Privacy Policy
Effective date: 2025-09-15 · Last updated: 2025-09-15
This Privacy Policy (“Policy”) applies to sproutstudio.app and related apps/services operated by Sprout Studio (“Company”). We primarily follow Korea’s Personal Information Protection Act (PIPA) and, where applicable, provide additional rights under your local law (see addenda for EEA/GDPR and California/CPRA).
Controller
- Controller: Sprout Studio
- Business Reg. No.: 659-55-01058
- Address: B-1126, 50, Seouldaehak-ro 264beon-gil, Siheung-si, Gyeonggi-do, Republic of Korea
- Email: sprout.wonjae@gmail.com
- Privacy Officer: Wonjae Kim / CEO / +82 10-8434-0316
- Deputy: Wonjae Kim / CEO / +82 10-8434-0316
1) What we collect & why
We collect only the minimum personal data necessary to provide the Services. Details and retention are summarized below.
| Category | Purposes | Legal basis | Retention |
|---|---|---|---|
| Account identifiers (email, password hash, nickname) | Account creation/login, license/purchase linkage | Performance of contract; legitimate interests (fraud prevention) | Until account deletion or statutory retention |
| Purchase/payment info (order no., email, license key, amount, history) | Payment, refunds/CS, tax/accounting | Contract; legal obligation (e-commerce/tax) | As required by law |
| Support records (inquiries, selected system logs) | Customer support, incident response, disputes | Legitimate interests (quality/security) | 3 years after resolution |
| Service usage data (device/browser, IP, usage logs, cookies/local storage) | Analytics & quality, security, license verification, anti-abuse | Legitimate interests; consent (optional cookies/marketing) | Until purpose met or ≤24 months |
We do not collect sensitive/unique identifiers by default. If unavoidable, we obtain separate consent as required by law.
2) How we collect
- Direct input during sign-up/purchase/support
- Automatic collection during use (access/usage, device info)
- From partners such as the Merchant of Record/payment provider
3) Provision to third parties
We provide personal data only within the scope permitted by law. If provision involves overseas recipients, Section 5 applies.
4) Processing by entrusted processors
- Vercel, Inc. — Hosting/deployment (logs/incidents)
- Cloudflare, Inc. — CDN, security, performance
- Lemon Squeezy, LLC (MoR) — Payments, license issuance/verification
- [Analytics - optional] — Usage analytics (cookies/SDK)
5) Cross-border transfers
Some data may be transferred overseas for hosting, performance, payment, or support. Lawful bases and required notices/consents are provided in advance.
6) Retention & destruction
- Data are deleted without undue delay when purposes end or periods expire
- If statutes require retention, we store separately for that period
7) Your rights
You may request access, rectification, erasure, restriction, and portability (subject to legal limitations). We respond within statutory periods.
Contact: sprout.wonjae@gmail.com
8) Children
We do not knowingly process data of children under 14; if unavoidable, we obtain guardian consent.
9) Security measures
- Administrative: access control, least privilege, training
- Technical: encryption (TLS/at rest), patching, logging/monitoring
- Physical: facility access controls, document security
11) Domestic representative
If required by law, we will designate and disclose a domestic representative.
12) Automated decision-making
We do not perform solely automated decisions with legal or similar significant effects.
13) Updates
We announce changes at least 7 days prior to effect (30 days for material changes).
Contact
Email: support@sproutstudio.app