Privacy Policy
graduand — Moayo Inc. (주식회사 모아요)
The official version of this document is the Korean version. If this translation and the Korean version differ in interpretation, the Korean version prevails.
Moayo Inc. (the "Company") processes personal data in providing graduand (the "Service"). This policy states what personal data the Company processes and for what, how long it is kept, and what you can demand about it.
| Item | Details |
|---|---|
| Company name | Moayo Inc. (주식회사 모아요) |
| Representative | Jihyun Kim |
| Business registration number | 642-88-03702 |
| Address | 3F V1434, 6 Teheran-ro 79-gil, Gangnam-gu, Seoul, Republic of Korea (Samseong-dong, JS Tower) |
| Contact | privacy@graduand.dev |
The structure of this Service narrows the processing. The Service creates no accounts, the diagnosis involves no sign-in and no tokens, and the judgment runs in the customer's CI environment. The Company's infrastructure does not read the customer's repositories, and repository names and judgment contents are not transmitted to the Company's servers in any mode. Every section below stands on that.
1. Purposes of processing
The Company processes personal data for the following purposes and uses it for no others. If a purpose changes, we give notice in advance and obtain any consent required.
- Performance of the paid subscription contract — confirming activation of the subscription and delivering the subscription benefit
- Responding to inquiries
- Compliance with legal obligations
2. Items and categories of personal data processed
The items the Company processes, or is scheduled to process when the Service takes effect, and their categories are as follows. Cells not yet settled are marked "not yet set" — so that empty cells are not filled with guesses.
| Category | Items | How collected | Retention period |
|---|---|---|---|
| Contact information | Inquiry email address and the content of the inquiry | The inquiry channel (privacy@graduand.dev) | Destroyed without delay once the purpose of handling the inquiry is achieved. Where a record falls under records of consumer complaints or dispute handling, it is kept for 3 years under the Act on Consumer Protection in Electronic Commerce and then destroyed |
| Contact information | Items used to deliver the subscription benefit (not yet set — stated on the day the delivery mechanism is settled) | The subscription activation notice from the Seller | Not yet set — same as above |
Information collected at checkout (email address, payment method, business verification details) is collected and processed by the Seller under the Seller's own privacy policy, and is provided directly from the customer's browser to the Seller — it does not pass through the Company. Payment method details do not reach the Company. Sections 5 and 6 state that entrustment and the overseas transfer.
What is not personal data (the aggregate). In the flow from diagnosis to payment the Company counts only the number of occurrences of two events — checkout opened and subscription activated. Both are requests that take you somewhere else, so the per-path request counts kept by the host where the Company's site runs count them as they are; the page sends nothing to the Company. What happens only on screen (diagnosis completed, not-judgeable shown, pricing viewed) produces no request and is not counted. The aggregate carries no value that identifies a user, and repository names and judgment contents are not transmitted to the Company's servers in any mode.
2.1 Declarations of non-applicability — an empty cell and "none" are different things
- Sensitive personal data — not collected. There is no processing of sensitive data for which a possibility of disclosure, or a way to opt out of it, would need to be stated.
- Pseudonymized data — the Company does not pseudonymize personal data.
- Countries of parties collecting personal data of data subjects in Korea directly from abroad — not applicable, as the Company is a corporation of the Republic of Korea.
3. Processing and retention periods
Retention periods are stated per item in the table in Section 2. When a retention period ends or the purpose of processing is achieved, the data is destroyed without delay (Section 7). If records that a law orders to be preserved arise, their items, basis and periods will be specified in Section 2 and kept separately.
3.1 Transaction records preserved under the law
As a mail-order business, the Company preserves transaction records for the periods set by the Act on Consumer Protection in Electronic Commerce.
| Record | Retention period |
|---|---|
| Records of contracts or withdrawal of subscription | 5 years |
| Records of payment and of the supply of goods and services | 5 years |
| Records of consumer complaints or dispute handling | 3 years |
These records are used only for the purpose of preservation, and cannot be deleted on request for the duration of the period (Section 9), because a law orders them preserved. Once the period ends they are destroyed by the method in Section 7.
⚠️ The items collected at checkout do not pass through the Company (Section 2) — the Seller collects them as merchant of record, and the contract of sale stands between the buyer and the Seller. ⭕ The preservation duty above is nonetheless the Company's: the Company is a registered mail-order business and publishes that registration number on every screen of the Service, and the duty that comes with that standing is not moved by the commercial arrangement with the Seller.
The items preserved are limited to the following, out of the Seller's order records.
| Group | Items |
|---|---|
| The other party | The buyer's email address |
| What was supplied | Product name · billing interval (monthly or annual) · quantity (number of repositories) |
| Payment | Subtotal, discount, tax and total, with the currency · payment status · refunded amount |
| Evidence | Invoice number · receipt number |
| Time | Time of the transaction |
⛔ The Seller's order and subscription identifiers are not received. The handle that points at such a record is the evidence number (invoice or receipt); preservation has no reason to hold the Seller's internal identifiers as well.
⛔ The billing address and the tax identification number are not received either. What preservation requires is the fact of the contract, the payment and the supply; those two are items the Seller uses to issue invoices. ⛔ Payment instrument details never reach the Company by any route (Section 2).
⚠️ All three are items that could be received and are not — they are present in the Seller's order records. This is written down because "not stated because it does not exist" and "exists and is not taken" are different statements.
How they are obtained: the items above are obtained through the order-lookup features the Seller provides (its dashboard and API) and then preserved. The Seller's terms state no obligation to provide records, so if that access closes, the Company will arrange another way to continue preservation and state it here.
4. Provision to third parties, and categories of third parties
The Company does not provide personal data to third parties — there are no categories of receiving third parties. The processors in Section 5 handle the Company's work on its behalf and do not constitute provision to third parties.
5. Entrustment of processing — the processors and the entrusted work
| Processor | Entrusted work |
|---|---|
| Polar Software, Inc. | Payment processing for paid subscriptions · issuing invoices · tax handling · sending receipts and subscription notices |
The Company sets out the safe management of personal data in its entrustment contracts and supervises whether the processor keeps to it. If a processor or the entrusted work changes, this policy is revised to give notice. Infrastructure processors, such as web hosting, will be added to this table on the day the infrastructure is settled — they are not written in by guesswork.
The Seller (Merchant of Record) processes payments on its own responsibility — payment methods and billing records do not reach the Company.
6. Overseas transfer of personal data
Because the Seller designated by the Company is a foreign corporation, the entrustment and storage of personal data that accompany payment take place abroad. The matters required by law are disclosed in this section — this disclosure is the legal condition that substitutes for separate consent to the overseas transfer (Personal Information Protection Act, Article 28-8(1)3(a)).
| Recipient | Contact | Country of transfer (storage location) | Items transferred | When and how | Purpose of use | Retention period |
|---|---|---|---|---|---|---|
| Polar Software, Inc. | legal@polar.sh | United States (the Seller's place of business) — the locations of its sub-processors follow the list the Seller publishes and will be settled in this cell before this policy takes effect | Items the customer enters at checkout (email address · payment method · business verification details) | At the moment the customer proceeds through checkout, over encrypted connections, directly from the customer's browser to the Seller | Payment processing · issuing invoices · tax handling · sending receipts and subscription notices | The period the Seller sets under its own legal obligations |
How to refuse the transfer, the procedure, and the effect of refusal: if you do not start a payment, this transfer does not happen — the free scope (the diagnosis) remains available as it is. Demands for destruction or suspension of processing regarding a transfer already made can be exercised in the way set out in Section 9; in that case it may be difficult to maintain the paid subscription.
7. Destruction of personal data — procedure and method
When a retention period ends or the purpose of processing is achieved, the data is destroyed without delay. Destruction is carried out by means that make recovery impossible. Records preserved under a legal obligation are destroyed in the same way after the preservation period ends.
8. Measures to secure safety
- Minimal collection by structure — accounts, passwords and repository access tokens are not accepted in the first place. Not creating a place for leaks is the first measure.
- Protection in transit — communications use encrypted channels (TLS).
- Minimal handlers — the number of people handling personal data is kept to a minimum (currently one).
- Access control — the only accounts that can reach the settings of the host where the Service runs, and the records it keeps, belong to the handlers named above.
- Access records — the Company does not keep access records itself. The host where the Service runs does keep them, and the Company can access them — those records contain the address requested and the IP address. The Company looks at them for two purposes only: to check for faults and abuse, and to read the two counts in Section 2. They are not used to trace an individual user or to build per-user records, and the Company does not copy them to its own side. Because the host is the party writing the records, the items they contain and how long they are kept are determined by the host.
If the Company becomes aware of a leak of personal data, it will notify the affected users and report to the competent authorities without delay, and immediately take measures to reduce the harm.
9. Rights of data subjects and legal representatives, and how to exercise them — the process for access and correction
You may at any time demand access (including requests for disclosure), correction, deletion, and suspension of processing of your personal data.
How to exercise them: make the demand to the contact in Section 11; you may also act through a legal representative or an authorized person. The Company takes action and informs you of the result within 10 days of receiving the demand. If you disagree with the outcome, you may raise an objection through the same channel, and the Company will inform you of the result of its review and the reasons within 60 days of receiving the objection. Separately from the Company, you may also apply for dispute mediation or counsel to the competent bodies, such as the Personal Information Dispute Mediation Committee.
10. Automatic collection devices and how to refuse them · Do Not Track signals · third-party cross-site collection
- The Company places no cookies or identifiers that identify you or follow you over time. The aggregate in Section 2 is the per-path request counts kept by the host; it counts only occurrences of events and uses no identifiers.
- Do Not Track signals — as there is no tracking that identifies a user and follows them across sites and services, the Company does not respond separately to Do Not Track signals. The fact that it does not respond is itself stated in this section.
- Third-party cross-site collection — the Company does not allow third parties to collect users' behavioral information across sites and services through this Service. No advertising tools and no advertising identifiers are used.
11. The privacy officer
| Role | Name | Contact |
|---|---|---|
| Privacy officer (Chief Privacy Officer) | Jihyun Kim (CEO) | privacy@graduand.dev |
As a corporation operated by one person, the representative serves as the privacy officer as provided by law. Requests for access are received and handled, and inquiries, complaints and requests for remedy concerning personal data are received, at the contact above; the Company answers and handles them without delay — at the latest within 14 days of receipt.
12. The procedure for announcing changes
When the Company changes this policy, it announces the content of the change and its effective date on the surface where this document is published, at least 7 days before it takes effect. For a change unfavorable to users or material, it announces at least 30 days before it takes effect, also notifies subscribing customers by email, and provides a way to compare before and after. Earlier versions are kept so that the period each version applied can be checked.
13. Effective date
This policy (version 1.0.0) takes effect on 28 October 2026.
This version was published on 28 October 2026 — for this version the publication date and the effective date are the same day.