Featpaper Privacy Policy

1. Scope and Processing Roles

Where the Company is the controller: User personal data

This Policy applies to personal data of Users for which the Company determines the purposes and means of processing, including registration, login, billing and subscription management, Workspace operation, customer support, security, fraud prevention and product improvement.

Where the Company is a processor: Viewer Data

Document view records, lead-form submissions and messages generated or submitted while a Viewer views content or submits a lead form are personal data whose purposes and scope are determined by the User who shared the content. The User is the controller and the Company is a processor that stores, analyzes and displays such data on the User's behalf. The DPA and the User's own privacy policy apply to that processing. The Company does not use Viewer Data beyond the scope of the outsourced processing or disclose it to third parties.

Viewer Data the Company processes independently

For service security, detection of fraud and security incidents and incident response, the Company processes Viewers' IP address, request time, browser and device information and error and security logs independently, on the basis of its legitimate interests (Article 15(1)(6) of the Personal Information Protection Act) and legal obligations. The Company does not use this information for marketing or for cross-analysis between Users. On viewer pages the Company operates only a screen-recording tool for error diagnosis and customer support, with document content and form input masked, and does not operate marketing or behavioral-analytics tools.

2. Personal Data We Process

Viewer Data marked “processed for the User” is controlled by the User; the Company processes it as a processor. The data actually processed depends on the features and settings the User uses. Where no lead form is used, no lead data is processed.

3. Purposes and Legal Bases

Users

• Member management, identity verification, account creation and management, and provision of the Service (performance of a contract)
• Provision of Paid Services, confirmation of subscriptions and transactions, invoicing and customer support (performance of a contract)
• Service security, fraud prevention, and response to outages and security incidents (legal obligation and legitimate interests)
• Provision of AI Features (viewing-data insights and analytics, drafting assistance for visitor follow-up) (performance of a contract)
• Service quality and feature improvement and statistical analysis (legitimate interests; analytics cookies are described in Section 9)
• Service announcements and policy-change notices (performance of a contract)
• Marketing and promotional communications, with prior consent where required by applicable law (consent)
• Compliance with legal obligations and dispute resolution (legal obligation)

Viewer Data (processed for the User)

• Delivery of content, operation of share links and verification of access rights on the User's instructions
• Generation of view records and analytics for the User and display through the User's dashboard and API
• Collection, storage and display of lead data through forms configured by the User, and transmission to external services connected by the User
• Provision of AI Features used by the User (viewing-data insights, drafting assistance)

The legal basis for this processing is secured by the User as controller (consent, performance of a contract or otherwise); the Company processes only within the purposes set out in Article 3 of the DPA.

Viewer Data processed independently by the Company

• Service security, detection of fraud and security incidents, incident response (legitimate interests, legal obligation)

The Company obtains consent where required and otherwise relies on the lawful bases permitted by applicable law, including Article 15(1)(4) (performance of a contract), 15(1)(2) (legal obligation) and 15(1)(6) (legitimate interests) of the Personal Information Protection Act. Where personal data is to be used for a purpose other than those stated, separate consent is obtained.

4. Retention

1. Users: retained until account deletion or termination of the service agreement. After a deletion request, data is kept for thirty (30) days with access blocked to allow recovery from mistaken deletion, and then irreversibly destroyed.
2. Viewer Data (processed for the User): retained for the period determined by the User as controller or until the User's service agreement ends; deleted or returned in accordance with Article 8 of the DPA when the User deletes it in the Service or the processing relationship ends. Technical information processed independently by the Company for security follows the access-log retention period below.
3. The following records are kept separately for the periods required by law.

The Company may destroy the account and personal data of a free-plan account that has not been logged into for twelve (12) months or more, after giving thirty (30) days' notice to the registered email address. Users may request account deletion at any time.

5. Processors and Sub-processors

The Company entrusts the processing of personal data to specialized external providers to the extent necessary to provide the Service. Processing agreements prohibit use beyond the entrusted purpose and impose security measures, sub-processing restrictions, supervision and liability for damages in accordance with applicable law, and the Company supervises its processors.

Where the Company has Viewer Data entrusted by a User processed by any of the above providers, that provider is a sub-processor in relation to the User and Article 6 of the DPA applies. Additions to or changes of sub-processors are disclosed through this Policy.

6. International Transfers

The Company processes and stores personal data outside the Republic of Korea as set out below in order to provide the Service. These transfers rely on Article 28-8(1)(3) of the Personal Information Protection Act (outsourced processing and storage necessary for the performance of a contract) and the information required by law is disclosed as follows.

How to refuse and the consequences: Data subjects may object to these international transfers by contacting dev@wefeat.kr. Because these transfers are essential to the infrastructure, payment and support processing that make the Service possible, refusal may result in account deletion or restriction of the affected features (payment, support, AI Features).

Where a User located outside the Republic of Korea collects personal data of Viewers in Korea using the Company as its processor, that collection is made directly by the User as controller and does not constitute an international transfer by the Company. The User's country and contact details are shown on the viewer notice, and compliance with the extraterritorial application of the Personal Information Protection Act, including appointment of a domestic representative, is the User's responsibility.

AWS regions reflect the Company's current infrastructure (data storage: Seoul; API and log processing: five regions) and this Policy will be updated if that changes.

7. Disclosure to Third Parties

The Company does not disclose personal data to third parties beyond the purposes of processing. Displaying Viewer Data processed as a processor in the controlling User's dashboard or API, or transmitting it to an external service designated by the User, is performance of the outsourced processing and not a disclosure to a third party.

7-1. Transmission to external services on the User's instructions

Where a User connects an external service such as Slack, Notion, Google Sheets or Zapier, the Company transmits lead data and viewing notifications to that service on the User's instructions. The connected service is the User's processor, and the User bears the related notice, disclosure and other legal responsibilities.

The Company may otherwise disclose personal data to the extent permitted by applicable law, such as where required by statute or by a lawful request from a law-enforcement authority; the Company may notify the controlling User of requests relating to entrusted Viewer Data to the extent not prohibited by law.

8. Viewer Data: Structure and Notice

1. The controller of the document view data, lead data and messages processed when a Viewer views content or submits a lead form is the User who shared the content. The Company is a processor acting on the User's instructions.
2. The Company provides a notice screen on lead forms and viewer pages that identifies the User as the data collector by name and contact email (with a link to the User's privacy policy where registered), sets out the items, purposes and retention period, and states that the Company operates the form as the User's processor. Consent is obtained in the User's name; the act of submitting the lead form (“Agree and view document”) together with its time and the notice version is recorded with the view record. The name and contact details are populated automatically from the User's account and Workspace information and may be edited by the User.
3. Where the User is located outside the Republic of Korea, the notice screen shows the User's country and contact details. In that case the Viewer's personal data is collected directly by that User and no international transfer by the Company occurs.
4. Viewers may address requests for access, rectification, deletion or restriction of their personal data to the controlling User. Requests received by the Company (dev@wefeat.kr) are forwarded to the User without delay and the Company supports their fulfilment in accordance with the DPA. Requests concerning technical information processed independently by the Company for security are handled by the Company directly.
5. The Company does not use Viewer Data for purposes outside the outsourced processing and does not operate marketing, behavioral-analytics or advertising tools on viewer pages.

The viewer notice is a separate document from the Terms that apply to Members, and shows only the items relevant to the viewing context and the User's settings.

9. Cookies and Analytics Tools

Cookies and similar technologies we use

• Essential cookies: login session (Amazon Cognito), security, saved settings
• Identifier cookie: a browser-level identifier (ft.sid) that links repeat visits and view records from the same browser. On viewer pages it is used only for viewing analytics performed for the User (outsourced processing).
• Usage analytics: on the Company website and the User dashboard, Google Analytics and Google Tag Manager (Google LLC) collect visit and usage patterns, IP address and browser type using cookies and similar technologies and transfer them to servers in the United States. They are not used on viewer pages (shared-document viewing pages).
• Error-diagnosis tool: Microsoft Clarity (Microsoft Corporation) records screen usage for error diagnosis and customer support. On viewer pages, document content and form input are masked; recordings are not used for marketing or behavioral analysis.
• Customer support: the Intercom messenger sets cookies in the dashboard of logged-in Users.

How to refuse

1. You can refuse or delete cookies in your browser settings (Chrome: Settings → Privacy and security → Third-party cookies; Edge: Settings → Cookies and site permissions; Safari: Preferences → Privacy). Refusing cookies may limit some features, including login.
2. Google Analytics opt-out: Google Analytics Opt-out Browser Add-on. Microsoft Clarity opt-out: Clarity information page or your browser's tracking-prevention settings.
3. Where prior consent for non-essential cookies is required (for example in the EU or UK, determined by the browser time zone), the Company does not load analytics or diagnostic tools or their cookies without consent. Until an opt-in mechanism is offered to users in those regions, these tools are not used for them.

The Company does not provide Users' activity data to third-party advertising providers for targeted advertising.

10. Your Rights and How to Exercise Them

Data subjects, including Users and Viewers, and their legal representatives may exercise rights of access, rectification and deletion, restriction of processing, withdrawal of consent, portability (where applicable) and explanation of or objection to automated decisions, in accordance with applicable law.

1. How: profile information can be viewed and edited in the Service settings. Other requests (access, deletion, restriction, account deletion) may be made in writing, by phone or by email to dev@wefeat.kr or +82-70-8065-4362. The Company will respond within ten (10) days of receipt.
2. Representatives: a legal representative or an authorized agent may exercise these rights by submitting a power of attorney in the form prescribed by the Notice on Methods of Processing Personal Information. The Company verifies that the requester is the data subject or an authorized representative.
3. Limitations: requests for access or restriction may be limited under Articles 35(4) and 37(2) of the Personal Information Protection Act, and deletion may not be requested for data whose collection is required by other laws.
4. Viewers: requests concerning document view data and lead data may be addressed to the controlling User (content provider); requests received by the Company are forwarded to that User and supported in accordance with the DPA. Requests concerning technical information processed independently by the Company for security may be made to the Company at the contact above.
5. Account deletion: request through customer support (hello@wefeat.kr); the Company processes the request after verifying identity.

11. Deletion of Personal Data

1. Personal data is destroyed without delay once the retention period expires or the purpose of processing is fulfilled. Data subject to statutory retention is stored separately and destroyed when the period ends.
2. Electronic files are deleted by technical means that prevent recovery; printed materials are shredded or incinerated.
3. Data that cannot be deleted immediately because of backup-system constraints is access-restricted and deleted according to the backup retention cycle (maximum 35 days).

12. Security Measures

• Encrypted storage of passwords and other sensitive data and encryption in transit (TLS)
• Least-privilege access, role-based access management and controls on internal administrator access
• Management of access and security logs and detection of abnormal access
• Security updates, vulnerability management and incident-response procedures
• Minimization of staff handling personal data, confidentiality obligations and regular training
• Backup and recovery arrangements

13. Privacy Officer and Remedies

Data subjects may submit access requests under Article 35 of the Personal Information Protection Act to the department above, and the Company will handle them promptly. Complaints or consultations regarding infringement of personal data may also be directed to the following Korean authorities.

• Personal Information Dispute Mediation Committee: kopico.go.kr / 1833-6972
• Personal Information Infringement Report Center (KISA): privacy.kisa.or.kr / 118
• Supreme Prosecutors' Office Cybercrime Division: spo.go.kr / 1301
• National Police Agency Cyber Bureau: ecrm.cyber.go.kr / 182

Data subjects in the EU/EEA or UK may also lodge a complaint with their local supervisory authority.

14. Children

The Service is intended for persons aged 14 or older and the Company does not knowingly collect personal data of children under 14. If the Company learns that it has collected such data, it will delete it without delay. Requests concerning a child under 14 must be made by the child's legal representative; minors aged 14 or older may exercise their rights themselves or through a legal representative.

15. Changes to this Policy

When this Policy is amended, the Company will post the effective date, the reasons and a comparison of the current and amended text on the Service or its website from at least seven (7) days before the effective date. Material changes affecting data subjects' rights, such as changes to the items, purposes, disclosures or processors, will be posted at least thirty (30) days in advance and notified by email or other means; changes requiring consent under applicable law will apply only after such consent is obtained. Previous versions are available at version-specific URLs such as /privacy/20260330. This Policy is prepared in Korean; in case of any inconsistency the Korean text prevails.