Webtory Privacy Policy
> Effective: 2026-11-02
the WebTory operator ("Webtory") follows the Korean Personal Information Protection Act and the privacy laws of the country where you live (EU/UK GDPR, Japan APPI, and others).
1. What we collect
| When | Data |
|---|---|
| Social login | Account ID from the login provider, name or nickname, email (if the provider shares it) |
| Using the service | Your saved website projects and images, content saved in member tools (such as mind maps), country of access, chosen language, access logs, cookies |
| Creator market (buying) | Order number, item bought, amount, payment method type, payment reference from the payment company (Webtory never receives card numbers) |
| Creator market (selling) | Creator name and bio (public); for paid sellers, legal name, bank, account number and holder, business number or PayPal email (encrypted) |
| Client reviews | Client email addresses invited by the maker (optional), memos, drawings and names left by the client, access log (country and device type, no IP address) |
| Usage statistics (anonymous) | Pages viewed, referring site (domain only), country, device and browser type, how often editor features are used (for example which block types are added) |
Usage statistics are anonymous. We use no cookies for them and do not store IP addresses or browser details. To avoid counting the same visitor twice in one day, we create a short-lived anonymous fingerprint that changes every day and is deleted within two days. The text and images of your websites are never used for statistics. For signed-in members we record only the days they used the service, to count active members and return rates.
We do not collect passwords, national ID numbers, or payment details.
2. Why we use it
To identify you, save your website projects, show the right language, prevent abuse, answer questions, and improve the service. Usage statistics help us improve the service. GDPR legal bases: contract, legitimate interests, and consent for advertising cookies and for visitor de-duplication for EU/EEA, UK and Swiss visitors.
3. How long we keep it
- Account and websites: deleted immediately when you delete your account (My info → Delete account)
- Accounts unused for 1 year: deleted or stored separately after notice
- Market payment, refund and payout records: 5 years as required by Korean e-commerce law (kept after account deletion; usage rights are deleted immediately). Creator payout details: 5 years after the last payout, for tax records
- Review links with their memos, drawings and invited emails: deleted 30 days after the link expires, or immediately when the maker deletes them or the site. Review access logs: 90 days
- Anonymous visitor fingerprints: deleted within 2 days. Member activity days: deleted after 400 days, or immediately when you delete your account. Daily aggregate numbers (not linked to anyone): up to 2 years
- Longer only where a law requires it
4. Service providers and international transfers
| Company | Purpose | Location |
|---|---|---|
| Toss Payments Co., Ltd. | Market payments and creator payouts | Korea |
| Cloudflare, Inc. | Servers and storage (data kept encrypted) | USA and data centers worldwide |
| Google (AdSense) | Ads in the editor | USA |
| Kakao (AdFit) | Ads in the editor (Korean visitors only) | Korea |
| Coupang (Partners) | Product ad links (Korean visitors only) | Korea |
| Anthropic, PBC | WebTory AI text (only what you ask is sent; not used for training) | USA |
| Google LLC (Gemini API) | WebTory AI images and video (paid tier; not used for training) | USA |
| Google LLC (Sign-in) | Google sign-in | USA |
| Resend, Inc. | Notice and confirmation emails | USA |
Data is transferred over the network each time you use the service. We do not sell your data or share it with anyone else unless the law requires it.
5. Cookies
We use a login cookie (30 days). Usage statistics use no cookies; if EU/EEA, UK or Swiss visitors do not consent, we do not create the daily fingerprint and only count totals. Ad partners may use cookies for advertising; visitors from the EU/EEA, UK and Switzerland are asked for consent first.
6. Your rights
You can access, correct, delete, restrict, or export (project file) your data at any time. Contact us below and we will reply within 10 days. EU/UK users may complain to their local supervisory authority.
Children under 14 (or the age set by your country, 13–16 in the EU) may not sign up.
7. Security (encryption)
- All traffic is encrypted with HTTPS.
- Your login ID, name, email, and saved website projects are stored encrypted with AES-256. Even if server data leaked, it could not be read without the key.
- Login IDs are looked up only by a keyed hash, and login session tokens are stored only as hashes.
- Encryption keys are kept separately from the data, and admin accounts use two-factor authentication.
- Admins do not view your website projects, and emails are masked on admin screens.
- Access logs do not contain personal data.
8. Contact
Privacy officer: WebTory operator · Email: privacy@webtory.app (or the in-app support inquiry)
9. Changes
We announce changes in the editor 7 days before they take effect (30 days for important changes).