This policy explains how webinstudio handles personal data when an agency or studio (the "Customer") uses Webin Agency Operations (the "Service"). The Service is a web application in which the Customer records estimates, change requests, time, expenses and invoices for its projects and collects its clients' approvals.
1. Who we are
webinstudio is a sole proprietorship registered in the Republic of Korea.
- Owner: Juhan Lee
- Business registration number: 145-65-00656
- Address: 404-1301, 151 Wolsan-ro, Gimhae-si, Gyeongsangnam-do, 50990, Republic of Korea
- Email (including privacy requests): contact@webinstudio.co.kr
For the client, contact and staff data the Customer enters, the Customer decides the purposes and means of processing and webinstudio processes it on the Customer's behalf under the data processing addendum in the Terms. For the account data and the subscription and billing data of the Customer's users (owner, manager, member, client reviewer), webinstudio decides the purposes and means.
2. Information the Service collects
2.1 Account and subscription data
- Email address, password (stored only as an scrypt hash; the plaintext is never stored), role (owner, manager, member or client reviewer), company workspace
- Hash and expiry of the login session token (8 hours after login)
- Self-service signup requests: company name, email address, password hash, display language, time of the request and a hash of the confirmation link token. Opening the link moves them into the account data; otherwise they are deleted after the period in section 6. To stop repeated requests we count the connecting IP address in server memory for one hour and do not store it.
- Subscription data: trial period, and what our payment provider Freemius sends us about a purchase: buyer email, Freemius user ID, license ID, plan, expiry date and cancellation status
Card numbers and billing addresses are collected and stored by the payment provider Freemius on its own checkout page. webinstudio never receives or stores card numbers.
2.2 Work data the Customer enters
- Companies, contacts and deals (CRM): company name, contact name, email, phone, sales stage, notes
- Projects, estimates and change requests: scope, amounts, due dates, approval and rejection records with reasons, the client reviewer's decisions
- Time, expenses and cost: time entries per worker, cost and sell rates, expense lines and receipt files (5 MB per file at most)
- Billing and collection: invoices, credits, payment records, client purchase order numbers
- Documents: estimate PDFs, contract documents, brand logos, proof images and videos
The Service has no fields for card numbers, bank account numbers or government identifiers. We ask Customers not to put such data in notes or files.
2.3 Data created automatically
- Server logs: request time, path, status code, error message. Production logs are capped at five files of 20 MB and rotate.
- Login attempt counts per connecting IP address, kept in memory per minute and never written to disk
- Change history: who changed which amount or state and when. These audit records cannot be edited or deleted.
- Billing event records: the raw purchase, renewal, cancellation and expiry events Freemius sends us (including the buyer's name, email and license data) and when they arrived. We keep them to determine the subscription state and to handle disputes.
The Service uses no advertising or analytics scripts.
3. How we use information
- Login, permission checks and separation of company workspaces
- Storing and calculating estimates, changes, time, expenses and invoices, and recording client approvals
- Checking the trial period and subscription state, and limiting a workspace without a subscription to read-only use
- Keeping the audit history of amount and state changes (dispute review and error recovery)
- Incident response, security investigation, backup and restore
- Answering support requests the Customer sends by email
- Keeping the transaction records that tax and e-commerce law require
The Service sends no automated email. There is no signup confirmation, invitation or password reset email; webinstudio creates accounts, hands over passwords and sends the notices described in this policy by email directly. Payment receipts and renewal reminders are sent by Freemius.
4. Who receives information
webinstudio does not sell personal data and does not disclose it to third parties except where the law requires and for the payment processing described below.
4.1 Payment provider and merchant of record
Paid subscriptions are sold and charged by Freemius, Inc. (United States) as the merchant of record on its own checkout page. The name, email, card details and billing country the buyer enters there are collected by Freemius under Freemius's privacy policy and terms of sale. webinstudio receives the buyer's email, name and license status from Freemius and links them to the workspace's subscription state. Freemius has no access to the Customer's work data (2.2).
4.2 Sub-processors
| Sub-processor | Purpose | Location |
|---|---|---|
| Amazon Web Services (Lightsail) | Server and storage hosting, daily backups | Seoul region (ap-northeast-2), Republic of Korea |
| Amazon Web Services (Lightsail Object Storage) | Off-server copies of the backups | Seoul region (ap-northeast-2), Republic of Korea |
| Cafe24 Corp. (mail hosting) | Sending the signup confirmation email (recipient address and message) | Republic of Korea |
We email the Customer's owner accounts 30 days before adding or replacing a sub-processor.
5. Where information is stored and international transfers
The Customer's work data (2.2), account data and backups are all stored on servers in the Republic of Korea and are not transferred abroad. If the Customer uses the Service from outside Korea, that access is the Customer's choice.
The following transfer takes place for payments.
| Item | Detail |
|---|---|
| Recipient | Freemius, Inc. (merchant of record and payment provider; privacy contact at freemius.com/privacy) |
| Country | United States |
| When and how | When the owner opens the checkout link inside the Service, the owner's email address is passed over HTTPS to prefill the checkout page. After the purchase, Freemius sends the buyer's email, name and license status to webinstudio's server over an HTTPS webhook. |
| Data transferred | The owner's (buyer's) email address. Name, card details and billing country are entered by the buyer directly on the Freemius checkout page. |
| Purpose | Charging the subscription and linking it to the workspace's subscription state |
| Retention | According to Freemius's policy. The billing event records webinstudio receives are kept for the period in section 6. |
| If you do not want this transfer | Do not open the checkout link; no email is passed. The trial and read-only use are unaffected. If you need a subscription without using the checkout, email us. |
For Customers in the European Union or the United Kingdom, the personal data they enter reaches servers in the Republic of Korea under the European Commission's adequacy decision for Korea (December 2021). Part B of the Terms sets out the roles.
6. How long we keep information
| Data | Retention |
|---|---|
| Account data | Until the account is deleted |
| Unconfirmed signup requests | Deleted within one hour after the confirmation link expires (24 hours). Opening the link moves the data into the account and deletes the request |
| Customer work data (2.2) | Deleted within 30 days after the Customer asks to terminate. If a workspace has no subscription 60 days after its trial ended or 30 days after its subscription ended, we may delete it after notifying the owner by email |
| Backups (on-server and off-server) | Made once a day, 14 most recent copies kept. Deleted data leaves the backups within 14 days |
| Subscription and billing event records | Five years from the end of the transaction (the retention period for contract, payment and supply records under the Korean E-Commerce Act enforcement decree) |
| Complaint and dispute records | Three years after the matter is closed |
| Server logs | Rotate within five 20 MB files (about 100 MB) |
| Support email | One year after the request is closed |
Tax and transaction records that the law requires us to keep longer are stored separately for that period and used only for that purpose.
7. Deletion and data requests
When the Customer emails contact@webinstudio.co.kr to terminate or delete, we delete the workspace's database rows; backups expire on their own schedule. We confirm the deletion by email. Electronic files are erased so that they cannot be recovered; we keep no paper records.
Requests from the Customer's own clients (data subjects) are handled by the Customer. On the Customer's instruction we export the relevant records as JSON or CSV or delete them.
8. Your rights
Account users may ask to access, correct, delete or restrict the processing of their account data. Items that cannot be changed inside the Service (email address, role) are handled by email within 10 days, and we report the result. Records we must keep for legal or contractual reasons, such as the audit history and billing records, may be restricted instead of deleted; we explain why. When a representative makes a request, we verify the authorisation.
9. Security
- Passwords are stored only as scrypt hashes; session tokens only as hashes.
- All connections use HTTPS (TLS). The session cookie is HttpOnly, Secure and SameSite=Strict.
- The server checks the company workspace and role on every request. Client reviewers and members never receive internal costs, rates or audit payloads.
- Login attempts are limited to 15 per minute per IP address.
- Every amount or state change requires the exact current version and an idempotency key, and the change history cannot be edited or deleted.
- Billing events from Freemius are accepted only after their signature is verified.
- Backups are made daily and only copies that pass an integrity check are kept. Off-server copies sit in AWS storage with encryption at rest, and no access key for them exists outside the server.
- Server access is key-based SSH only, by webinstudio's single operator.
10. Cookies and automatic collection
The Service uses one login session cookie (session). There are no advertising or analytics cookies. Browser local storage holds display settings only, such as language and theme. If your browser blocks cookies you cannot sign in.
11. Children
The Service is for businesses and does not knowingly collect data from children under 14.
12. Changes to this policy
When we change this policy we update the effective date and version on this page. If the data items, purposes, sub-processors or international transfers change, we email the Customer's owner accounts at least 7 days before the change takes effect.
13. Contact and remedies
Privacy officer: Juhan Lee (owner), contact@webinstudio.co.kr.
In Korea you may also report or seek mediation through the Personal Information Infringement Report Center (privacy.kisa.or.kr, 118), the Personal Information Dispute Mediation Committee (kopico.go.kr, 1833-6972) and the Korean National Police Agency cyber unit (ecrm.police.go.kr, 182). Customers in the EU or UK may contact their own supervisory authority.