[Company Policy] Privacy Policy

Date posted: December 19, 2025

*Previous policy: [Company Policy] Privacy Policy_20250818 ver

Chapter 1 General Provisions

Article 1 (Purpose)
The purpose of this Privacy Policy is to inform users of how Flexcil Inc. (hereinafter referred to as the “Company”) collects, uses, stores, and disposes of personal information in connection with its products and services (hereinafter referred to as the “Services”), as well as to notify users of their rights, thereby complying with applicable laws such as the Personal Information Protection Act, GDPR, and CCPA, and protecting users’ rights and interests.

Article 2 (Scope of Application and Services)
This Policy applies to the following products and services developed and provided by the Company:

  1. Flexcil – Notes & PDF Reader
  2. Flexcil 笔记和 PDF
  3. Other applications, web viewers, cloud synchronization services, and related services provided by the Company

Article 3 (Definition of Personal Information)
“Personal Information” refers to any information that can identify an individual (such as email address or name) or any information that, when combined with other data, can identify an individual.

Chapter 2 Collection and Use of Personal Information

Article 4 (Items of Personal Information Processed)
The Company processes only the minimum personal information necessary to provide the Services, and the items are as follows.

  1. Account Information: Email, password (encrypted/hashed), name or nickname
  2. Payment Information: Transaction ID, purchase history, payment channel (Apple, Google, Web)
  3. Usage/Device Information: Service usage logs, device/OS information, IP address, crash data
  4. Content/Synchronization: Notes, documents, annotations, and other materials that the user uploads or synchronizes within the Services (only when the synchronization service is used).
  5. Customer Support Information: Inquiry details, attachments, email address
  6. Cookies/Similar Technologies: Cookies collected when using the website or web viewer (refer to the separate Cookie Policy for details)

Article 5 (Installation, Operation, and Rejection of Automatic Personal Information Collection Tools)
The Company may collect personal information directly during the use of the app, website, or customer service center, or may collect additional information through the third-party SDKs listed below.

  • Huawei Mobile Services (HMS): In-app payments, analytics, performance management (excluding Mainland China)
  • Google Firebase: App crash reporting (Crashlytics), user behavior analytics
  • Others: Service providers listed in the Company’s disclosed subprocessors list

Chapter 3 Purpose and Legal Basis for Processing Personal Information

Article 6 (Purpose and Legal Basis of Processing)

  1. Performance of Contract (Article 15(1)(4) of the Personal Information Protection Act): Account creation, login, content synchronization, and payment processing.
  2. Actions taken at the user’s request (Article 15(1)(4) of the Personal Information Protection Act): Customer support, including responding to inquiries submitted to the customer service center.
  3. Legitimate Interests (Article 15(1)(6) of the Personal Information Protection Act): Enhancing service security, preventing unauthorized use, and improving service quality.
  4. Legal Obligations (Article 15(1)(2) of the Personal Information Protection Act): Tax compliance, consumer protection, and retention of e-commerce transaction records.
  5. Consent-Based Processing (Article 15(1)(1) of the Personal Information Protection Act): Agreement to the basic Terms of Use when creating an account.
    • Verification of membership registration or withdrawal intent, user identification, and identity verification for member management.
    • Identity verification, purchase processing, and payment of fees associated with providing synchronization services and Paid Services.
    • Demographic analysis and analysis of service visits and usage records for discovering new service features and improving existing services.

Chapter 4 Retention and Disposal of Personal Information

Article 7 (Retention Period)

  1. Collected personal information is retained until membership withdrawal and is destroyed immediately upon withdrawal.
  2. However, if retention is required by applicable laws, the information shall be retained for the prescribed period.
    • Records of contracts, subscription withdrawals, payments, and the provision of goods: 5 years (Article 6(1)(2) and (3) of the Enforcement Decree of the Act on the Consumer Protection in Electronic Commerce).
    • Records related to consumer complaints or dispute resolution: 3 years (Article 6(1)(4) of the Enforcement Decree of the Act on the Consumer Protection in Electronic Commerce).
    • Records related to labeling and advertising: 6 months (Article 6(1)(1) of the Enforcement Decree of the Act on the Consumer Protection in Electronic Commerce).
    • Computer communications and internet log records, connection trace data: 3 months (retention of communications confirmation data pursuant to Article 15-2(2) of the Protection of Communications Secrets Act).

Article 8 (Procedures and Methods for Destruction)

  1. When personal information becomes unnecessary—such as when the retention period has expired or the processing purpose has been achieved—the Company shall promptly destroy the relevant personal information.
  2. If the Company is required to continue retaining personal information under other applicable laws, the relevant information will be stored in a separate database (DB) or preserved in a different storage location. Personal information recorded or stored on paper will be destroyed by shredding or incineration, and electronic files will be permanently deleted using technical methods that prevent recovery.

Chapter 5: Overseas Transfer of Personal Information

Article 9 (Overseas Transfer)
The Company processes customers’ personal information only within the scope specified for its processing purposes. The Company may transfer personal information overseas only if the customer provides separate consent, if required by law or by a treaty or international agreement to which the Republic of Korea is a party, or when the outsourcing or storage of personal information is necessary for the conclusion or performance of a contract with the customer.

  • Destination countries: United States and other AWS region countries
  • Transfer method: Storage via network transmission
  • Safeguards: Application of GDPR Standard Contractual Clauses (SCCs) and other lawful protections
Items of Personal Information Transferred
Items of Personal Information Transferred
Email address
Destination Country, Time, and Method of Transfer
United States; transferred via the online information and communications network when a customer support request is received.
Name (Entity and Contact Information) of the Recipient
Zendesk. Inc. ([email protected])
Purpose of Use and Retention Period of the Recipient
Purpose: Outsourced customer service (CS) support
Retention period: Until membership withdrawal or termination of the outsourcing contract

Users may refuse the overseas transfer of their personal information by contacting the Company’s personal information protection department ([[email protected]](mailto:[email protected])).

If a user refuses the overseas transfer of personal information, the Company will exclude that user’s personal information from overseas transfer; however, in such cases, the user will no longer be able to maintain a member account with the Company.

Chapter 6 User Rights

Article 10 (Guarantee of User Rights)
Users may exercise the following rights regarding their personal information at any time:

  1. Request for access, correction, or deletion of personal information
  2. Request to suspend processing or withdraw consent
  3. Right to data portability: The right to export one’s notes, documents, and annotations in standard formats such as PDF or TXT
  4. Region-Specific Rights
    • EU/UK (GDPR): Right to lodge a complaint with a supervisory authority
    • US (CCPA, etc.): Right to opt out of the “sale/sharing” of personal information, and the right to know categories and sources of collected data

Article 11 (Methods for Exercising Rights)

  1. Users may exercise their rights through the in-service account settings, the customer support center, or by email, and the Company will respond without delay.
  2. Users may also exercise their rights through a legal representative or an authorized agent. In such cases, a power of attorney in the form prescribed in Annex No. 11 of the “Public Notice on the Processing of Personal Information” must be submitted.

Chapter 7 Protection of Children’s Personal Information

Article 12 (Principles of Child Protection)

  1. The Company restricts children under the age of 14 (Korea), 13 (US), and 16 (EU) from independently creating accounts.
  2. Flexcil services allow account registration only through third-party social login platforms such as Google, Apple, and Meta. These platforms operate their own age restrictions and parental consent procedures (e.g., Google Family Link, Apple Family Sharing) in accordance with local laws, and the Company adheres to these processes.
  3. Therefore, the Company does not directly provide separate parental consent procedures, and users must follow each platform’s policies for child account creation and parental consent.

Chapter 8 Provision and Outsourcing of Personal Information

Article 13 (Principles of Provision)
As a rule, the Company does not provide users’ personal information to third parties. However, it may be provided exceptionally in the following cases:

  1. When separate consent has been obtained from the user.
  2. When required by other laws or when unavoidable for complying with legal obligations.
  3. When necessary to perform a contract concluded with the user or to take steps requested by the user in the process of concluding such a contract.
  4. When it is deemed necessary to protect the urgent life, body, or property interests of the user or a third party.
  5. When necessary to achieve the Company’s legitimate interests and such interests clearly outweigh the rights of the user; provided that the Company’s legitimate interests are substantially related to the matter and do not exceed a reasonable scope.
  6. When urgently required for public hygiene or other public safety and welfare.

Article 14 (Outsourcing of Processing)
For the purpose of improving service quality, the Company may outsource certain tasks to third-party service providers and will disclose such facts when outsourcing occurs.

  • Outsourced Providers: Google Firebase, AWS, HMS
    • Google Firebase: App crash reporting (Crashlytics), user behavior analytics (Analytics)
    • Huawei Mobile Services (HMS): In-app purchases, analytics, performance management (excluding mainland China)
    • AWS: Inspecting error details when server-side issues occur

Chapter 9 Safeguards for Personal Information

Article 15 (Technical and Administrative Safeguards)

  1. Technical measures: Operation of the latest security patches and antivirus programs, and encryption of network sections (SSL/TLS).
  2. Physical measures: Minimizing access rights and conducting regular inspections.
  3. Administrative measures: Establishing and implementing internal management plans, providing regular training to employees who handle personal information, and requiring confidentiality agreements.

Chapter 10 Responsible Officer and Contact Information

Article 16 (Personal Information Protection Officer and Complaint Handling Department)

Chapter 11 Miscellaneous

Article 17 (Linked Sites)
External website links included within the Company’s Services are not subject to this Privacy Policy, and users should review the policies of those sites.

Article 18 (Notice of Changes to the Privacy Policy)
If this Policy is amended, the Company shall specify the effective date in the Terms.

Supplementary Provisions

These Terms shall take effect as of December 26, 2025.