Privacy Policy

1. Purpose of Collecting and Using Personal Information

Story ("Company" or "Service") processes personal information for the following purposes. Personal information collected shall not be used for any purpose other than those stated below. In the event of any change in purpose, the Company will take necessary measures, including obtaining separate consent, in accordance with applicable laws.

• Membership registration and management: Verification of intent to register, identification and authentication for membership services
• Service provision: Providing small group community services, content delivery, and personalized services
• Service improvement: Development of new services and enhancement of existing services

2. Personal Information Collected

A. Upon Registration

• Required: Email address or mobile phone number, name
• Optional: Profile image
• When using social login (Google): Google account email, name, profile picture

B. During Service Use

• Post information: Text, images, date and time of creation
• Group activity information: Groups joined, roles within groups
• Usage records: Service usage history, access logs, IP addresses

3. Retention and Use Period of Personal Information

The Company processes and retains personal information within the retention and use period prescribed by law or within the retention and use period consented to by the data subject at the time of collection.

• Member information: Until membership withdrawal (however, retained for the required period if preservation is mandated by applicable law)
• Posts and activity records: Until membership withdrawal or deletion request
• Service usage records: 3 months

4. Provision of Personal Information to Third Parties

The Company, in principle, processes personal information only within the scope specified in Article 1 (Purpose of Processing Personal Information) and provides personal information to third parties only in cases stipulated by applicable law, such as with the consent of the data subject or under special provisions of the law.

5. Outsourcing of Personal Information Processing

The Company outsources the processing of personal information as follows to ensure smooth handling of personal information tasks.

6. Rights and Obligations of Data Subjects and How to Exercise Them

Data subjects may exercise the following rights related to the protection of personal information against the Company at any time.

• Request to access personal information
• Request for correction in case of errors
• Request for deletion
• Request to suspend processing

Rights may be exercised by written request, email, or other means as prescribed by applicable regulations. The Company shall take action without delay upon receiving such requests.

7. Destruction of Personal Information

When personal information becomes unnecessary due to the expiration of the retention period, achievement of the processing purpose, or other reasons, the Company shall destroy the personal information without delay.

• Electronic files: Permanently deleted using methods that prevent recovery and reproduction
• Paper documents: Shredded or incinerated

8. Measures to Ensure the Security of Personal Information

The Company takes the following measures to ensure the security of personal information.

• Minimizing and training personnel handling personal information
• Encryption of personal information
• Technical measures against hacking and other threats
• Restricting access to personal information
• Retention and prevention of falsification of access logs

9. Privacy Officer

The Company has designated a Privacy Officer to oversee the processing of personal information and to handle complaints and remedies related to personal information processing by data subjects.

10. Changes to the Privacy Policy

This Privacy Policy shall be effective from the date of enforcement. In the event of additions, deletions, or corrections due to changes in laws or policies, the Company shall notify users through public notices at least 7 days prior to the effective date of such changes.

11. Remedies for Infringement of Rights

Data subjects may seek resolution or consultation regarding infringement of personal information through the following organizations.

• Personal Information Dispute Mediation Committee: www.kopico.go.kr
• Personal Information Infringement Report Center (KISA): privacy.kisa.or.kr
• Supreme Prosecutors' Office Cybercrime Investigation Division: www.spo.go.kr
• National Police Agency Cyber Bureau: ecrm.cyber.go.kr