Privacy Policy
Effective September 9, 2026
Pay4World Inc. (the "Company") establishes and discloses this Privacy Policy under Article 30 of the Personal Information Protection Act of Korea to protect the personal information of data subjects and to handle related complaints promptly. This policy applies to the website www.pay4world.net (the "Site") operated by the Company. The privacy policy for the PayForward mobile app is provided separately inside the app.
Article 1 (Purposes of Processing)
The Company processes personal information for the purposes below and does not use it for any other purpose. If a purpose changes, the Company takes the necessary measures under Article 18 of the Act, such as obtaining separate consent.
- Launch notifications — sending news and advance notice about the PayForward app launch by email
- Inquiries and partnerships — replying to inquiries and partnership proposals received by email
- Site operation and security — managing access logs, handling errors, and preventing and responding to abuse and security incidents
Article 2 (Items Collected and Method of Collection)
- Launch notification sign-up (the Site's form): email address, language preference (Korean/English), and the time of sign-up
- Inquiries and partnerships (email): the sender's email address and the contents of the message
- Automatically collected information: while you access the Site, the hosting provider's servers may record your IP address, browser type, access time, and the page requested.
The Company does not use visitor analytics tools or advertising trackers. Cookies are described in Article 10.
Article 3 (Processing and Retention Period)
The Company processes and retains personal information within the period required by law or agreed to by the data subject.
- Launch notification sign-ups: until launch notices have been sent. If you ask to unsubscribe, the information is destroyed without delay, and in any case no later than six months after the app's official launch.
- Inquiry and partnership records: one year from the date the reply is completed
- Access logs: three months under the Protection of Communications Secrets Act
Article 4 (Provision to Third Parties)
The Company processes personal information only within the purposes in Article 1 and does not provide it to third parties except with the data subject's separate consent or where specifically required by law. The processors in Article 5 are entrusted processors, not third-party recipients.
Article 5 (Entrustment of Processing)
To provide the service smoothly, the Company entrusts the following processing tasks and supervises each processor under Article 26 of the Act so that personal information is handled safely.
| Processor | Entrusted task |
|---|---|
| Supabase, Inc. | Database hosting (storage of launch notification sign-ups) |
| Vercel, Inc. | Website hosting and content delivery |
| Amazon Web Services, Inc. (sub-processor of Supabase) | Database infrastructure (Seoul region, ap-northeast-2) |
Any change to the entrusted tasks or processors will be disclosed through this policy without delay.
Article 6 (Cross-Border Transfer)
Launch notification sign-ups are stored in a database in the Seoul region of the Republic of Korea (AWS ap-northeast-2). However, because the processors in Article 5 are companies located in the United States that may access and process that data to provide the service, the Company discloses the following under Article 28-8 of the Act.
| Item | Details |
|---|---|
| Recipient | Supabase, Inc. / Vercel, Inc. (United States) |
| Items transferred | Email address, language preference, time of sign-up (Supabase) / data processed while serving requests (Vercel) |
| Time and method | Transmitted over the network at the time of sign-up or access |
| Recipient contact | privacy@supabase.io / privacy@vercel.com |
| Purpose and retention | The purposes in Article 1 and the retention periods in Article 3 |
You may refuse the cross-border transfer by contacting us at the address in Article 11. If you refuse, you will not be able to receive launch notifications.
Article 7 (Destruction Procedure and Method)
- Personal information whose retention period has elapsed or whose purpose has been achieved is destroyed without delay.
- Electronic files are deleted in a way that prevents recovery, and printed documents are shredded or incinerated.
Article 8 (Rights of Data Subjects and Legal Representatives)
- You may at any time request access to, correction or deletion of, or suspension of the processing of your personal information, and you may withdraw consent (unsubscribe from launch notifications).
- Requests may be sent by email to the Privacy Officer in Article 11, and the Company will act without delay.
- Rights may also be exercised through a legal representative or an authorized agent, in which case the Company verifies the agent's authority.
- Requests for access or suspension may be limited under Article 35(4) and Article 37(2) of the Act.
Article 9 (Security Measures)
- Data minimization: launch notifications require only an email address and a language preference.
- Access control: the database is protected by row-level security (RLS), and administrative keys are used only on the server and never exposed to the browser.
- Encryption in transit: all communication with the Site is encrypted over HTTPS.
- Administrator authentication: the admin area is protected by a password and an httpOnly session cookie.
- Internal management: the number of people handling personal information is kept to a minimum and reviewed regularly.
Article 10 (Cookies and Similar Technologies)
The Site uses only the cookies below. It does not use cookies that identify or track visitors, nor analytics or advertising cookies.
- NEXT_LOCALE — a functional cookie that remembers your language choice (Korean/English)
- pf_admin — the login session cookie for the Site administrator. It is set only for administrators, never for ordinary visitors.
You can refuse cookies in your browser settings. Doing so does not affect your use of the Site; only your language choice will not be remembered.
Article 11 (Privacy Officer)
The Company designates the following Privacy Officer to oversee personal information processing and to handle complaints and remedies for data subjects.
- Privacy Officer: Anton Yu, CEO
- Email: anton@bnjpartners.com
- Company: Pay4World Inc., 656-75 Seongsu-dong 1-ga, Seongdong-gu, Seoul 04768, Republic of Korea
Article 12 (Remedies for Infringement)
If you need to report or consult about a personal information infringement, you may contact the following organizations in Korea.
- Personal Information Infringement Report Center (KISA): 118 (no area code), privacy.kisa.or.kr
- Personal Information Dispute Mediation Committee: 1833-6972, www.kopico.go.kr
- Supreme Prosecutors' Office, Cyber Investigation Division: 1301 (no area code), www.spo.go.kr
- Korean National Police Agency, Cyber Bureau: 182 (no area code), ecrm.cyber.go.kr
Article 13 (Changes to This Policy)
This policy takes effect on September 9, 2026. If it is revised due to changes in law, policy, or the service, the changes will be announced on the Site at least 7 days before they take effect (at least 30 days for changes material to your rights).