Legal
Privacy Policy
Last updated: August 1, 2026 · Effective: August 1, 2026
Overview
InsightWorks (the "Company") complies with the Personal Information Protection Act of Korea, the Act on Promotion of Information and Communications Network Utilization, the Act on Consumer Protection in Electronic Commerce, and other applicable laws. This policy applies to the main site (insightworks.io) and all services operated under it, including VisibleBrand (AI-VIEW) and IdeaVet. The Korean version of this policy is the authoritative text.
1. Purposes of Collection and Use
· Receiving service requests, identity confirmation, and contract fulfillment · Providing services and delivering outputs (diagnoses, reports, deliverables) · Payment, refund, settlement, and electronic receipt issuance · Responding to inquiries, complaints, and dispute resolution · Service improvement, quality management, and statistical analysis · (With optional consent) Marketing and event information
2. Personal Information We Collect
① Inquiries/applications — Required: name (contact person), email address or phone number / Optional: company or brand name, industry, website URL, service of interest, inquiry details ② Paid service payments — order number, payment amount, payment method, approval date/time, approval number, PG transaction ID, card issuer/type and partial card number (first 6 digits), payer name, payer phone number, email address ③ Automatically collected — IP address, cookies, service usage records, device/browser information, access timestamps We do not store full card numbers, card passwords, CVC codes, or account passwords. Payment authentication data is handled by the payment gateway and is not transmitted to the Company. Payer name and phone number are values entered by the user in the payment window and delivered to the Company as part of the payment result; the Company retains them for contract fulfillment (payment confirmation, refunds, support). These items are processed without separate consent under Article 15(1)4 of the Personal Information Protection Act (contract performance) and are disclosed separately from items processed with consent (Article 22(3)). We do not collect resident registration numbers as a rule.
3. Collection Methods
· Direct input via website, application forms, and consultation forms · Payment information received via payment gateways (PG) · Automatic generation and collection during service use
4. Retention and Use Period
We destroy personal information without delay once the purpose of collection is fulfilled, except where retention is required by law, in which case the information is stored separately from other personal information (Article 21(3)): · Records on contracts or withdrawal of offers (orders, payments, refund requests, payer name/contact/email) — 5 years (E-Commerce Act, Enforcement Decree Art. 6(1)2) · Records on payment and supply of goods (payment method, approval number, date, amount, card issuer) — 5 years (Art. 6(1)3) · Records on consumer complaints or dispute resolution — 3 years (Art. 6(1)4) · Records on display/advertising — 6 months (Art. 6(1)1) · Access logs and communication records — 3 months (Protection of Communications Secrets Act) · Consultation/inquiry records not leading to a contract — 1 year (internal policy) · Marketing consent records — until consent is withdrawn Information subject to statutory retention cannot be deleted before the retention period expires, even upon user request (E-Commerce Act Art. 6(2); PIPA Art. 21(1) proviso). It is not used for any purpose other than retention.
5. Provision to Third Parties
① We do not provide personal information to third parties beyond the purposes in Section 1. ② Exceptions apply where the user has given separate prior consent, or where required by law or legal proceedings such as investigations or trials. ③ Where third-party provision becomes necessary, we notify the recipient, purpose, items, and retention period in advance and obtain consent.
6. Outsourcing of Processing
We outsource the following processing tasks and supervise the processors in accordance with Article 26 of PIPA: · PortOne Korea / KG INICIS and other payment gateways — payment processing, approval/cancellation/refund handling (order/payment info, payer name/contact, email) · Supabase Inc. — database operation and storage (service data in general) · Railway Corp. / Cloudflare, Inc. — hosting and transmission security (connection/transmission data) · Google LLC — email delivery, operational data management (email address, inquiry details) · Anthropic, PBC and other AI processors — automated generation of diagnoses and reports (minimum items required) Processors are limited to those actually in use; changes are disclosed through this policy.
7. Overseas Transfer
Under Article 28-8(1)3(a) of PIPA, we transfer personal information overseas for processing and storage necessary for contract fulfillment, disclosed as follows: · Supabase Inc. — Australia / service, order, and consultation data / database operation / until outsourcing contract ends or service use stops · Railway Corp. / Cloudflare, Inc. — USA / connection and transmission data / hosting and security / until contract ends · Google LLC — USA / email address, inquiry details / mail delivery and data management / until contract ends · Anthropic, PBC — USA / minimum items for output generation / automated report generation / until processing completes Timing and method: transmitted over the network as needed during service use, payment, and diagnosis. Refusal: you may refuse overseas transfer by emailing [email protected]. As these transfers are essential to service delivery and payment processing, refusal may limit your use of the services.
8. Cookies
① We may use cookies for service delivery, convenience, and statistics. ② We use essential cookies only; tracking or advertising cookies are not used without separate notice and consent. ③ You may refuse cookies via browser settings (Settings > Privacy and Security), which may limit some features.
9. Destruction of Personal Information
① Personal information is destroyed without delay once the retention period expires or the purpose is fulfilled. ② Electronic files are deleted irreversibly; paper documents are shredded or incinerated. ③ Information retained under statutory obligations (Section 4) is stored separately, with the legal basis and items as listed in that section.
10. Your Rights and How to Exercise Them
① Users (and legal representatives) may request access, correction, deletion, suspension of processing, or withdrawal of consent at any time. ② Requests can be made by email ([email protected]) or phone (+82-70-8027-2881) and are handled without delay. Information under statutory retention (Section 4) cannot be deleted within the retention period. ③ For reports or counseling on privacy infringement: KISA Privacy Center (privacy.kisa.or.kr / 118), Personal Information Dispute Mediation Committee (kopico.go.kr / 1833-6972).
11. Security Measures
· Minimized account access rights, password and two-factor authentication management · Minimized identification risk (ID numbers, minimal collection of real names/sensitive data) · Transmission encryption and storage/device security management · HMAC-SHA256 signature verification for payment webhooks · Contractual safeguards with external processors · Access log retention and abnormal access monitoring
12. Chief Privacy Officer
Name/Title: Jusung Hong / CEO · Chief Privacy Officer Phone: +82-70-8027-2881 Email: [email protected].
13. Notification of Changes
· Changes to this policy are announced on the website before taking effect. · Material changes (collected items, purposes, third-party provision, retention periods) are notified separately before the effective date, with re-consent obtained where necessary.
Business Information
Company: InsightWorks · Representative: Jusung Hong Business Registration No.: 774-68-00611 · E-Commerce Registration No.: 2026-Seoul Gangseo-1382 Address: 706, Hanil Novellia Tower, 10 Magokjungang 1-ro, Gangseo-gu, Seoul, Korea Tel: +82-70-8027-2881 · Email: [email protected]