LOWARCHIVE · PRIVACY · 2026-08-30-legal-review-draft-v2

Privacy Policy

This policy explains what personal data LowArchive processes, why and how long it is retained, and how you can exercise your rights.

Data, purpose, and retention by activity

Activity	Main data	Purpose and basis	Retention
Account and authentication	Email, username, display name, region, language, consent history, sessions, security events	Registration, verification, sign-in, recovery, security, and contract performance	Deleted or anonymized at closure; links, codes, and sessions expire on their shorter schedules
Order, payment, and supply	Order contact/address, items, amounts, status, payment identifiers, delivery and refund records	Contract performance, payment, fulfilment, refund, and statutory records	Five years for contract, withdrawal, payment, and supply records
Contact and disputes	Reply details, message, linked order/licence, replies, and handling history	Response and consumer complaint or dispute handling	Three years while support is active, one year after resolution or closure; statutory dispute records remain for three years
Licence and device	Product/version entitlement, stable ownership principal, device identifier, status, and timestamps	Download, activation, upgrade, revocation, and abuse prevention	For the valid right and required legal period; relinkable identifiers remain separated and protected
Reviews and images	Rating, text, benefit label, report/moderation evidence, optional images	Verified review publication, editing, reporting, and appeal	Hidden immediately on author deletion with a 30-day deletion grace; resolved report and moderation evidence remains for one year
Site analytics	Daily aggregate route/referral category, click target, engagement band, and viewport band	Improve service flows and interface quality	400 days; no visitor identifier or IP is written to the analytics database
Marketing	Email and consent type/version/time	Optional news and offer messages	Until withdrawal or closure; separate from transaction and security email

1. Controller and contact

LowArchive processes personal data to provide the service. Requests for access, correction, deletion, restriction, withdrawal, or other privacy rights may be sent through Contact, Support, or the configured customer-service email shown below. The controller and rights-request contact are shown consistently in this policy and the site footer.

2. Accounts and authentication

Registration and security use email, username, display name, region, language, policy type/version/time, sessions, and security events. Password plaintext is not stored. The data supports verification, sign-in, recovery, session management, abuse prevention, and account preferences.

3. Orders, payment, and delivery

Orders may use customer and recipient names, email, phone, shipping address and notes, items, price, discount, tax, currency, and order/payment status. Provider transaction identifiers and status may be stored, but raw card numbers and security codes are not. Delivery uses carrier identifiers, tracking numbers, and normalized status and timestamps; raw carrier responses are not retained.

4. Software and licences

Downloads and activation use product, version and entitlement scope, licence status and term, a stable ownership principal, device activation identifier and label, last-check time, and release/file integrity evidence. Raw device data is minimized. Processing supports grants, revocation, upgrades, subscription eligibility, fraud prevention, and support.

5. Returns, contact, support, and reviews

A physical or mixed-item return or exchange may use a reason, pickup address, and up to three optional JPEG, PNG, or WebP photos of no more than 5 MiB each. Contact and support may process name, reply email, category, subject, message, linked order or licence, replies, and attachments. Verified reviews use rating, text, language, benefit disclosure, and optional images. Internal notes are separated from customer replies. Images are re-encoded to remove EXIF and GPS data, with visibility limited to the relevant feature.

6. Cookies, security logs, and analytics

Essential cookies and browser storage support sign-in, cart, and language. Request time, IP address, session identifiers, and error logs may support security and rate limiting; an analytics-request IP is used only by an in-memory 60-second rate limiter and is not written to D1. Public-page views, referral category, explicit clicks, 10/30/60/180-second engagement bands, and mobile/tablet/desktop bands are stored only as daily aggregates without a visitor identifier and deleted after 400 days. Collection is disabled by Do Not Track, Global Privacy Control, or the exclusion cookie, and on admin, account, order-lookup, and preview routes. Advertising tracking is not currently used.

7. Retention

Authentication data, the general profile, addresses, and marketing consent are deleted or anonymized when account closure completes. Korean e-commerce records are separated and retained for five years for contracts, withdrawal, payment, and supply; three years for complaints and disputes; and six months for advertising. One-time links, codes, and rate-limit data expire shortly after their purpose. A valid legal hold preserves only its defined scope.

8. Perpetual rights after closure

A valid perpetual licence or ownership right may remain as a stable ownership principal separated from direct account identifiers. Privacy safeguards continue to apply where that principal could be relinked, and it is not linked to a new member profile until a one-time verified recovery flow succeeds. After legal transaction-retention periods, contact, address, and provider identifiers are deleted or de-identified while only necessary amount, status, item snapshot, and entitlement evidence remains.

9. Processors and external services

Cloudflare provides Workers, D1, private R2, and security; return and support source photos are stored in private R2 without a public object URL. Brevo sends authentication and transaction email; NICEPAY and PayPal process payment; Delivery Tracker uses the tracking number to supply shipment status. Only the minimum operational data is sent through a browser redirect, hosted checkout, or server API, depending on the feature. External processing is described in the table below and in any feature-specific notice.

Service	Processing	Route
Cloudflare	Workers, D1, private R2, Turnstile, and access protection	Browser and server, depending on feature
Brevo	Authentication, order, security, and licence transaction email	Server API
NICEPAY and PayPal	Payment authorization, cancellation, refund, and status	Checkout/redirect and server API/webhook
Delivery Tracker	Shipment lookup using carrier and tracking number	Server API
JUSO road address	Korean address search	Server proxy; raw search terms are not retained
BBaton	Age verification where a product requires it	Browser redirect and server verification; minimum evidence retained
GitHub	Moru, Naru, and Siru release metadata and source installer	Server synchronization and mediated download

Where international transfer applies, the related notice identifies the recipient, country, fields, purpose, timing, method, retention, and refusal method.

10. Disclosure and international transfer

Personal data is not sold or disclosed arbitrarily without consent, contractual necessity, or another lawful basis. Where an international transfer applies, the relevant notice describes the transferred fields, country, recipient, purpose, timing, method, retention, refusal method, and effect of refusal.

11. Your rights

After identity verification, you may request access, portability where applicable, correction, deletion, restriction, withdrawal, and account closure. If another person's rights, legal retention, or security justifies a limit, the reason and appeal path will be explained. Marketing withdrawal is separate from transactional messages needed for accounts, orders, security, and licences.

12. Destruction and security

Data is deleted in a manner intended to prevent recovery when its purpose or retention period ends, while legally retained records are separated. Controls include least privilege, stronger administrator authentication, encrypted transport, secret separation, audit logs, input and file validation, bounded retries, and incident response. A transient private-R2 deletion failure is retried with exponential spacing up to five times, after which automatic repetition stops and the item is isolated for operator review.

13. Changes and effective date

Changes are published with their reason and effective date. Material changes to user rights receive reasonable advance notice and an individual notice path; processing requiring consent does not begin before consent. Previous versions and their effective dates remain available.

Rights-request contact

You or a lawful representative may use Contact, Support, or hello@lowarchive.com. Identity or authority is verified before the result, any lawful restriction, and the appeal path are explained.