FOLIROOM · Privacy information

Privacy policy

1. Whose information do we process, and why?

Foliroom processes information about account users, production contacts, people making inquiries or rights reports, and visitors to public pages, as needed to provide and protect the service. We verify applicable legal grounds, including contract formation and performance, and explain purposes and data categories before any processing requiring separate consent. Agreement to the terms is not consent to all personal data processing.

• Account verification and sign-in: Email address, account identifier, registration time, code verification values, attempt counts and expiry times, and session verification values and expiry times. These support email verification, signed-in sessions and misuse prevention.
• Production, publication and management: Website address, source and requested languages, plan selection, requests and edits, attached images, created pages, and approval, publication and withdrawal records. Personal information such as contact details is limited to what is needed.
• Service emails and inquiries: Sender and recipient addresses, subjects and bodies, and delivery, receipt and bounce records. These are used for account verification, production updates, support and incident response.
• Rights reports and disputes: Reporter contact details, affected URLs, minimum evidence of rights and authorization, and reports, actions and objections. We ask people not to submit unnecessary ID copies or national identity numbers.
• Security and access: Rate-limit identifiers, administrative activity and server/CDN access information may be processed. Actual fields, such as IP address, time, request path and browser information, and log retention periods will be finalized after checking operational settings.

If you submit other people’s personal information, you need a lawful basis for having Foliroom process, translate and publish it. Public names, faces, reviews and contact details can still be personal information. Do not submit unnecessary customer lists, payment information, sensitive data or unique identifiers.

2. How long do we keep information, and how is it deleted?

Our principle is to delete information without delay when its purpose is fulfilled or a lawful deletion request is verified, except where retention is required by law. Legally retained records are separated by basis, category and duration and are not used for other purposes. Dispute records are not retained indefinitely beyond what is necessary.

• Verification codes currently expire after 10 minutes and sign-in sessions after at most 30 days. Successful verification deletes that code’s verification record. These validity periods are not the retention periods for all personal information.
• Expired verification, session and rate-limit records are subject to cleanup. Final deletion timing, including cleanup frequency and execution, will be checked against operational settings.
• Specific retention periods and starting points for account, request, version, approval, email, inquiry, report and security records will be finalized and announced before formal adoption.
• Where e-commerce laws require retention of transaction records, statutory periods apply to records actually created. We do not state that payment information is collected or stored when it is not.

Electronic files are deleted in a way that makes recovery difficult; paper records, if any, are shredded or otherwise appropriately destroyed. We also check the scope and timing of deletion for backups, image objects and email-provider copies. Account closure, unpublishing and stored-data deletion are separate procedures; we confirm which you request.

3. Public pages, search and CDN delivery

Approved pages and public images receive separate public URLs accessible worldwide. Search engines may index them and external services may copy or quote them, so check for personal information before approval. Access to drafts and private previews is restricted.

When unpublishing, we take necessary action on servers and CDNs we manage, including access restrictions and cache invalidation. Browser-saved files, external indexes and third-party copies may need separate deletion requests. We explain the distinction between our systems and external services.

4. Processors and external services

We use the external providers below. The formal policy will specify their exact contractual names, tasks, subprocessors and safeguards based on actual contracts and settings. Linking to a provider’s general privacy information does not replace Foliroom’s disclosure duties.

• Amazon Web Services: Application, database and file storage, and CDN delivery. We distinguish Seoul-region storage from worldwide CDN delivery. Contracting entity, support access and detailed retention/deletion terms are under review.
• Resend(Plus Five Five, Inc.): Verification and service email delivery, inquiry receipt and processing webhooks. Data includes sender/recipient addresses, subjects, bodies and delivery records. The provider identifies the United States as its primary processing region.
• Google support mailbox: An operational mailbox used for forwarding inquiries and customer support. Forwarded sender addresses, subjects and bodies, account contract type, processing countries and retention periods must be checked and finalized.
• Google Analytics(Google LLC): Visitor analytics for public foliroom.com pages. Data includes analytics cookie identifiers, pages visited, referral sources, browser/device information and approximate IP-based location. We accepted GDPR data-processing terms when creating the account and set event/user retention to 14 months. Aggregated reports remain beyond that period; Google’s actual processing countries are under review. See section 7 for details and opt-out options.

We provide personal information only as needed for outsourced tasks and protect and manage it under applicable law. We also check required consent, notices and controls for subprocessors. We do not currently offer a feature that automatically sends customer content to an external AI translation service at Foliroom’s discretion. Any separate introduction will be accompanied by updated information about its scope and legal basis.

5. International transfers under review

Overseas email processing and CDN operation require assessment of international personal data transfers. Using a domestic server does not mean all information stays in Korea. We must verify lawful grounds for each activity and carry out applicable prior notice or separate consent procedures.

• Recipient’s exact name and contact details
• Data categories, countries, timing and method of transfer
• Purpose and retention/use period
• Legal basis, refusal method and procedure, and consequences of refusal

We are finalizing these items against each provider’s contracts and account settings. A provider appearing on Resend’s subprocessor list does not by itself mean every customer’s information is transferred to it; we check processing relevant to our usage. Contact hello@foliroom.com with questions. We explain which features are affected by refusal instead of stating that refusing a transfer automatically prevents all service use.

6. Third-party disclosure and other purposes

We distinguish outsourcing, customer-approved publication and legally required disclosure. Any separate third-party provision or new purpose requires checking legal grounds and obtaining necessary notices and consent. Permission to use customer content for advertising, portfolios, AI training or other purposes outside service delivery is not bundled into agreement to the terms.

7. Cookies and safeguards

We use essential session cookies to keep you signed in. You can block or delete cookies in your browser, but sign-in may be affected. Verification/service emails are separate from marketing consent.

Separately, we use Google Analytics 4 on public pages such as our introduction, pricing and blog to understand which pages are read and how visitors arrive, and improve our information and service. This processes analytics cookies, visited URLs, referral sources, browser/device types and approximate IP-based location. We do not send signed-in account details or application form content to Google Analytics.

Google-account advertising signals, ad-personalization signals and sharing measurement data with Google advertising products are disabled. To opt out, block cookies in your browser or install Google’s Google Analytics Opt-out Browser Add-on. Opting out does not affect your use of the service. We do not add this analytics tool to customer-approved public pages (pages.foliroom.com).

We apply safeguards including access controls, encrypted communication, sign-in and approval checks, hashed authentication values, private-file access restrictions and security records. Operational reviews and incident response follow separate management procedures.

For service outreach emails, we record delivery status, tracking image requests, link clicks and visits to linked pages per email. These records help assess outreach and prevent duplicate messages. Automatic image loading and security scans may differ from actual reading. Per-email identifiers are not sent to Google Analytics. Use the unsubscribe link at the bottom of the email to stop further outreach.

8. Access, correction, deletion and restriction requests

You or your authorized representative may email hello@foliroom.com to request access, correction, deletion, restriction of processing or withdrawal of consent. We request only minimum identity evidence and follow statutory procedures and deadlines. If a request must be restricted or some information retained, we explain the basis and how to object.

If your personal information is public on a customer page, use our Rights reporting guidanceto request removal or deletion. Our contract with a customer does not override your statutory data-subject rights.

9. Contacts, remedies and policy changes

Privacy inquiries: hello@foliroom.com. The controller’s legal name and address, privacy officer and responsible department will be finalized before formal adoption.

For privacy advice and reports, contact the Personal Information Infringement Report Center; for mediation, contact the Personal Information Dispute Mediation Committee. We announce policy changes and effective dates, and obtain new consent separately when required.