Privacy Policy

Effective date: September 23, 2026

피코 온라인 (the "Company") operates "Resource Lab & PICO" (the "Site") in compliance with the Korean Personal Information Protection Act and other applicable laws, and handles Members' personal information as described below.

1. Personal Information We Collect

• Registration and sign-in: email address, name and profile image of your Google account, or email address, username and avatar of your Discord account
• Member details (required): name, nickname, mobile phone number
• Member details (optional): gender, Minecraft server address — you can use the service without providing them.
• Orders and payment: depositor name and order history (products, amounts, dates)
• Collected automatically while you use the service: IP address, browser information and content download records
• Designer settlement: payout account details (bank, account number, account holder)

2. Purposes of Collection and Use

• Identifying Members and keeping them signed in
• Name and mobile phone number: identity verification, and contacting you about refunds or disputes
• Nickname: identifying you within the site
• Server address (optional): stated as the place of use in the license file of purchased Content
• Gender (optional): user statistics
• Accepting orders, confirming deposits, delivering Content, and handling withdrawals and refunds
• Preventing misuse such as unauthorized sharing, and handling disputes
• Settling Designers' sales proceeds
• Responding to inquiries and delivering notices

3. Retention Period

The Company destroys personal information without delay when a Member withdraws. However, the following information is retained for the periods required by law:

• Records of contracts or withdrawal of purchase: 5 years (Act on the Consumer Protection in Electronic Commerce)
• Records of payment and supply of goods: 5 years (same Act)
• Records of consumer complaints or dispute handling: 3 years (same Act)
• Website access logs: 3 months (Protection of Communications Secrets Act)

4. Provision to Third Parties

The Company does not provide Members' personal information to third parties, except where required by law through lawful procedures, such as a request from an investigative authority.

5. Outsourcing of Processing

To provide the service, the Company entrusts the following processing:

• Google LLC: sign-in authentication
• Discord Inc.: sign-in authentication
• Cloudflare, Inc.: site connectivity and security (access records pass through it)
• Pushbullet Inc.: relaying deposit notifications for the Company's bank account (automatic payment confirmation)
• Discord Inc.: operator handling of orders, deposits, refund requests and seller applications, and download records (operations channel messages)

6. Transfer of Personal Information Overseas

In accordance with Article 28-8 of the Korean Personal Information Protection Act, the Company transfers personal information overseas as follows:

• Recipient: Google LLC (USA, contact: https://www.google.com/policies/privacy) / Items: email address, name, profile image / When and how: transmitted over the network at sign-in / Purpose: sign-in authentication / Retention: until membership is withdrawn
• Recipient: Discord Inc. (USA, contact: https://discord.com/privacy) / Items: email address, username, avatar, OAuth identifiers / When and how: transmitted over the network at sign-in / Purpose: sign-in authentication / Retention: until membership is withdrawn
• Recipient: Discord Inc. (USA, contact: https://discord.com/privacy) / Items: for orders, nickname, email address, sign-in method (Google or Discord), sign-up date, ordered products, depositor name, order amount, IP address at the time of ordering, and number and total of past purchases; for deposit notices, depositor name and amount; for seller applications, nickname, email address, display name and portfolio URL; for payout requests, display name, amount and balance; for refund requests, nickname, email address, order amount, time the download started and the refund reason; for downloads, nickname, product name, version and IP address (only if a dedicated downloads channel is configured — nothing is sent otherwise) / When and how: sent over the network as bot messages to a private operations channel when an order, deposit, seller application, payout request, refund request or download occurs / Purpose: operators confirming and cancelling orders, matching deposits, handling seller applications and payouts, handling refund requests, and checking for misuse such as unauthorized sharing / Retention: for as long as the Discord message is kept (until operators delete it or Discord deletes it under its retention policy)
• Recipient: Discord Inc. (USA, contact: https://discord.com/privacy) / Items: the member's Discord user ID and the notification content (for confirmed sales, product name, item count, settlement amount and settlement balance; for new versions of purchased products, product name and version) / When and how: only if the member turns the notification on in account settings, sent over the network as a bot direct message (DM) when a sale is confirmed or a new version is approved / Purpose: sending the notifications the member opted in to / Retention: for as long as the Discord message is kept (until the member deletes it or Discord deletes it under its retention policy)
• Recipient: Cloudflare, Inc. (USA, contact: https://www.cloudflare.com/privacypolicy) / Items: IP address, request logs / When and how: transmitted over the network each time the Site is accessed / Purpose: connectivity and security / Retention: according to Cloudflare's retention policy
• Recipient: Pushbullet Inc. (USA, contact: https://www.pushbullet.com/privacy-policy) / Items: depositor name, amount, time of deposit (bank deposit notifications for the Company's account) / When and how: transmitted over the network on each deposit / Purpose: automatic payment confirmation / Retention: according to Pushbullet's policy (the Company keeps nothing beyond its own deposit records)

You may refuse this transfer. If you do not want your sign-in information transferred to Discord, sign in with Google instead. The Discord transfer for handling orders, deposits, seller applications and payouts is needed for operators to review them, so if you refuse it you cannot purchase items or apply as a seller or request payouts. However, because sign-in is available only through Google or Discord and all access to the Site passes through Cloudflare, refusing all transfers means you cannot use the service. The transfer to Pushbullet is required to confirm bank deposits, so if you refuse it you cannot purchase items. The Discord transfer for notification DMs happens only if you turn it on in account settings; turning it off stops the transfer and does not affect your use of the service.

7. Destruction Procedure and Method

Personal information whose retention period has ended or whose purpose has been fulfilled is destroyed without delay. Electronic files are deleted in a way that cannot be recovered.

8. Rights of Data Subjects

Members may at any time request access to, correction or deletion of, or suspension of processing of their personal information, and may withdraw consent.

Requests can be made to the Privacy Officer below, and the Company will act on them without delay.

Member details (name, nickname, mobile phone number, gender, server address) can be corrected directly on the account page.

Consent to receive marketing information can be withdrawn directly in account settings.

9. Security Measures

• Designers' payout account details are stored encrypted.
• All connections use encrypted transport (HTTPS).
• Administrative access is limited to the minimum number of people, and administrative actions are logged.
• Content files are kept outside public paths and delivered through links that are valid only for a short time.

10. Cookies

The Site uses cookies to keep you signed in. You can refuse cookies in your browser settings, but features that require sign-in will then be unavailable.

11. Privacy Officer

• Business name: 피코 온라인
• Contact: [email protected] · 010-5962-6061

12. Changes to This Policy

If this Policy changes, the Company will announce it on the Site at least 7 days before the effective date.

This Policy is provided in Korean and English. If the two versions differ, the Korean version prevails.

This Policy takes effect on September 23, 2026.

13. Change Log

• September 22, 2026: First version.
• September 23, 2026: Described the items transferred to the operations channel (Discord) in the detail actually sent, and added the overseas transfer to Pushbullet (USA) used for automatic deposit confirmation.
• September 23, 2026: Added the overseas transfer for opt-in Discord notification DMs.
• September 23, 2026: Added refund request details and download records (when a dedicated downloads channel is configured) to the items transferred to the operations channel (Discord).