naimstory ("the Company") complies with the Personal Information Protection Act and explains below how we collect, use, store, and delete your personal information.
1. Personal information collected
Required items
- Sign up: Name, email, password (stored with one-way encryption)
- Paid transactions: Payment key issued by payment processor, card issuer, last 4 digits of card, payment amount and date
- Automatically collected during service use: IP address, access date, browser and device info, service usage history
Optional items
- Contact info, company/brand name, profile image
- Marketing consent status
When contacting sales
- Name, company, email, contact number, team size, inquiry details
We do not collect or store sensitive payment information such as card number, expiration date, or CVC. This information is handled securely by the payment processor.
2. Purpose of personal information use
- User identification and account management
- Service delivery, project and asset storage, team collaboration features
- Paid service payments, subscription renewals, refunds, tax invoices
- Customer support and dispute resolution
- Statistical analysis for service improvement (processed so individuals cannot be identified)
- Fraud prevention and security incident response
- New feature and event notifications (with consent only)
3. Retention and use period
In principle, personal information is deleted without delay once its purpose is achieved. However, the following information is stored for the period required by law.
| Item | Retention period | Legal basis |
|---|---|---|
| Contract or withdrawal records | 5 years | E-commerce Act |
| Payment and goods supply records | 5 years | E-commerce Act |
| Consumer complaint or dispute records | 3 years | E-commerce Act |
| Electronic financial transaction records | 5 years | Electronic Financial Transactions Act |
| Access logs (login history) | 3 months | Protection of Communications Secrets Act |
| Transaction evidence such as tax invoices | 5 years | Framework Act on National Taxes |
4. Provision of personal information to third parties
We do not provide users' personal information to third parties except in the following cases.
- When the user has given prior consent
- When required by law and requested by investigative agencies through due process
5. Outsourcing of personal information processing
We outsource personal information processing as follows to provide smooth service.
| Outsourced task | Details of outsourcing |
|---|---|
| Payment processing | Paid service payment approval, recurring payments, refund processing |
| Cloud infrastructure | Data storage and server operation for service management |
| Email delivery | Sending verification, notification, and information emails |
| AI model processing | Generate product page text and images (only product brief is sent) |
The specific names of subcontractors will be confirmed and specified in this document when the service launches. The contract will include compliance with privacy instructions, restrictions on subcontracting, and liability for damages.
6. Notice on AI processing
- When using AI features, the product brief and text you enter are sent to the AI model provider. Account information such as your name and email is not sent.
- We do not use your content for AI model training, and our contract with the AI provider restricts use for training purposes.
- If you do not want AI processing, you can use the service with only the block editor and templates, without AI features.
7. Your rights and how to exercise them
- You can view and edit your personal information at any time, and withdraw your consent (delete your account).
- You can view and edit information in Settings > Profile, and delete your account in Settings > Delete account.
- You can also request to view, correct, delete, or restrict processing of your personal data via soomjjak@naver.com. We will notify you of the result within 10 days of your request.
- We do not collect personal information from children under the age of 14.
8. Destruction of personal information
- Electronic files: Permanently deleted using an unrecoverable method
- Paper documents: Shredded or incinerated
- Personal information that has exceeded the retention period is deleted monthly according to our regular destruction procedure. Deleted projects and images are kept in the trash for 30 days before being permanently deleted.
9. Measures to ensure the security of personal information
- Passwords are stored as one-way hashes that cannot be decrypted.
- Data in transit is encrypted using HTTPS.
- Payment identification keys are encrypted and not exposed in responses.
- Access to personal information systems is limited to the minimum number of personnel required for business purposes, and access logs are maintained.
- Data is isolated by workspace so that users cannot access other users’ projects.
10. Use of cookies
We use session cookies to maintain login status and for security (to prevent forgery requests). You can block cookies in your browser settings, but this will prevent you from staying logged in. We do not use third-party tracking cookies for advertising purposes.
11. Personal information protection officer
- Officer
- 김미정
- soomjjak@naver.com
- Reception hours
- Weekdays 10:00 – 18:00
12. Remedies for infringement of rights
If you suffer damage due to a personal information breach, you may request dispute resolution or consultation from the organizations below.
- Personal Information Dispute Mediation Committee (1833-6972)
- Personal Information Infringement Report Center (118)
- Supreme Prosecutors’ Office Cyber Investigation Division (1301)
- National Police Agency Cyber Bureau (182)
13. Changes to this policy
If this policy is changed, we will notify you via service announcements at least 7 days before the effective date. For changes unfavorable to users, we will notify you at least 30 days in advance and provide individual notice electronically.