This policy is prepared based on MongCloud’s account registration, identity-verification, payment, cloud PC provisioning, and customer-support procedures.

MongCloud Privacy Policy

MongCompany (the “Company”, “we”, “us”) recognizes the importance of protecting personal information and strives to comply with the Personal Information Protection Act of Korea and other applicable laws in connection with the operation of mongcloud.net and related services. This policy takes effect on April 19, 2026. If there is a material change to the purpose, categories, retention period, or method of processing personal information, the Company will provide notice through this policy without undue delay.

Purposes of processing, categories of data, and retention periods

The Company processes personal information within the scope necessary for account registration, identity verification, payment and billing, service provision, customer support, service protection, and prevention of unauthorized or abusive use.

  • Records on contracts or withdrawal/cancellation: 5 years
  • Records on payment and supply of goods or services: 5 years
  • Records on customer complaints or dispute resolution: 3 years
  • Records on display or advertising: 6 months
PurposeKey data categoriesRetention period
Account registration and loginEmail address, name or nickname, language preference, email verification status, and information necessary for login and account protectionUntil account deletion, unless a longer period is required by law, for dispute handling, or for abuse investigation
Mobile identity verification and account protectionMobile number, identity verification result information, name, date of birth, gender, carrier, foreigner status, and duplicate-account check informationUntil account deletion or until the verification purpose and any related disputes have been resolved
Social login integration (optional)Social account identifier, provider email, profile information, and other information required for login integrationUntil unlinking, account deletion, or any additional period required under the relevant provider policy
Payments, recurring billing, refunds, receipts, and tax handlingBilling profile information (contact name, company name, email, phone number, address, postal code, business or tax information), payment method identifiers, masked card information, order, subscription, invoice, and payment records, payment results, and receipt informationFor the period required by e-commerce and other applicable laws, or until relevant disputes are resolved
Cloud PC provisioning and service deliveryUser email, instance identifiers, information required for provisioning and access guidance, and service status and usage-period informationDuring the service period and, after termination, only for settlement, dispute response, incident response, or applicable statutory retention periods
Password reset and verification of sensitive actionsAuthentication information needed for email verification, password reset or change, and verification of sensitive actionsDeleted without undue delay after the purpose is fulfilled or the validity period expires
Customer support, inquiries, and dispute handlingInquiry contents, reply email, information provided during support, support history, refund or dispute records, and customer support records where enabledFor three years after closure of the matter, or longer if required by applicable law
Service stability, security, and abuse responseIP address, access and connection logs, device or browser information, service operation and error logs, instance identifiers, authentication and account-protection signals, and other limited metadata reasonably necessary for security investigations, legal compliance, and abnormal-use responseUntil the purpose is fulfilled, unless longer retention is necessary for security investigations or legal compliance

The statutory retention periods above reflect Article 6 of the Enforcement Decree of the Act on Consumer Protection in Electronic Commerce, etc.

Automatically collected information and cookies

The Company may automatically collect cookies, access logs, and device or browser information for service delivery, user convenience, and security maintenance.

  • Authentication and security: cookies and similar technologies may be used to maintain login status and protect accounts.
  • Functional support: functional cookies may be used for language preferences and smoother payment or dashboard use.
  • Analytics and quality improvement: usage records and error information may be processed to improve service quality and respond to issues.
  • Customer support: information necessary to respond to inquiries may be processed when customer-support features are used.
  • Cookie controls: users may refuse cookie storage through browser settings; however, some functions such as login persistence, payments, and support may then be limited.

Third-party disclosures and entrusted processing

The Company does not sell or lease personal information. However, the Company may use external service providers or processors where necessary to comply with law, to conclude or perform a contract, or to provide a service requested or selected by the data subject.

Provider / servicePurposeData categoriesNotes
Payment and identity-verification servicesCard registration, payment processing, refunds, and identity verificationName, email, mobile number, and information necessary to process payments and identity verificationRequired for transaction performance
Social login, analytics, and communication servicesLogin integration, usage analytics, and service noticesEmail, profile information, basic usage records, and information necessary to send noticesProcessed only within the scope of enabled features
Error-response and service-stability toolsIssue analysis, incident response, and quality improvementError information, connection-environment information, and information necessary to operate the serviceUsed to maintain service stability
Customer support servicesReal-time support and inquiry-history managementName, email, inquiry contents, and information necessary to provide supportApplies only when support features are enabled

If there is a change to the entrusted processing or external-service arrangement, the Company will update this policy accordingly. Where separate consent is required by law, the Company will obtain such consent before processing.

Overseas transfers of personal information

The Company may process personal information outside Korea or transfer personal information overseas for the provision of certain services. Such transfers may occur through network transmission during service use or through the use of cloud infrastructure operated by service providers.

Recipient / serviceCountry or regionData categoriesPurpose and retention
Overseas cloud-based login, analytics, and communication servicesCountries or regions operated by the relevant service providerEmail, profile information, basic usage records, and information necessary for service noticesFor login integration, analytics, and service notices; retained during the relevant usage period or any applicable retention period
Overseas cloud-based error-response servicesCountries or regions operated by the relevant service providerError information, connection-environment information, and information necessary for service stabilizationFor issue analysis and security response; retained for the applicable retention period
Customer support services that may operate in overseas regionsMay vary depending on the operating environmentName, email, inquiry contents, and information necessary to provide customer supportFor customer support; retained until closure of the support matter and thereafter according to internal policy or applicable retention periods

The details of overseas transfer may vary depending on the services actually enabled and the operating environment, and any material change will be reflected in this policy.

Destruction procedures and methods

The Company destroys personal information without undue delay when the retention period expires, the processing purpose has been achieved, or the account has been deleted. Where another law requires retention, the relevant information will be stored separately and destroyed once the applicable retention period ends.

  • Electronic files are deleted in a manner that makes recovery or restoration difficult.
  • Printed or paper records are destroyed by shredding, incineration, or comparable means.
  • If immediate destruction is impracticable due to disputes, unpaid balances, refunds, or abuse investigations, only the minimum necessary information will be retained until the relevant reason ends.

Data-subject rights and methods of exercise

Users may request access to, correction of, deletion of, suspension of processing of, withdrawal of consent for, or account deletion relating to their personal information. Unless restricted by applicable law, the Company will review and respond without undue delay.

  • Requests for access, correction, deletion, or suspension of processing may be submitted to info@mongcloud.net.
  • Some account and billing information may also be reviewed or updated directly through the dashboard or support channel.
  • A legal representative may exercise rights on behalf of the data subject to the extent permitted by applicable law.
  • Certain requests may be limited where retention is required by law or where necessary for unpaid-balance handling, fraud or abuse investigation, or court or investigative response.

Security measures

The Company implements technical and administrative safeguards for the protection of personal information.

  • Technical and administrative measures are applied to protect account information and personal information.
  • If repeated authentication failures or abnormal access are detected, access may be temporarily restricted to protect the account.
  • Additional authentication or verification procedures may be required for identity checks or sensitive actions.
  • Initial Cloud PC passwords are generated and delivered on a one-time basis, are deleted without undue delay after delivery, and the Company does not retain passwords after they are changed by the user.
  • Administrator access is performed only within the minimum scope necessary where expressly requested by the customer for support or where urgently required for legal or security reasons.
  • Where administrator access occurs, the Company records the requester, approval basis, operator, time of work, work performed, and target system, and provides post-work notice to the customer where necessary.
  • Security reviews for unauthorized access, fraud, legal violations, or material service abuse are limited to logs and other minimum metadata reasonably necessary for the relevant investigation; the Company does not routinely inspect customer file contents for these purposes.
  • Protective measures such as access control, internal management plans, approval controls, and review procedures are continuously maintained.

Due to the nature of internet transmission and electronic storage, absolute security cannot be guaranteed. The Company will continue to improve its safeguards in light of applicable law and prevailing technical standards.

Children under 14

The Company does not provide services to children under the age of 14 and does not permit account registration by children under 14. If the Company becomes aware that personal information of a child under 14 has been collected, it will take prompt deletion or account-restriction measures.

Privacy contact and remedies

Privacy-related inquiries, requests for access, and complaints may be submitted through the following contact channel.

  • Company: MongCompany
  • Address: 30, Nonhyeon-ro 10-gil, Gangnam-gu, Seoul, Republic of Korea
  • General and privacy inquiries: info@mongcloud.net
  • If counseling or dispute mediation is needed for a privacy infringement, the following institutions may also be contacted.
  • Personal Information Dispute Mediation Committee: +82-1833-6972 / www.kopico.go.kr
  • Personal Information Infringement Report Center: 118 / privacy.kisa.or.kr
  • Supreme Prosecutors' Office: 1301 / www.spo.go.kr
  • Korean National Police Agency: 182 / ecrm.police.go.kr

Changes to this policy

The Company may revise this policy in the event of changes to applicable law, service features, categories of processed data, entrusted processing arrangements, or overseas transfers. Where the changes are material, the Company will provide advance notice through the website, email, or another reasonable method.