SuperGalaxy (초은하) (the “Operator”, “we”) runs GalaxyDresser (the “Service”) and processes personal data under the Korean Personal Information Protection Act and other applicable laws.
1. What we process and why
| Category | Data | Purpose |
|---|---|---|
| Account | Steam ID, Steam display name, times of sign-up, last sign-in and consent | Sign-in, identifying the account, recording consent |
| Linked devices | Device public key, device name, plugin and Warudo versions, last seen time, link-code records | Authenticating devices, making results open only on your device |
| Usage records | Monthly usage counts, records of outfit conversions (recipes issued) and counts given back, issued recipes and outfit keys | Usage limits, opening results, preventing misuse, handling payment disputes |
| Conversion information | Product name and paths inside the package, file hashes and sizes, prefab and material settings (text), a structural summary such as bone names, positions and polygon counts, your character's skeleton information | Issuing recipes. Structural information is deleted after the recipe is issued. |
| Billing | Paddle customer ID, subscription ID, status and period, transaction IDs, price ID, amount and currency paid, refund and chargeback records, records of processed payment notifications | Checking subscription access, linking to subscription management, accounting and disputes |
| Enquiries | Email address and message, plugin bug reports and their attachments (such as logs) | Answering you, fixing errors |
| Access and security | IP address, records of key actions (sign-in, device linking, payments) | Security, preventing misuse |
| Statistics | Conversion counts per product (product name, package hash and count; nothing that identifies you) | Improving compatibility |
2. Retention and deletion
- Account, device and usage data are kept until you ask us to delete your account, and are then deleted without delay. Enquiries and bug reports are deleted once they are no longer needed.
- Records that Korean law requires us to keep are kept separately for the required period:
- records of contracts and withdrawals: 5 years (Act on Consumer Protection in Electronic Commerce);
- records of payments and supply: 5 years (same Act);
- records of consumer complaints and disputes: 3 years (same Act);
- access logs: 3 months (Protection of Communications Secrets Act).
- Electronic files are deleted so that they cannot be recovered; paper records are shredded or incinerated.
3. Disclosure to third parties
We do not disclose your personal data to third parties, except where the law requires it or investigative authorities request it through legal procedures.
Payments are processed directly by Paddle, our Merchant of Record. Paddle handles the data it receives at checkout, such as card details, billing email and address, independently under its own privacy notice. We do not store this data in our service database (we can view it in Paddle's dashboard to answer payment questions).
4. Processors and international transfers
| Recipient | Role | Location |
|---|---|---|
| Google Cloud, Cloudflare | Running servers and databases, delivering the site (CDN) | Servers in the Seoul (Korea) region; delivery network worldwide |
| Paddle.com Market Ltd and the Paddle group | Payments, tax, receipts, refunds and buyer support (independent controller) | United Kingdom, United States and elsewhere |
| Valve Corporation | Steam sign-in (you sign in on Steam directly) | United States |
Only the data needed for the purposes above is transferred abroad. It is transmitted over the network while you use the Service and kept for each recipient's retention period. If you do not want your data transferred abroad, you can stop using the Service and ask us to delete your account.
5. Your rights
You may ask at any time to access, correct, delete or stop the processing of your personal data by writing to support@supergalaxy.me. We act without delay (within 10 days at the latest) and tell you the result. A legal representative or someone you authorise may also make the request.
6. Cookies and external scripts
- The product, pricing and policy pages use no cookies, analytics, advertising or external scripts.
- The app (dresser.supergalaxy.me) uses only the cookies that keep you signed in (gd_session, gd_login).
- Paddle's script (cdn.paddle.com) loads only when the checkout opens; cookies and storage used by the checkout follow Paddle's notice.
- You can refuse cookies in your browser, but you will then not be able to sign in to the app.
7. Security measures
Encryption in transit (HTTPS), an extra encryption layer for plugin traffic, per-device keys and signatures, tokens stored only as hashes, restricted administrator access with two-factor authentication, and audit records of key actions.
8. Children
The Service is not directed at children under 14, and we do not knowingly collect personal data from children under 14.
9. Privacy officer
- Privacy officer: Sibaek Yang
- Contact: support@supergalaxy.me · +82-10-3344-6941
10. Where to complain
For advice or to report a privacy violation, you can contact these Korean bodies (or the data protection authority where you live):
- Personal Information Infringement Report Center: 118, privacy.kisa.or.kr
- Personal Information Dispute Mediation Committee: 1833-6972, www.kopico.go.kr
- Supreme Prosecutors' Office: 1301, www.spo.go.kr
- Korean National Police Agency: 182, ecrm.police.go.kr
11. Changes
We announce changes to this policy on this page and in the Service at least 7 days before they take effect (30 days for significant changes).
This is a translation of the Korean 개인정보처리방침; if the two differ, the Korean version prevails.