SuperGalaxy (초은하) (the “Operator”, “we”) runs GalaxyDresser (the “Service”) and processes personal data under the Korean Personal Information Protection Act and other applicable laws.
1. What we process and why
| Category | Data | Purpose |
|---|---|---|
| Account | Steam ID, Steam display name, times of sign-up, last sign-in and consent | Sign-in, identifying the account, recording consent |
| Linked devices | Device authentication information, device name, plugin and Warudo versions, last seen time, link-code records | Authenticating devices, making results open only on your device |
| Usage records | Monthly usage counts, records of outfit conversions and counts given back, the conversion data sent and outfit keys | Usage limits, opening results, preventing misuse, handling payment disputes |
| Conversion information | Product name, text information from the outfit package such as names and setting values, your character's skeleton information | Processing conversions. The outfit package's text information is deleted once the conversion data is made. |
| Billing | Paddle customer ID, subscription ID, status and period, transaction IDs, price ID, amount and currency paid, refund and chargeback records, records of processed payment notifications | Checking subscription access, linking to subscription management, accounting and disputes |
| Enquiries | Email address and message, plugin bug reports and their attachments (such as logs) | Answering you, fixing errors |
| Access and security | IP address, records of key actions (sign-in, device linking, payments) | Security, preventing misuse |
| Statistics | Conversion counts per product (product name, package hash and count; nothing that identifies you) | Improving compatibility |
2. Retention and deletion
- Account, device and usage data, conversion records (including character skeleton information), and records of key actions, are kept with no set period until you ask us to delete your account, and are then deleted without delay. IP addresses in the records of key actions are deleted after 3 months. Enquiries and bug reports are deleted once they are no longer needed.
- Records that Korean law requires us to keep are kept separately for the required period:
- records of contracts and withdrawals: 5 years (Act on Consumer Protection in Electronic Commerce);
- records of payments and supply: 5 years (same Act);
- records of consumer complaints and disputes: 3 years (same Act);
- access logs (IP addresses): 3 months (Protection of Communications Secrets Act).
- Electronic files are deleted so that they cannot be recovered; paper records are shredded or incinerated.
3. Account settings and support
- You may optionally save a contact email address and a preferred language (Korean, English or Japanese) in your account settings; every feature works without them. We store the email address as you enter it, without verification, use it only to respond to your support requests and never for advertising or marketing.
- The address in your account settings is deleted as soon as you clear it; a contact email already included in a support request you sent stays with that request for the retention period below.
- Support requests sent through "Contact us" in the app (category, subject, message, any reference number you add, and your contact email) and our replies are kept for 3 years after the request is closed (or, for a request that was never closed, after its last message), for handling complaints and disputes, and then destroyed.
- To answer payment questions, our staff may look up the billing email you registered with Paddle through Paddle; we do not store it in our database.
- The admin-console cookies (__Host-gd_admin, __Host-gd_admin_device) are used only by our staff and are never set for users.
4. Disclosure to third parties
We do not disclose your personal data to third parties, except where the law requires it or investigative authorities request it through legal procedures.
Payments are processed directly by Paddle, our Merchant of Record. Paddle handles the data it receives at checkout, such as card details, billing email and address, independently under its own privacy notice. We do not store this data in our service database (we can view it in Paddle's dashboard to answer payment questions).
5. Processors and international transfers
| Recipient | Role | Location |
|---|---|---|
| Google Cloud, Cloudflare | Running servers and databases, delivering the site (CDN), visit statistics | Servers in the Seoul (Korea) region; delivery network worldwide |
| Paddle.com Market Ltd and the Paddle group | Payments, tax, receipts, refunds and buyer support (independent controller) | United Kingdom, United States and elsewhere |
| Valve Corporation | Steam sign-in (you sign in on Steam directly) | United States |
Only the data needed for the purposes above is transferred abroad. It is transmitted over the network while you use the Service and kept for each recipient's retention period. If you do not want your data transferred abroad, you can stop using the Service and ask us to delete your account.
6. Your rights
You may ask at any time to access, correct, delete or stop the processing of your personal data by writing to support@supergalaxy.me. We act without delay (within 10 days at the latest) and tell you the result. A legal representative or someone you authorise may also make the request.
7. Cookies and external scripts
- The product, pricing and policy pages use no cookies or advertising.
- Visit statistics for the site and the app are collected with Cloudflare Web Analytics. It sets no cookies and keeps only aggregate data that does not identify you (pages viewed, referrer, browser type, country, load times).
- The app (dresser.supergalaxy.me) uses only the cookies that keep you signed in (gd_session, gd_login).
- Paddle's script (cdn.paddle.com) loads only when the checkout opens; cookies and storage used by the checkout follow Paddle's notice.
- You can refuse cookies in your browser, but you will then not be able to sign in to the app.
8. Security measures
Encryption in transit, device authentication, token protection, restricted administrator access with two-factor authentication, and audit records of key actions.
9. Children
The Service is not directed at children under 14, and we do not knowingly collect personal data from children under 14.
10. Privacy officer
- Privacy officer: Sibaek Yang
- Contact: support@supergalaxy.me
11. Where to complain
For advice or to report a privacy violation, you can contact these Korean bodies (or the data protection authority where you live):
- Personal Information Infringement Report Center: 118, privacy.kisa.or.kr
- Personal Information Dispute Mediation Committee: 1833-6972, www.kopico.go.kr
- Supreme Prosecutors' Office: 1301, www.spo.go.kr
- Korean National Police Agency: 182, ecrm.police.go.kr
12. Changes
We announce changes to this policy on this page and in the Service at least 7 days before they take effect (30 days for significant changes).
This is a translation of the Korean 개인정보처리방침; if the two differ, the Korean version prevails.