Privacy Policy
Effective: 2026-10-16
Upcoming change (effective 2026-10-23): server access logs will be kept for 7 days instead of 14 (Section 3).
BEPULJANG (“Umtri”, “we”) operates the Umtri service. This policy explains what personal information we collect, why, how long we keep it, and how you can control it. It follows the Personal Information Protection Act of Korea.
1. Why we process personal information
We process personal information only for these purposes. If a purpose changes, we will tell you first and ask for consent again where required.
- Accounts: confirming sign-ups, email verification, keeping you signed in, preventing abuse
- The service: grounds, teams and invitations, API tokens and MCP connections
- Payments: paid plans, recurring billing, cancellations and refunds
- Support and notices: answering questions and feedback, sending emails you need to use the service
- Usage statistics: analyzing visits and usage to improve the service — only if you consent
2. What we collect
| Category | Items |
|---|---|
| Sign-up (required) | Email address, password, handle (unique name) |
| Profile (optional) | Name, profile image, bio |
| Created while using Umtri | Project content you enter (nodes, bugs, wiki, etc.), feedback, email addresses you enter when inviting someone to a team |
| Collected automatically | Access records (IP address, time), session cookie that keeps you signed in, last use time of API tokens |
| Payments | Payment identifiers issued by Toss Payments (customer key, billing key), payment and subscription history |
| Usage statistics (with consent) | Google Analytics cookie identifier, pages visited, device and browser information |
- Passwords and API tokens are stored only as one-way hashes.
- We never receive or store card numbers. Payments are processed by Toss Payments.
- Email addresses in team invitations are entered by the member who invites. They are used only to send the invitation and track whether it was accepted, and are deleted when the team is deleted.
3. How long we keep it
When the purpose ends — for example, when you delete your account — we delete your personal information without delay, except for the following.
| Item | Retention |
|---|---|
| Account information and content you created | Until you delete your account (deleted immediately) |
| Sign-in session | Up to 30 days |
| Server access logs (IP address, etc.) | 14 days |
| Usage statistics (with consent) | According to the Google Analytics data retention setting (up to 14 months) |
Content you wrote in a ground owned by another member’s team stays with that team, but nothing that identifies you is kept after you leave.
Korean law requires us to keep the following records for a set period even after you delete your account.
| Record | Retention | Legal basis |
|---|---|---|
| Payments and supply of goods or services | 5 years | Act on Consumer Protection in Electronic Commerce |
| Contracts and withdrawal of orders | 5 years | Act on Consumer Protection in Electronic Commerce |
| Consumer complaints and dispute resolution | 3 years | Act on Consumer Protection in Electronic Commerce |
4. How we delete it
- Personal information is deleted without delay once its retention period ends or its purpose is fulfilled.
- Electronic records are deleted so they cannot be recovered.
- Records kept by law are stored separately, used for no other purpose, and deleted when the period ends.
5. Sharing with third parties
We do not provide your personal information to third parties, except with your prior consent or where the law specifically requires it.
6. Service providers
We entrust the following providers with processing needed to run the service.
| Provider | Task |
|---|---|
| Amazon Web Services, Inc. | Server and database hosting (AWS Lightsail, Seoul region), sending email (Amazon SES) |
| Kakao Corp. | Receiving support email (Daum Mail) |
| Toss Payments Co., Ltd. | Payment processing and recurring billing |
| Google LLC | Usage statistics (Google Analytics, only for visitors who consent) |
We require these providers to keep personal information secure, and we will update this policy if a provider or task changes.
7. Transfers outside Korea
If you consent to usage statistics, the following information is transferred abroad. If you do not consent, nothing is transferred.
- Recipient: Google LLC (privacy policy)
- Country: United States
- When and how: sent over the network while you use the website
- Items: cookie identifier, pages visited, device and browser information, approximate location derived from your IP address
- Purpose and retention: usage statistics, according to the Google Analytics data retention setting (up to 14 months)
- How to refuse: decline in the cookie banner, or change your choice anytime with “Change cookie choice” at the bottom of this page. Declining does not limit anything in the service.
8. Your rights
You can ask at any time to see, correct, delete, or stop the processing of your personal information.
- See and correct: in the app, Settings → Profile.
- Delete your account: in the app, Settings → Delete account. If you own a team that has other members, transfer ownership or remove the members first.
- Anything else: email support@umtri.io and we will handle it without delay.
- You can also exercise these rights through a legal representative or someone you authorize.
Umtri does not accept sign-ups from children under 14.
9. How we protect it
- Passwords and API tokens stored as hashes
- HTTPS encryption on every connection
- Protected session cookie (HttpOnly, Secure)
- Rate limits on sign-in and other authentication requests
- Admin features and server access limited to designated administrators
10. Cookies
| Cookie | Purpose | Type |
|---|---|---|
umtri.sid |
Keeps you signed in to the app (up to 30 days) | Essential |
umtri_consent |
Remembers your cookie choice (1 year) | Essential |
_ga, _ga_* |
Usage statistics (Google Analytics) | Optional — only with consent |
- The banner shown on your first visit lets you allow or decline usage statistics cookies. Your choice applies to both umtri.io and app.umtri.io.
- To change your choice, use “Change cookie choice” at the bottom of this page.
- You can also block cookies in your browser settings, but blocking essential cookies means you cannot sign in.
11. Privacy officer
For questions, complaints, or remedies about how we handle personal information, contact:
- Privacy officer: CEO
- Contact: support@umtri.io
12. Getting help
If you need advice or want to report a privacy violation, you can also contact these Korean authorities.
- Personal Information Dispute Mediation Committee: 1833-6972, www.kopico.go.kr
- Personal Information Infringement Report Center: 118, privacy.kisa.or.kr
- Supreme Prosecutors’ Office: 1301, www.spo.go.kr
- Korean National Police Agency: 182, ecrm.police.go.kr
13. Changes to this policy
If we change this policy, we will announce it on this page at least 7 days before the change takes effect.