Privacy policy
Heritage Inc. processes the minimum information needed for inquiries, purchases, device activation and licenses. Drawings are processed on your computer. Activation does not require uploading drawing files or TPM private keys.
1. Information, purposes, grounds and retention
| Information | Purpose and basis | Retention |
|---|---|---|
| Inquiries: name, email, category, message, consent and correspondence. Company is optional. Problem reports also include app version, OS, reproduction steps and expected result. | Customer and technical support / consent | Three years after the inquiry closes |
| B2B inquiries: company, contact, email, PC count, rollout type and timing, selected features, message and reference. Phone, industry and current CAD are optional. | Rollout consultation and quotations / consent | Three years after consultation closes |
| Activation: device identifier, registered public key, registration time, approval and recheck status, transfer and revocation history. Device name, platform, app version and notes supplied during support. | License delivery, device verification, prevention of duplicate use and transfers / contract performance | While needed to maintain the license; unnecessary information is deleted when it ends. Transaction and dispute evidence follows the periods below. |
| Student licenses: school email, domain and school name, verification time, expiry, renewal/payment links and verification-token hash. | Email verification, license delivery and renewal / contract performance | While maintaining the license. Unpaid email verification is valid for 30 days; unnecessary information is deleted when its purpose ends. Transactions: five years. |
| Purchases: order, transaction and receipt identifiers, amount, currency, tax, status, time, verified payer email, license linkage, coupon use, payment-date reference exchange rate, available fee, refund and settlement records. | Payment, licenses, receipts, refunds and accounting / contract performance and legal duties | Contract, withdrawal, payment and supply records: five years; other required records for their statutory period. |
| Refunds: purchase email, payment references, linked device, reason, correspondence and processing history. | Refund handling and dispute resolution / request consent, contract performance and legal duties | Complaints/disputes: three years after closure. Related transactions: five years. |
| B2B device documents: company, contact, email, document ID, device linkage, issuance and delivery status. | Requested registration and approval documents / contract performance | While maintaining the license. Transaction evidence: five years; correspondence: three years after closure. |
| Connection/security: IP, request time and address, browser information and security assessments. Inquiry rate limits use IP and request count. | Site delivery and abuse prevention / service provision and necessary legitimate interests | Inquiry limits expire after ten minutes and are removed from memory within one further minute. External network processing is described in section 3. |
You may refuse or withdraw consent for inquiries, but the form cannot be submitted without the required consent. Optional fields may be left blank. Required device/payment data is needed for the corresponding activation or purchase service. New purposes require the appropriate legal basis and procedures.
2. Collection and drawing files
Information comes from forms, emails you send, app registration/recheck requests and payment-provider responses. School email verification checks access to the mailbox, not enrollment records held by a school. Standard and student license data use the same protected license storage and backup system.
Drawings and diagnostics are not submitted automatically; inquiry forms have no attachment facility. File support is arranged separately with an agreed scope. B2B request previews, downloads and printing are processed in your browser. Do not include identification numbers, passwords, private keys, full card numbers or third-party confidential material.
3. Sharing, providers and international processing
We do not sell or disclose personal information for advertising. Disclosure outside the stated purpose requires consent or another legal basis. The services currently used are:
| Provider | Processing | Retention and contact |
|---|---|---|
| Google Workspace / Google | Email delivery and storage for inquiries, replies, school verification, receipts and requested documents. Sender/recipient addresses, names and message contents. | Company mail follows the purpose-specific periods above. Provider deletion and backup handling follows the data processing addendum. Workspace support. |
| Cloudflare, Inc. | Site delivery, connectivity and network security: IP, time, URL, browser/security signals and web request data passing through the connection. | Service-specific operational/security periods and applicable contracts. Privacy policy · [email protected]. |
| PayPal | PayPal processes payment details you enter there. We exchange order, amount, transaction status and payer email for payment confirmation. We do not receive card numbers or PayPal passwords. | Company transaction records: five years. PayPal’s independent payment/compliance processing follows its privacy statement. Contact PayPal. |
No separate Google Workspace data region or Cloudflare regional restriction is configured. Google Workspace and Cloudflare operate international infrastructure, so email and web connections may involve processing/storage abroad over a network. Contract-related outsourced processing/storage must meet the applicable conditions of Article 28-8(1)(3) of Korea’s Personal Information Protection Act or another relevant basis. Transfers requiring separate consent are disclosed and consented to in advance. Specific countries, entities and periods depend on account-region settings and contracts; consult the sources below or contact us. Processing is not restricted to South Korea.
Workspace processors and countries · Cloudflare international processing · South Korea addendum · PayPal international processing
If you do not want international transfers, contact us before submitting to discuss available alternatives or refrain from the relevant email, web or payment feature. Requests to stop transfers are reviewed with an explanation of alternatives and service restrictions. Statutory retention still applies. KG Inicis and Naver Pay are planned; this site does not currently collect payment data through them.
4. Deletion
Unnecessary information is deleted without undue delay when the purpose or retention period ends. Legally retained records have separate purposes and access controls. Ongoing disputes or legal preservation may require limited records until resolved or the relevant period expires. A perpetual license may require minimum registration records while it is maintained, but does not mean all personal information is retained forever.
Electronic records are deleted in a manner intended to prevent recovery; paper records are shredded. Backups are restricted to recovery purposes, and deletion requests must be reflected during restoration so deleted records are not brought back into use. Backup cleanup and deletion from external mail systems are part of the deletion procedure.
5. Security and incidents
We apply restricted access, separation of management services, protected transmission, device verification and protected storage/backups. Public web assets and internal material have separate access. Incident handling includes assessing impact, containment, evidence preservation and recovery. Legally required breach notifications and reports follow applicable conditions and deadlines.
6. Cookies and browser storage
- Language cookie: up to one year. Theme preference stays in local storage until you clear site data.
- Checkout cookie: up to 24 hours. Duplicate-request identifiers are stored for the current browser tab.
- Device-bound activation, when available: a short-lived cookie lasting up to ten minutes.
You can block cookies or clear site data in browser settings; blocking necessary cookies may prevent checkout or activation. We have not installed advertising trackers, Google Analytics or Meta Pixel on the site. External checkout pages follow their provider’s storage policy.
7. Your rights and representatives
You may request access, correction, deletion, suspension, consent withdrawal and explanation/review of automated decisions by email or letter. State your request and reply address without sending unnecessary ID documents. We verify identity or representative authority only as needed and respond under statutory procedures. If legal duties restrict a request, we explain the reason and objection route.
Legal representatives may exercise the rights of children under 14. Processing requiring their consent needs a lawful guardian-consent procedure; contact us first where required. Minor purchase agreements remain subject to applicable guardian-consent and cancellation rights.
8. Automated checks
School domains/mail verification, device signatures/registration, payment status and license periods are checked to determine activation and license delivery. Failed checks can limit a feature. You can ask support for an explanation and review of domain-list errors, device changes or payment mismatches. Where statutory automated-decision rights apply, refusal, explanation and human review are provided subject to legal exceptions. Available explanations and support remain accessible.
9. Privacy contact and remedies
Jimin Jang / Representative
[email protected]
+82-10-8425-7201
501, Daejin Village Building A, 51 Paldal-ro 165beon-gil, Paldal-gu, Suwon-si, Gyeonggi-do, Republic of Korea
KISA privacy complaints / 118 · Personal Information Dispute Mediation Committee / 1833-6972
10. Changes and earlier policy
This update covers activation, student licenses, B2B, refunds, mail and network providers, and corrects unavailable domestic payment descriptions. New purposes and changes requiring consent are notified in advance and consented to as required. Publication alone does not broaden existing consent.