Privacy Policy
Last updated: 27 October 2026
1. Scope
JOLIVERSE complies with Korea's Personal Information Protection Act and related laws when processing personal information through the JOLDISK website, administrator portal, desktop security software, licence and subscription management, and support channels. This Privacy Policy explains what data is processed, why it is processed, how long it is retained, when it may be disclosed or outsourced, and how users may exercise privacy rights.
2. Data We Process
The Company may process the following data as necessary for the Service. Account data: email address, password hash, name, name components, title, account type, email verification status, password reset token, and consent records. Organisation data: organisation name, roles, member lists, invitations or direct registration data, departments or organization charts, AD/LDAP username, AD/LDAP/document centralisation (NAS)/SSL VPN/network settings, and security policies. Document centralisation data: each member's dedicated NAS account name and status, the account password (stored encrypted), personal folder path, the organisation's NAS connection token (stored as a hash only) and last connection time, and NAS job records (target member, account name, folder paths and names, and results). Folder handover data: requester, data owner, recipient or receiving shared folder, target folder path and name, the people who accepted or approved the handover and when, and results. Licence and device data: licence key, plan, seats, subscription status, device identifier, device name, operating system and app version, IP address, user agent, download and update records. Security and operations logs: login and authentication records, policy sync records, heartbeat status, enabled features, policy version, client log level/category/message/context, and administrator audit logs. Billing data: plan, amount, currency, seats, payment method identifiers, transaction identifiers, invoices, refunds, and subscription changes. Support data: name, email, inquiry content, attachments, and handling history. Automatically collected data: IP address, cookies, browser and device information, access time, and service usage records. The Company does not intentionally collect sensitive information or government-issued unique identifiers unless required by law. Users and administrators should not enter unnecessary sensitive information into inquiries, policy names, logs, file names, or memo fields.
3. Purposes of Processing
The Company processes personal information to manage accounts, verify identity, reset passwords, verify email, operate organisations, invite or register members, assign permissions and licences, apply security policies, create dedicated NAS accounts for document centralisation, change their passwords periodically, disable them, confirm the organisation's NAS connection, process folder handovers, provide desktop security features, synchronize policies, check heartbeat status, process subscriptions and billing, prevent misuse, provide downloads and updates, diagnose failures, respond to security incidents, handle support requests, improve service quality, analyse statistics, investigate legal or contractual violations, and respond to disputes.
4. Retention Periods
The Company retains personal information only for the period necessary for the processing purpose and deletes it without delay when the purpose is achieved or the user withdraws. Data required by law is stored separately for the statutory period. Account and organisation data is retained until withdrawal or contract termination. Document centralisation data and folder handover data are deleted without delay once 30 days have passed after contract termination; however, the passwords of dedicated NAS accounts are deleted when the member is removed from the organisation. Contract and withdrawal records are generally retained for 5 years, payment and supply records for 5 years, consumer complaint and dispute records for 3 years, and access logs for the period required by communications privacy laws. Security and audit logs are retained for a reasonable period needed for incident response, disputes, and organisation policy operations.
5. Deletion
When the retention period expires or the processing purpose is achieved, the Company deletes personal information without delay. Electronic files are deleted so they cannot be restored or are permanently erased by technical means. Paper documents are shredded or incinerated. Data retained under law is stored separately with restricted access.
6. Third-Party Disclosure
The Company processes personal information only within the purposes stated in this Privacy Policy and does not provide it to third parties in principle. Disclosure may occur when the user consents in advance, when required by law, or when a competent authority requests disclosure under lawful procedure. Where third-party disclosure is required, the Company will disclose the recipient, purpose, items, and retention period and obtain consent when required.
7. Outsourcing
The Company does not currently outsource routine personal information processing beyond what is necessary to operate the Service. If outsourcing becomes necessary for email delivery, payment processing, cloud infrastructure, customer support tools, or similar services, the Company will publish the contractor, outsourced work, retention period, and security measures in this Privacy Policy or a separate notice and will supervise the contractor through a written agreement.
8. International Transfer
The Company does not currently make routine international transfers of personal information. If future use of overseas cloud, email, payment, analytics, or customer support services involves an international transfer, the Company will provide the required notice under Korea's Personal Information Protection Act, including recipient, country, timing and method, data items, purpose, retention period, refusal method, and consequences of refusal.
9. Cookies and Browser Storage
The Company may use cookies and browser storage for login, language settings, theme settings, security status checks, and service quality. For example, the NEXT_LOCALE cookie stores language preferences, and local storage may store authentication tokens, user profile data, and theme settings needed for the Service. Users can refuse or delete cookies in browser settings, but login, language persistence, and some security features may be limited. The Company does not provide third-party behavioral advertising without explicit consent.
10. User Rights
Users may request access, correction, deletion, suspension of processing, withdrawal of consent, or account deletion. Requests can be made through service settings, the administrator portal, or support@joldisk.com. The Company verifies identity and responds without delay according to applicable law. Requests may be limited where legal retention is required or where another person's rights or interests may be harmed, and the Company will explain the reason.
11. Security Measures
The Company applies technical, administrative, and physical measures such as least-privilege access, administrator permission controls, password hashing, encrypted storage and periodic rotation of dedicated NAS account passwords for document centralisation, TLS encryption in transit, server access control, log management, vulnerability checks, backup and recovery procedures, security updates, and internal management plans. Organisation administrators must manage policy settings and log access according to their own internal rules and authority structure.
12. Children
JOLDISK is a desktop security service for businesses and individual users and is not directed to children under 14. If the Company needs to process personal information of a child under 14, it will follow the procedures required by Korea's Personal Information Protection Act, including consent from a legal representative.
13. Privacy Contact and Remedies
The Company operates the following contact point for privacy rights, complaints, and remedies. Privacy department: JOLDISK Operations Team Email: support@joldisk.com Phone: 02-749-4705 Users may also seek consultation or dispute resolution from relevant Korean authorities such as the Personal Information Dispute Mediation Committee or the privacy infringement reporting center if additional remedies are needed.
14. Changes
The Company may update this Privacy Policy when laws, the Service, or data processing practices change. Changes will be posted on the website or Service screen. Material changes affecting user rights will be announced for a reasonable period before they take effect. The updated Privacy Policy applies from the posted effective date.
For questions about this Privacy Policy, contact support@joldisk.com.