Deeprootkit Privacy Policy

This is an English translation of the Korean privacy policy (개인정보 처리방침). If the two versions differ, the Korean version prevails.

The individual who operates Deeprootkit (deeprootkit.com, the "Site") (the "Operator") sets out and publishes this privacy policy under Article 30 of the Personal Information Protection Act, to protect the personal information of the Site's users (data subjects, the "Users") and to handle related complaints promptly. The Operator processes only the minimum personal information needed for the purposes of processing.

Article 1 (Personal information processed and legal basis)

(1) You can use the Site without signing up. Values that Users enter into a calculator are used for the calculation only inside the User's browser, and are not sent to or stored by the Operator. A score that a User taps in "Was this page helpful?" at the bottom of a page ("이 페이지가 도움이 됐나요?" on Korean pages) is stored together with the page address, language and date. Information that could identify who tapped it (such as the IP address or cookies) is not stored with it.

(2) The items of personal information that the Operator processes, how they are collected, and the legal basis are as follows. All of them fall under cases where personal information may be processed without the data subject's consent.

Inquiry emails: the sender's email address, the content of the email, and delivery records (time sent and delivery result). Collected when a User sends an inquiry email. Basis: Article 15(1)(iv) of the Personal Information Protection Act (taking measures at the data subject's request).
Access logs: IP address, browser type, date and time of access, and the page requested. Created automatically on the hosting server when the Site is used. Basis: Article 15(1)(vi) of the same Act (the Operator's legitimate interest in providing the service and keeping it secure).
Visit statistics: pages visited, referrer, country, browser, operating system and device type, and page loading time. Collected automatically by a visit statistics tool that does not use cookies (Cloudflare Web Analytics), and aggregated in a form that does not identify individual Users. Basis: Article 15(1)(vi) of the same Act (the Operator's legitimate interest in improving the service).

Article 2 (Purposes of processing)

The Operator processes personal information only for the following purposes. If a purpose changes, the Operator takes the necessary measures under Article 18 of the Personal Information Protection Act.

Inquiry emails: reading inquiries, replying, and fixing errors
Access logs: providing the service, detecting and blocking security threats, and responding to outages
Visit statistics: understanding how the Site is used and improving the service

Article 3 (Processing and retention periods)

(1) Inquiry emails are kept for 1 year from the day the reply is completed and then destroyed. If a User asks for deletion, they are destroyed without delay, regardless of this period.

(2) For visit statistics, the processor (Cloudflare, Inc.) keeps the raw data for 7 days and then keeps it in a reduced, sampled form. The Operator can view the most recent 6 months.

(3) The Operator does not separately keep access logs or the delivery records of inquiry emails. The processor (Cloudflare, Inc.) keeps them for as long as needed to provide the service and keep it secure. The exact period is not published.

Article 4 (Provision to third parties)

The Operator does not provide Users' personal information to third parties. However, it may provide it under Article 18(2)(ii) and (iii) of the Personal Information Protection Act where another law has a special provision, or where it is clearly necessary for the urgent life, body or property interests of the data subject or a third party.

Article 5 (Outsourcing and transfer abroad)

(1) To provide the service, the Operator outsources the processing of personal information as follows. Because the processors are located abroad, personal information is transferred abroad, and this Article discloses the details (Article 28-8(1)(iii)(a) of the Personal Information Protection Act).

Cloudflare, Inc.

Contact: dpo@cloudflare.com
Country of transfer: United States
Outsourced work: hosting and security of the Site, visit statistics, and forwarding of inquiry emails
Items transferred: access logs, visit statistics, and inquiry emails
Time and method of transfer: sent over the network when a User uses the Site or sends an inquiry email
Retention and use period: the periods in Article 3(2) and (3)

Google LLC

Contact: googlekrsupport@google.com
Country of transfer: United States
Outsourced work: receiving and storing inquiry emails
Items transferred: inquiry emails
Time and method of transfer: sent over the network when an inquiry email is received
Retention and use period: the period in Article 3(1)

(2) The Operator checks the personal information processing standards published by the processors above, and amends and announces this policy if a processor or the outsourced work changes.

(3) Users may refuse the transfer of their personal information abroad. However, because the Site is provided only through the services of the processors above, refusing means not using the Site and not sending inquiry emails. For inquiry emails already sent, Users may request deletion under Article 7.

Article 6 (Procedure and method of destruction)

(1) The Operator destroys personal information without delay once its retention period has passed or the purpose of processing has been achieved.

(2) Procedure: every month, the Operator selects and destroys inquiry emails whose retention period has passed.

(3) Method: permanent deletion from the mailbox and the trash, so that they cannot be recovered.

Article 7 (Rights and duties of data subjects and how to exercise them)

(1) Users may at any time request access to, correction or deletion of, or suspension of processing of their personal information (Articles 35 to 37 of the Personal Information Protection Act).

(2) Requests under paragraph (1) may be made to the email address in Article 10. The Operator acts within 10 days of receiving a request and reports the result.

(3) The Operator checks that the person making a request is the data subject or a lawful representative. Data subjects must make requests from the address they sent the inquiry email from, and representatives must also send a power of attorney.

(4) Where access is restricted by law (Article 35(4) of the same Act) or a request to suspend processing may be refused (Article 37(2) of the same Act), the Operator gives the reason.

(5) The Operator does not collect personal information from children under 14. If the Operator learns that an inquiry email was sent by a child under 14, it obtains the consent of the legal representative or destroys the email without delay.

Article 8 (Measures to keep personal information secure)

The Operator takes the following measures to keep personal information secure.

Communication between the Site and Users is encrypted with HTTPS.
Access to inquiry emails is limited to one person, the Operator.
No personal information other than inquiry emails is separately downloaded or stored.

Article 9 (Automatic collection tools: installation, operation and refusal)

(1) The Operator does not use cookies.

(2) The visit statistics tool (Cloudflare Web Analytics) does not use cookies. It runs in the browser when a page is opened and sends the items in Article 1(2), item 3. Users can refuse this by blocking static.cloudflareinsights.com with the browser's tracking protection or a content blocker. Blocking it does not affect the use of the Site.

(3) Check marks in the moving checklist (이사 체크리스트) are stored only in the User's browser storage (localStorage) and are not sent to the Operator. They are deleted when the User clears browser data or taps "Clear all checks" (체크 모두 지우기) in the moving checklist.

(4) A score tapped in "Was this page helpful?" is also kept in the User's browser storage (localStorage), so that it is not sent again for the same page. It is deleted when the User clears browser data.

(5) The Operator does not currently show advertising on the Site. If it starts showing advertising, it will add to this policy the items collected by third-party advertisers, the collection tools, the purposes, and how to refuse.

Article 10 (Privacy officer)

The Operator appoints the following privacy officer to oversee the processing of personal information and to handle Users' complaints and remedies for damage. The Operator answers and handles Users' inquiries and complaints without delay.

Privacy officer: Deeprootkit privacy contact (딥루트킷 개인정보 보호 담당)
Email: contact@deeprootkit.com

Article 11 (Remedies for infringement)

To seek remedies for an infringement of personal information, Users may apply for dispute resolution or counseling to the following organizations.

Personal Information Dispute Mediation Committee: 1833-6972 (www.kopico.go.kr)
Personal Information Infringement Report Center: 118 (privacy.kisa.or.kr)
Supreme Prosecutors' Office: 1301 (www.spo.go.kr)
Korean National Police Agency: 182 (ecrm.police.go.kr)

Article 12 (Changes to this privacy policy)

(1) This privacy policy applies from October 4, 2026. If the content changes, the changes and the effective date are posted on this page.

(2) Previous privacy policies (in Korean): applied from October 2, 2026 to October 3, 2026, applied from September 30, 2026 to October 1, 2026