Upside (upside.kr, the "Company") complies with applicable law, including the Personal Information Protection Act and the Act on Promotion of Information and Communications Network Utilization and Information Protection, and publishes this Privacy Policy to handle users' personal information safely. This Policy applies to "LT's Email Workshop" (with.lt, the "Service") operated by the Company.
This English text is provided for convenience. If it differs from the Korean version, the Korean version prevails.
- Guests can use the Service without entering any personal information. Temporary mail and addresses are deleted after 60 minutes by default.
- Members provide an email address, name and an encrypted password, and with social login we receive what that account provides.
- We do not store payment method details. They are handled by our payment provider PayApp.
- We keep access records (IP address and the like) for 3 months and payment records for 5 years.
- For privacy inquiries write to privacy@lt.al, and to report abuse write to abuse@lt.al.
Article 1 (Personal information collected and purposes of use)
The Company collects only the minimum personal information needed to provide the Service.
| Category | Items collected | Purpose |
|---|---|---|
| Sign-up | Email address, name (first/last), password (stored encrypted) | Identifying members, verification, preventing fraudulent use, notices and guidance |
| Social login | Email address, name and profile image provided by the social account | Easy sign-up and login |
| Paid service payments | The Company does not collect payment method details; PayApp processes them. The Company records the mobile number you enter at payment, the transaction ID, product, amount, payment time and subscription status. The mobile number is deleted when you delete your account. | Opening the payment window, payment processing, subscription management, texting a notice when your paid period ends, refunds, dispute handling |
| Generated automatically while using the Service | IP address, cookies, access logs, usage records, device and browser information | Providing the Service, security and abuse prevention, usage statistics and improvement |
| Service data | Temporary email addresses, received emails and attachments, favorite messages, forwarding settings | Core features such as receiving, displaying and forwarding mail |
| Inquiries | Name, email address, message | Responding to and handling inquiries |
- The Company does not collect sensitive information such as ideology, beliefs, trade union or political party membership, political views, health or sex life.
- Free users may see ads from third-party ad networks, which use information that does not directly identify an individual.
Article 2 (Processing and retention periods)
The Company destroys information without delay once the purpose of collection and use has been achieved. Retention periods by item are as follows.
| Information | Retention period |
|---|---|
| Temporary email addresses, received mail and attachments (guests, free) | Deleted after 60 minutes by default (until the extended time if extended) |
| Received mail of paid email addresses, favorite messages | Until the user deletes them or closes the account |
| Member account information | Destroyed without delay when the member leaves |
| Payment records | 5 years, under the Act on Consumer Protection in Electronic Commerce |
| Access records (IP address, access logs and the like) | 3 months, under the Protection of Communications Secrets Act |
| Inquiry records | Kept for the period needed after handling, then destroyed |
Information past its retention period is destroyed in a way that cannot be recovered. Information that must be retained under law is stored separately for that period.
Article 3 (Provision to third parties)
In principle, the Company does not provide users' personal information to outside parties. The following are exceptions.
- When the user has given prior consent
- When required by law, or when an investigative agency requests it for investigation in accordance with the procedures and methods set by law
- When provided for statistics, academic research or market research in a form that does not identify a specific individual
Article 4 (Entrustment of processing)
The Company entrusts processing as follows to provide the Service smoothly.
| Processor | Entrusted tasks | Retention period |
|---|---|---|
| UDID Inc. (PayApp) | Subscription and email rental payments, refund processing | According to the PayApp Privacy Policy |
If entrusted tasks are added or changed, we will notify you promptly through this Policy.
Article 5 (Rights of data subjects and how to exercise them)
You may exercise the following rights at any time.
- Request access to personal information
- Request correction of errors
- Request deletion
- Request suspension of processing
You can view and edit your information on the Settings page of the Service. For account deletion and other requests, email the Chief Privacy Officer in Article 10. We will act within the period set by law.
Article 6 (Destruction procedures and methods)
- Procedure: Information whose retention period has passed or whose purpose has been achieved is destroyed without delay in accordance with internal policy and applicable law.
- Method: Information stored as electronic files is deleted using technical methods that make it impossible to restore.
Article 7 (Cookies)
- Purposes:
- Maintaining login sessions and authentication status, and identifying the temporary address you are currently using
- Saving preferences such as dark mode
- Serving third-party ads (for example, Google AdSense) and analyzing ad performance (free users)
- Settings and refusal: You can allow cookies, be asked each time one is saved, or refuse all through your web browser settings.
- Chrome: Settings > Privacy and security > Cookies and other site data
- Safari: Preferences > Privacy
- Firefox: Settings > Privacy & Security
Article 8 (Security measures)
The Company takes the following measures so that personal information is not lost, stolen, leaked, altered or damaged.
- Technical measures: SSL/TLS encrypted communication, passwords stored with one-way encryption (bcrypt), access control and firewalls, and payment information that is not stored on our servers but processed by our payment provider (PayApp)
- Administrative measures: Minimizing the staff who handle personal information, and establishing and carrying out an internal management plan
Article 9 (Handling of received email)
- Mail and attachments that arrive at a temporary address are processed only to display and forward them to you, and are deleted after the retention period.
- Received mail may contain personal information of you or third parties, so we advise against receiving important personal or authentication information at a temporary address.
- The Company may check or delete mail content to the extent necessary when it receives an abuse report, when a violation of the Terms is evident, or when required by law.
Article 10 (Chief Privacy Officer and contact)
The Company designates a privacy department, as below, to oversee personal information processing and handle complaints and remedies.
- Contact person: Privacy Department
- Phone: +82 2-6404-4144
- Email: privacy@lt.al
Please send all privacy-related inquiries, complaints and remedy requests to the contacts above. We will respond promptly and fully.
Article 11 (Remedies for infringement of rights)
If you need to report or consult about an infringement of personal information, you may contact the following organizations.
- Personal Information Infringement Report Center (privacy.kisa.or.kr / dial 118 without an area code, within Korea)
- Personal Information Dispute Mediation Committee (www.kopico.go.kr / 1833-6972)
- Supreme Prosecutors' Office Cyber Crime Investigation Division (www.spo.go.kr / dial 1301 without an area code, within Korea)
- National Police Agency Cyber Bureau (ecrm.police.go.kr / dial 182 without an area code, within Korea)
Article 12 (Changes to this Policy)
If this Policy changes, we will give notice at least 7 days before the effective date (30 days for significant changes to users' rights) through a notice in the Service or an update to this page.