Privacy Policy

Effective date: 2026-10-26 · Revision history

Duolabs (the "Company") complies with the Personal Information Protection Act and related laws, and establishes and discloses this Privacy Policy to protect the rights of data subjects.

Article 1. Purpose of Processing

The Company processes personal data for the following purposes and does not use it for any other purpose.

• Receiving and responding to inquiries: name, email, phone, company, inquiry details
• Consultation & quotes: project consultation and estimates in response to your inquiry (information received for this purpose is not used to send advertising messages)
• Receiving updates (only if you opt in): sending Duolabs news emails such as development cost guides and technical resources (name, email)
• Website analytics: improving the service based on self-collected anonymous visit, acquisition, and conversion statistics together with Google Analytics reports (not used for personalized advertising or advertising profiles)
• Advertising performance measurement: self-collected statistics, together with Naver search ads' conversion measurement tool, on whether visitors arriving from online ads submit an inquiry, used to evaluate ad efficiency (not used to target individual users with personalized ads)

Article 2. Processing and Retention Period

• Inquiry handling: 1 year after the inquiry is answered (to review inquiry history and handle follow-up questions)
• If a contract is concluded: the period required by applicable law (e.g., E-Commerce Act Art. 6)
• Anonymous usage analytics events: 24 months from collection
• Ad attribution stored with an inquiry (UTM parameters, ad click identifiers): the same period as that inquiry
• Google Analytics events: the retention period configured in Google Analytics (up to 14 months)
• Naver search ad conversion data: the period set out in NAVER Corp.'s privacy policy
• Consent to receive updates: until you withdraw it. Every two years from the date you consented, we will remind you that you have agreed to receive them
• Destroyed without delay upon a data subject's deletion request

Article 3. Cookies and Automatic Collection

We do not use cookies that collect behavioral information for personalized advertising. For visitor analytics, a randomly generated anonymous visitor ID is stored in local storage, while a randomly generated session ID and first-touch attribution are stored in session storage. First-touch attribution may include campaign parameters carried in ad links (such as utm_source) and click identifiers that ad platforms append to links (fbclid, gclid); these values do not identify you and are used only to count which ad brought the visit. When you submit an inquiry, the first-touch attribution at that moment is stored together with the inquiry. Usage statistics are also collected with Google Analytics, which stores analytics cookies in your browser (_ga and cookies beginning with _ga_) to tell visitors apart. These cookies hold the anonymous visitor ID above and visit timestamps, and last up to 2 years. This information is not used for advertising profiles, and the name, email, and other details you enter in the contact form are never sent to Google Analytics. You can refuse or delete cookies in your browser settings, and you can block collection with Google's Google Analytics opt-out browser add-on (tools.google.com/dlpage/gaoptout). For Naver search ad conversion measurement, a script provided by NAVER Corp. also stores cookies in your browser (such as _fwb), through which the pages visited, acquisition source, ad click information, and whether an inquiry was completed are sent to Naver. These cookies can be refused or deleted through the same browser settings. Refusing cookies does not restrict your use of the website. Otherwise, we use only the minimum cookies/local storage needed to operate the service (login session and display theme).

Article 4. Provision to Third Parties & Entrustment

As a rule, the Company does not provide personal data to outside parties. However, to operate the service, it processes (entrusts) data as follows.

• Telegram Messenger Inc.: real-time inquiry notifications. Items provided are name, email, phone, company, and inquiry details, destroyed after the inquiry is resolved.
• Cloudflare, Inc.: website traffic delivery and security (CDN/tunnel). Processed data is connection information such as the visitor's IP address, handled only to the extent necessary for reliable service and security.
• Google LLC: website usage statistics (Google Analytics). Processed data is the visitor's IP address, browser, device and operating system information, pages visited, acquisition source, and the anonymous visitor ID. Contact form details such as name and email are not sent.
• Meta Platforms, Inc.: conversion measurement for Meta (Facebook/Instagram) ads via the Conversions API. Only when you submit an inquiry after arriving from a Meta ad, we send the ad click identifier (fbclid), the time of the inquiry, and your IP address and browser information from our server. Name, email, phone, and inquiry details are not sent, and no Meta Pixel or cookie is installed in your browser.
• NAVER Corp.: conversion measurement for Naver search ads. To measure whether visitors arriving from Naver ads visit and complete an inquiry, a script provided by Naver sends your IP address, browser information, pages visited, acquisition source, Naver ad click information, and the identifier stored in its cookie to Naver. Name, email, phone, and inquiry details are not sent.

* Telegram, Cloudflare, Google, and Meta are overseas (U.S.) services; the above information may be processed on overseas servers. Telegram and Cloudflare are entrusted processing necessary to handle your inquiry (in the course of entering into a contract), Google Analytics is entrusted processing for website usage statistics, and Meta for ad conversion measurement. This disclosure in the Privacy Policy serves as notice of the overseas transfer under Article 28-8(1)3 of the Personal Information Protection Act. Their privacy policies: telegram.org/privacy · cloudflare.com/privacypolicy · policies.google.com/privacy · facebook.com/privacy/policy · policy.naver.com

Article 5. Destruction of Personal Data

When the retention period expires or the purpose is achieved and the data is no longer needed, it is destroyed without delay; electronic files are permanently deleted in an irrecoverable manner.

Article 6. Rights of Data Subjects and How to Exercise Them

Data subjects may exercise the following rights at any time: access, correction, deletion, and suspension of processing. Consent to receive updates can be withdrawn at any time through the unsubscribe instructions in any email you receive from us, or by email request.

• How to exercise: email ceo@duolabs.co.kr We will notify you of the outcome within 10 days of receipt.

Article 7. Personal Data Items Collected

• [Contact form] Required: name, email, inquiry details
• [Contact form] Optional: phone, company
• [Contact form] Optional: whether you consented to receive updates, and when
• [Automatically collected] anonymous visitor/session IDs, path, language, first-touch referrer domain, UTM campaign values (utm_source, utm_medium, utm_campaign, utm_term, utm_content), ad click identifiers (fbclid, gclid), and event timestamp
• [Contact form · attached automatically] first landing path, referrer domain, UTM campaign values, ad click identifiers, and session ID at the time of submission (used to see which ad or channel the inquiry came from)
• [Automatically collected · Google Analytics] IP address (used to estimate an approximate region), browser, device and operating system information, pages visited, acquisition source, the anonymous visitor ID, and the identifier stored in the analytics cookie (_ga)
• [Automatically collected · Naver search ad conversion measurement] IP address, browser information, pages visited, acquisition source, Naver ad click information, the identifier stored in its cookie (such as _fwb), and whether an inquiry was completed

Under Article 15(1)4 of the Personal Information Protection Act (measures taken at the data subject's request in the course of entering into a contract), the Company collects and uses the above information without separate consent, solely to respond to your inquiry. If use beyond this purpose is needed (such as sending advertising information), we obtain separate prior consent. You may request deletion or suspension of processing at any time, as described in Article 6.

Article 8. Data Protection Officer

• Officer: Seojin Hong (CEO)
• Email: ceo@duolabs.co.kr

Article 9. Changes to This Policy

This policy applies from its effective date. If there are changes due to law or policy, they will be announced on the website at least 7 days before they take effect.

Article 10. Remedies for Infringement

• Personal Information Dispute Mediation Committee: 1833-6972 (www.kopico.go.kr)
• Privacy Infringement Report Center: 118 (privacy.kisa.or.kr)
• Supreme Prosecutors' Office: 1301 (www.spo.go.kr)
• National Police Agency: 182 (ecrm.cyber.go.kr)