Privacy Policy

OHSUNG SYSTEM CO., LTD. (the "Company", "we", "us", or "our") provides SignForge (the "Service"). This Privacy Policy (this "Policy") explains how we protect and process your personal information in accordance with the Personal Information Protection Act of the Republic of Korea ("PIPA") and other applicable laws, and how we promptly and properly handle related inquiries and complaints.

The Service is a subscription service that lets you upload SVG files on the web, configure shape, thickness, and structure, and generate production files (such as STL and DXF) for 3D printing and CNC machining. We are a company incorporated in the Republic of Korea, and this Policy is based on PIPA. Additional information for users in Japan, the EU, and the UK is provided in Section 15.

1. Purposes of Processing

We process personal information for the following purposes. We do not use it for any other purpose, and if a purpose changes, we will take the steps required under Article 18 of PIPA, such as obtaining your separate consent.

1. Registration and account management: verifying your email address at sign-up (by sending a 6-digit verification code that expires after 30 minutes), identifying members, managing accounts, setting your display language, applying promo codes, making sure the free trial offered at sign-up is provided only once per person, preventing misuse, and sending notices
2. Providing the Service: generating and making available for download 3D sign production files based on your uploaded files (processed in your browser), keeping and loading projects that you choose to save to the cloud, providing features according to your plan, and managing plan usage limits (usage records and cloud storage limits), and managing the number of simultaneous sign-ins allowed by your plan (including showing the device type, browser, operating system and last-used time of each signed-in place, and signing out remotely)
3. Selling paid subscriptions and processing payments: processing subscription payments (including automatic payments) and refunds through PayPal, checking subscription status and applying your plan, recording on your account the billing country if PayPal provides it at your first payment, checking which refund and withdrawal rules apply based on your billing country, calculating and filing taxes and issuing receipts and other transaction records, providing information about renewals, cancellations, and refunds, handling PayPal disputes and chargebacks, and responding to payment inquiries
4. Handling inquiries and disputes: reviewing and responding to inquiries, and keeping records for dispute resolution
5. Improving the Service and maintaining security: understanding access frequency, analyzing usage statistics (including by sign-up channel and by country), identifying and fixing errors, maintaining security, protecting logins (temporarily locking login after a certain number of failed attempts), preventing abuse of sign-up, login, and verification code requests (limiting the number of attempts per IP address), and reviewing login records to prevent misuse such as account takeover or unauthorized account sharing
6. Complying with legal obligations: retaining records as required by applicable law, among others
7. Sending marketing information (optional): if you have agreed to receive marketing information, sending you news about new features, discounts and promotions (including trade show offers), events, and surveys. You can use the Service without agreeing, and you can withdraw your consent at any time. You can give or withdraw consent yourself under “Marketing emails” on your account page after signing in, or by contacting us as described in Section 9. We show the date and result of the change on that page right away and keep a record of each consent and withdrawal (the date and time, and the version of this Policy in effect at that time). For details such as the sender, what we send, how we send it, and how to withdraw, see our Consent to Receive Marketing Emails.
8. Operating organization (team) accounts: sending invitation emails at the request of organization admins, matching the invited email address against the account's email address when an invitation is accepted, managing the members and seats of an organization and applying the organization's plan, providing member information to organization admins with the member's consent (see Section 5), and preventing abuse of invitation emails and invitation links (limiting the number of attempts)
9. Responding to education inquiries: reviewing and answering inquiries from schools and other educational institutions about adopting the Education plan, providing quotes and contract information, managing the handling status of inquiries, compiling inquiry statistics in a form that does not identify individuals, and preventing abuse of the inquiry form (limiting the number of attempts)

2. Personal Information We Process and How We Collect It

Registration and account

• Required: email address, password (stored only as a hash that cannot be reversed, so even we cannot see your original password), language (the language of the sign-up page), and records of your agreement to the Terms of Service and this Policy (the type and version of each document, the date and time you agreed, and the leading part of your IP address (/24 for IPv4, /48 for IPv6))
• Optional: whether you agree to receive marketing information (including the dates and times you agreed or withdrew, and the leading part of your IP address at that time (/24 for IPv4, /48 for IPv6)), and a promo code (if you enter one)
• Recorded automatically at sign-up: sign-up channel (information on how you came to sign up, such as through an exhibition)
• We do not collect your country at sign-up. Only if PayPal provides your billing country do we record it as your account's country at your first payment (see "Paid subscription payments" below).
• Email verification: to confirm your email address at sign-up, we send a 6-digit verification code to that address. The code expires after 30 minutes. We do not create your account until verification is complete, and to process the verification we temporarily keep your email address, hashes of your password and the verification code, the expiry time, and the number of attempts.
• Free trial duplicate-prevention record: so that the free trial offered at sign-up is provided only once per person (per mailbox), we convert a normalized form of the email address you sign up with (ignoring letter case, anything after a "+", and dots in Gmail addresses, and treating googlemail.com addresses as gmail.com addresses) into an irreversible hash created with a secret key known only to us, and keep it together with the time it was recorded. This record does not contain your email address itself.
• Information processed depending on your login method: we provide only login with an email address and password, and do not offer social login, so we receive no information from external login services. If we introduce social login, we will amend this Policy.
• How collected: entered by you when you register or update your account settings (the sign-up channel is recorded automatically during sign-up)

Service data

• Items: usage records used to manage plan limits (such as the number of files generated or exported, values that tell quote numbers and exported images apart (converted so that the original content cannot be known), or credits used)
• How collected: generated automatically while you use the Service
• Files you upload (such as SVG), settings such as shape, thickness, and structure, and production files generated by the Service (such as STL and DXF) are processed in your browser or on your device and are not transmitted to our servers. Projects you put in the editor's library are also kept only in your browser's storage. However, projects you choose to save to the cloud are handled as described under "Cloud-saved projects" below.

Cloud-saved projects

• Items: project name, project data (content you enter in the editor, such as sign text, artwork (such as SVG), settings such as shape, thickness, and structure, images, and quote and order details), file size, and the dates and times the project was saved and updated
• How collected: we transmit a project to our servers and keep it only when you choose to save it to the cloud in the editor. We do not upload projects automatically.
• Storage location and protection: kept in file storage in the Amazon Web Services (AWS) Seoul Region (Republic of Korea), encrypted at rest, with public access blocked. Within the Service, cloud-saved projects can be opened only through the logged-in owner's account. We access them only when necessary, such as for technical support you request or to respond to legal requirements, and only to the minimum extent needed.
• Project data may contain personal information about other people (such as your customers) that you enter, for example customer names, site contact details, and site photos. We process this information only to provide the Service, such as keeping your projects and making them available to you again. If you enter or save other people's personal information, please make sure you have the right to process it, and do not include information that is not needed (Section 19-2 of the Terms of Service).
• Please do not enter sensitive information or government-issued identification numbers (such as Korean resident registration numbers) into projects.

Organization (team) accounts

• Invitation information: the invitee's email address (entered by an organization admin, or by us when we designate an owner), who sent the invitation, the role offered, the date and time of the invitation and of its expiry, and the date and time it was accepted or cancelled. The verification value contained in an invitation link is stored only as a hash, not in its original form.
• Member information: the organization the member belongs to, their role, and the date and time they became a member
• Record of consent to display to organization admins: whether you agreed, when accepting an invitation, to your member information being shown to organization admins, the version of the consent wording, the date and time, and the leading part of your IP address (see Section 11). We keep this record in the same way as the records of your agreement to the Terms of Service and this Policy at sign-up.
• How collected: invitation information is entered in the Service by an organization admin or by us, and member information is generated when an invitation is accepted or when an organization admin changes a member's role.
• We process an invitee's email address to send the invitation email and confirm acceptance even if the invitee does not yet use the Service. The invitation email contains the name of the inviting organization, the role, the invitation link, and information about its expiry, and no account is created unless the invitation is accepted. Invitees can request the deletion of their email address and exercise their other rights as described in Section 9.
• Information shown to organization admins: to the extent a member agreed on the invitation acceptance screen, the organization admins (the owner and admins) of the same organization can see the member's email address in masked form (only the first two or fewer characters and the domain are visible), role, and the date and time they joined (see Section 5). For pending invitations, organization admins can see the email address entered by them or by us, masked in the same way, together with the role and the date and time the invitation was sent and expires. We do not show members' cloud-saved projects, usage records, or payment information to organization admins.

Paid subscription payments (via PayPal)

• Payment method details, such as card numbers, are collected and processed directly by PayPal, our payment processor. We do not receive or store them.
• Items we receive from PayPal: PayPal payer ID, subscription ID, payment (transaction) ID, the payer's name and email address, the payer's country (only if PayPal provides it, such as the country of the address registered in your PayPal account; the "billing country"), subscription status, plan, billing interval and subscription period, transaction history (amount, currency, and date and time), and refund, dispute, and chargeback history
• If we receive your billing country at your first payment, we record it as your account's country.
• How collected: received from PayPal when a payment is made, when your subscription status changes, or when a refund or dispute occurs

Inquiries

• Items: email address, the content of your inquiry (including attachments), and any other information you provide when contacting us
• How collected: provided by you when you contact us by email or other means

Education inquiries

• Required items: contact person's name, email address, institution name, institution type, region, expected number of users, preferred start time, purposes of use, experience with the Service, and the content of the inquiry
• Optional items: phone number, department or program, and how you heard about the Service
• Recorded automatically: date and time received, display language, the leading part of the IP address (/24 for IPv4, /48 for IPv6), your member identifier (account ID) if you were signed in, campaign information attached to the inquiry page address (utm_source, utm_medium, and utm_campaign values), and the version and date and time of your consent to the collection and use of personal information
• Recorded by us: the handling status of the inquiry and staff notes
• How collected: entered by you in the education inquiry form on the Service's website, where we ask for your separate consent to the collection and use of personal information. We do not send a confirmation email.

Information collected automatically

• Items: access logs (date and time of access and request records), login session information, login records (date and time, and whether the attempt succeeded or failed), IP address, browser, device, and operating system information, cookies, and Service usage records
• How collected: automatically generated and collected while you use the Service
• We also use IP addresses to limit repeated sign-up, login, and verification code requests within a short time (abuse prevention), and we keep the records used for this purpose only for a short period (see Section 3).

We do not collect sensitive information or government-issued identification numbers (such as Korean resident registration numbers) to provide the Service.

3. Retention Period

We process and retain personal information within the retention period required by law or the retention period you agreed to when the information was collected.

• Member information: until you delete your account. However, we retain it until the following circumstances end:
  • If an investigation or inquiry into a violation of applicable law is in progress: until that investigation or inquiry concludes
  • If claims or debts arising from your use of the Service remain: until they are settled
• Cloud-saved projects: kept until you delete the project, delete your account, or your agreement is terminated under Section 24 of the Terms of Service (except where we delete content under Section 19(4) of the Terms of Service). When you delete a project or your account, the project disappears from your list immediately, and its files in storage are destroyed within 24 hours. Previous versions replaced when you overwrite a project are kept for 90 days and then destroyed automatically (we may help you restore one within that period if you ask), while projects you delete, or that are deleted when you delete your account, are destroyed together with their previous versions within 24 hours and cannot be recovered (for database backups, see Section 4). We do not delete your projects when the plan that applies to you changes, for example because your subscription ends, you switch to a lower plan, or your use of paid features is restricted (Section 19-2(4) of the Terms of Service).
• Files and data processed in your browser: uploaded files, production files, and the editor's settings and library are processed and kept in your browser or on your device, and we do not hold them.
• Payment and subscription information and access records: used until you delete your account. Information that falls under the records listed below is retained for the period specified by law.
• Sign-up verification and login protection records: information we temporarily keep to process email verification is destroyed within 7 days after verification is completed or the verification code expires. IP address records used for abuse prevention (limiting attempts) are kept only for 24 hours, and login records are kept for three months. However, information that falls under the service access records in the table below is retained for the period specified there.
• Login session records: login session records used to manage simultaneous sign-ins (a summary of the device type, browser and operating system, the leading part of the IP address (/24 for IPv4, /48 for IPv6), and the last-used time) are destroyed within 7 days after the sign-in's validity period ends.
• Free trial duplicate-prevention records: kept while you use your account. After you delete your account, the record is kept for one year with its link to your account removed (the member identifier is deleted and the recorded times are kept only to the day), and is then destroyed automatically. After account deletion, it is used only to avoid offering the free trial again if you sign up again with the same mailbox.
• Organization (team) account information: member information is kept until the member leaves the organization (for example, by being removed or by deleting their account). However, records of a member's use of the organization's plan (the organization, plan, period of use, and end date and time) are kept as usage-right records until the member deletes their account. Pending invitations are kept until they are accepted, cancelled, or expire, and invitations that have ended through acceptance, cancellation, or expiry are destroyed within 30 days at the latest from the date they ended. However, when an invited user deletes their account, invitations sent to that email address are destroyed immediately upon deletion, whether or not they have ended. Records used to limit the number of invitation emails (keys made from hashes instead of the original email address) are destroyed when the limit period ends.
• Education inquiries: kept for 1 year from the date of the inquiry. After 1 year, the contact person's name, email address, phone number, department or program, the content of the inquiry, staff notes, the leading part of the IP address, and the member identifier are destroyed automatically, and only the institution name, the selected items (such as institution type, region, number of users, timing, and purposes), and the handling status and dates are kept as statistics that do not identify individuals. This period applies whether or not you delete your account, and we destroy the information earlier if you ask. If an Education plan contract is concluded after the inquiry, records about the contract are managed separately from the inquiry, and their retention period is explained during the contract process. Records used to limit attempts on the inquiry form (keys made from hashes instead of the original IP address or email address) are destroyed when the limit period ends.

The information we retain under applicable law is as follows. In the table below, the Act on the Consumer Protection in Electronic Commerce of the Republic of Korea is referred to as the "E-Commerce Act."

4. Destruction Procedure and Method

When personal information is no longer needed, for example because the retention period has expired or the purpose of processing has been achieved, we destroy it without delay. If we must keep personal information under other laws, we move it to a separate database or store it in a separate location, and we do not use it for any other purpose.

• Procedure: we identify personal information that is due for destruction and destroy it with the approval of our Privacy Officer. However, items subject to automatic destruction, such as cloud-saved projects, education inquiries, and free trial duplicate-prevention records, are destroyed automatically according to set procedures.
• Method: electronic files are deleted using technical methods that prevent recovery or reproduction, and paper documents are shredded or incinerated.
• Database backups: automatic database backups kept for recovery from failures may retain destroyed member information, organization invitation information, education inquiry information, free trial duplicate-prevention records, and list information such as the names of cloud-saved projects for up to 14 days, after which they are deleted automatically. We do not use these backups for any purpose other than recovery from failures.

5. Provision to Third Parties

We process personal information only within the scope of the purposes set out in Section 1, and we provide it to third parties only in cases permitted under Articles 17 and 18 of PIPA, such as with your consent or where specifically required by law.

We provide personal information to third parties with your consent as follows. We obtain this consent on the screen where you accept an invitation to an organization (Section 5-4(2) of the Terms of Service).

You can withdraw this consent at any time by leaving the organization (Section 5-5(4) of the Terms of Service). When you leave, your membership of that organization and your use of the organization's plan end. If you are the owner, you can leave after asking us to change the owner.

Except as described above, we do not sell or provide your personal information to third parties. For how information is handled with PayPal for subscription payments, see Sections 6 to 8.

6. Outsourcing of Processing

To provide the Service smoothly, we outsource the processing of personal information as follows.

In accordance with Article 26 of PIPA, our contracts with service providers set out the prohibition on processing personal information for purposes other than the outsourced tasks, technical and administrative safeguards, restrictions on sub-outsourcing, our management and supervision of the service provider, and responsibilities such as liability for damages. We supervise our service providers to ensure that they process personal information securely. If the outsourced tasks or service providers change, we will disclose the changes through this Policy.

Currently, payments for paid subscriptions are processed through PayPal (see Section 8). PayPal payment is not offered in the Republic of Korea. If we add domestic Korean payment methods in the future (PortOne and Korean payment gateways), we will amend this Policy to add the service providers for payment processing and notify you.

7. International Transfers of Personal Information

We transfer personal information outside the Republic of Korea as follows. The details below are disclosed under Article 28-8(2) of PIPA.

PayPal (payment processing)

Payment method details, PayPal account details, and other information that you enter directly into PayPal's checkout are collected by PayPal directly and do not pass through us (see Section 8).

8. Payment Processing and PayPal

Paid subscriptions for all accounts are sold by us as the seller, and subscription payments and refunds are processed through PayPal as our payment processor. In the checkout provided by PayPal, you log in to your PayPal account or enter your payment details and approve automatic payments, and PayPal collects and processes that information directly.

• We do not receive or store payment method details such as card numbers, or your PayPal login credentials.
• In addition to processing payments on our behalf, PayPal processes personal information under its own responsibility for purposes such as operating PayPal accounts, handling payment method details, preventing fraud, and complying with the law. PayPal's privacy statement, published on PayPal's website, applies to that processing.
• We receive the information listed in Section 2 from PayPal to check subscription status, apply your plan, handle refunds and disputes, and for similar purposes.
• If we add domestic Korean payment methods in the future, we will amend this Policy in accordance with Section 6 and notify you.

9. Your Rights and How to Exercise Them

You may at any time exercise your rights to request access to, correction or deletion of, or suspension of processing of your personal information, and to withdraw your consent.

• You can exercise your rights in writing, by email, or by similar means, and we will act on your request without delay. Contact: global@ohsungsys.com
• You may also exercise your rights through an agent, such as your legal representative or a person you have authorized. In that case, a power of attorney must be submitted.
• Requests for access or suspension of processing may be restricted under Article 35(4) and Article 37(2) of PIPA.
• You cannot request the deletion of personal information that other laws specifically require to be collected.
• We verify that the person making a request is the data subject or a duly authorized agent.
• You can exercise your rights regarding your PayPal account and the payment method details that PayPal processes under its own responsibility directly with PayPal. If you contact us, we will also cooperate to the extent necessary.

10. Children's Personal Information

We do not offer the Service to children under the age of 14 and do not collect personal information from children under 14. If the laws of your country of residence set a higher age threshold, that threshold applies. If we become aware that we have collected personal information from a child under the applicable age, we will destroy it without delay. The same applies where an organization admin has entered such a child's email address to send an invitation (Section 5-3(6) of the Terms of Service).

11. Security Measures

We take the administrative, technical, and physical measures required by applicable law to keep personal information secure.

• Administrative measures: we take steps to limit the personnel who handle personal information to the minimum necessary for their work, and to establish internal rules and provide training for handling personal information securely.
• Technical measures: we take steps to limit access rights to systems that process personal information to what is necessary for each person's work, and to protect personal information, such as by encrypting data in transit (HTTPS).
• Physical measures: personal information is stored in cloud data centers (AWS) whose physical security is managed, and we take steps to prevent the unauthorized removal of materials containing personal information.
• Details of measures (Service app): passwords and verification codes are stored only as irreversible hashes (bcrypt), and verification codes expire after 30 minutes. Login is temporarily locked after repeated failures, and the number of sign-up, login, and verification code requests is limited per IP address. Attempt-limit records use keys made from hashes instead of the original email address or IP address, and audit records, consent records, and education inquiries store only the leading part of the IP address (/24 for IPv4, /48 for IPv6). The database is accessed with least-privilege roles. The contact details and content of education inquiries can be viewed only by operators who have passed two-step verification, in the operator console, and viewing them or changing their handling status is logged.
• Details of measures (Infrastructure): the service runs in the AWS Seoul Region. All connections are encrypted with HTTPS (TLS 1.2 or later), and HTTP requests are redirected to HTTPS. Servers sit in a private network without public IP addresses and accept connections only through a load balancer, with firewalls (security groups) allowing only necessary traffic. Server programs run without administrator privileges on a read-only file system, and the database and file storage are encrypted at rest.

12. Cookies and Similar Technologies

We use cookies to keep you logged in and to maintain security. A cookie is a small text file that a website sends to your browser and that is stored on your device.

• Cookies and analytics tools we use: we use only essential cookies for keeping you logged in and for security (preventing request forgery), and we do not use cookies or analytics tools for usage analysis or advertising. The editor's settings and library are stored in your browser's storage (localStorage and IndexedDB) and are not sent to us. Of the editor's data, only projects you choose to save to the cloud are kept on our servers (see Section 2).
• How to refuse: you can refuse cookies or delete stored cookies in your web browser settings. For instructions, see your browser's help pages.
• If you refuse cookies, some features that require login may not work properly.
• PayPal's privacy statement and cookie policy apply to the processing of information (including cookies) in the checkout provided by PayPal (such as the PayPal payment buttons and checkout window).

13. Privacy Officer

We have designated the following Privacy Officer, who is responsible for overseeing the processing of personal information and for handling complaints and providing remedies relating to the processing of personal information.

• Privacy Officer: Lim Soyoung
• Email: global@ohsungsys.com
• Phone: +82-31-507-4978 (Hours: Weekdays 9:00–17:30 Korea Standard Time, UTC+9; closed on weekends and Korean public holidays)

14. Remedies for Infringement

To seek remedies for an infringement of your personal information, you may apply for dispute resolution or consultation to the following organizations in the Republic of Korea. The phone numbers can be dialed from within Korea.

15. Additional Information for Users Outside Korea

Users in Japan (Act on the Protection of Personal Information)

• Business handling personal information: OHSUNG SYSTEM CO., LTD. (Address: Room 119, 120, Dongsan-ro 76, Danwon-gu, Ansan-si, Gyeonggi-do, Republic of Korea; Representative: Ji Sunghan)
• Handling of personal information in foreign countries: We are located in the Republic of Korea and handle your personal information in the Republic of Korea. As described in Sections 6 and 7, your personal information may also be handled in the countries where PayPal processes personal information (such as Singapore, as set out in PayPal's privacy statement). The Republic of Korea has enacted the Personal Information Protection Act, which is administered by the Personal Information Protection Commission. Singapore has enacted the Personal Data Protection Act 2012, which is administered by the Personal Data Protection Commission (PDPC). For information on the personal information protection systems of each country, please refer to the information published by the Personal Information Protection Commission of Japan (www.ppc.go.jp).
• Provision to third parties in foreign countries: When we provide personal data to a third party in a foreign country, we will take the measures required by law, such as providing the necessary information and obtaining consent.
• Security control measures: As described in Section 11 and in "Handling of personal information in foreign countries" above.
• Requests regarding retained personal data: To request notification of the purposes of use, disclosure (including disclosure of records of provision to third parties), correction, addition, or deletion, suspension of use or erasure, or suspension of provision to third parties, please contact global@ohsungsys.com using the method described in Section 9.
• Complaints: global@ohsungsys.com

Users in the EU and the UK (GDPR and UK GDPR)

• Controller: the Company (contact: global@ohsungsys.com). PayPal is a separate controller for PayPal accounts and payment method details.
• Legal bases for processing
  • Performance of a contract: account management (including email verification at sign-up), providing the Service (including managing plan usage limits and keeping cloud-saved projects), managing subscriptions, processing subscription payments and refunds, and managing the members of organization (team) accounts (including showing member information to organization admins; consent under Korean law (Section 5) is obtained separately) and applying the organization's plan
  • Compliance with legal obligations: retaining records required by law as described in Section 3, and filing taxes
  • Legitimate interests: maintaining security (including login protection and attempt limits), preventing misuse (including making sure the free trial is provided only once per person), improving the Service (including analyzing sign-up channels), responding to inquiries, and sending invitation emails at the request of organization admins (processing invitees' email addresses)
  • Consent: receiving marketing information, processing information received through the education inquiry form, and use of non-essential cookies and analytics tools (you can withdraw your consent at any time)
• International transfers: The EU and the UK have recognized the Republic of Korea as providing an adequate level of data protection. When we transfer personal information to a country that is not covered by an adequacy decision, we apply appropriate safeguards required by law, such as standard contractual clauses.
• Your rights: You have the right to access, rectification, erasure, restriction of processing, objection to processing, data portability, and withdrawal of consent. You can exercise these rights as described in Section 9.
• Complaints to a supervisory authority: You can lodge a complaint with the supervisory authority of the EU member state where you live or work or where the alleged infringement occurred, or, in the UK, with the Information Commissioner's Office (ICO).

16. Changes to This Policy

If we add to, delete from, or modify this Policy, we will give notice on the Service's website or by other means at least 7 days before the changes take effect. However, if there are material changes that affect your rights, such as changes to the personal information we collect or the purposes of use, we will give notice at least 30 days in advance and, where necessary, obtain your consent again.

This Policy takes effect on October 23, 2026.