EN
Sign in

LEGAL · PRIVACY

Privacy policy

Information required for email accounts, retention criteria, and self-service account deletion.

Draft for review before public registration · 2026-09-04

1. Scope and current status

This notice covers email registration, sign-in, and account deletion on the SEOHA website. Public registration is currently on hold. Product purchases, payments, trials, device activation, and marketing subscriptions are not connected to website accounts. Creating an account does not start a trial.

Separately from invitations, administrators may grant or revoke per-product access for registered accounts. Product Manager and supported products check these rights when signed in with the same account. Granting access alone does not initiate a payment or trial.

The criteria below describe planned operations based on implemented features. Details of overseas processing, external service retention, and live operational verification remain outstanding; this is not a final effective policy.

Website registration is limited to people aged 14 or older. Age is self-confirmed during registration, not verified using a date of birth or identification document. Registration with a legal guardian's consent for children under 14 is not provided.

2. Information processed and purposes

  • Account management: email address, random account identifier, first verification, registration and most recent sign-in timestamps, and the accepted terms version. Used for identity verification and account services.
  • Email verification: email address, request identifier, request and expiry timestamps, delivery status, verification attempt count and usage timestamp, and hashes of the verification code, browser, email address, and IP address. Used for verification and preventing excessive requests.
  • Sign-in persistence: account and session identifiers, session token hash, and creation, expiry, and revocation timestamps. Used to verify sign-in and end sessions.
  • Product access: account identifier, product, access status and revision, change request identifier, processing timestamp, and the administrator account identifier. Used to check, grant, revoke, and review the history of product access.
  • Security checks: Cloudflare Turnstile and hosting services may process connection IP addresses, browser, device, and request-related information. SEOHA authentication request tables store an IP hash instead of the original IP address.
  • Support and privacy enquiries: sender email address, enquiry and response content, and user-supplied attachments are used to respond and confirm the outcome. Do not send verification codes, passwords, or unnecessary identification copies.

Account forms do not collect names, phone numbers, dates of birth, separate passwords, or card details. Verification codes and sign-in tokens are not stored in plaintext in the account database. Verification codes do appear in outgoing email bodies, which is separate from database storage.

3. Account and support enquiry retention

  • Account information: retained while the account is in use and deleted from the operational database once identity-verified account deletion is complete.
  • Product access and change history: retained while the recipient account is in use and deleted with that account. If only an administrator who made a change deletes their account, that administrator's identifier is removed while the recipient account's access history remains.
  • Sign-in sessions: valid for up to 30 days. Sign-out deletes that session; account deletion removes all sessions. Expired sessions cannot be used for authentication and are removed during the next scheduled cleanup.
  • Verification requests: codes are valid for 10 minutes. Records older than 24 hours from the request time are periodically removed, regardless of use or failure. Account deletion also removes records for that email address.
  • General support enquiries: retained for 90 days after resolution, then deleted. This is separate from account deletion; the 24-hour authentication-request rule does not apply. The person responsible manually clears the mailbox and attachments. There is currently no automatic deletion feature.

Scheduled cleanup is configured to run every 15 minutes, with additional cleanup on authentication requests. Successful scheduled execution on the production server has been confirmed. Failure handling and removal of actual expired records are to be verified before public registration. These criteria concern operational account data; they do not mean that external service logs and backups below expire at the same time.

Retention grounds and periods for future payment and dispute records will be established and announced separately. The general enquiry policy does not set retention periods for payment records.

4. Account deletion and privacy requests

Account page: sign in by email and select ‘Delete account’. After completing email verification within the last five minutes, enter the email address again and select ‘Confirm and delete’. If verification is older, sign in again. Signing in again alone does not delete the account.

Deleting an account removes the account, all its sign-in sessions, and email verification requests, as well as its product access, change history, and administrator privileges. It does not delete plugins, projects, or personal library files on the computer.

Requests by the individual or a lawful representative for access, correction, deletion, or suspension of processing, and enquiries about difficulties deleting an account, should be sent to privacy contact 배성환 at support@seoha-plugins.com . Only the minimum information needed to verify the requester will be used. Do not send verification codes or passwords. Live receipt at the support address is a pre-registration verification item.

5. External services and overseas processing

SEOHA uses Cloudflare, Inc. Workers for site operation, D1 for account data, Email Service for verification emails, and Turnstile for security checks. Payment processors are not currently connected to accounts.

  • Workers and D1: process account requests and store account, authentication, and session information.
  • Email Service: processes verification email recipient and sender addresses, subject, body, and delivery status. The body contains a one-time verification code.
  • Turnstile: uses connection IP addresses, browser and communication signals, and site identifiers for security checks. SEOHA does not include the registration email address in Turnstile verification requests.
  • Support enquiries: routed through Cloudflare Email Routing to the operator's Naver mailbox. Enquiries are handled in that mailbox, not the account database.

Processing may take place on overseas infrastructure. Actual processing and transfer countries, timing and methods, recipient contacts, retention periods, applicable grounds, and refusal methods are being checked against contracts and settings. Public registration will not open before these details are finalised and disclosed.

Turnstile distinguishes security processing for customers from processing to improve Cloudflare's own services. For details, see Cloudflare Turnstile privacy information .

6. Deletion, backups, and safeguards

Account deletion removes the account and associated authentication data together from the operational database. If an outage or other issue prevents confirmation, deletion is not shown as complete and a recheck is requested. HTTPS, server-side authentication checks, access restrictions, and cookies with security attributes are used.

Cloudflare D1 may retain point-in-time recovery history. Official guidance describes recovery windows of seven or 30 days depending on the plan; deleting an account does not immediately delete all backups. Body-preview storage for the authentication email domain is currently disabled. This does not remove all records, such as email delivery processing or delivery status. External log retention, the actual recovery history window, and procedures to prevent deleted information from being served again after restoration will be finalised before public registration.

7. Sign-in cookies

Sign-in cookies last up to 30 days, and browser-verification cookies used during email verification last up to 10 minutes. HttpOnly, Secure, and SameSite attributes are applied. Sign-out or account deletion expires the account cookies in that browser. Blocking cookies may prevent sign-in and verification. These account features do not create advertising or marketing cookies.