Revision of 2026-11-05
Current versionWith the new Service guide, which works without logging in, we added that questions and recent messages are sent to OpenAI (United States) to generate answers, and described the browser identifier and transformed IP values used for usage limits. Service guide conversations are not stored on SKIMTUBE's servers.
2. Information we collect
| Before | After |
|---|---|
| • Service guide information: questions and recent messages entered in the Service guide (not stored on SKIMTUBE's servers; sent to an external AI processor to generate the answer), a random browser identifier and transformed IP values used for usage limits, and daily usage counts and costs that cannot identify a person |
4. Purposes and legal bases for processing
| Before | After |
|---|---|
| Provide the Service guide (questions about using the service, pricing, and rules, with or without an account) and prevent excessive use | Questions and recent messages, and transformed identifier and IP values used for usage limits | Steps requested by the user and legitimate interests in protecting the service (Article 6(1)(b) and (f) GDPR) |
5. Retention periods
| Before | After |
|---|---|
| • Service guide conversations: not stored on SKIMTUBE's servers. A conversation stays only on the user's browser screen and disappears when the window is closed. Transformed values used for usage limits are cleaned up after the limit period, and daily totals are kept in a form that cannot identify a person. |
8. Subprocessors and cross-border transfers
| Before | After |
|---|---|
| OpenAI | United States and other countries where OpenAI operates infrastructure | Sent over secure transport when a user asks the Service guide a question | Questions and recent messages. IP addresses, device identifiers, and account information are not sent. Anything typed into a question is sent as written, so do not enter personal information | Generate Service guide answers | SKIMTUBE asks that responses not be stored. Provider-side retention for purposes such as abuse monitoring follows OpenAI's policies and contract terms | You may refuse. Nothing is sent if you do not use the Service guide, and the support page Q&A and contact form remain available | OpenAI privacy policy: https://openai.com/policies/privacy-policy/ | |
| Cloudflare Turnstile | United States and other countries where Cloudflare operates security verification infrastructure and its global edge network | Sent and verified through security verification integration when abuse-prevention checks are needed, such as signup form submission or public support form submission | Abuse-prevention verification information, IP-related information, and browser/device signals needed for verification | Block spam and bots, and prevent automated abuse of signups and of public support forms | For the period needed for verification and security logs. Support emails and handling records follow this policy's retention periods, and Cloudflare-side retention follows the provider's policy and contract terms | Users may refuse. However, if verification is refused or fails, protected features such as signup and public support submission may be unavailable | Cloudflare privacy policy: https://www.cloudflare.com/privacypolicy/ | Cloudflare Turnstile | United States and other countries where Cloudflare operates security verification infrastructure and its global edge network | Sent and verified through security verification integration when abuse-prevention checks are needed, such as signup form submission, public support form submission, or Service guide questions | Abuse-prevention verification information, IP-related information, and browser/device signals needed for verification | Block spam and bots, and prevent automated abuse of signups, public support forms, and the Service guide | For the period needed for verification and security logs. Support emails and handling records follow this policy's retention periods, and Cloudflare-side retention follows the provider's policy and contract terms | Users may refuse. However, if verification is refused or fails, protected features such as signup, public support submission, and the Service guide may be unavailable | Cloudflare privacy policy: https://www.cloudflare.com/privacypolicy/ |
9. Cookies, local storage, and device information
| Before | After |
|---|---|
| To limit Service guide use, SKIMTUBE stores a random identifier in browser storage. Usage-limit records keep only irreversibly transformed values of that identifier and the IP address. The identifier is not created unless you use the Service guide. Cloudflare Turnstile processes browser signals for abuse-prevention checks (Section 8). |
10. AI chat, personalization, deletion, and opt-out
| Before | After |
|---|---|
| The Service guide is separate from AI chat. It answers only from public documents, does not store conversations, and does not read account information. To generate an answer, the question and recent messages are sent to OpenAI (Section 8). |
Revision of 2026-10-14
Added how we handle referral coupon (subscription discount coupon) issue and expiry notices for users who choose to receive them as advertising messages. They are sent only to accounts with the region set to South Korea that give a separate, optional consent per channel (email, Telegram) in Settings › Notifications, and the use of personal information for advertising and the overseas transfer to Resend (United States) and Telegram each need their own optional consent. Consent and withdrawal records are kept for 3 years after withdrawal or account deletion and then destroyed, and you can withdraw for free without signing in — in Settings, with the unsubscribe link in the email, or with the Telegram button or /stop_ads. If you don't opt in, nothing is sent, as before; existing purposes and retention periods are unchanged.
2. Information we collect
| Before | After |
|---|---|
| • Advertising consent information (only if you opt in): for each channel (email, Telegram), whether and when you gave or withdrew consent to receive advertising, consent to the use of personal information for advertising, and consent to overseas transfer; the version of the consent text; the request channel (Settings, unsubscribe link, Telegram, and so on); irreversible transformations of the destination at the time of consent (email address or Telegram connection identifier) and of the IP address; and records of the notices of the result of those requests |
4. Purposes and legal bases for processing
| Before | After |
|---|---|
| Send advertising messages — referral coupon (subscription discount coupon) issue and expiry notices (accounts with the region set to South Korea, only on the channels you chose) | Account identifier, the email address or Telegram connection identifier of the chosen channel, coupon status and deadlines, and language setting | Your separate, optional consent (Article 15(1)(1) of the Personal Information Protection Act and Article 50(1) of the Network Act of Korea; Article 6(1)(a) GDPR). Refusing does not affect signing up, subscribing, or receiving and using coupons, and you can withdraw at any time | |
| Process advertising consent and withdrawal, notify the result and confirm consent every two years, and keep the proof | Advertising consent information (Section 2) and the account's email address or Telegram connection identifier | Compliance with legal obligations (Article 50(7) and (8) of the Network Act of Korea) and legitimate interests in handling disputes (Articles 6(1)(c) and 6(1)(f) GDPR) |
5. Retention periods
| Before | After |
|---|---|
| • Advertising consent information: use for sending advertising stops immediately when you withdraw consent or delete your account. Consent and withdrawal records are kept separately for 3 years after withdrawal or account deletion for dispute handling and legal proof, then destroyed |
8. Subprocessors and cross-border transfers
| Before | After |
|---|---|
| Overseas transfers needed to send you advertising messages (referral coupon issue and expiry notices) by email or Telegram are separate from the service transfers above and happen only if you give a separate, optional consent for that channel in Settings › Notifications (second table below). | |
| [Overseas transfers for advertising messages (separate optional consent)] Recipient and contact | Destination country | Timing and transfer method | Transferred items | Purpose | Retention/use period | Choice and consequences of refusal | |
| Plus Five Five, Inc. (Resend) · [email protected] | United States | Sent by the server over an encrypted connection (HTTPS API) each time an advertising email or a notice of the result of a consent request is sent | Recipient email address, email subject and body (coupon discount rate and deadline, unsubscribe link) | Sending advertising emails (referral coupon issue and expiry notices) | For the period needed to send the email and handle delivery issues. Resend-side retention follows its policy and contract terms | Users may refuse; advertising coupon notices are then not sent by email. Use of the service is not affected | |
| Telegram group companies (Telegram Group Inc. (British Virgin Islands), Telegram FZ-LLC (Dubai, UAE) and others) · contact: Telegram app Settings › Ask a Question | Regions outside Korea where Telegram operates data centers (Telegram does not disclose the storage country for users outside the EEA and UK) | Sent through the Telegram Bot API each time an advertising message or a notice of the result of a consent request is sent | Telegram connection identifier (chat id), message text (coupon discount rate and deadline, unsubscribe button) | Delivering advertising messages on Telegram (referral coupon issue and expiry notices) | Telegram-side retention follows Telegram's policy. You can delete messages in the chat yourself | Users may refuse; advertising coupon notices are then not sent on Telegram. Use of the service is not affected |
12. Privacy rights requests
| Before | After |
|---|---|
| You can withdraw consent to advertising messages at any time, free of charge and without signing in: in Settings › Notifications, with the unsubscribe link in each advertising email (including your mail app's one-click unsubscribe), or with the "Unsubscribe from ads (free)" button or the /stop_ads command in Telegram. The result of a consent or withdrawal is shown on screen or in the chat right away and is also notified on that channel or by email within 14 days of your request. If you consent, we ask you to confirm your consent every two years from the date you gave it. |
Revision of 2026-09-16
The Korean version now writes the data controller's name as its registered trade name throughout; the English version continues to use the brand name LeanLog. Collected items, purposes, and retention periods are unchanged.
View the full previous text (2026-09-03)Revision of 2026-09-03
Added the buyer's name or display name and the IP address used at card registration to the items shared with Toss Payments Co., Ltd., the domestic payment processor. The name appears in the merchant dashboard and in the payment-history email Toss Payments sends to the buyer. It is passed to Toss Payments when that card is charged, for payment fraud detection, and 'payment fraud detection' was added to the purposes accordingly. The IP address was already among the collected items (device and security information); other collected items and retention periods are unchanged.
8. Subprocessors and cross-border transfers
| Before | After |
|---|---|
| Toss Payments Co., Ltd. | Republic of Korea (domestic processing — no cross-border transfer) | Sent or received through the payment integration during domestic checkout, card registration (auto-renewal), recurring charges, cancellations, and refunds | Email, order number and payment identifiers, customer identifier (customerKey), card issuer and partially masked card number, payment status and amount, cancellation/refund reason. SKIMTUBE does not store full card numbers or CVCs | Domestic payment processing, auto-renewal (recurring charges), cancellations and refunds, payment dispute response | For the retention periods required by e-commerce, tax, and accounting law. In-app payment records follow this policy's retention periods, and Toss Payments' own retention follows its policy and legal obligations | Users may refuse. However, domestic payments, subscriptions, and refunds may be unavailable | Toss Payments privacy policy: https://pages.tosspayments.com/terms/homepage/privacy/policy | Toss Payments Co., Ltd. | Republic of Korea (domestic processing — no cross-border transfer) | Sent or received through the payment integration during domestic checkout, card registration (auto-renewal), recurring charges, cancellations, and refunds | Email, name or display name (used in the merchant dashboard and in the payment-history email Toss Payments sends to the buyer), order number and payment identifiers, customer identifier (customerKey), card issuer and partially masked card number, payment status and amount, cancellation/refund reason, the IP address used at card registration (for fraud detection — passed to Toss Payments when that card is charged). SKIMTUBE does not store full card numbers or CVCs | Domestic payment processing, auto-renewal (recurring charges), cancellations and refunds, payment dispute response, payment fraud detection | For the retention periods required by e-commerce, tax, and accounting law. In-app payment records follow this policy's retention periods, and Toss Payments' own retention follows its policy and legal obligations | Users may refuse. However, domestic payments, subscriptions, and refunds may be unavailable | Toss Payments privacy policy: https://pages.tosspayments.com/terms/homepage/privacy/policy |
Revision of 2026-08-27
Named Dodo Payments as the provider that processes overseas (USD) payments and listed it in the external processors table with its processing locations, the items transferred, and a link to its privacy policy. Dodo Payments and the operator are independent data controllers for their respective processing activities. The policy now also states that card details and the full billing address are entered on the Dodo Payments checkout and collected by Dodo Payments. Collected items and retention periods are unchanged.
8. Subprocessors and cross-border transfers
| Before | After |
|---|---|
| Payments made in the Republic of Korea are processed by Toss Payments Co., Ltd. as a payment gateway (PG), and its processing is governed by its own privacy policy (https://pages.tosspayments.com/terms/homepage/privacy/policy). Where an overseas payment provider processes buyer and payment information as the Merchant of Record, that provider and LeanLog (Wonjung Choi) each act as independent data controllers for their respective processing activities. The overseas payment provider is still to be determined; once it is selected, its name and privacy notice link will be reflected in this policy. | Payments made in the Republic of Korea are processed by Toss Payments Co., Ltd. as a payment gateway (PG), and its processing is governed by its own privacy policy (https://pages.tosspayments.com/terms/homepage/privacy/policy). Overseas payments (USD) are processed by Dodo Payments as the Merchant of Record; to the extent Dodo Payments processes buyer and payment information, Dodo Payments and LeanLog (Wonjung Choi) each act as independent data controllers for their respective processing activities. Dodo Payments' processing is governed by its own privacy policy (https://dodopayments.com/privacy-policy). |
| Overseas payment provider (to be determined) | Countries or regions processed by the overseas payment provider and payment networks. Once the provider is selected, the specific countries and regions will be reflected in this policy | For international (USD) payments, sent or received through payment integrations during checkout, subscription creation/renewal/cancellation, customer portal sessions, refunds, payment notices, and payment-method management | Email, customer/address/subscription/transaction/payment-method identifiers, payment status, refund reason, and information needed for receipts and tax handling. SKIMTUBE does not directly store full card numbers or CVCs | Payments, subscription management, refunds, receipts and tax handling, payment-method management, and payment dispute response | For the period needed for e-commerce, tax, accounting, and dispute response. In-app payment records follow this policy's retention periods, and provider-side retention follows that provider's policy and legal obligations | Users may refuse. However, payments, subscriptions, customer portal, refunds, and saved payment-method management may be limited | Overseas payment provider privacy notice: to be published once the provider is selected | Dodo Payments (Merchant of Record for overseas payments — the companies that operate together under the Dodo Payments trade name, including Dodo Payments Inc (United States)) | The United States and other countries where the Dodo Payments group companies and their processors and payment networks run their infrastructure. The Dodo Payments privacy policy does not name specific countries; it states that processors located anywhere in the world may be used and that Standard Contractual Clauses are applied to transfers out of the UK/EEA | For international (USD) payments, sent or received through payment integrations during checkout, subscription creation/renewal/cancellation, customer portal sessions, refunds, payment notices, and payment-method management | Email, name or display name, billing country, customer/subscription/transaction/payment-method identifiers, payment status, refund reason, and information needed for receipts and tax handling. Card details and the full billing address (city, postal code, and so on) are entered by you on the Dodo Payments checkout and collected by Dodo Payments; SKIMTUBE does not store full card numbers or CVCs | Payments, subscription management, refunds, receipts and tax handling, payment-method management, and payment dispute response | For the period needed for e-commerce, tax, accounting, and dispute response. In-app payment records follow this policy's retention periods, and Dodo Payments' own retention follows its policy and legal obligations | Users may refuse. However, overseas payments, subscriptions, the customer portal, refunds, and saved payment-method management may be limited | Dodo Payments privacy policy: https://dodopayments.com/privacy-policy · Buyer Terms: https://dodopayments.com/legal/buyer-terms |
Revision of 2026-08-25
Added Toss Payments Co., Ltd. to the external processors table as the domestic payment processor (processed in Korea, no cross-border transfer). Statements about an overseas Merchant-of-Record provider now apply only to international payments; that provider is still to be determined. Collected items and retention periods are unchanged.
8. Subprocessors and cross-border transfers
| Before | After |
|---|---|
| Where the payment provider processes buyer and payment information as the Merchant of Record, that provider and LeanLog (Wonjung Choi) each act as independent data controllers for their respective processing activities. The provider's processing is governed by its own privacy notice. The payment provider is still to be determined; once it is selected, its name and privacy notice link will be reflected in this policy. | Payments made in the Republic of Korea are processed by Toss Payments Co., Ltd. as a payment gateway (PG), and its processing is governed by its own privacy policy (https://pages.tosspayments.com/terms/homepage/privacy/policy). Where an overseas payment provider processes buyer and payment information as the Merchant of Record, that provider and LeanLog (Wonjung Choi) each act as independent data controllers for their respective processing activities. The overseas payment provider is still to be determined; once it is selected, its name and privacy notice link will be reflected in this policy. |
| Payment provider (to be determined) | Countries or regions processed by the payment provider and payment networks. Once the provider is selected, the specific countries and regions will be reflected in this policy | Sent or received through payment integrations during checkout, subscription creation/renewal/cancellation, customer portal sessions, refunds, payment notices, and payment-method management | Email, customer/address/subscription/transaction/payment-method identifiers, payment status, refund reason, and information needed for receipts and tax handling. SKIMTUBE does not directly store full card numbers or CVCs | Payments, subscription management, refunds, receipts and tax handling, payment-method management, and payment dispute response | For the period needed for e-commerce, tax, accounting, and dispute response. In-app payment records follow this policy's retention periods, and provider-side retention follows that provider's policy and legal obligations | Users may refuse. However, payments, subscriptions, customer portal, refunds, and saved payment-method management may be limited | Payment provider privacy notice: to be published once the provider is selected | Toss Payments Co., Ltd. | Republic of Korea (domestic processing — no cross-border transfer) | Sent or received through the payment integration during domestic checkout, card registration (auto-renewal), recurring charges, cancellations, and refunds | Email, order number and payment identifiers, customer identifier (customerKey), card issuer and partially masked card number, payment status and amount, cancellation/refund reason. SKIMTUBE does not store full card numbers or CVCs | Domestic payment processing, auto-renewal (recurring charges), cancellations and refunds, payment dispute response | For the retention periods required by e-commerce, tax, and accounting law. In-app payment records follow this policy's retention periods, and Toss Payments' own retention follows its policy and legal obligations | Users may refuse. However, domestic payments, subscriptions, and refunds may be unavailable | Toss Payments privacy policy: https://pages.tosspayments.com/terms/homepage/privacy/policy |
| Overseas payment provider (to be determined) | Countries or regions processed by the overseas payment provider and payment networks. Once the provider is selected, the specific countries and regions will be reflected in this policy | For international (USD) payments, sent or received through payment integrations during checkout, subscription creation/renewal/cancellation, customer portal sessions, refunds, payment notices, and payment-method management | Email, customer/address/subscription/transaction/payment-method identifiers, payment status, refund reason, and information needed for receipts and tax handling. SKIMTUBE does not directly store full card numbers or CVCs | Payments, subscription management, refunds, receipts and tax handling, payment-method management, and payment dispute response | For the period needed for e-commerce, tax, accounting, and dispute response. In-app payment records follow this policy's retention periods, and provider-side retention follows that provider's policy and legal obligations | Users may refuse. However, payments, subscriptions, customer portal, refunds, and saved payment-method management may be limited | Overseas payment provider privacy notice: to be published once the provider is selected |
Revision of 2026-08-13
This is the version currently in effect. Comparison tables for earlier revisions are not provided.
This is the first version tracked in the revision history.