Privacy Policy

Draft — legal review pending before launch
This policy is a draft and may change after legal review. The effective date is not set yet (drafted 2026-10-29, revised 2026-10-30 to add scheduled scans, quote requests and payments). The Korean version prevails.

DicoGuard (operated by Dicolab, "the Company") provides website security checks and fixes, and handles personal information as follows.

1. What we collect, why and for how long

• Sign-up: email, name (for contacting you, not shown publicly), nickname (shown in Security Q&A), password (one-way encrypted); optional phone numbers — kept until you leave.
• Scans: requesting IP (stored only as an irreversible hash), target address, time and result, linked to your account when logged in — guests: 30 days; members: detailed results for one year, the one-line summary until you leave. Rate-limit counters: 1 hour.
• Domain verification: domain, method and time — unfinished requests 7 days; verified domains until you leave.
• Scheduled scans: domain, frequency, alert conditions and run times — until you remove them or leave.
• Notifications: your member email and the notifications sent — 1 year from sending (delivery confirmation and disputes, internal policy); notifications that show a transaction, such as payment confirmations, are kept with payment records for 5 years.
• Quote requests: type, name, email and message; optionally phone, organization, domain and the attached scan result — 3 years (consumer complaint records, Enforcement Decree of the E-Commerce Act, Art. 6(1)).
• Payments: payer name, phone and email, description, amount, method, status, time and IP; for card or bank transfer also the transaction and approval numbers, card issuer, masked card number, installments or bank name, and receipt link; for bills, the bill title and amount — 5 years (payment and contract records, Enforcement Decree of the E-Commerce Act, Art. 6(1); tax records 5 years under the Framework Act on National Taxes).
• Web server access logs: time, IP and browser — 3 months (Protection of Communications Secrets Act).
• Administrator access logs to the personal data processing system — at least 1 year (Standards for Security Measures of Personal Information, Art. 8).

We never receive full card numbers or card passwords. Card and bank transfer payments are made in the NICEPAY payment window; we only receive the result. NICEPAY keeps its own electronic financial transaction records as required by law. We do not send advertising messages.

2. When you leave

Verification records and scheduled scans are deleted at once; remaining scan results are unlinked from you and deleted when their retention ends; payment and quote records are kept separately for the legal periods above.

3. Deletion

Data past its retention period is destroyed without delay in a way that cannot be restored. Scan results, rate-limit counters, verification requests and quote requests are removed by an automatic clean-up job; personal data in payment records and bill contacts is destroyed automatically without delay once the 5-year period ends (amounts and dates stay as anonymous sales records).

4. Sharing

We do not share personal information with third parties, except where the law requires it.

5. Processors

NICEPAY Payments Co., Ltd. (card and bank transfer processing); Amazon Web Services, Inc. — Amazon SES, Seoul region (notification and verification emails); Amazon Web Services, Inc. — Amazon Lightsail, Seoul region (servers and database); Cloudflare, Inc. (web traffic security and delivery, CDN). Changes will be listed here first.

6. Transfers abroad

To deliver the service securely we use the Cloudflare network, so your connection data may pass through servers abroad. Recipient: Cloudflare, Inc. Countries: the United States and other countries where the Cloudflare network operates. Data: connection IP and request information (address, browser). Purpose: web traffic security and delivery. When and how: sent over the network each time you connect. If you do not want this transfer you may stop using the service; the service cannot be delivered without Cloudflare.

7. Your rights

You may ask to access, correct, delete or stop processing your data. Members can edit their data or leave in My page, and delete their scan results and scheduled scans themselves.

8. Security

HTTPS, one-way password encryption, IPs stored only as an irreversible hash, restricted admin access, unguessable result and payment links with a noindex mark, and escaping of user-written text in notification emails.

9. Cookies

We use only cookies needed for the service, such as keeping you logged in — no advertising or tracking cookies.

10. Privacy officer and contact

Privacy officer: 정영균 (CEO). Email: dicolab@naver.com. Contact: DicoGuard quote request.

11. Operator

• Company: Dicolab (디코랩)
• CEO: 정영균
• Business registration No.: 449-20-02254
• Address: 대전광역시 유성구 죽동로 72 501-605
• Email: dicolab@naver.com
• Contact: DicoGuard quote request

12. Changes

Changes are announced on the service 7 days before they take effect, or 30 days before for important changes.