Onleave Privacy Policy

Article 1. Purposes of Processing Personal Information

Onleave processes personal information for the following purposes. Personal information is not used beyond these purposes; if a purpose changes, Onleave will take necessary measures such as obtaining separate consent under Article 18 of PIPA.

• ①Membership management — confirming intent to join, identifying and authenticating members for member services, maintaining membership, preventing misuse, sending notices, and handling grievances.
• ②Content and community services — publishing posts, comments, ratings, and images, and providing likes, bookmarks, and author-follow features.
• ③Events — receiving entries, drawing winners, and announcing results.
• ④Stable operation — diagnosing service errors and preventing misuse.
• ⑤Service improvement — analyzing visit statistics, only where the data subject has consented.

Article 2. Personal Information Items Processed

Onleave processes the following items without separate consent based on Article 15(1)4 of PIPA ('conclusion and performance of a contract'). Sign-up is available only through Kakao or Google account login; Onleave does not collect or store passwords of its own.

Onleave also processes the following item with the data subject's consent, based on Article 15(1)1 of PIPA ('consent').

• ·Visit-statistics analysis (service improvement) — service-usage records via the GA4 analytics cookie (pages visited, session duration, online identifiers). Collected only if you choose 'Allow' in the cookie consent banner; declining does not limit your use of the Service.

※ Onleave does not process sensitive information, resident registration numbers or other unique identifiers, or pseudonymized information. Children under 14 may not register; Onleave does not collect children's personal information and will destroy any found to have been collected without delay.

Article 3. Processing and Retention Period

• ①Onleave processes and retains personal information within the retention period required by law or necessary for the conclusion and performance of the contract.
• ②The respective retention periods are as follows.

• ·Where an investigation into a violation of law is in progress, information is kept until that investigation concludes.
• ·Posts and comments not deleted by the user may remain on the Service without identifying the author after account deletion. Delete them beforehand or request removal via the contact in Article 10.

Article 4. Destruction Procedures and Methods

• ①Onleave destroys personal information without delay when it becomes unnecessary, such as upon expiry of the retention period or fulfillment of the processing purpose.
• ②Where information must be preserved under other statutes despite expiry or fulfillment, it is moved to a separate database or storage location.
• ③Procedure: information subject to destruction is identified and destroyed with the approval of the privacy officer.
• ④Method: information in electronic files is permanently deleted using technical methods that make the records irrecoverable.

Article 5. Provision to Third Parties

Onleave does not provide personal information to third parties. Exceptions apply only with the data subject's prior consent or where specifically permitted by law, including Articles 17 and 18 of PIPA, and only to the minimum extent necessary.

Article 6. Delegation of Processing and Overseas Transfer

① Onleave delegates processing as follows, and personal information is transferred abroad because the providers' servers are located overseas. Transfers to Supabase and Vercel are based on Article 28-8(1)3 of PIPA ('delegation/storage of processing necessary for the conclusion and performance of a contract with the data subject'); the transfer to Google LLC (analytics cookie) is based on Article 28-8(1)1 ('separate consent'). The following is disclosed under Article 28-8(2).

• ·Under Article 26 of PIPA, delegation contracts stipulate the prohibition of processing beyond the delegated purpose, technical and managerial safeguards, restrictions on sub-delegation, supervision of the delegatee, and liability, and Onleave supervises the delegatees' safe processing.
• ·Changes to the delegated work or delegatees will be disclosed through this Privacy Policy without delay.
• ·You may refuse the overseas transfers. The transfer to Google LLC (analytics cookie) can be refused by choosing 'Decline' in the cookie consent banner, with no limitation on your use of the Service. Transfers to Supabase and Vercel are essential to providing the Service, so refusal is exercised by deleting your account (profile menu) or requesting deletion via the contact in Article 10; member features will then be unavailable.

Article 7. Measures to Ensure Safety of Personal Information

Onleave takes the following measures to ensure the safety of personal information.

• ①Managerial: access to personal information is limited to the minimum necessary personnel, and processing status is reviewed regularly.
• ②Technical: encryption in transit (HTTPS), authentication-based database access controls with scoped permissions, management of system access rights, and application of security updates.
• ③Physical: Onleave operates no server facilities of its own; personal information is stored in cloud facilities with physical access controls operated by the delegatees (Supabase, Vercel).

Article 8. Installation, Operation, and Refusal of Automatic Collection Devices

• ①Onleave uses cookies, small pieces of information the server sends to your browser, stored on your computer or mobile device and automatically sent back to the server when you access the site.
• ②Essential cookie: a sign-in session cookie, which is necessary for providing member services.
• ③Analytics cookie (only with consent): only if you choose 'Allow' in the cookie consent banner is the Google Analytics (GA4) cookie activated, through which Google LLC collects behavioral information for visit statistics. Advertising signals (ad storage, ad personalization, etc.) remain denied at all times regardless of consent, and declining does not limit your use of the Service.
• ④Some display preferences (such as text size) are stored only in your browser (localStorage) and are never sent to our servers.
• ⑤How to refuse: decline the analytics cookie in the consent banner; a previous choice can be changed by clearing the site data (localStorage) in your browser and revisiting. You can also block cookies entirely via browser settings, though features requiring sign-in will then be unavailable.

Article 9. Rights and Obligations of Data Subjects and Legal Representatives

• ①You may at any time request access to, correction of, deletion of, or suspension of processing of your personal information, or withdraw consent ('exercise of rights').
• ②You can directly view and edit your information or delete your account in the in-service 'Profile' menu, or exercise rights via the contact in Article 10. Onleave responds within 10 days of receiving a request.
• ③Rights may be exercised through a legal representative or an authorized agent; a power of attorney in the form of Annex 11 of the Notification on Personal Information Processing Methods must be submitted. Onleave verifies that the requester is the data subject or a legitimate agent.
• ④Requests for access or suspension may be restricted under Articles 35(4) and 37(2) of PIPA; deletion cannot be requested where the information is designated for collection by other statutes.
• ⑤Onleave does not make automated decisions that materially affect data subjects' rights or obligations (Article 37-2 of PIPA).

Article 10. Privacy Officer and Grievance Handling

① Onleave designates the following privacy officer to take overall responsibility for personal-information processing and to handle related complaints and remedies.

② You may direct all privacy-related inquiries, complaints, and requests for remedy arising from your use of the Service to the contact above. Onleave will respond and act without delay.

Article 11. Remedies for Infringement of Rights

To seek dispute resolution or counseling regarding a personal-information infringement, you may contact the following Korean authorities.

• ①Personal Information Dispute Mediation Committee: 1833-6972 (www.kopico.go.kr)
• ②Personal Information Infringement Report Center: 118 (privacy.kisa.or.kr)
• ③National Police Agency: 182 (ecrm.police.go.kr)

Article 12. Changes to This Privacy Policy

• ①This Privacy Policy applies from August 3, 2026. The previous version (in effect July 8, 2026 – August 2, 2026) predates the disclosure of the business registration details and the named privacy officer; to review it, please request a copy through the contact point in Article 10.
• ②If this policy is amended, the changes and their effective date will be disclosed continuously on this page, with links to previous versions and their applicable periods provided in this article. Changes materially affecting your rights will be announced separately before taking effect.