1. Purpose and scope
This policy applies to personal information processed by SetFN Inc. (the "Company" or "we") in connection with:
- Registration and sign-in for setfn.com accounts
- Tenant (organization) registration and business information management
- SpaceBuilder license issuance, renewal and verification
- Payments and refunds for paid services, and tax invoice issuance
- Customer support, inquiries and error reports
- Updates, diagnostics and advertising operations for SpaceBuilder and the Space app
When personal information about Users is collected, used or retained in a Space operated by an Administrator, the Administrator is the personal information controller for that information. We do not manage personal information on behalf of that Space's Administrator or Users.
2. Personal information we collect
We may collect the following information at different stages of service use:
| Category | Information collected |
|---|---|
| setfn.com account | Administrator's email address, password, authentication information and login records |
| Basic tenant (organization) information | Organization (tenant) name, organization size and maximum number of users |
| Tenant business information (optional) | Business registration number, representative's name, business address including detailed address, city, province, postal code and country, business type and business activities |
| Tenant contact details (optional) | Contact person's email address and telephone number, and organization logo image |
| License issuance and renewal | Administrator account information, tenant information, license type, validity period, device identifier, hostname, host IP address, software version and operating system information |
| Paid service payments | Purchaser's name and email address, payment method information, billing address information, payment and refund history, and receipt information. Sensitive payment details, such as full card numbers, are handled directly by card issuers or payment gateways. We do not store full card numbers. |
| Customer support | Inquiry details, contact information, attachments, error descriptions and material voluntarily provided by the user |
| Automatically collected information | Access logs, IP address, browser and device information, cookies, service usage records, app version, operating system, error codes, crash information and performance logs |
| Advertising operations | Advertising identifiers, ad impression and click events, approximate location and app usage events |
Passwords are stored using secure encryption or hashing.
Business registration numbers, representatives' names, business addresses and contact details are optionally supplied by Administrators for tax invoices and proof of payment. They are not required for registration or license issuance. If an Administrator enters information about another person, such as an organization's representative or an accounting or purchasing contact, that Administrator is responsible for informing the person that their personal information has been provided.
To reiterate, the information we store relates to the Administrator's account, tenant, license and payments for SpaceBuilder—not work data inside the Space server the Administrator creates.
User accounts, passwords and access logs within an organization's workspace server are processed and retained only on that organization's own server under the Administrator's control. We do not collect or access that information.
3. Purposes of collection and use
We use the personal information we collect for:
- Identifying Administrators, enabling sign-in and managing accounts
- Registering and managing tenants; issuing, renewing and validating SpaceBuilder licenses; and preventing abuse
- Processing paid plans, billing, refunds, subscription status checks and tax invoices
- Responding to inquiries, incidents and errors as part of customer support
- Providing security patches, bug fixes, improvements and updates
- Maintaining service stability, preventing misuse and conducting security checks
- Displaying advertisements and measuring their performance to support free features
- Providing announcements and marketing information only where the Administrator or User has consented
4. Retention periods
As a general rule, we destroy personal information without delay once its collection and use purposes have been fulfilled. However, we may retain it separately for the applicable period where required by law or necessary for dispute resolution, misuse prevention or settlement.
| Records retained | Retention period | Basis |
|---|---|---|
| Records of contracts or withdrawal of offers | 5 years | Act on the Consumer Protection in Electronic Commerce, Etc. |
| Records of payment and supply of goods or services | 5 years | Act on the Consumer Protection in Electronic Commerce, Etc. |
| Records of consumer complaints or dispute resolution | 3 years | Act on the Consumer Protection in Electronic Commerce, Etc. |
| Business information for tax invoices, including business registration number, representative's name and business address | The period required by applicable tax law, generally 5 years, or until account withdrawal or tenant termination | Framework Act on National Taxes and other applicable laws |
| Access logs and connection tracking information, including license instance connection history | 3 months | Protection of Communications Secrets Act |
5. Self-hosting and user content
Spaces created with SetFN SpaceBuilder are stored on PCs, servers or infrastructure selected by the Administrator. Files, conversations, documents, calendars, email, database contents and training material in a Space fall under the Administrator's control.
We do not separately collect or retain that content or any personal information it contains. Even when access is needed for technical support, we access only the material the Administrator or User has agreed to and directly provided in advance.
If an Administrator stores or processes personal information about employees, clients, partners or guests in a Space, the Administrator generally bears the obligations of a personal information controller, including establishing a lawful basis for collection, notice, consent, retention, destruction and access controls.
6. The Space app and Space user information
Users may sign in to a Space using its ID and password or another authentication method set by the Administrator. This account is generally managed by that Space's Administrator and is technically separate from a setfn.com account.
Connecting to a Space through the Space app does not mean the User's Space login ID or password is transmitted to or retained by us.
However, limited information such as the app version, operating system, device information, error codes and advertising identifiers may be sent to us for app updates, advertising, diagnostics or customer support. Even in these cases, local files and data inside the Space are generally not sent to us.
7. External AI, agents and MCP integrations
SpaceBuilder and the Space app may offer integrations with external tools, including MCP (Model Context Protocol). We provide the ability to connect to external AI or agents, or the means for MCP integration, rather than the external AI itself.
If an Administrator or User selects external AI and grants permission, authorized files, documents, chats, screen content and work context may be sent to that external service to carry out the requested task. Unless expressly stated otherwise, this does not mean the data is sent to the Company's own servers.
The external service's terms and privacy policy govern the data it processes, use for training, retention periods, security policies and fees. We do not control the responses, processing practices, retention, training use or security policies of external AI selected by an Administrator or User.
8. Disclosure to third parties
We do not disclose personal information externally without the Administrator's or User's consent, except:
- Where the Administrator or User has given separate prior consent
- Where disclosure is based on law or requested by an investigative authority in accordance with legally prescribed procedures and methods
When paying for a service, payment details may be processed by card issuers, banks, payment gateways or other payment-related institutions. This processing is limited to what is needed to complete payment and is governed by the payment screen, the payment provider's policies and the data processing provisions of this policy.
9. Data processors
We may entrust the following personal information processing tasks to service providers. Our processing agreements specify the measures necessary for secure handling of personal information.
| Service provider | Processing tasks |
|---|---|
| Toss Payments Co., Ltd. | Paid service payment processing, payment authorization, cancellation, refunds and settlement support |
The table above lists the processing arrangements currently disclosed for our general service operations. If we separately contract with an Administrator to provide managed services such as server operation, hosting, monitoring or backups, additional infrastructure providers or operational tools may be used within that agreement's scope. We will disclose these through the agreement, quotation, order form, Privacy Policy or a separate notice.
10. Your rights and how to exercise them
You may exercise the following rights regarding your personal information at any time:
- Request access, correction or deletion
- Request suspension of processing
- Withdraw consent and close your account
You may make a request through your setfn.com account settings or the privacy contact below. We will act within the period prescribed by applicable law.
If tenant business information or contact details belong to someone other than the Administrator, that person may exercise the same rights by contacting our privacy contact.
Requests to access, correct or delete user accounts, files, documents, chats, calendars or email stored in a self-hosted Space must be directed to that Space's Administrator. We have no means of accessing Space data managed directly by an Administrator.
12. Security measures
We take the following measures to protect personal information:
- Encrypting or hashing stored passwords
- Encrypting data in transit using TLS
- Minimizing access to tenant business information, such as business registration numbers and representatives' names
- Restricting access to personal information and maintaining access records
- Installing security software and performing regular updates and checks
- Training staff who handle personal information and maintaining internal management procedures
13. Children's privacy
As a general rule, we do not collect personal information from children under 14. If a person is identified as under 14, we restrict registration or promptly destroy collected information in accordance with the relevant procedures.
14. Privacy officer
We designate a privacy officer to oversee personal information processing and respond to inquiries.
- Company: SetFN Inc.
- Representative: Sun Joong, Kim
- Email: help@setfn.com
- Address: Room 301, Building B, Startup Square, 40 Geumto-ro 80beon-gil, Sujeong-gu, Seongnam-si, Gyeonggi-do, Republic of Korea
15. Policy changes
We will announce changes to this policy on our website at least 7 days before they take effect, or 30 days before changes that materially affect your rights. The revision history is available on our website.