Privacy Policy

ValueFormer (the "Company") operates the LabelFormer service (the "Service"). In line with the Personal Information Protection Act of Korea and related laws, this policy explains how personal information is processed and how to exercise your rights. The Korean version of this policy is the authoritative one; this English version is a translation.

1. Our role

The Service is a business service for companies (our "Customers"). Each Customer works in its own space in the Service, its "Organization".

1. The accounts of the people who belong to a Customer's Organization ("Users") and the content a Customer enters — label copy, proof images and the like — are processed on behalf of the Customer, for the Customer's purposes. The Customer is the controller of that information; the Company processes it as instructed under its contract with the Customer.
2. Where the Company decides the purpose itself — signing up and running trials, contacting a Customer's representatives, billing and payment, and running and securing the Service — this policy applies directly.

2. Why we process personal information

1. Creating, authenticating and managing accounts: sign-up, invitations, sign-in, password resets, membership of several Organizations
2. Providing the Service: managing label copy and rules, connecting design tools, recording check results, sending change notifications
3. Trials and contracts: recording acceptance of the Terms and this policy, trial reminders
4. Billing and payment: invoicing, taking payments, issuing tax invoices
5. Support: answering enquiries, reviewing issue reports Users send
6. Security: preventing misuse, keeping activity records

3. What we process

Category	Items
Account	Email address, display name, password (stored only in a form that cannot be reversed), language and email notification preferences, Organizations and the role in each
Acceptance	Which versions of the Terms and this policy were accepted, and when
Service records	Activity records (who changed what, and when), label versions and check records, the name of the design file a label was last published from, notifications, sign-in session data
Issue reports (only when a User presses "Report issue")	What the User wrote, the label and design file open at the time, the design-tool add-on's diagnostic log (which can include file names and label copy), add-on and operating-system versions
Billing	Company name, business registration number or foreign tax identification number, country, representative's name, address, billing contact email
Payment	[Payment processor to be named once chosen: the payment details the Company receives from it]
Generated automatically	A session cookie that keeps you signed in

• Label copy, proof images and uploaded fonts are the Customer's content. We never ask for personal information in content; Customers keep unnecessary personal information out of it.
• The design tool's files are never sent to the Service; the add-on sends only label data and an image of each artboard.
• The Service does not store visitors' IP addresses or browser details. IP addresses are processed in transit, in memory only to limit repeated sign-in attempts, and by Cloudflare Turnstile on the forms named in section 7.

4. How long we keep it

Item	Kept for	Basis
Accounts (email address, name etc.)	While the person belongs to an Organization; when an Organization is closed, the details of people who belong to no other Organization are destroyed without delay	Contract
Content and service records	The term of the contract and 30 days after the Organization is closed (to answer requests to return data or resume the service); then destroyed	Contract
Activity records (access records of the processing system; they can include email addresses)	The term of the contract (at least 1 year); destroyed 1 year after the Organization is closed	Standards on securing personal information
Acceptance records	The term of the contract and 5 years after it ends	Proof of the contract
Issue reports	Destroyed without delay once resolved, and within 1 year at most	Support
Billing, payment and tax-invoice records	5 years from the statutory filing deadline of the tax concerned (7 years for offshore transactions)	Framework Act on National Taxes, art. 85-3
Sign-in sessions	Without "Keep me signed in": until the browser closes, after 7 days unused, and 30 days at most. With it, and in the design-tool add-on: until you sign out, change your password or your access ends	Contract

Password-reset links expire after 60 minutes, invitation links after 72 hours.

5. How we destroy it

1. Personal information is destroyed without delay (within 5 days) once its retention period ends or its purpose is achieved.
2. Information other laws require us to keep is stored separately from other personal information.
3. Electronic files are deleted so they cannot be recovered. Backups are kept for 30 days, so deleted information leaves the backups within 30 days.

6. Provision to third parties

We do not provide personal information to third parties, except with the data subject's separate consent or where a law specifically requires it.

7. Processors and transfers abroad

We use the following processors to provide the Service; the work takes place outside Korea. Our contracts with them require personal information to be protected.

Processor	Work	Information transferred	Countries
Cloudflare, Inc. (USA)	Serving the website (labelformer.com) through Cloudflare's network. The dashboard and the API used by the add-on are served from our own servers in Korea, not through Cloudflare	What a visitor sends to or receives from the website in transit: IP address, browser details, a contact form's contents	Cloudflare data centres worldwide, normally the one nearest the visitor
Cloudflare, Inc. (USA)	Checking that a form is sent by a person, not a program (Turnstile): the website's contact form, sign-up, password reset, and sign-in after several wrong passwords	IP address, browser and device characteristics, and how the page was used, while the check runs	Cloudflare data centres worldwide, normally the one nearest the user
Cloudflare, Inc. (USA)	File storage (proof images, fonts, issue-report logs) and database backups (R2)	The files and what they contain; the service data in backups	The storage is set to the Asia-Pacific region. Cloudflare treats this setting as best effort, not a guarantee, so files may be stored in other countries where Cloudflare provides R2 storage
Google LLC (Google Workspace)	Sending email (invitations, password resets, notifications, reminders and invoices)	Recipient's email address and name, the message	The United States and other countries where Google operates data centres
[Payment processor — to be named once chosen]	[Taking card payments]	[To be completed]	[To be completed]

• When and how: over the network, each time the Service is used.
• Contact: Cloudflare — www.cloudflare.com/privacypolicy · Google — policies.google.com/privacy
• How long: until the processing contract ends or the period in section 4 passes.
• Refusing: you may ask the privacy officer (section 11) not to transfer your information abroad. File storage, email and the check on the forms above are needed to provide the Service, so refusing means the Service cannot be used.

The Service's database and application run on the Company's own servers in Korea.

8. Your rights

1. You may at any time ask to see, correct, delete or stop the processing of your personal information.
2. In the Service's settings you can see your account and correct your name, language, email notifications and password.
3. An administrator of your Organization can deactivate your membership, which ends your access to that Organization at once.
4. For anything else — including deleting your account or changing its email address — email the privacy officer (section 11). We act without delay.
5. A representative may act for you with a power of attorney.
6. For information we process on a Customer's behalf (section 1.1), you may ask the Customer; if you ask us, we pass the request to the Customer and act on its instructions.
7. Information a law requires us to keep cannot be deleted on request.

9. How we keep it safe

1. Passwords are stored only in a form that cannot be reversed (argon2id).
2. Data in transit is encrypted (TLS) between your device and our servers, and between your device and Cloudflare for the website.
3. Customers' (Organizations') data is separated at the database level, so no Customer can reach another's information.
4. Access rights are granted per role, at the minimum needed.
5. Activity records are kept, and cannot be edited or deleted through the Service.
6. Data is backed up regularly.

10. Cookies

1. The Service uses only the cookie needed to keep you signed in. No advertising or analytics cookies.
2. The website remembers the language you choose in your browser's storage; it is not sent to us.
3. You can refuse cookies in your browser settings, but you will not be able to sign in.

11. Privacy officer

• Privacy officer: Jiwon Lee (Representative)
• Email: privacy@labelformer.com
• Phone: +82-70-7818-7373

12. Remedies

For reports or advice on privacy infringements you may contact:

• Personal Information Dispute Mediation Committee: 1833-6972 (www.kopico.go.kr)
• Personal Information Infringement Report Center: 118 (privacy.kisa.or.kr)
• Supreme Prosecutors' Office: 1301 (www.spo.go.kr)
• Korean National Police Agency: 182 (ecrm.police.go.kr)

13. Changes

We announce changes on our website at least 7 days before they take effect, or 30 days before for changes that matter to your rights.

Company

ValueFormer · Representative Jiwon Lee · Business registration 184-45-00347 · 801, 8 Baumoe-ro 7-gil, Seocho-gu, Seoul, Republic of Korea · +82-70-7818-7373