Privacy Policy
KustodyFi Co., Ltd. (the "Company") establishes and discloses the following Privacy Policy in accordance with the Personal Information Protection Act and other relevant laws, in order to protect the personal information of its users and to promptly handle related grievances.
1. Purposes of Processing Personal Information, Items Processed, and Processing and Retention Periods
The Company processes personal information for the purposes set out below. The personal information processed will not be used for any purpose other than those set out below, and where the purpose of use is changed, the Company will take the measures necessary, such as obtaining separate consent, pursuant to Article 18 of the Personal Information Protection Act.
A. Items of personal information processed without the consent of the data subject
Legal basis | Category | Purpose of processing | Items processed | Retention period |
|---|---|---|---|---|
Personal Information Protection Act, Article 15(1)4 | Membership registration and account management | Verification of intent to register, account creation and authentication, account maintenance, prevention of unauthorized use, notices | Name, e-mail address, OAuth identifier (provider-specific account identifier, e-mail address), date of birth | Until withdrawal of membership |
Personal Information Protection Act, Article 15(1)4 | Provision of the API/MCP | Issuance and authentication of API Keys, processing of requests, call-volume limits, service security | API key, request logs, called endpoints, timestamps, request volume, IP address | Until withdrawal of membership; provided that usage records necessary for service stability, security, prevention of unauthorized use and response to disputes are stored separately for one (1) year from the date of withdrawal or the date of collection and then destroyed |
Act on Consumer Protection in Electronic Commerce, Etc., Article 6 | Customer support and complaint handling | Confirming and answering inquiries; handling complaints and disputes | Name, e-mail, content of the inquiry, information relating to the account, payment and subscription | 3 years |
Personal Information Protection Act, Article 15(1)4 and Act on Consumer Protection in Electronic Commerce, Etc., Article 6 | Orders, payment processing and management of paid subscriptions | Processing of orders and payments; identification of paid Service users | ID, purchaser information (name, date of birth, e-mail address, country of residence) | 5 years |
B. Items of personal information processed with the consent of the data subject
The Company processes the following items of personal information with the consent of the data subject pursuant to Article 15(1)1 and Article 22(1)7 of the Personal Information Protection Act.
Legal basis | Category | Purpose of processing | Items processed | Retention period |
|---|---|---|---|---|
Personal Information Protection Act, Article 15(1)1 and Article 22(1)7 | Statistics on product/service usage records; development of new services | Compilation of usage statistics and development of new services | Various automatically generated information and service usage records created in the course of using the Service (app usage history, search history, records of improper use, access logs, cookies); information such as posts and other content created by the data subject; device information (OS/screen size, device ID); IP address | Until six (6) months after withdrawal of consent or withdrawal of membership |
2. Scope of the Service and Information Provided
•The Company receives financial institution information — such as traditional foreign exchange (FX) quotes, financial product information and interest rate information — and makes it available for access as received, and additionally provides analytical content produced on that basis in accordance with its proprietary models and published methodologies (comparisons by maturity, annualized conversions, curve construction and interpolation, historical statistical analysis and the like). Analytical content is limited to technical and computational analysis, does not include market outlooks or investment or trading recommendations, and is not designed to be used as a binding reference (benchmark) for contracts, settlement, clearing or valuation.
•The services to which this Policy applies are limited to financial institution information and analytical content relating to traditional foreign exchange (FX); digital-asset and blockchain-based ("on-chain") products are not within its scope.
3. Provision of Personal Information to Third Parties
•The Company processes the personal information of data subjects only within the scope specified in Section 1 (Purposes of Processing Personal Information), and provides personal information to third parties only where Article 17 or Article 18 of the Personal Information Protection Act applies — for example, with the consent of the data subject or under a special provision of law.
•The Company does not provide the personal information of data subjects to the partner financial institutions or market data vendors from which it receives raw financial institution information. However, aggregated or de-identified statistics from which individuals cannot be identified (for example, aggregated demand or usage statistics) may be provided.
•Where a data subject accesses the Service via an AI platform (such as Claude or ChatGPT), this Policy does not apply to information that the AI platform independently collects and processes; the privacy policy of that AI platform applies instead.
4. Outsourcing of Personal Information Processing
The Company outsources personal information processing tasks as follows.
Trustee | Outsourced task |
|---|---|
Amazon Web Services, Inc. | Operation of cloud infrastructure (server hosting and account authentication processing for the operation of the Service) |
When entering into an outsourcing agreement, the Company specifies in the contract or other document, pursuant to Article 26 of the Personal Information Protection Act, matters such as the prohibition on processing personal information for any purpose other than performing the outsourced task, technical and administrative safeguards, restrictions on sub-outsourcing, management and supervision of the trustee, and liability including compensation for damages; and the Company supervises whether the trustee processes personal information safely.
5. Rights and Obligations of Data Subjects and Their Legal Representatives, and How to Exercise Them
1.A data subject may exercise rights against the Company at any time, including the right to request access to, correction or deletion of, or suspension of the processing of, their personal information.
2.The rights under Paragraph 1 may be exercised against the Company in writing, by e-mail or by facsimile (FAX) pursuant to Article 41(1) of the Enforcement Decree of the Personal Information Protection Act, and the Company will act on such requests without delay.
3.The rights under Paragraph 1 may be exercised through an agent, such as the data subject’s legal representative or a duly authorized person. In such case, a power of attorney in the form of Annexed Form No. 11 of the Enforcement Rule of the Personal Information Protection Act must be submitted.
4.A request for access to personal information or for suspension of processing may be restricted or refused pursuant to Article 35(4) and Article 37(2) of the Personal Information Protection Act.
5.Deletion may not be requested in respect of personal information that other laws expressly require to be collected or retained.
6.Where a data subject makes a request for access, correction or deletion, or for suspension of processing, the Company verifies whether the person making the request is the data subject or a duly authorized agent.
6. Processing of the Personal Information of Children and Adolescents
The Company’s Service is intended for users aged 18 or older. The Company does not permit persons under 18 years of age to register as members or to use the Service, and does not intentionally collect the personal information of persons under 18 years of age.
If the Company becomes aware that it has collected the personal information of a person under 18 years of age, it may delete such personal information without delay, or restrict that person’s membership registration and use of the Service, except where retention is required under relevant laws. A legal representative may exercise rights in respect of the minor’s personal information — including access, correction, deletion and suspension of processing — through the Company’s Privacy Officer or the responsible department.
7. Destruction of Personal Information
•Where personal information becomes unnecessary — for example, because the retention period has elapsed or the purpose of processing has been achieved — the Company destroys it without delay.
•Where personal information must continue to be retained under other laws even though the retention period consented to by the data subject has elapsed or the purpose of processing has been achieved, the Company stores such personal information separately from other personal information.
•The procedures and methods for destroying personal information are as follows.
–Destruction procedure: The Company identifies the personal information in respect of which grounds for destruction have arisen and destroys it upon the approval of the Company’s Privacy Officer.
–Destruction method: Information in electronic file form is deleted using technical methods that make the records irreproducible; personal information recorded or stored on paper is destroyed by shredding or incineration.
8. Measures to Ensure the Security of Personal Information
The Company takes the following measures to ensure the security of personal information.
•Administrative measures: establishment and implementation of an internal management plan, regular employee training and the like.
•Technical measures: management of access rights to the personal information processing system and the like, installation of an access control system, encryption of unique identifying information and the like, and installation of security programs. The Service is operated on industry-standard cloud infrastructure (Amazon Web Services), through which additional physical and network-level security controls are provided. Accounts created through third-party login (Google is currently supported) do not store passwords; authentication is performed using OAuth tokens issued by that provider.
•Physical measures: access control for the computer room, document storage room and the like.
9. Installation and Operation of Devices that Automatically Collect Personal Information, and Refusal Thereof
•The Company uses "cookies", which store usage information and retrieve it from time to time, in order to provide individually customized services to users.
•A cookie is a small amount of information that the server (http) operating a website sends to the user’s computer browser. It is stored on the data subject’s PC or mobile device and is automatically transmitted from the data subject’s browser to the server when the website is accessed. The Company uses cookies for the purposes of session authentication, remembering preference settings and understanding aggregated usage patterns, and does not use them for third-party targeted advertising.
•Users have a choice as to the installation of cookies and may, by setting the options in their web browser, allow all cookies, be asked for confirmation each time a cookie is stored, or refuse the storage of all cookies. However, if the storage of cookies is refused, difficulties may arise in using some parts of the Service.
10. Privacy Officer
The Company designates a Privacy Officer as set out below, who has overall responsibility for matters relating to the processing of personal information and who handles data subjects’ complaints and provides remedies in connection with the processing of personal information.
▶ Privacy Officer — Name: In-woo Kang; Title: Chief Executive Officer; Contact: support@kustodyfi.com
Data subjects may direct to the Privacy Officer or the responsible department any inquiries, complaints or requests for remedies relating to the protection of personal information that arise in the course of using the Company’s Service. The Company will respond to and handle data subjects’ inquiries without delay.
11. Remedies for Infringement of the Rights and Interests of Data Subjects
In order to obtain relief from an infringement of personal information, a data subject may apply for dispute resolution or counselling to bodies such as the Personal Information Dispute Mediation Committee or the Personal Information Infringement Report Center of the Korea Internet & Security Agency. For other reports of, or counselling on, personal information infringement, please contact the organizations set out below.
•Personal Information Dispute Mediation Committee: 1833-6972 (no area code) — www.kopico.go.kr
•Personal Information Infringement Report Center: 118 (no area code) — privacy.kisa.or.kr
•Supreme Prosecutors’ Office: 1301 (no area code) — www.spo.go.kr
•National Police Agency: 182 (no area code) — ecrm.cyber.go.kr
Where a data subject considers that their rights or interests have been infringed as a result of the processing of personal information, the data subject may seek relief pursuant to Article 35 (Access to Personal Information), Article 36 (Correction or Deletion of Personal Information) and Article 37 (Suspension of Processing of Personal Information, Etc.) of the Personal Information Protection Act. For further details, please refer to the website of the Personal Information Protection Commission.
If you require a report or counselling, please contact the responsible department set out in Section 10 (Privacy Officer).
12. Changes to This Privacy Policy
This Privacy Policy takes effect on September 9, 2026.