PRIVACY POLICY · 2026-10-16
Privacy Policy
This is an English translation provided for convenience, published on 2026-10-30. The Korean original is the official version and prevails if the two differ.
FlowCoder (플로우코더) (the "Company") sets out this Privacy Policy under the Personal Information Protection Act of Korea to protect users' personal information and to handle related complaints promptly. This website has no membership sign-up. It processes personal information only through the inquiry form and, if you consent, visit statistics.
1. Purposes of processing
- Inquiry form: responding to inquiries, consultation, and quotes
- Visit statistics (only with consent): To produce website visit statistics (which pages are viewed and how much, and where visitors come from) and use them to improve the website.
We do not use the information for other purposes. If a purpose changes, we will notify you in advance and obtain any required consent.
2. Personal information we process
- Inquiry form (required): Inquiry type, contact name, contact details (at least one of phone number or email), and message
- Inquiry form (optional): Company name, other contact details, budget, and reference link
- Bot protection (Cloudflare Turnstile, loaded only when you start using the inquiry form): IP address, browser information (User-Agent), and connection encryption characteristics (TLS fingerprint). The Company does not store this information.
- Daily inquiry count record: a value made by mixing your IP address with the date so that it cannot be reversed (the original address is not stored)
- Visit statistics (Google Analytics, only if you agree to both collection and use and overseas transfer in the banner at the top of the page on your first visit): A random identifier stored in your browser (cookies such as _ga) · The address of the page viewed (excluding search terms after the address, keeping only campaign tags the company has registered), the previous site's address (domain only), and the time of the visit · Device, browser, and operating system type, screen size, and language · IP address (Google states that it uses it to estimate approximate location at country, region, and city level, and discards the original address after use)
If you do not consent to visit statistics, the analytics tool is not loaded and the visit statistics information above is not processed. The server does not keep separate access logs. See section 8 below for cookies.
3. Processing and retention periods
- Inquiries: kept for 1 year from the date received. They may be destroyed earlier once they are no longer needed after the consultation ends. Inquiries past the retention period cannot be viewed in the admin screen, even before they are destroyed.
- Daily inquiry count record (IP-derived value): destroyed within 2 days.
- Bot protection information: the Company does not keep it. Cloudflare uses it for bot checks and to improve bot detection, and keeps it for as long as needed for those purposes (Cloudflare Privacy Policy, Korea addendum).
- Database recovery records: kept by Cloudflare for up to 30 days in case of failure and then deleted automatically. If data is restored from these records, inquiries past the retention period are destroyed again.
- Visit statistics: Visitor-level records are kept by Google for 2 months and then deleted. Browser cookies expire 1 year after your last visit. Totals that cannot identify individuals (such as visit counts) remain as statistics.
4. Destruction procedure and method
Personal information past its retention period is deleted from the database by an automated job that runs every hour. Destroyed information is deleted so that it cannot be recovered, and it is not printed on paper. Google deletes visitor-level visit statistics records after the retention period (2 months), and if you withdraw consent, the visit statistics cookies in this browser are deleted immediately.
5. Provision to third parties
The Company does not provide users' personal information to third parties, except where otherwise specifically provided by law. Cloudflare may also process bot protection information on its own to improve bot detection (see sections 6 and 7 below). Visit statistics are processed by Google on our behalf (see sections 6 and 7 below).
6. Outsourcing of processing
| Processor | Work outsourced |
|---|---|
| Cloudflare, Inc. | Website server operation, inquiry storage (database), bot protection (Turnstile), and forwarding of email sent to the Company's address (admin@flow-coder.com) |
| Google LLC | Visit statistics (Google Analytics, only with consent) |
Inquiry notifications are received through Discord, but they contain no personal information (only "1 new inquiry" and the inquiry type).
7. Overseas transfer
The website, database, bot protection, and company email forwarding are processed on the facilities of Cloudflare, Inc., a US company, so personal information is transferred overseas as described below. Legal basis: Article 28-8(1)(3) of the Personal Information Protection Act (outsourcing and storage for concluding and performing a contract, disclosed in this policy). Recipient: Cloudflare, Inc. (data protection contact dpo@cloudflare.com).
Visit statistics are transferred to Google LLC only with your consent. Legal basis: Article 28-8(1)(1) of the Personal Information Protection Act (separate consent of the data subject, obtained separately from consent to collection and use in the banner at the top of the page on your first visit. You can choose each one in the banner settings, or agree to both collection and use and overseas transfer with "Accept all"). Recipient: Google LLC (1600 Amphitheatre Parkway, Mountain View, CA 94043, USA · privacy contact googlekrsupport@google.com).
| Category | Items transferred | Destination | Timing and method | Purpose | Retention |
|---|---|---|---|---|---|
| Inquiry storage | Items entered in the inquiry form | One Cloudflare data center in the Asia-Pacific region (this region was requested when the database was created, and Cloudflare decides the exact country. It does not move after creation) | When the form is submitted, sent over HTTPS | Keeping and responding to inquiries | 1 year from the date received |
| Request handling | Items entered in the inquiry form, IP address | The Cloudflare data center closest to the user (including in the Republic of Korea) | When you connect or submit, sent over HTTPS | Website operation | Only during processing (the Company does not keep access logs) |
| Bot protection | IP address, browser information (User-Agent), TLS fingerprint | United States, United Kingdom, Singapore, Australia, Germany, Portugal, France, Japan, Canada, Netherlands, United Arab Emirates, India, Mexico, Malaysia, Sweden (Cloudflare group, Cloudflare Privacy Policy, Korea addendum) | When you start using the inquiry form, sent over the network | Bot checks and improvement of Cloudflare's bot detection | The Company does not keep it. Cloudflare keeps it for as long as needed for those purposes (same addendum) |
| Company email forwarding | Email sent to the Company's address (admin@flow-coder.com) (sender address and content) | When email is sent, sent over the network | Email forwarding | ||
| Visit statistics (only with consent) | A random identifier stored in your browser (cookies such as _ga) · The address of the page viewed (excluding search terms after the address, keeping only campaign tags the company has registered), the previous site's address (domain only), and the time of the visit · Device, browser, and operating system type, screen size, and language · IP address (Google states that it uses it to estimate approximate location at country, region, and city level, and discards the original address after use) | Storage and processing: countries with Google data centers: United States, Chile, Uruguay, Belgium, Denmark, Finland, Germany, Ireland, Netherlands, United Kingdom, Taiwan, Singapore, Japan (Google decides which of these to use and does not disclose it). Support and related work: countries of Google affiliates and subprocessors handling Google Analytics: United States, Ireland, Netherlands, United Kingdom, Germany, France, Spain, Portugal, Italy, Switzerland, Denmark, Norway, Sweden, Poland, Czechia, Croatia, Türkiye, Israel, United Arab Emirates, Kenya, India, Singapore, Malaysia, Philippines, Taiwan, Japan, Australia, Canada, Mexico, Colombia, Peru, Brazil, Argentina. (Based on Google's published data center locations and subprocessor list. We update this if the list changes.) | Each time you view a page after consenting, sent over the network (HTTPS) | Visit statistics | Visitor-level records are kept by Google for 2 months and then deleted. Browser cookies expire 1 year after your last visit. Totals that cannot identify individuals (such as visit counts) remain as statistics. |
You can refuse overseas transfer. To refuse transfers related to inquiries, do not use the inquiry form or email, and contact us by post (B1, 26 Hongyureung-ro 248beon-gil, Namyangju-si, Gyeonggi-do, Republic of Korea, FlowCoder (플로우코더)). In that case your inquiry simply will not be received through the website, with no other disadvantage. To refuse the visit statistics transfer, choose "Refuse" in the banner, or withdraw under "Analytics settings" at the bottom of the website (footer) even after consenting. You can use the website and inquiry form as usual without consenting (no disadvantage). Even after consenting, you can withdraw at any time under "Analytics settings" at the bottom of the website (footer).
8. Automatic collection tools (cookies): installation, operation, and refusal
- Visit statistics cookies (_ga and names starting with _ga_): a random identifier that Google Analytics uses to distinguish visitors. They are set only if you agree to both collection and use and overseas transfer in the banner at the top of the page on your first visit. They expire 1 year after your last visit.
- Visit statistics consent record: only "agree" or "refuse" and the date you chose are kept in this browser's storage (nothing that identifies you). If storage cannot be written, only "refuse" is kept in a cookie (fc-analytics-off, 1 year). This is so we do not ask you again.
- Bot protection (Cloudflare Turnstile): cookies essential to the bot check may be used when you use the inquiry form.
How to refuse: choose "Refuse" in the banner, or change your choice under "Analytics settings" at the bottom of the website (footer) even after consenting. The analytics tool is then no longer loaded and the visit statistics cookies are deleted. You can also block or delete cookies in your browser settings. You can still use the website and inquiry form if you refuse cookies (the form's bot check may fail if cookies are blocked).
9. Rights of data subjects and how to exercise them
You may at any time request access to, correction of, deletion of, or suspension of processing of your personal information, and withdraw consent. If you send a request to admin@flow-coder.com, we will verify your identity and notify you of the result within 10 days. You may also make a request through a representative. You can withdraw visit statistics consent directly under "Analytics settings" at the bottom of the website (footer) (the Company cannot link visit statistics records to individual users, so access and deletion requests can be handled only by Google's cookie identifier).
10. Security measures
- Only the two CEOs can log in to the admin screen (Cloudflare Access login plus a server-side check).
- All communication is encrypted with HTTPS.
- IP addresses are not stored in their original form. Only a one-way derived value is kept briefly.
- Information past its retention period is destroyed automatically.
11. Privacy officers
Co-CEOs Cho Yonghyeon, Hyunil Park · admin@flow-coder.com
12. Remedies for infringement
You can seek advice or report a personal information infringement to the Korean agencies below. The phone numbers are for calls within Korea.
- Personal Information Dispute Mediation Committee: 1833-6972 (www.kopico.go.kr)
- Personal Information Infringement Report Center: 118 (privacy.kisa.or.kr)
- Supreme Prosecutors' Office: 1301 (www.spo.go.kr)
- Korean National Police Agency: 182 (ecrm.police.go.kr)
13. Changes to this policy
This policy applies from 2026.10.16. If we change it, we will announce the change on this page with its effective date. Changes from the previous policy (effective 2026.10.14): we added visit statistics with consent (Google Analytics) (sections 1, 2, 3, 4, 6, 7, and 8).