Privacy Policy

Effective date: 2026-09-11

듀오랩스 (the "Company") complies with the Personal Information Protection Act and related laws, and establishes and discloses this Privacy Policy to protect the rights of data subjects.

Article 1. Purpose of Processing

The Company processes personal data for the following purposes and does not use it for any other purpose.

• Receiving and responding to inquiries: name, email, phone, company, inquiry details
• Consultation & quotes: project consultation and estimates in response to your inquiry (not used for advertising or marketing; separate prior consent is obtained if needed)
• Website analytics: improving the service based on self-collected anonymous visit, acquisition, and conversion statistics together with Google Analytics reports (no analytics cookies, no advertising profiles)
• Advertising performance measurement: self-collected statistics on whether visitors arriving from online ads submit an inquiry, used to evaluate ad efficiency (not used to target individual users with personalized ads)

Article 2. Processing and Retention Period

• Inquiry handling: 1 year after the inquiry is answered (to review inquiry history and handle follow-up questions)
• If a contract is concluded: the period required by applicable law (e.g., E-Commerce Act Art. 6)
• Anonymous usage analytics events: 24 months from collection
• Ad attribution stored with an inquiry (UTM parameters, ad click identifiers): the same period as that inquiry
• Google Analytics events: the retention period configured in Google Analytics (up to 14 months)
• Destroyed without delay upon a data subject's deletion request

Article 3. Cookies and Automatic Collection

We do not use cookies for behavioral analytics. For visitor analytics, a randomly generated anonymous visitor ID is stored in local storage, while a randomly generated session ID and first-touch attribution are stored in session storage. First-touch attribution may include campaign parameters carried in ad links (such as utm_source) and click identifiers that ad platforms append to links (fbclid, gclid); these values do not identify you and are used only to count which ad brought the visit. When you submit an inquiry, the first-touch attribution at that moment is stored together with the inquiry. Usage statistics are also collected with Google Analytics, which is configured not to create cookies (client storage disabled); only the anonymous visitor ID above is passed as the identifier. This information is not used for advertising profiles, and the name, email, and other details you enter in the contact form are never sent to Google Analytics. Otherwise, we use only the minimum cookies/local storage needed to operate the service (login session and display theme).

Article 4. Provision to Third Parties & Entrustment

As a rule, the Company does not provide personal data to outside parties. However, to operate the service, it processes (entrusts) data as follows.

• Telegram Messenger Inc.: real-time inquiry notifications. Items provided are name, email, phone, company, and inquiry details, destroyed after the inquiry is resolved.
• Cloudflare, Inc.: website traffic delivery and security (CDN/tunnel). Processed data is connection information such as the visitor's IP address, handled only to the extent necessary for reliable service and security.
• Google LLC: website usage statistics (Google Analytics). Processed data is the visitor's IP address, browser, device and operating system information, pages visited, acquisition source, and the anonymous visitor ID. Contact form details such as name and email are not sent.
• Meta Platforms, Inc.: conversion measurement for Meta (Facebook/Instagram) ads via the Conversions API. Only when you submit an inquiry after arriving from a Meta ad, we send the ad click identifier (fbclid), the time of the inquiry, and your IP address and browser information from our server. Name, email, phone, and inquiry details are not sent, and no Meta Pixel or cookie is installed in your browser.

* Telegram, Cloudflare, Google, and Meta are overseas (U.S.) services; the above information may be processed on overseas servers. Telegram and Cloudflare are entrusted processing necessary to handle your inquiry (in the course of entering into a contract), Google Analytics is entrusted processing for website usage statistics, and Meta for ad conversion measurement. This disclosure in the Privacy Policy serves as notice of the overseas transfer under Article 28-8(1)3 of the Personal Information Protection Act. Their privacy policies: telegram.org/privacy · cloudflare.com/privacypolicy · policies.google.com/privacy · facebook.com/privacy/policy

Article 5. Destruction of Personal Data

When the retention period expires or the purpose is achieved and the data is no longer needed, it is destroyed without delay; electronic files are permanently deleted in an irrecoverable manner.

Article 6. Rights of Data Subjects and How to Exercise Them

Data subjects may exercise the following rights at any time: access, correction, deletion, and suspension of processing.

• How to exercise: email ceo@duolabs.co.kr We will notify you of the outcome within 10 days of receipt.

Article 7. Personal Data Items Collected

• [Contact form] Required: name, email, inquiry details
• [Contact form] Optional: phone, company
• [Automatically collected] anonymous visitor/session IDs, path, language, first-touch referrer domain, UTM campaign values (utm_source, utm_medium, utm_campaign, utm_term, utm_content), ad click identifiers (fbclid, gclid), and event timestamp
• [Contact form · attached automatically] first landing path, referrer domain, UTM campaign values, ad click identifiers, and session ID at the time of submission (used to see which ad or channel the inquiry came from)
• [Automatically collected · Google Analytics] IP address (used to estimate an approximate region), browser, device and operating system information, pages visited, acquisition source, and the anonymous visitor ID

Under Article 15(1)4 of the Personal Information Protection Act (measures taken at the data subject's request in the course of entering into a contract), the Company collects and uses the above information without separate consent, solely to respond to your inquiry. If use beyond this purpose is needed (such as sending advertising information), we obtain separate prior consent. You may request deletion or suspension of processing at any time, as described in Article 6.

Article 8. Data Protection Officer

• Officer: 홍서진 (CEO)
• Email: ceo@duolabs.co.kr

Article 9. Changes to This Policy

This policy applies from its effective date. If there are changes due to law or policy, they will be announced on the website at least 7 days before they take effect.

Article 10. Remedies for Infringement

• Personal Information Dispute Mediation Committee: 1833-6972 (www.kopico.go.kr)
• Privacy Infringement Report Center: 118 (privacy.kisa.or.kr)
• Supreme Prosecutors' Office: 1301 (www.spo.go.kr)
• National Police Agency: 182 (ecrm.cyber.go.kr)