify users of the recipient, purpose, items provided, and retention period in advance and obtain consent.

Article 6 (Entrustment of Personal Information Processing)

(1) The Company entrusts personal information processing to the following entities for smooth service provision:

(2) When entering into entrustment contracts, the Company stipulates necessary matters to ensure the safe management of personal information and supervises whether the entrusted parties process personal information securely.

(3) If the content of entrusted tasks or entrusted parties change, the Company will disclose such changes through this Privacy Policy without delay.

Article 7 (Rights of Users and Legal Representatives and Methods of Exercise)

(1) Users (data subjects) may exercise the following rights related to personal information protection at any time:

1. Request to access personal information
2. Request to correct errors, if any
3. Request for deletion
4. Request to suspend processing

(2) Rights under Paragraph 1 may be exercised by contacting the Company via email (support@layerlab.io), and the Company will take action without delay.

(3) Rights under Paragraph 1 may be exercised through a legal representative or an authorized agent. In such cases, a power of attorney in the form prescribed by the Enforcement Rules of the Personal Information Protection Act must be submitted.

(4) If a user requests correction or deletion of personal information errors, the Company will not use or provide such personal information until the correction or deletion is completed.

(5) For children under the age of 14, legal representatives may request access to, correction/deletion of, or suspension of processing of the child's personal information. The Company obtains consent from legal representatives when collecting personal information of children under 14.

(6) The right to access and request suspension of processing may be restricted pursuant to Article 35(4) and Article 37(2) of the Personal Information Protection Act.

(7) Requests for correction and deletion cannot be made if the personal information is specified as a collection target under other laws and regulations.

Article 8 (Security Measures for Personal Information)

The Company implements the following technical, administrative, and physical measures to ensure the security of personal information in accordance with Article 29 of the Personal Information Protection Act:

1. Administrative Measures: Establishment and implementation of an internal management plan, minimization of personnel handling personal information and regular training, collection of security pledges related to personal information processing
2. Technical Measures: Access control for personal information processing systems, encryption of unique identification information, installation of security programs with regular updates and inspections, technical countermeasures against hacking (firewall installation, intrusion detection system operation, etc.)
3. Physical Measures: Access control for server rooms and data storage rooms, secure storage of documents and auxiliary storage media containing personal information in locked facilities
4. Access Log Retention: Access records to personal information processing systems are retained and managed for at least one year, with security features used to prevent forgery, tampering, theft, or loss of access records
5. Data Transmission Security: When transmitting users' personal information, encrypted transmission using security protocols such as SSL (Secure Socket Layer) is employed

Article 9 (Installation, Operation, and Rejection of Automatic Data Collection Devices)

(1) The Company uses 'cookies' and similar technologies that store and retrieve usage information to provide individualized customized services.

(2) The purposes of using cookies and automatic collection devices are as follows:

1. Analyzing access frequency and visit times to understand service usage patterns
2. Identifying users' areas of interest to provide personalized advertising
3. Improving services through analysis of usage patterns

(3) Users may refuse the collection of cookies and advertising identifiers:

• Advertising Identifier (ADID/IDFA) Opt-out:
  • Android: Settings > Google > Ads > Delete or reset advertising ID
  • iOS: Settings > Privacy & Security > Tracking > Turn off "Allow Apps to Request to Track"
• Firebase Analytics Opt-out: Users can disable data collection in app settings or restrict app permissions in device settings.

(4) Refusing the collection of cookies and advertising identifiers may cause difficulties in using personalized services.

Article 10 (Privacy Officer)

(1) The Company designates a Privacy Officer to oversee personal information processing and handle user complaints and damage relief related to personal information processing:

(2) Users may direct all inquiries, complaints, and damage relief requests related to personal information protection arising from the use of the Service to the Privacy Officer. The Company will respond to and process user inquiries without delay.

Article 11 (Remedies for Infringement of Rights)

Users may contact the following organizations regarding damage relief and consultation for personal information infringement. These organizations are separate from the Company, and users who are not satisfied with the Company's own complaint handling and damage relief results or who need more detailed assistance may contact them:

Furthermore, persons whose rights or interests have been infringed by dispositions or omissions by the head of a public institution regarding requests under Article 35 (Access to Personal Information), Article 36 (Correction/Deletion of Personal Information), or Article 37 (Suspension of Processing of Personal Information) of the Personal Information Protection Act may file administrative appeals as prescribed by the Administrative Appeals Act.

Article 12 (Changes to Privacy Policy)

(1) This Privacy Policy is effective from the enforcement date, and any additions, deletions, or corrections due to changes in laws or policies will be announced through in-service notices or pop-ups at least 7 days before the changes take effect.

(2) In the event of material changes affecting users' rights, notice will be given at least 30 days in advance.

(3) When the Company changes this Privacy Policy, it will display a comparison of the before and after versions so that users can easily identify the changes.