Войти
Privacy

Privacy standards for the EG Tone web service

EG Tone processes only the minimum personal information needed for account creation, domestic paid sales, downloads, customer support, and community operation.

Effective date2026.10.24
Current scopeAccount · international sales · downloads · community

Это предыдущая версия, которая действовала до 2026.10.27.

Посмотреть действующую версию

1. What this policy covers

This policy applies to the EG Tone website, Google-based sign-in, gift-code registration, download authorization, community, user preset, and Play (leaderboard) surfaces, and to device linking, license checks, and in-app feedback in the EG Tone app (plug-in and standalone app).

For paid sales, order, payment, refund, download, license entitlement, and tax information is processed together with the notices shown during checkout. International orders are sold through Polar (our Merchant of Record) with card processing by Stripe, who process the related payment and billing data. Korean domestic orders are paid through Toss Payments.

2. Categories of personal information we process

  • Sign-in and account identity data: Google sign-in identifiers, email address, and Supabase user identifiers
  • Profile and environment data: nickname, preferred locale, preferred market code, avatar, and other information you choose to connect or enter
  • Access and download operations data: gift-code registration history, entitlement status, download history, device-link records, and offline access records
  • Community, preset, and Play data: posts, comments, recommendations, preset metadata, operational data generated during uploads, and Play leaderboard scores and attempt records (your nickname, profile picture, and score are shown publicly on the leaderboard)
  • Support data: email inquiries, response history, and any additional materials you provide for troubleshooting
  • Technical usage data: access timestamps, IP address, browser or device information, OS/DAW/error details needed for installation support, and security or operations logs
  • Preset content data: titles, descriptions, tags, cover images, preset JSON, versions, download/save/like/comment counts for public uploaded presets, and account-linking identifiers for private saved presets
  • Free trial data: trial start and end times, the page where the trial was started, and values derived from your email address, sign-in account identifiers, and IP address with a one-way keyed hash, used to prevent repeated trials (the trial records do not store the original values)
  • In-app feedback: feedback type, message, and time received; if you choose to include app info, the app details (app version, operating system, standalone or DAW mode, language, sample rate, and buffer size); identifiers of the sending account and device link; and the account email address used for our reply
  • License-protection records: the time and result of each license refresh by the app, app version, platform, integrity check results (app file signature and hash checks, and whether a debugger is attached), country of access, and a hashed value of the network range (the original IP address is not stored), together with account and device-link identifiers
  • Collaboration and gift-code issuance records: the name or channel name, contact email, and channel URL of collaborating creators, how the code was delivered, and the gift-code issuance record

3. Why we use personal information

  • To identify members, maintain sign-in sessions, and verify account security
  • To manage gift code redemption, download authorization, device linking, and access status
  • To operate community and user preset sharing and Play leaderboards (which show nicknames, profile pictures, and scores publicly), including reports and dispute handling
  • To answer support questions, deliver notices, and contact users when necessary for service operation
  • To detect abuse, respond to security incidents, analyze failures, and stabilize the service
  • To improve service quality through statistics and operational analysis
  • Search, display, sharing, downloads, recommendations, comments, statistical analysis, and service quality improvements for public uploaded presets
  • Analysis of private saved preset settings is limited to statistics that are made difficult to identify personally, and only when the user gives separate consent
  • To provide and end free trials and to prevent abuse by limiting the free trial to one per person, based on our legitimate interest in preventing misuse of the trial
  • To reply to inquiries and in-app feedback (contract performance, Article 15(1)(4) of Korea's Personal Information Protection Act), and to fix errors and translations and improve the service based on feedback (legitimate interest, Article 15(1)(6))
  • To detect and respond to license misuse, account sharing, and app tampering (contract performance and legitimate interest, Article 15(1)(4) and (6)). These records alone never block your use automatically; an administrator reviews them before taking action under existing procedures.
  • Personal data processed without consent and the legal basis (Article 22(3)): accounts, sign-in, purchases, downloads, device linking, providing the free trial, community and preset sharing, Play leaderboards, replies to inquiries and feedback, and issuing gift codes under collaboration agreements rely on contract performance (Article 15(1)(4)); security, license protection, trial-abuse prevention, feedback-based improvements, and keeping collaboration and gift-code issuance records rely on legitimate interest (Article 15(1)(6)); and keeping transaction records relies on legal obligations (Article 15(1)(2)). Analytics cookies and statistical analysis of private presets require your separate consent on the relevant screen.
  • To manage collaborations with creators and keep records of the gift codes we issue and revoke (performance of the collaboration agreement and legitimate interest, Article 15(1)(4) and (6))

4. External services, processors, and disclosures

EG Tone entrusts the operations below to outside services that process personal data on our behalf. For recipients located outside Korea, the transferred items and contact details are listed in Section 6.

  • Authentication, database, and storage operations: Supabase (data stored in Seoul, Republic of Korea)
  • Web deployment and hosting operations: Vercel
  • Social sign-in provider: Google
  • Payments: for international orders, Polar Software, Inc. (our Merchant of Record) and its payment processor Stripe process the payment, billing, and tax information needed for authorization, settlement, tax, invoicing, refunds, and dispute handling. For Korean domestic orders, Toss Payments processes the payment information needed for authorization, settlement, refunds, cash receipts, and dispute handling. When a payment screen or payment module loads, the payment service may receive your connection information (IP address and browser information). For domestic orders, the Toss Payments module may load in advance when you open the purchase page; for international orders, Polar's checkout page (including its card processor Stripe) loads when you start checkout.
  • Support mailbox (receiving and storing feedback notification emails and email inquiries): Google LLC (Gmail)
  • Installer download delivery: Cloudflare, Inc. (R2 storage)

5. Standards for third-party provision

EG Tone does not provide user personal information to outside parties for advertising sales or external marketing purposes.

  • However, data may be provided within the scope permitted by law when there is a legal basis, a lawful request from an investigative or supervisory authority, or a genuine need for dispute handling.
  • For international orders, Polar (Merchant of Record) and Stripe process the payment and billing information needed for payment processing, tax, settlement, refunds, invoicing, and fraud/dispute response.
  • Processing by service providers and direct third-party provision are managed separately, and the service list disclosed here is centered on processor or operational-support roles.

6. Overseas transfer, storage, and processing

EG Tone transfers personal data outside Korea where entrusting processing or storage is needed to enter into and perform our contract with you, and discloses the following under Article 28-8(1)(3)(a) of Korea's Personal Information Protection Act. Unless an item says otherwise, data is sent over encrypted connections whenever needed while you use the service, and each recipient keeps it until the entrustment ends or the retention period in Section 7 ends.

Database, authentication, and file storage data is stored in the Seoul region of the Republic of Korea, and our web server functions run in Seoul (icn1). If you do not want your data transferred abroad, you can ask us to stop through the contact channel in Section 11. However, sign-in, purchases, and downloads cannot be offered without these transfers, so your use of the service would be limited. Refusal for the support mailbox follows its separate item below.

  • Google LLC (United States; 1600 Amphitheatre Parkway, Mountain View, CA 94043; privacy contact: https://support.google.com/policies/contact/general_privacy_form): processes account authentication data during Google sign-in (email address and Google account identifier) and, if you consent to analytics, web usage statistics (Google Analytics 4) in the United States and other countries where Google operates data centers.
  • Vercel Inc. (United States; 440 N Barranca Avenue #4133, Covina, CA 91723; privacy@vercel.com): website hosting, server functions, and CDN. Processes connection records (IP address, browser information, requested path) and the account or order data that passes through requests. Server functions run in Seoul, Republic of Korea (icn1), and static files may be served through a global CDN.
  • Supabase Pte. Ltd. (Singapore; 65 Chulia Street #38-02/03, OCBC Centre, Singapore 049513; privacy@supabase.com): authentication, database, and file storage operations for service data such as accounts, purchases, licenses, device links, community posts, presets, and feedback. The data is stored in Seoul, Republic of Korea (ap-northeast-2).
  • Polar Software, Inc. (United States; 3500 South DuPont Highway, Dover, DE 19901; privacy@polar.sh): Merchant of Record for international orders, handling payment, tax, invoices, and refunds. When an order is created we send your account email, account identifier, order number, and the IP address of the device you use to start checkout (so that Polar can determine your country for tax and currency), and Polar processes your connection information (IP address and browser information) when its checkout page loads, as well as the payment and billing details you enter on that page. Card payments are processed by Polar's payment processor Stripe (United States), and as the seller Polar may keep transaction records for the periods required by tax and accounting laws.
  • Cloudflare, Inc. (United States; 101 Townsend St., San Francisco, CA 94107; privacyquestions@cloudflare.com): installer download delivery (R2 storage). When you download, the IP address and browser information of the request are processed on Cloudflare's network, including in the United States; no personal data is stored in the installer storage.
  • Support mailbox (Gmail): the recipient is Google LLC (United States; address and privacy contact as above). Transferred items: in-app feedback number, type, message, and time received; app info if you chose to include it; the account email address used for our reply; and the content of email inquiries and our replies. Countries: the United States and other countries where Google operates data centers. Feedback is sent right after it is received (retried if sending fails) from EG Tone's server in Seoul to Gmail over the encrypted Gmail API, and email inquiries are stored in Gmail when you send them. Purpose: receiving feedback notifications, replying, and keeping records. Feedback notification emails are deleted 1 year after receipt or when the sender's account is deleted, whichever comes first, and email inquiries are deleted 1 year after they are handled (3 years for purchase-related complaints or disputes). If you do not want this transfer, you can contact us by phone (070-8064-1275) instead of in-app feedback or email; in that case in-app feedback and email inquiries are not available to you.
  • For users in Japan: EG Tone is a business in the Republic of Korea, and personal data is processed and stored in Korea and in the countries of the recipients above (the United States and Singapore). Information on each country's personal data protection system is available from Japan's Personal Information Protection Commission (https://www.ppc.go.jp/enforcement/infoprovision/laws/), and EG Tone applies the security measures in Section 10 with those systems in mind.

7. Retention and deletion principles

  • Account, profile, community, and preset-related data is generally deleted, anonymized, or destroyed in a hard-to-recover manner when the account is closed or the purpose is fulfilled.
  • Some records needed for security, abuse prevention, dispute handling, or showing how we handled your requests are kept separately for the following periods and then deleted: rate-limit records and finished device-link requests, 7 days; download and update records and gift-code registration security records, 1 year; expired license refresh records, 90 days after expiry; security and operations audit records, 3 years; records of resolved reports and handled deletion requests, 3 years after handling; and license-protection records, 180 days after collection (1 year for incidents an administrator reviewed and acted on). Where a law requires a longer period, we follow that period.
  • Records of orders, payments, refunds, and related transactions are kept separately for the periods required by law (Korea's E-Commerce Act Enforcement Decree). Contract, withdrawal, payment, and supply records are kept for 5 years, and records of payment disputes raised through a payment provider (such as chargebacks) are also kept for 5 years as part of the payment records. Records of consumer complaints and disputes received through in-app feedback or inquiries are kept for 3 years. If you delete your account, records of orders, payments, refunds, and disputes that have a payment record at the payment provider are unlinked from your account, and only the information needed to verify the transaction (such as order number, amounts, payment and refund history, and buyer email) is kept separately for 5 years from the transaction date and then deleted. Orders with no payment record at the payment provider are deleted together with the account. Tax records are kept for the periods set by tax law.
  • When retention ends, data is deleted, anonymized, or otherwise destroyed using methods appropriate to the medium.
  • When an account is deleted, private saved presets and account-only preset data are deleted.
  • When an account is deleted, its public preset posts and the comments on those posts (including comments written by other users) are deleted as well. We do not keep them on the web under an anonymized author.
  • Free trial records are kept while the account exists and deleted with the account. The transformed email and sign-in identifier values used to prevent repeated trials are kept for 2 years from the trial start, even after account deletion, and then destroyed; the transformed IP address value is destroyed 30 days after collection.
  • In-app feedback: general feedback such as bug reports, suggestions, and translation errors is deleted 1 year after it is handled. Feedback classified as a purchase-related complaint or dispute (refunds, payments, license issuance, device-link failures, compensation requests, or disputes) is kept separately for 3 years after it is handled, as required by Korea's E-Commerce Act Enforcement Decree, and then deleted. When you delete your account, we immediately unlink your feedback from the account, mask personal data in the message, and keep it only within the periods above.
  • Support mailbox (Gmail): feedback notification emails are deleted 1 year after receipt or when the sender's account is deleted, whichever comes first. Email inquiries and our replies are deleted 1 year after they are handled (3 years for purchase-related complaints or disputes).
  • License-protection records: deleted 180 days after collection. Records of incidents that an administrator reviewed and acted on are kept for 1 year after collection and then deleted.
  • Collaboration and gift-code issuance records: kept while the access rights granted by the gift code remain in effect, and deleted 1 year after those rights end.
  • Play leaderboards: your nickname, profile picture, and score are shown publicly on the leaderboard. Weekly scores are deleted after 8 weeks, and attempt records after 7 days (attempts that were never submitted are deleted 1 day after they expire). All-time scores are kept while your account exists and are deleted with the account.
  • Backups: we back up the service database and uploaded files so that we can recover from failures. Backups are encrypted and kept in Korea on storage managed by the operator (external disks and the operator's work computer); they are not transferred overseas. Daily backups are deleted after 35 days and monthly backups after 5 years, in line with the 5-year retention period for transaction records. Information deleted from the service, for example through account deletion, may remain in backups during these periods. Backups are used only to recover from failures, and when we restore from a backup, we delete again any information that had already been deleted.

8. Your rights and how to exercise them

  • You may request access, correction, deletion, restriction of processing, or withdrawal of consent for your personal information where applicable. We handle requests for access, correction, deletion, or restriction of processing within 10 days of the day we receive them. If there is a legitimate reason we cannot do so within that period, we will tell you the reason and when we expect to complete the request.
  • Account details that are directly editable can be changed from your account screen after sign-in.
  • Account deletion requests can be submitted from the account screen after signing in, and you can delete your account even if you have completed purchases. If a payment is in progress, deletion waits until that payment is confirmed or cancelled, and while deletion is being processed you cannot make new purchases or uploads. Transaction records that the law requires us to keep are kept separately from your account as described in Section 7. Once deletion is processed, server access ends immediately, but download links already issued (up to 5 minutes) and offline access stored on a device (up to 24 hours after the last check) may remain until they expire.
  • Where immediate deletion is not possible because of legal, security, or dispute-handling reasons, data may be retained separately or put under restricted processing.
  • Questions about privacy and rights requests can be sent through the official contact channel below.
  • Deleting your account also deletes your public preset posts and the comments on them, and this cannot be undone. If you want to keep any presets, download them before you request account deletion.
Submit a deletion request from the Account page

9. Cookies and similar technologies

EG Tone may use cookies or similar technologies to maintain sign-in sessions, confirm security state, preserve language settings, support core service functions, and analyze service quality.

  • Authentication cookies for sign-in session continuity and security verification
  • Functional cookies used to remember language choice and similar baseline preferences
  • You can refuse or delete cookies through your browser settings, but some features such as sign-in persistence may then work only in a limited way.
  • Google Analytics 4 may be used to collect usage statistics such as page visits, CTA clicks, and download button clicks for service improvement, while advertising personalization storage is denied by default.
  • Analytics collection follows the consent choice shown in the interface, and deleting browser storage may reset that choice.

10. Security measures

  • We maintain internal controls such as least-privilege access, separated authentication boundaries, and operational logging.
  • We apply technical safeguards such as protected transport, separated secrets, and server-only trust boundaries.
  • We limit the scope of personal data processing to what each task needs, and when choosing outside services we review the privacy and security commitments those companies publish. However, the personal Gmail account used as our support mailbox is covered by Google's general terms of service and privacy policy, without a separate data processing agreement. This account uses 2-step verification, and our servers hold only send-only permission for it.
  • If a security incident or abnormal signal is detected, we investigate the impact range and take necessary response and notice steps.

11. Privacy contact and responsible channel

Privacy-related questions are handled through the official support email and phone number, and the privacy officer is 염성진. The seller business address and online sales registration number are shown in the site footer and terms.

  • Current official contact email: egtone.service@gmail.com
  • Privacy officer: 염성진
  • Customer support phone: 070-8064-1275
  • Seller business address and online sales registration number: disclosed in the site footer and seller terms

12. Policy changes

We update this policy when applicable law, service structure, data categories, processor relationships, or payment flows change. Material changes will be announced in advance through service notices or appropriate channels.

Notice of change effective 2026-10-14: We added the processing needed to offer the 7-day free trial to Section 2 (categories of personal information we process), Section 3 (why we use personal information), and Section 7 (retention and deletion principles). We are announcing this change from 2026-10-07, seven days before it takes effect. The previous version of this policy took effect on 2026-05-13.

Notice of change effective 2026-10-20: We added in-app feedback, the support mailbox (Gmail), and license-protection records to Sections 1, 2, 3, 4, 6, and 7. Section 6 (overseas transfers) now lists each recipient's name, contact, transferred items, and countries, including the Supabase storage location (Seoul, Republic of Korea), Polar, Cloudflare, and information for users in Japan. Section 8 now explains access that may remain after account deletion, Section 10 states the contract status of the support mailbox accurately, and the new Section 13 adds information for users in the EEA and UK. We also added Play leaderboards (public nicknames, profile pictures, and scores, and retention periods) and records for managing creator collaborations and gift-code issuance to Sections 1, 2, 3, 7, and 13, and the connection information that payment services receive when a payment screen loads to Sections 4 and 6. Section 7 now lists the main retention periods for records, how we keep encrypted backups (on operator-managed storage in Korea; daily backups for 35 days and monthly backups for 5 years), that public presets and their comments are deleted along with the account, how transaction records are kept separately, and how long dispute records are kept. Section 8 now states the deadline for handling requests for access, correction, deletion, or restriction of processing (10 days from receipt), and explains that you can delete your account even after completed purchases, and what happens when a payment is in progress. We are announcing this change from 2026-10-13. The previous version of this policy took effect on 2026-10-14.

Notice of change effective 2026-10-24: Section 6 (overseas transfers) now states that when an order is created we also send Polar the IP address of the device you use to start checkout, so that Polar can determine your country for tax and currency. This change takes effect on the day it is announced. The previous version of this policy took effect on 2026-10-20.

13. Additional information for users in the EEA and the UK

If you are in the European Economic Area (EEA) or the United Kingdom, the GDPR or the UK GDPR may apply to your personal data. The controller is EG Tone (이지톤), a business in the Republic of Korea (representative: 염성진; 402, 46 Suyeong-ro 587beon-gil, Suyeong-gu, Busan, Republic of Korea), and you can reach us at egtone.service@gmail.com.

Right to object (GDPR Article 21): you may object at any time, on grounds relating to your particular situation, to processing based on our legitimate interests (such as security and license protection, preventing trial abuse, improving the service from feedback, and keeping copies in the support mailbox). If you object, we will stop that processing unless we have compelling legitimate grounds that override your interests, rights, and freedoms, or need it to establish, exercise, or defend legal claims. Send your request to the contact above.

  • Legal bases: accounts, sign-in, purchases, downloads, device linking, the free trial, community and preset sharing, Play leaderboards, replies to inquiries and feedback, and issuing gift codes under collaboration agreements rely on contract performance (Article 6(1)(b)); security, license protection, trial-abuse prevention, error analysis and service improvement, keeping copies in the support mailbox, keeping transaction and complaint records (including for legal claims), and keeping collaboration and gift-code issuance records rely on legitimate interests (Article 6(1)(f)); analytics cookies and statistical analysis of private presets rely on consent (Article 6(1)(a)).
  • Recipients: Supabase (authentication, database, storage), Vercel (hosting), Google LLC (sign-in, analytics, support mailbox), Polar Software, Inc. and Stripe (international sales, payments, tax), Toss Payments (Korean domestic payments), and Cloudflare (installer delivery). Details are in Sections 4 and 6.
  • International transfers: personal data you provide directly to EG Tone from the EEA or UK is processed in the Republic of Korea, which is covered by adequacy decisions of the EU and the UK. When we send data to recipients in other countries such as the United States, we rely on appropriate safeguards such as certification under the EU-U.S. Data Privacy Framework (including the UK Extension) or the Standard Contractual Clauses; Google LLC, which runs our support mailbox, is certified under that framework.
  • Retention: we keep data for the periods in Section 7.
  • Your rights: you can exercise the rights of access (Article 15), rectification (Article 16), erasure (Article 17), restriction (Article 18), portability (Article 20), objection (Article 21), and rights related to automated decisions (Article 22). Send requests to the contact above; we reply within one month, which may be extended where the GDPR allows.
  • Withdrawing consent: you can withdraw consent for consent-based processing (such as analytics cookies) at any time through the cookie settings in Section 9. Withdrawal does not affect processing carried out before it.
  • Complaints (Article 77): you can lodge a complaint with the supervisory authority of the EU member state where you live or work or where an alleged infringement took place, or with the UK Information Commissioner's Office (ICO).
  • Automated decisions and what is optional: EG Tone does not make automated decisions under GDPR Article 22 (decisions with legal or similarly significant effects), and license-protection records alone never block your use automatically. Your account email is needed for an account and purchases, but in-app feedback and including app info are optional, and not sending them does not limit your use.