Privacy Policy
Effective date: April 19, 2026
ActuallyWorks Co., Ltd. ("Company", "we", "us") operates the Unveily service. This Privacy Policy explains how we collect, use, share, and protect personal data, and describes your rights under the GDPR, Japan's APPI, Australia's Privacy Act, and South Korea's PIPA.
1. Data Controller
ActuallyWorks Co., Ltd.
Representative: Hyunju No
Address: 10F-1003-377, Hyowon Major Building, 1449 Jungang-ro, Ilsanseo-gu, Goyang-si, Gyeonggi-do, 10387, Republic of Korea
Email: [email protected]
2. Personal Data We Collect
- Account data: Email address, display name — provided via Google OAuth 2.0 or Apple Sign-In
- Company profile: Company name, local name, contact email and phone, billing address, country, tax / business registration number — entered by the user
- App identity: Android package name, iOS Bundle ID, app signature hash — entered by the user
- Billing data: Subscription tier, payment status, transaction date, amount, currency. Card numbers are stored exclusively by Lemon Squeezy; we never receive or store them.
- Audit logs: License key access events (developer email address, timestamp)
- Server logs: IP address, request timestamp — retained for security purposes only
3. Purposes and Legal Basis (GDPR Art. 6)
| Purpose | Legal basis |
|---|---|
| Provide and operate the Service | Performance of contract (Art. 6(1)(b)) |
| Process payments and issue invoices | Performance of contract (Art. 6(1)(b)) |
| Issue and manage SDK licenses | Performance of contract (Art. 6(1)(b)) |
| Send transactional emails | Legitimate interests (Art. 6(1)(f)) |
| Fraud prevention and security | Legitimate interests (Art. 6(1)(f)) |
| Comply with legal obligations | Legal obligation (Art. 6(1)(c)) |
4. Data Retention
- Account and company data: Deleted within 30 days of account closure
- Payment records: 5 years (statutory accounting obligations)
- Audit logs: 12 months
- Server access logs: 3 months
5. Sub-Processors
We do not sell personal data. We share it only with the following sub-processors under contractual data protection obligations:
| Sub-processor | Purpose | Location |
|---|---|---|
| Google LLC | Authentication, cloud infrastructure (servers, database) | South Korea (GCP Seoul) |
| Lemon Squeezy LLC | Subscription billing and invoice management | United States (EU SCCs) |
| Resend Inc. | Transactional email delivery | United States |
| Apple Inc. | Authentication (Sign in with Apple) | United States |
6. International Transfers
Our primary infrastructure is in South Korea (GCP Seoul region). Transfers to sub-processors in the United States are covered by EU Standard Contractual Clauses (SCCs) or equivalent safeguards.
7. Your Rights
| Right | GDPR | APPI (Japan) | PIPA (Korea) | Australia |
|---|---|---|---|---|
| Access your data | ✓ | ✓ | ✓ | ✓ |
| Correct inaccurate data | ✓ | ✓ | ✓ | ✓ |
| Delete your data | ✓ | ✓ | ✓ | — |
| Restrict / suspend processing | ✓ | ✓ | ✓ | — |
| Data portability | ✓ | — | — | — |
| Object to processing | ✓ | ✓ | ✓ | — |
To exercise any right: [email protected] — we respond within 30 days.
Supervisory authorities:
- EU/EEA: Your local data protection authority
- Japan (PPC): www.ppc.go.jp
- South Korea (PIPC): www.pipc.go.kr
- Australia (OAIC): www.oaic.gov.au
8. Security
- All data in transit encrypted with TLS 1.2+
- Secrets and encryption keys stored in GCP Secret Manager
- License key access protected by time-limited master key and audit-logged
- Least-privilege access control on all production systems
9. Cookies
We use only strictly necessary session cookies for authentication. No tracking or advertising cookies.
10. Children
The Service is for businesses only. We do not knowingly collect data from individuals under 16.
11. Changes
Material changes will be communicated at least 30 days before they take effect via email or in-service notice.
12. Contact
Email: [email protected]
ActuallyWorks Co., Ltd., 10F-1003-377, Hyowon Major Building, 1449 Jungang-ro, Ilsanseo-gu, Goyang-si, Gyeonggi-do, 10387, Republic of Korea