Privacy Policy

1. Information collected and purposes of use

With your consent, we collect the four required groups of information below and any optional information you enter. We use it to review your inquiry and requirements and send a reply about the operations assessment. We do not use it for marketing messages.

Company / industry

Description of the company and industry

Current work difficulties

Description of current work and difficulties

Desired outcome

The work improvements you expect

Name / contact details

Name and email address for replies

Detailed requirements (optional)

Main users, required features, nice-to-have features, preferred schedule / budget, and reference link. We collect only the fields you complete and do not accept file attachments.

On the website, we collect what you enter when you submit it. You can submit an inquiry without completing the optional fields. For email inquiries, we collect the sender information and body of the email received by the Company. You may refuse consent; if you do, you cannot submit an inquiry using the website form.

Do not enter or attach sensitive information that is unnecessary for your inquiry, such as customers' or employees' personal information, passwords, or authentication credentials.

2. Retention period and deletion

Personal information in inquiries is retained for 6 months (180 days) from receipt of each email. We do not create a separate inquiry database; website form inquiries and replies are stored in Gmail.

For website form inquiries, a Google Apps Script trigger runs once a day and moves individual messages to Trash after 180 days have elapsed since receipt. A new reply in the same thread does not extend the retention period of older emails. For replies in Sent, the period is counted from the time each email is recorded in Gmail. Because checks are periodic, there may be a delay between the end of the period and the next check.

The person responsible deletes inquiries and replies received directly by email after 6 months (180 days) from receipt of each email. For outgoing replies, the period is counted from each sending date.

Moving an email to Trash does not permanently delete it immediately. Emails in Gmail Trash are normally permanently deleted after 30 days, in accordance with Google's email deletion process. Deletion requests are accepted through the designated contact point.

Retention and final deletion of backups, technical information, and logs within Google and Cloudflare services are subject to each provider's policies. These are separate from the Company's inquiry retention period. See the Google data retention policy and Cloudflare Privacy Policy (data retention).

We do not currently apply a separate statutory retention obligation to these inquiries. Any paper printouts are shredded after the retention period ends.

3. Third-party disclosure and outsourced processing

The Company does not provide inquiry information to other companies for their own independent use. We outsource the following tasks needed to process inquiries to external services. If a legal obligation to disclose information arises, we check the applicable legal basis.

Google LLC

Sending inquiry emails through Google Apps Script; storing and deleting inquiry emails and replies in Gmail.

Cloudflare, Inc.

Processing and forwarding website inquiry requests; anti-bot checks using Cloudflare Turnstile; cookie-free visitor analytics.

We manage the services' personal information protection and subprocessing conditions based on provider terms and policies, including the official Google Privacy Policy and official Cloudflare Privacy Policy. The person responsible checks access permissions and the status of deletion triggers. Changes to the outsourcing scope or providers are reflected in this policy.

4. Cross-border transfer of personal information

Because we use Google and Cloudflare services to process inquiries, personal information may be processed and stored outside Korea. On the website form, we obtain separate consent to cross-border transfer under Article 28-8, paragraph 1, subparagraph 1 of Korea's Personal Information Protection Act through a required checkbox separate from consent to collection and use. You can decide after reviewing the information below; without consent, you cannot submit the form.

Google LLC · Apps Script / Gmail

Legal basis for transfer

Article 28-8, paragraph 1, subparagraph 1 of Korea's Personal Information Protection Act: separate consent to cross-border transfer

Information transferred

Company / industry, current work difficulties, desired outcome, name / email, detailed requirements you enter (optional: main users, required features, nice-to-have features, preferred schedule / budget, reference link), and information contained in inquiry and reply emails

Destination countries

The United States and other countries where Google operates servers. The data transfer information in Google's official policy explains that processing may take place on servers worldwide, outside your country of residence. Actual processing countries are not limited to the United States.

Timing / method

After separate consent, information is sent to Google Apps Script over HTTPS when the form is submitted, then sent and stored as Gmail email. Direct email inquiries follow the transmission and storage routes of the email service used.

Recipients

Google LLC. Privacy policy inquiries: googlekrsupport@google.com (official Google Privacy Policy). Company contact point: theampinc@theamp.co.kr

Purpose / period

Receiving and replying to inquiries; sending, storing, and deleting emails. Emails are moved to Trash after 180 days from receipt of each email. Deletion of outgoing replies and direct emails, and permanent deletion, follow section 2. Technical information and backups within the service are subject to the Google data retention policy.

How to refuse consent and consequences

If you do not select the cross-border transfer consent checkbox, you cannot submit the form. You may make a preliminary inquiry at theampinc@theamp.co.kr and request that transfers stop or information be deleted. Direct emails may also be processed abroad depending on the service used. If you do not want cross-border transfer, ask the person responsible about available inquiry methods before sending personal information.

Cloudflare, Inc. · Request processing / Turnstile

Legal basis for transfer

Article 28-8, paragraph 1, subparagraph 1 of Korea's Personal Information Protection Act: separate consent to cross-border transfer

Information transferred

The four required groups of information in the inquiry request, optional requirements you enter, and the Turnstile verification token. To prevent automated submissions, technical information is processed, including IP address, TLS fingerprint, browser User-Agent, sitekey, and origin (Turnstile Privacy Addendum). Turnstile itself does not read the inquiry body; the inquiry forwarding Function processes the information entered.

Destination countries

The United States, the European Economic Area (EEA), and other countries where Cloudflare operates. Section 7 of Cloudflare's official policy explains that information is primarily stored in the United States and EEA and may be accessed and transferred in countries where it operates worldwide.

Timing / method

After separate consent, information is transferred over HTTPS during anti-bot checks, form submission, and request processing.

Recipients

Cloudflare, Inc. Privacy inquiries: privacyquestions@cloudflare.com; data protection officer: dpo@cloudflare.com (official Cloudflare Privacy Policy). Company contact point: theampinc@theamp.co.kr

Purpose / period

Forwarding inquiry requests and anti-bot verification. The Company does not store inquiry bodies in a separate database or application logs. Retention of Cloudflare technical information, service logs, and backups follows the applicable service policies, including section 11 of the Cloudflare Privacy Policy.

How to refuse consent and consequences

If you do not select the cross-border transfer consent checkbox, you cannot proceed with the Turnstile check or form submission. You can make an inquiry through the preliminary contact route at theampinc@theamp.co.kr. Direct email may also be processed abroad depending on the service, so you can ask the person responsible about available methods before sending personal information.

5. Exercising your rights and contact point

You may request access to your personal information, its correction or deletion, or suspension of its processing. You may also withdraw consent. Please send your request to the contact point below. Requests may also be made through a representative. The Company verifies the identity of the individual or representative to the extent necessary to exercise these rights.

Role

Personal information protection

Contact details

theampinc@theamp.co.kr

The Company reviews requests, handles them in accordance with the law, and informs you of the result. If legal restrictions apply, we explain the reason. For advice or remedies concerning personal information violations, you may contact the Personal Information Infringement Report Center or the Personal Information Dispute Mediation Committee.

6. Safeguards and automatic collection technologies

The Company uses 2-step verification for email accounts, minimizes staff access permissions, and encrypts data in transit (HTTPS) as safeguards. Authentication credentials are kept separate from public code and documents. Inquiry bodies are not recorded in server application logs or a separate database.

Cookie-free Cloudflare Web Analytics, when visitor analytics are used

When visitor analytics are used, the following are aggregated for live pages: visits and page views, host and page paths, referral sources (Referer), country, browser, operating system, device type, page load times, and performance metrics such as Core Web Vitals. Inquiry form entries are not sent to visitor analytics. See the official metric classifications and official collection documentation for details of the scope. According to the provider's information, cookies and localStorage are not used. The visitor analytics script is not loaded unless an analytics token is configured. We do not use advertising tracking tools, and fonts are self-hosted.

After consent to cross-border transfer on the form, Cloudflare Turnstile is loaded to prevent automated submissions. This processing is separate from visitor analytics. Pre-clearance is disabled, so no cf_clearance cookie is issued. Retention of technical information follows the Turnstile Privacy Addendum and Cloudflare policies.

If you do not want external processing of technical information, you may choose not to use the inquiry form. Pages with the inquiry form disabled do not load the Turnstile script.

7. Changes to this policy

This policy takes effect on October 14, 2026. If the processing purposes, information, periods, outsourcing, or cross-border transfer arrangements change, we will state the changes and their effective date on this page.