SetFN Privacy Policy

Effective Date: September 1, 2025

Your file is yours

SetFN (“Company,” “we,” “us,” or “our”) built SetFN SpaceBuilder as a local-first file management system to realize this philosophy.

We respect your right to control your personal information and comply with applicable privacy laws, including the Personal Information Protection Act of the Republic of Korea, the EU General Data Protection Regulation (GDPR), and U.S. privacy laws (including state laws such as California’s CCPA/CPRA).

This Privacy Policy applies to SetFN’s global services and includes additional, region-specific disclosures where required.

Summary (Quick Read)

Guided by our “Your file is yours” philosophy, we protect personal information across all SetFN services.

SetFN Account (Website)

• You create an account with an email address and password.
• We collect basic technical data (e.g., browser type, language) to ensure compatibility and support.
• Except for payment processors (Stripe/PayPal/Toss Payments), we do not share your email with third parties.
• We email only license confirmations and important service updates.
• You can delete your account at any time; account data and licenses are permanently removed.

SetFN SpaceBuilder (Desktop Software)

• All files are stored locally on your computer and are not sent to our servers.
• We cannot access your files or data—and, by design, we technically cannot.
• For license activation we collect minimal information: email, device ID, and IP address.
• SpaceBuilder may connect to the internet to validate license keys and check for updates.
• When you enable external access (*.setfn.me), we store IP addresses to route connections to your PC.

SetFN SpaceBuilder Beta

• Beta features may be unstable and can change without notice.
• We may request feedback to improve features, but only with your consent.
• Even during Beta, your files remain on your computer.

SetFN Community

• Joining the community requires an ID (email) and password.
• We do not share community information with third parties.
• Community posts and interactions must follow the community guidelines.

1. Purposes of Processing Personal Information

We process personal information to:

• Issue and manage SetFN SpaceBuilder software licenses
• Authenticate users and verify identity
• Respond to inquiries and provide technical support

2. Personal Information We Process and Retention Periods

2.1 Categories of Personal Information

When creating a SetFN Account (website)

Required:

• Email address, password, nickname
• Service usage records, device information
• IP address (for license validation and preventing duplicate use)
• Browser information (User Agent)
• Language settings for localization

Optional:

• Country/region

Purpose:

• Authentication and identity verification
• Prevent license misuse and enhance security
• Technical support, service improvement, and localization

Legal bases (where applicable, e.g., GDPR):

• Performance of a contract (account creation and authentication)
• Legitimate interests (fraud prevention and security)

When activating a SetFN SpaceBuilder license

Required:

• Device identifiers, license key, activation details, email address

Optional:

• Operating system, device location

Purpose:

• License authentication and prevention of duplicate use
• User identification and account linkage

Legal basis:

• Performance of a contract (software license validation)

When using the external access service for SetFN SpaceBuilder

Required:

• IP address, port information, connection status

Optional:

• None

Purpose:

• Provide secure connectivity from outside to the user’s PC
• Network routing and security management

Legal basis:

• Performance of a contract (providing the external access service)

When joining the SetFN Community

Required:

• ID, password, nickname

Optional:

• Email address

Purpose:

• Community account creation and user identification
• Managing community activity and communication

Legal basis:

• Performance of a contract (community services)

Identity verification (for users under the applicable age or where identity checks are required)

Required:

• Name, date of birth, mobile number, nationality, CI (hashed unique identifier), DI (duplicate registration check value)

Paid services

Korea (Toss Payments):

• Approval numbers and transaction details

PayPal:

• PayPal account info, approval numbers, transaction details

Other processors:

• Payment data as provided by the relevant payment service

Refunds

Required:

• Refund account info (account number, account holder, bank), email address

Customer Support

• Additional information may be collected to resolve your inquiry.

2.2 Retention Periods

• License-related data: up to 3 years after the license term ends
• Customer support data: up to 3 years after the inquiry is resolved

3. How We Process Personal Information

3.1 SetFN SpaceBuilder (Local File Management)

• SpaceBuilder is local-first.
• Files and account data within SpaceBuilder are managed on your own computer and are not transmitted to our servers.
• We cannot technically access file contents or user records inside your local SpaceBuilder.

3.2 License Management

We collect only the minimum information necessary for license issuance and validation:

• Email address (license issuance and identification)
• Device information (authenticating genuine licenses and preventing duplicate use)

3.3 External Access Service (*.setfn.me)

• When enabled, we process IP and port information to provide secure routing to your PC.
• This information is used solely to provide the service and is deleted when the service is disabled or ends.
• You may disable external access at any time; related information is deleted immediately upon deactivation.

4. Sharing and Processing by Third Parties

4.1 Sharing Personal Information

We do not share personal information except:

• With your prior consent; or
• As required by law or pursuant to lawful requests from authorities.

4.2 Service Providers (Processing on Our Behalf)

Payment Processing (Korea)

• Processor: Toss Payments Co., Ltd.
• Purpose: Payment processing, authentication, refunds
• Data: Payment amount, payment method details, transaction records
• Retention: As required by law or until the processing agreement ends

Global Payment Processors

• Processors: PayPal Holdings, Inc. and other payment services
• Purpose: Payment processing, authentication, refunds
• Data: Payment amount, payment method details, transaction records
• Retention: As required by law or until the processing agreement ends

Identity Verification (Korea)

• Processor: Authorized Korean identity verification providers
• Purpose: Identity, age, and legal guardian consent verification
• Data: Name, date of birth, mobile number, CI, DI
• Retention: Deleted immediately after verification or as required by law

4.3 International Data Transfers

For PayPal and other overseas processors

• Recipient: PayPal Holdings, Inc. (United States)
• Data: Payment-related information
• Purpose: Payment processing and fraud prevention
• Retention: As described in the recipient’s privacy policy

5. Children’s Privacy

5.1 Consent from Legal Guardians

Where we process personal information of children below the applicable age threshold, we obtain consent from the child’s legal guardian in accordance with local law.

5.2 Guardian Rights

Guardians may refuse consent or withdraw it at any time and can request suspension of processing.

5.3 Global Thresholds (Overview)

Korea: Under 14 (PIPA; and, where applicable, the Network Act)
United States: Under 13 (COPPA)
European Union: Under 16 (member states may set between 13–16) — GDPR Art. 8
Other Countries: As required by local law; if unclear, we apply under-13 as a conservative default

6. Your Rights and How to Exercise Them

6.1 Common Rights (All Regions)

You may request:

• Notice of processing activities
• Access to your personal information
• Correction or deletion
• Restriction or suspension of processing

6.2 Additional, Region-Specific Rights

Republic of Korea

• Rights under PIPA, including claims for damages and collective dispute mediation

California, USA (CCPA/CPRA)

• Right to know/access and deletion
• Right to correct
• Right to opt out of the sale or sharing of personal information
• Non-discrimination for exercising your rights
• Right to use an authorized agent

European Union (GDPR)

• Data portability
• Right to object to automated decision-making
• Right to lodge a complaint with a supervisory authority

6.3 How to Exercise Your Rights

• Email: support@setfn.com

We respond without undue delay and within the timelines required by law
(Korea: within 10 days; U.S.: within 45 days; EU: within 1 month).

7. Deletion of Personal Information

7.1 Procedure

After the purpose of processing is fulfilled, we move personal information to a separate database or segregate it, then delete it after the period required by our policies or applicable laws.

7.2 Timing

• When a retention period expires: within 5 days after the end of the period
• When the information is no longer necessary: within 5 days after it is deemed unnecessary

8. Safeguards to Protect Personal Information

We implement technical, administrative, and physical safeguards as required by applicable laws in each region we operate.

8.1 Technical Measures

Korea (PIPA Art. 29)

• Access control and authorization management
• Network access controls
• Encryption of personal information
• Security software installation and updates

United States (FTC guidance and applicable state laws)

• Encryption in transit and at rest
• Firewalls and intrusion detection
• Regular vulnerability assessments and patching
• Multi-factor authentication

European Union (GDPR Art. 32)

• Pseudonymization and encryption
• Ongoing confidentiality, integrity, availability, and resilience
• Rapid restoration of access after incidents
• Regular testing and evaluation of security measures

8.2 Administrative Measures

Korea

• Minimization and training of personnel who handle personal information
• Access rights management for handlers

United States

• Security awareness training
• Separation of duties and least-privilege access
• Periodic audits and risk assessments

European Union

• Data Protection Impact Assessments (DPIA), where required
• Appointment of a Data Protection Officer (DPO), where required
• GDPR training for staff and contractors
• Records of processing activities (Art. 30)

8.3 Physical Measures

• Physical access controls to data centers
• Controlled entry to server rooms and CCTV monitoring
• Secure storage of backups
• Disaster recovery and fire protection plans

8.4 Incident Response and Notifications

Korea

• Report to the Personal Information Infringement Report Center and notify affected users
• Notify the Personal Information Protection Commission where required

United States

• Notification to relevant state authorities (e.g., California AG) and affected individuals as required by state law

European Union (GDPR Arts. 33–34)

• Notify the supervisory authority within 72 hours where required
• Notify affected individuals without undue delay where there is a high risk

9. Data Protection Officer (DPO) / Contacts

9.1 Data Protection Officer

• Name: Name
• Title: Title
• Contact: Email, Phone

9.2 Privacy Team / Contact Point

• Department: Department
• Contact: Email, Phone

10. Remedies

If you believe your rights have been infringed, you may contact the following:

Korea

• Personal Information Protection Commission: privacy.go.kr, 182
• Korea Internet & Security Agency (KISA): privacy.kisa.or.kr, 118
• Supreme Prosecutors’ Office Cybercrime Division: spo.go.kr, +82-2-3480-3573
• National Police Agency Cyber Bureau: cyberbureau.police.go.kr, 182

United States

• Federal Trade Commission (FTC): consumer.ftc.gov
• State Attorneys General

European Union

• Your national Data Protection Authority (DPA)
• European Data Protection Board (EDPB): edpb.europa.eu

11. Cookies

We use cookies on the SetFN website to support essential functionality and improve user experience, while keeping collection minimal.

11.1 What are cookies?

Cookies are small text files placed on your device when you visit the SetFN website.

11.2 Types of cookies we use

1. Strictly Necessary Cookies (required)
   Enable core site functions. Without them, requested services cannot be provided.
   Used for:

• Maintaining login sessions and authentication
• Ensuring correct service routing during site changes
• Security (e.g., CSRF protection)

2. Functional (Personalization) Cookies (optional)
   Remember preferences to improve your experience, e.g.:

• Language, theme (dark/light), layout
• Remembering whether pop-ups/notices have been shown
• Recording cookie consent state
• Displaying login status

3. Analytics (Statistical) Cookies (optional)
   Help us understand how the site is used (e.g., visited pages, errors).
   We do not use these to identify individuals and use them only to improve the site, e.g.:

• Website usage metrics and analysis
• Page views and user counts
• Error logging
• A/B testing of designs

11.3 What we do not collect

• No cross-site tracking: We do not track your activity on other websites.
• No SpaceBuilder telemetry: We do not collect local file contents or usage patterns from SetFN SpaceBuilder.

11.4 Managing cookie choices

• Strictly necessary cookies: cannot be disabled as they are required for the site to function.
• Functional cookies: you may accept or reject; rejecting may limit convenience features.
• Analytics/marketing cookies: opt-in; we ask for consent upon your first visit.

11.5 Browser-level controls

You can manage cookies through your browser settings (Chrome, Edge, Firefox, Safari, etc.), both on desktop and mobile, to allow, block, or delete cookies.

12. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will post changes at least 7 days before they take effect where required. The updated policy applies from the effective date indicated.