Privacy Policy
Artgraph Privacy Policy
This English version is provided for convenience. If there is any inconsistency between the English and Korean versions, the Korean version will prevail.
Artgraph (hereinafter, the “Operator”) values users’ personal information and complies with the Personal Information Protection Act of the Republic of Korea and other applicable laws and regulations.
This Privacy Policy applies to the mobile games and related services provided by the Operator (collectively, the “Service”). It explains why and how personal information is processed and the measures taken to protect it.
Article 1. Purposes, Categories, and Legal Bases of Processing
The Operator processes the minimum personal information necessary for the following purposes.
| Purpose | Categories of Personal Information | Legal Basis |
|---|---|---|
| User identification, login, and account linkage | Internal user identifier, BACKND member identifier, and, when Google Play Games Services is used, Player ID, authentication result, server authentication code, and nickname | Formation and performance of the Service agreement |
| Provision of game services | Game progress, owned heroes, equipment and items, in-game currency, achievements, rankings, mailbox data, access records, sanction records, and other game-use data | Performance of the Service agreement |
| Verification of in-app purchases, purchase restoration, and refunds | Purchased product, purchase date and time, app marketplace order number, receipt or purchase token, and purchase or refund status | Performance of a contract and compliance with legal obligations |
| Service operation, quality improvement, and security | IP address, access date and time, access logs, device model, operating system, app version, language and country settings, app installation identifier, error, crash and diagnostic information, and Service-use records | Performance of the Service agreement and the Operator’s legitimate interests |
| Service analytics and statistics | App launches, screen transitions, button selections, game events and usage records, acquisition source, and campaign information | The Operator’s legitimate interests or user consent where required |
| Advertising and advertising performance measurement | Advertising identifiers such as ADID and IDFA, IP address, device and app information, ad impressions, clicks, views and reward information, and diagnostic information | Processing permitted by law or user consent where required |
| Customer inquiries and complaint handling | Email address, internal user identifier or nickname, inquiry details, attachments, device information, operating system, and app version | Processing requested by the user or user consent |
The Operator does not directly collect or store payment method information such as card or bank account numbers. Such information is processed directly by app marketplace payment providers, including Google Play.
The information above may be generated automatically during use of the Service, entered directly by the user, or processed through third-party SDKs and platforms integrated into the Service.
Article 2. Retention Periods
The Operator destroys personal information without undue delay when the purpose of processing has been achieved. Personal information may be retained for a longer period when required by law or separately notified to the user.
| Information or Record | Retention Period |
|---|---|
| Member identifiers and game data | Until account deletion is completed |
| Account information where the BACKND withdrawal function is used | Until the seven-day withdrawal grace period expires. If withdrawal is canceled by logging in during the grace period, the information is retained until account deletion |
| Google Play Games Services server authentication code | Until authentication is completed, after which it is destroyed without undue delay |
| General customer inquiry records | One year after the inquiry is resolved |
| Access records used for security and prevention of improper use | Three months from creation |
| Firebase Analytics data | The period configured in the Firebase console, generally set by the Operator to no longer than 14 months |
| Firebase Crashlytics error and crash data | In accordance with the applicable service provider’s retention policy |
| Advertising-related information | Generally not separately stored by the Operator and retained by advertising providers under their respective privacy policies |
| Records concerning labeling and advertising | Six months |
| Records concerning contracts or withdrawal of offers | Five years |
| Records concerning payment and supply of goods or services | Five years |
| Records concerning consumer complaints or dispute resolution | Three years |
Information retained under applicable law is stored separately and is not used for any purpose other than the legally required purpose.
Article 3. Provision to Third Parties
The Operator does not provide users’ personal information to third parties in principle, except where:
- the user has given prior consent;
- applicable law specifically requires or permits such provision;
- the provision is necessary to deliver a service requested by the user; or
- a competent investigative or administrative authority makes a lawful request.
Where an overseas advertising SDK directly collects information from a user’s device or acts as an independent controller, the relevant processing is described in Articles 5 and 6.
Article 4. Outsourcing of Personal Information Processing
The Operator may outsource personal information processing as follows to provide the Service efficiently.
| Service Provider | Outsourced Work | Retention Period |
|---|---|---|
| AFI Inc. (BACKND) | Member authentication and account management, storage and operation of game data, receipt verification, service operation, and incident response | Until account deletion or termination of the outsourcing agreement, unless a longer period is required by law or the applicable service policy |
| Google LLC (Firebase Analytics, if used) | Service analytics and statistics | The period configured in the Firebase console |
| Google LLC (Firebase Crashlytics, if used) | App error and crash analysis and service stability improvement | In accordance with the applicable service policy |
| Google LLC (Firebase Database or Storage, if actually used) | Service data storage and system operation | Until account deletion, a deletion request, or termination of the outsourcing agreement |
Any Firebase function not used by the released app must be removed from this table.
When entering into an outsourcing agreement, the Operator includes provisions required by Article 26 of the Personal Information Protection Act, including restrictions on processing beyond the outsourced purpose, safeguards, restrictions on re-outsourcing, supervision, and liability.
Article 5. Overseas Processing and Transfers
Personal information may be transferred overseas or directly collected and processed by overseas providers through SDKs and platforms integrated into the Service.
1. Google LLC
- ServicesGoogle Play Games Services, Firebase, and Google AdMob
- Processing countriesUnited States and other countries where Google LLC and its service providers operate.
- Information processedUser or player identifiers, authentication information, IP address, app installation identifier, advertising identifier, device and app information, Service-use records, advertising interactions, and diagnostic information
- PurposesLogin and account linkage, Service operation and analytics, error diagnosis, advertising and performance measurement, and fraud prevention
- Timing and methodTransferred over an encrypted network when the relevant function is used or the SDK is executed
- Legal basisOutsourcing or storage necessary to provide the Service, or user consent where required by law
- RetentionUntil the relevant purpose is fulfilled or the applicable Google service retention period expires
- ContactGoogle Privacy Help Center
2. Unity Technologies
- ServicesUnity Ads or Unity LevelPlay, if actually used
- Processing countriesUnited States and other countries where Unity Technologies and its service providers operate.
- Information processedAdvertising identifier, IP address, device and app information, ad impressions, clicks, views and other interactions, app-use duration, and diagnostic information
- PurposesAdvertising, frequency capping, performance analysis, fraud prevention, and service stability
- Timing and methodTransferred over an encrypted network when an ad is requested, displayed or viewed, or when the relevant SDK is executed
- Legal basisProcessing permitted by law or user consent where required
- RetentionUntil the purpose is fulfilled or for the period specified in Unity’s privacy policy
- Privacy contactDPO@unity3d.com
Users may withdraw consent to optional processing or personalized advertising through in-app privacy or advertising settings, the device’s advertising privacy settings, or the customer support email address.
Refusing overseas processing that is essential for login or game-data storage may restrict account linkage, data restoration, or other parts of the Service. Refusing advertising processing may result in non-personalized or limited advertising instead of personalized advertising.
Article 6. Online Behavioral and Advertising Information
The following online behavioral information may be processed for advertising and advertising performance measurement.
| Provider | Information That May Be Processed | Purpose |
|---|---|---|
| Google AdMob | Advertising identifier, IP address, device and app information, ad impressions, clicks, video views, and diagnostic information | Advertising, frequency capping, performance analysis, and fraud prevention |
| Unity Ads or Unity LevelPlay | Advertising identifier, IP address, device and app information, advertising interactions, app-use duration, and diagnostic information | Advertising, performance analysis, retention analysis, security, and fraud prevention |
Where consent is required by law, personalized advertising is provided only after consent has been obtained. Users who do not consent may receive non-personalized or limited advertising.
Users may restrict or reset advertising identifier use through:
- privacy or advertising settings in Android or iOS;
- advertising or privacy settings provided in the app;
- app tracking permission settings provided by the operating system; or
- a processing objection submitted to the customer support email address.
Menu names and locations may vary depending on the device and operating system version.
Article 7. Rights of Users and How to Exercise Them
Users may exercise the following rights regarding their personal information:
- request confirmation and access;
- request correction or deletion;
- request suspension of processing;
- withdraw consent; and
- delete the account and associated game data.
Requests, including account deletion requests, may be submitted through:
- the in-game menu: Settings > Account Management > Delete Account;
- account deletion requests by email: help@artgraph.kr.
When rights are exercised through an agent, the Operator may verify proper authority, including by requesting a power of attorney. The Operator may also request the minimum information necessary to verify the requester’s identity.
Deletion or suspension requests may be restricted where retention is required by applicable law.
Article 8. Personal Information of Children Under 14
Where consent is legally required to process personal information of a child under 14, the Operator obtains consent from and verifies the child’s legal representative.
If no legally compliant parental consent process is available, the Operator does not provide children under 14 with features that require consent, such as account registration or personalized advertising.
Article 9. Destruction of Personal Information
Personal information is destroyed without undue delay when the retention period expires or the purpose of processing is achieved.
Electronic files are deleted using methods that make restoration or reproduction impracticable. Any paper records are shredded or incinerated.
Information that must be retained by law is separated from other information and destroyed after the applicable retention period expires.
Article 10. Security Measures
The Operator implements the following measures to prevent loss, theft, leakage, falsification, alteration, or damage:
- minimization of personnel and access privileges;
- management of access rights to personal information systems;
- encryption during transmission;
- retention of access records and prevention of unauthorized alteration;
- maintenance of current security software and SDK versions;
- incident response and recovery procedures; and
- periodic review of processors and third-party services.
Article 11. Privacy Officer and Remedies
The Operator designates the following contact to oversee personal information processing and respond to complaints and requests.
Privacy Officer: Representative of Artgraph
Access request and complaint contact: Representative of Artgraph
Email: help@artgraph.kr
Users may also contact the following independent organizations for consultation or remedies:
- Personal Information Infringement Report Center: 118
- Personal Information Dispute Mediation Committee: 1833-6972
These organizations are independent of the Operator. Requests concerning Artgraph should first be submitted to help@artgraph.kr.
Article 12. Automated Decision-Making
The Operator does not make decisions that materially affect a user’s rights or obligations solely through automated processing.
Statistical or automated processing that does not materially affect legal rights or obligations may be used for advertising recommendations, content placement, or game balance analysis.
Article 13. Changes to This Privacy Policy
If this Privacy Policy is added to, deleted, or amended, the Operator will generally provide notice through an in-game announcement or official webpage at least seven days before the effective date.
Material changes affecting user rights will be announced at least 30 days in advance or handled through a separate consent process where required by law.