Privacy Policy

Key Privacy Labels

Article 1 (Purposes of Processing Personal Information)

We process personal information for the following purposes and do not use it for any other purpose. If a purpose of use changes, we will take the necessary measures, such as obtaining separate consent under Article 18 of PIPA.

1. Member registration and management: confirming the intention to register, identification and authentication (email, mobile phone number, social login), account maintenance and management, prevention of fraudulent registration, and various notices and notifications
2. Provision of the VPN service: configuring VPN connections (WireGuard key registration, tunnel IP assignment), server selection and connection management, proxy authentication for the Chrome extension, usage limit management, and responding to service failures
3. Provision of paid services and settlement of fees: subscription payments and automatic renewal, confirming payment results, withdrawals and refunds, plan changes, handling failed payments, and billing business customers
4. Compliance with legal obligations: retaining connection logs and responding to lawful requests for data under the Protection of Communications Secrets Act, and retaining transaction records under the Act on the Consumer Protection in Electronic Commerce (전자상거래법, the “E-Commerce Act”)
5. Service protection and prevention of fraudulent use: checking the country of access, detecting and responding to account takeover, attack traffic and usage policy violations, and security audits
6. App quality management: analyzing the causes of errors (crashes), checking app stability, and analyzing service usage statistics
7. Customer support: receiving and handling inquiries and complaints, informing members of the results, and resolving disputes
8. Operation of the business VPN: managing business customer contracts, inviting and managing members, and operating the admin console and its audit logs
9. Sending advertising information (optional): information about events and offers. We send it only to members who have separately consented.

Article 2 (Items of Personal Information Processed and Legal Bases for Processing)

1. Personal information processed without the data subject’s consent

We process the following personal information without consent to the extent necessary for concluding and performing a contract (Article 15(1)(4) of PIPA), complying with legal obligations (Article 15(1)(2)) and pursuing our legitimate interests that clearly override the rights of the data subject (Article 15(1)(6)).

2. Personal information processed with the data subject’s consent

3. Methods of collecting personal information

• Entered or provided directly by the data subject during sign-up, login, payment and customer inquiries
• Received from social login providers (such as Google, Kakao and Naver), app marketplace operators (Apple, Google) and our payment processor (Stripe) to the extent the data subject has consented or requested
• Automatically generated and collected by the apps, the Chrome extension and servers in the course of service use (connection logs, session information, error information, etc.)
• Entered by a business customer’s administrator when inviting members

4. Information we do not process

• Communication content: the content of web pages visited, the paths and search terms of full URLs, messages, values entered in forms, and files sent or received
• Payment method information such as card numbers (processed directly by Apple, Google and Stripe)
• Unique identification information such as resident registration numbers, sensitive information, and precise device location information such as GPS

We do not process pseudonymized information. If we begin to do so, we will disclose the details in this Policy.

Article 3 (Processing and Retention Periods of Personal Information)

(1) We process and retain personal information within the retention period prescribed by law or the retention period consented to by the data subject, and destroy it without delay when the retention period ends or the purpose of processing has been achieved.

(2) The retention periods for each item are as follows.

(3) Even after a member deletes their account, information that paragraph (2) requires to be retained under law is stored separately from other information for the applicable period and is not used for any purpose other than those prescribed by law.

(4) In accordance with the amended PIPA that took effect on 15 September 2023, we do not operate a system that uniformly destroys or separately stores the personal information of accounts that have not used the service for a certain period (the so-called personal information validity period system). Account information is retained until the member deletes their account, and members may delete their account in the app at any time. We may send security notices to accounts that have not logged in for a long time.

Article 4 (Retention and Provision of Connection Logs)

(1) As a telecommunications business operator, we retain the connection logs described in Article 2 for 93 days under Article 15-2 of the Protection of Communications Secrets Act and Article 41 of its Enforcement Decree, in order to cooperate with requests from investigative agencies and others for communication confirmation data.

(2) Connection logs do not include the content of communications. We do not use connection logs for advertising, user profiling or sale, and use them only for the purposes stated in this Policy, such as responding to requests made under law, protecting the service and investigating fraudulent use.

(3) We provide the minimum data necessary only in response to requests that meet the requirements and procedures prescribed by law, such as a court permit. Details of the items retained and the disclosure procedure are available in the Connection Log Retention Notice.

(4) Because of the statutory retention obligation, connection logs within the retention period cannot be deleted before the period ends, even if the data subject requests deletion.

Article 5 (Procedures and Methods for Destroying Personal Information)

(1) When personal information is no longer needed, such as when the retention period ends or the purpose of processing has been achieved, we destroy it without delay.

(2) Personal information that must be preserved under law is stored by moving it to a separate database or storage space or by separating access rights.

(3) The procedures and methods of destruction are as follows.

1. Destruction procedure: We select personal information for which grounds for destruction have arisen and destroy it under the supervision of the Chief Privacy Officer. Records with a fixed retention period are deleted automatically when the period expires, using the database’s automatic expiry function.
2. Destruction method: Electronic files are permanently deleted in a manner that makes them impossible to recover or reproduce, and paper documents are shredded or incinerated. Information remaining in backup data is also deleted according to the backup retention cycle.

Article 6 (Provision of Personal Information to Third Parties)

(1) We process data subjects’ personal information only within the scope of the purposes in Article 1, and provide it to third parties only in cases falling under Articles 17 and 18 of PIPA, such as with the data subject’s consent or under special provisions of law.

(2) We provide personal information in the following cases.

(3) When a member accepts a business invitation, the information in the first row of the table in paragraph (2) is provided to that business customer, and we notify the member of this on the invitation acceptance screen.

(4) For requests for subscriber information (통신자료) under Article 83 of the Telecommunications Business Act (전기통신사업법), we review the lawfulness and necessity of the request and respond only to the minimum extent necessary.

Article 7 (Outsourcing of Personal Information Processing)

(1) To provide the service smoothly, we outsource (entrust) personal information processing tasks as follows.

(2) When entering into an outsourcing contract, we specify in the contract or other documents, in accordance with Article 26 of PIPA, the prohibition of processing for purposes other than performing the outsourced tasks, technical and managerial safeguards, restrictions on re-outsourcing, management and supervision of the processor, and responsibilities such as compensation for damages, and we supervise whether the processor processes personal information securely.

(3) If a processor or an outsourced task changes, we will disclose the change through this Policy without delay.

Article 8 (Overseas Transfer of Personal Information)

(1) We transfer personal information overseas as follows under Article 28-8(1)(3) of PIPA, for the outsourcing of processing and storage necessary to conclude and perform contracts with data subjects.

(2) Because overseas transfer is essential to providing the service, including operating VPN servers and processing payments, a data subject who does not want their personal information transferred overseas may stop using the service and delete their account. In that case, the service cannot be used. Questions about refusing the transfer can be directed to the Chief Privacy Officer listed in Article 14.

(3) To protect personal information transferred overseas, we take the safeguards prescribed by PIPA, such as encryption in transit, access control and protective measures under our contracts with processors.

Article 9 (Rights and Obligations of Data Subjects and Legal Representatives, and How to Exercise Them)

(1) Data subjects may at any time request access to, correction or deletion of their personal information, suspension of its processing, or withdrawal of consent, and may request the transmission of their personal information where the requirements set out in relevant laws are met.

(2) Rights may be exercised by the following methods. We will act without delay (within 10 days for access requests) and inform you of the result.

1. Account screen in the app: viewing and editing member information, withdrawing consent to receive advertising information, deleting your account
2. Email: privacy@stagevpn.com or the customer center at support@stagevpn.com
3. In writing or by phone: the Chief Privacy Officer or the responsible department listed in Article 14

(3) Rights may also be exercised through a legal representative or a person authorized by the data subject. In this case, a power of attorney in the form set out in the Notice on Personal Information Processing Methods (개인정보 처리 방법에 관한 고시) must be submitted.

(4) We verify that the person making a request is the data subject or a legitimate representative, and may ask for verification through the registered email address or mobile phone number for this purpose.

(5) Deletion of information that other laws require to be retained (such as the transaction records and connection logs in Article 3) cannot be requested before the retention period ends, and access and suspension of processing may be restricted under Article 35(4) and Article 37(2) of PIPA. In such cases, we will inform you of the reasons.

(6) Data subjects must not infringe their own or others’ personal information or provide false information.

Article 10 (Automated Decisions)

We do not currently make decisions, as referred to in Article 37-2 of PIPA, that significantly affect the rights or obligations of data subjects using fully automated systems. Suspension of use because a subscription period has expired or a payment has failed is simply the application of contract terms the member has agreed to. If we begin making automated decisions in the future, we will disclose the criteria, the procedures and how personal information is processed in this Policy, and explain how data subjects can refuse such decisions or request an explanation.

Article 11 (Measures to Ensure the Safety of Personal Information)

We take the following measures in accordance with Article 29 of PIPA and the Standards for Ensuring the Safety of Personal Information (개인정보의 안전성 확보조치 기준).

1. Administrative measures: establishing and implementing an internal management plan, minimizing the number of personal information handlers and training them regularly, and managing and supervising processors
2. Technical measures: granting and managing differentiated access rights to personal information processing systems, access control and retention and review of access logs (for at least the period prescribed by relevant laws), encryption in transit (TLS), one-way encrypted storage of passwords, encrypted storage of app authentication tokens in the device’s secure storage, security updates and vulnerability checks
3. Physical measures: using the physical security systems, such as access control, of the hosting providers that operate the data centers

Article 12 (Installation, Operation and Refusal of Tools That Automatically Collect Personal Information)

(1) We do not set our own cookies on the website or on the browser sign-in page. However, the social login providers used on the sign-in page (such as Google, Kakao and Naver) and Stripe’s payment and billing-management pages may set cookies for authentication, security and payment-fraud prevention. The apps and the Chrome extension use device or browser storage to keep you logged in.

(2) Data subjects can refuse or delete cookies in their browser settings. However, if you refuse cookies from a social login provider or Stripe, you may not be able to use that sign-in method or web payments. The types of cookies and how to refuse them are described in the Cookie Policy.

(3) We do not currently provide personalized advertising based on behavioral information, and we do not allow third parties to collect behavioral information for personalized advertising through our website or apps.

Article 13 (Personal Information of Children Under 14)

We do not accept sign-ups from children under the age of 14 and do not knowingly collect children’s personal information. If we learn that the personal information of a child under 14 has been collected, we will terminate the account and destroy the personal information without delay. Legal representatives should notify us through the contacts in Article 14.

Article 14 (Chief Privacy Officer and Complaint Handling Department)

(1) We designate the Chief Privacy Officer as follows to oversee our processing of personal information and to handle data subjects’ complaints and remedies for damage.

(2) Data subjects may direct any privacy-related inquiries, complaints, requests for remedies, access requests and the like arising from their use of the service to the contacts above, and we will respond and handle them without delay.

Article 15 (Remedies for Infringement of Rights)

To obtain remedies for infringement of their personal information, data subjects may apply for dispute resolution or consultation to the agencies below. These agencies are independent of the Company. Please contact them if you are not satisfied with the result of our own handling or need more detailed help.

Article 16 (Changes to This Privacy Policy)

(1) This Privacy Policy applies from 1 October 2026.

(2) If we change this Policy, we will post the changes and their effective date on the website and in the app at least 7 days before they take effect. For changes that are material to data subjects’ rights, such as adding items collected, changing the purposes of processing or providing information to third parties, we will post notice at least 30 days before they take effect and obtain consent again where necessary.

(3) The content and effective periods of previous versions of this Policy are available in the revision history below.

Revision history