TripleAuth Inc. (the “Company”) adopts this Privacy Policy to comply with the Personal Information Protection Act (「개인정보 보호법」, “PIPA”) and other applicable laws, and to process users’ personal information securely, in providing the Gazua.link service (including gazua.link and its subdomains, the console, and the REST API; the “Service”).
In this Policy, a “Member” means a person who has signed up for the Service and holds an account; a “Customer” means a Member who creates and operates links through the Service, or the business to which that Member belongs; and a “Visitor” means a person who clicks a link created by a Customer or opens a link page.
1. Purposes of Processing
The Company processes personal information for the following purposes and does not use it for any other purpose. If a purpose changes, the Company will take the necessary measures, such as obtaining separate consent under Article 18 of PIPA.
- Member registration and management: confirming the intent to sign up, email verification, identity verification and sign-in, two-step verification, account protection, maintaining and managing membership, and processing account deletion
- Providing the Service: creating and managing workspaces, projects, and links; inviting members and managing permissions; link redirection (app, app store, web); share previews; click analytics; and providing the REST API
- Service security and abuse prevention: detecting and blocking abnormal access and automated attacks, rate limiting, restricting use, investigating security incidents, and handling disputes
- Notices and customer support: sending emails essential to using the Service (such as verification, password reset, and invitations), announcing important changes, and responding to inquiries
- Operating and improving the Service: monitoring service status, responding to outages, and improving quality using usage statistics (in a form that cannot identify individuals)
- Fulfilling legal obligations: retaining records as required by applicable laws, and responding to lawful requests from investigative agencies and other authorized bodies
The Company does not currently send advertising messages. If it does so in the future, it will obtain separate consent as required by the Act on Promotion of Information and Communications Network Utilization and Information Protection (「정보통신망 이용촉진 및 정보보호 등에 관한 법률」).
2. Personal Information We Process
The Company processes only the minimum personal information necessary to provide the Service.
| Category | Items | How collected |
|---|---|---|
| Sign-up (required) | Email address, name (display name), password | Entered by the Member |
| Two-step verification (optional) | Authenticator app registration data (encrypted secret), recovery codes | Generated when the Member sets it up |
| Generated automatically during use | IP address, browser and device information (User-Agent), sign-in time, session information, service activity records (actions created or modified and who performed them), use restriction records, language and display settings | Generated and collected automatically while the Service is used |
| Workspace invitations | Invitee’s email address, inviting Member’s name, workspace name | Entered by the inviting Member |
| API keys | Key name, beginning of the key (for display). The full key is not stored; only a one-way transformed value is kept | Generated when the Member issues the key |
| Link Visitors | Country (country code estimated from the access location), operating system type, in-app browser type (e.g., KakaoTalk), redirect result (app, app store, web), campaign values attached to the link URL (utm_source, utm_medium, utm_campaign, utm_content), time of use | Collected automatically when the link is used |
| Inquiries | Email address, name (if provided), content of the inquiry | Sent by the user by email |
We do not store link Visitors’ raw IP addresses or browser information. IP addresses are used only while a request is being processed, to prevent excessive requests, and click analytics are kept only in a form that cannot identify a specific individual.
Project information (such as app name, app URL, and website URL) and link information (such as link URL, destination URL, values to pass along, and preview title, description, and image) entered by Customers are the Customer’s business information, stored to provide the Service. Customers must not include personal information in this information; details are governed by Section 9.
3. Processing and Retention Periods
The Company processes and retains personal information within the retention period required by law or consented to by the user, and destroys it without delay when that period ends. The retention period for each item is as follows.
| Item | Retention period |
|---|---|
| Member information (email, name, password, two-step verification data) | Until account deletion |
| Sign-in sessions (IP address, browser information) | Until sign-out or session expiry (7 days if unused, 30 days at most) |
| One-time verification values for email verification, password reset, etc. | Expire within 24 hours of issuance |
| Workspace invitation information | While the workspace exists (to manage invitation history) |
| Link click analytics | Up to 3 months after collection |
| Service operation and security logs (request URL, processing result, error information, etc.) | Up to 30 days after collection |
| Inquiry records | 3 years after the inquiry is resolved |
In the following cases, information is retained until the relevant reason ends.
- Where an investigation or inquiry into a violation of applicable laws is in progress: until the investigation or inquiry ends
- Where claims, debts, or disputes arising from use of the Service remain: until settlement or resolution of the dispute
- Members subject to a use restriction (for abuse, etc.): the relevant email address and the reason for the restriction are retained for 1 year after account deletion to prevent abuse through re-registration
Information that must be retained under applicable laws is retained for the required period.
- Protection of Communications Secrets Act (「통신비밀보호법」): communication confirmation data, such as service sign-in records — 3 months
- Act on the Consumer Protection in Electronic Commerce (「전자상거래 등에서의 소비자보호에 관한 법률」): if paid services are provided, records of contracts or withdrawal of offers, and of payment and supply of goods — 5 years; records of consumer complaints and dispute resolution — 3 years
4. Procedure and Method of Destruction
When personal information is no longer needed, such as when its retention period ends or the purpose of processing has been achieved, the Company destroys it without delay.
- Procedure: The Company identifies the personal information for which grounds for destruction have arisen. Information that must be retained under applicable laws is stored separately from other information and destroyed when its retention period ends.
- Method: Electronic files are deleted in a way that makes them unrecoverable, and paper documents are shredded or incinerated.
- Copies that cannot be deleted immediately due to the nature of the system, such as backups, are not used for any other purpose and are kept inaccessible until they are deleted according to the set backup cycle (up to 30 days).
5. Provision to Third Parties
The Company processes users’ personal information only within the scope of the purposes in Section 1 and does not provide it to third parties except in the following cases.
- Where the user has given prior consent
- Where special provisions of law so require, or where it is unavoidable to comply with legal obligations
- Where an investigative agency or other authority requests it in accordance with the procedures and methods prescribed by law
- Where it is urgently necessary to protect the life, body, or property of the user or a third party
- Other cases permitted under Articles 17 and 18 of PIPA
Members of the same workspace can see one another’s names, email addresses, roles, and activity records as part of the Service’s features. This is a Service feature that Members use by joining a workspace and does not constitute provision to a third party.
If the Company transfers the Service to another business through a merger, business transfer, or similar event, it will notify users in advance, under Article 27 of PIPA, of that fact, the recipient’s information, and how to opt out of the transfer.
6. Outsourcing of Processing
To provide the Service smoothly, the Company outsources personal information processing as follows.
| Processor | Outsourced tasks |
|---|---|
| Cloudflare, Inc. | Servers and data storage for operating the Service, sending service emails, and security |
When entering into an outsourcing contract, the Company sets out in the contract or other written document, under Article 26 of PIPA, matters including the prohibition of processing for purposes other than performing the outsourced tasks, technical and administrative safeguards, restrictions on sub-outsourcing, management and supervision of the processor, and liability such as compensation for damages. The Company also supervises whether the processor handles personal information securely.
If the processor or the outsourced tasks change, the Company will disclose this in this Policy without delay.
7. International Transfer of Personal Information
To perform the contract for providing the Service, the Company processes and stores personal information outside Korea through the outsourcing described in Section 6, as follows (Article 28-8(1)3 of PIPA). Users may refuse the international transfer by the method below; however, because all Service features run on this infrastructure, the Service cannot be used in that case.
| Category | Details |
|---|---|
| Recipient and contact | Cloudflare, Inc. (privacy inquiries: privacyquestions@cloudflare.com; privacy policy: https://www.cloudflare.com/privacypolicy/) |
| Destination countries | The United States and the countries where Cloudflare operates data centers (requests may be processed in the data center closest to the user) |
| Time and method of transfer | Transmitted in encrypted form over information and communications networks each time the Service is used |
| Items transferred | Of the items in Section 2: Member information, information generated automatically during use, invitation information, and link Visitor analytics |
| Purpose of use | Performing the outsourced tasks in Section 6 |
| Retention and use period | The retention periods in Section 3, or until the outsourcing contract ends |
| How to refuse and its effect | Send a request by email to the Chief Privacy Officer below (if you refuse, the Service cannot be used) |
To protect personal information transferred abroad, the Company ensures that the processor processes it in accordance with contracts setting out personal information protection obligations, such as the processor’s terms of service and Data Processing Addendum, and also applies the safeguards in Section 12 of this Policy.
9. Link Visitor Information and Customer Responsibilities
- The Company does not store information that can identify Visitors and provides Customers only with click analytics in a form that cannot identify individuals.
- Link URLs, values attached to links, and preview titles, descriptions, and images are public information that anyone who receives the link can see. Customers must not include other people’s personal information or sensitive information in them, and the Customer who entered the information is responsible for it.
- The apps, app stores, and websites that Visitors reach through links are operated by Customers or third parties, and the processing of personal information there is governed by each operator’s policy. Values attached to a link are passed to the destination app or website as configured by the Customer.
- If a Customer separately collects or processes Visitors’ personal information using the Service, the Customer, as the controller of that personal information, must itself fulfill the obligations under applicable laws (such as notice, consent, and security measures).
- A Member who invites others to a workspace must have the legitimate authority to provide the invitee’s email address for the purpose of the invitation.
10. Rights and Obligations of Data Subjects and Legal Representatives, and How to Exercise Them
Users may at any time request the Company to provide access to, correct or delete, or suspend the processing of their personal information, or withdraw their consent.
- You can view and change your name, password, and two-step verification directly in the account settings of the console, and you can delete your account there yourself after verifying your identity with an email confirmation code (and an authenticator app code if two-step verification is on).
- For other requests, you can email the Chief Privacy Officer from your registered email address. The Company will act within 10 days after verifying your identity and notify you of the result.
- Requests may also be made through a legal representative or an authorized agent. In that case, documents proving the authority, such as a power of attorney, must be submitted.
In the following cases, the Company may refuse or restrict a request in whole or in part under Articles 35 to 37 of PIPA, and will notify you of the reason.
- Where special provisions of law so require, or where it is unavoidable to comply with legal obligations
- Where there is a risk of harm to another person’s life or body, or of unfairly infringing another person’s property or other interests
- Where performing the contract would be difficult, such as being unable to provide the service agreed with the user without processing the personal information
- Where deletion cannot be requested because other laws designate the personal information as subject to collection
Members must keep their personal information current and accurate and are responsible for keeping their account credentials (password, two-step verification methods, API keys) secure. The Company is not liable for damages caused by a Member’s failure to do so unless the Company acted intentionally or negligently.
11. Personal Information of Children Under 14
The Service is intended for businesses and professionals and does not accept sign-ups from children under the age of 14. If the Company learns that a child under 14 has signed up, it will delete the account and personal information without delay.
12. Measures to Ensure the Security of Personal Information
Under Article 29 of PIPA, the Company takes the following measures.
- Administrative measures: establishing and implementing an internal management plan, minimizing the number of personnel handling personal information, and conducting regular inspections
- Technical measures: encrypting passwords and other important information in storage, encrypting data in transit, managing access rights, and blocking abnormal access
- Access record management: retaining access records of personal information processing systems and preventing their forgery or alteration
- Physical measures: operating systems in the processor’s (Cloudflare’s) data centers equipped with access controls
If the Company becomes aware of a leak or similar incident involving personal information, it will notify the affected users and report to the relevant authorities without delay under Article 34 of PIPA.
13. Criteria for Additional Use or Provision, and Automated Decisions
Under Article 15(3) and Article 17(4) of PIPA, the Company may additionally use or provide personal information without the user’s consent, taking the following into account.
- Whether it is related to the original purpose of collection
- Whether the additional use or provision is foreseeable in light of the circumstances of collection and processing practices
- Whether it unfairly infringes the user’s interests
- Whether necessary security measures, such as pseudonymization or encryption, have been taken
The Company does not make decisions that significantly affect users based solely on fully automated systems. Automatically and temporarily blocking excessive requests is done to protect the Service, and if you inquire about it, a person will review it.
14. Use of External Services
Service pages load fonts and documentation page components from the following external services. In doing so, the user’s browser connects directly to those services, so each service may receive the user’s IP address and browser information. The Company does not provide personal information to these services, and their processing is governed by each operator’s policy.
- Google Fonts (Google LLC): fonts — https://policies.google.com/privacy
- jsDelivr: fonts and API documentation page components — https://www.jsdelivr.com/terms/privacy-policy-jsdelivr-net
15. Chief Privacy Officer
The Company has designated a Chief Privacy Officer, as follows, to oversee personal information processing and to handle related complaints and remedies for damages. Please contact the officer below for inquiries about personal information, requests for access and other rights, complaints, and remedies for damages.
| Category | Details |
|---|---|
| Contact | Chief Privacy Officer, TripleAuth Inc. |
| contact@tripleauth.com | |
| Address | 502, 8 Teheran-ro 2-gil, Gangnam-gu, Seoul, Republic of Korea |
16. Remedies for Infringement of Rights
To obtain remedies for infringement of personal information, users may apply for dispute resolution or consultation to the following organizations.
- Personal Information Dispute Mediation Committee: 1833-6972, https://www.kopico.go.kr
- Personal Information Infringement Report Center (KISA): 118, https://privacy.kisa.or.kr
- Supreme Prosecutors’ Office: 1301, https://www.spo.go.kr
- Korean National Police Agency: 182, https://ecrm.police.go.kr
If your rights or interests are infringed by a disposition or omission of the head of a public institution in response to a request under Articles 35 to 37 of PIPA, you may file an administrative appeal under the Administrative Appeals Act (「행정심판법」).
17. Users Outside the Republic of Korea
The Service is operated in the Republic of Korea, and this Policy is interpreted in accordance with the laws of the Republic of Korea. However, where the laws of the user’s country of residence, such as the European Economic Area (EEA) or the United Kingdom, apply mandatorily, the Company guarantees the rights under those laws.
- Legal bases for processing: performance of the service contract (providing the account and Service), legitimate interests (security, abuse prevention, and improving the Service through statistics that cannot identify individuals), and compliance with legal obligations
- Rights: access, rectification, erasure, restriction of processing, objection, data portability, withdrawal of consent, and the right to lodge a complaint with the supervisory authority in your country of residence
- International transfers: The Company relies on safeguards recognized by the applicable laws, such as the Standard Contractual Clauses (SCCs) concluded with the processor.
- How to make a request: Please send an email to the contact in Section 15.
18. Changes to This Privacy Policy
This Policy applies from its effective date. If content is added, deleted, or modified due to changes in laws or the Service, the Company will announce it on the Service from 7 days before the change takes effect; changes that materially affect users’ rights, such as to the items collected or the purposes of use, will be announced 30 days before they take effect.
This Policy is written in Korean. If a translation in another language differs from it, the Korean original prevails.
- October 8, 2026: Established