Phazic Privacy Policy Phazic 개인정보 처리방침

1.1 Who we are

The Phazic software ("Software") is published by Devign29, a sole proprietorship registered in the Republic of Korea ("Devign29," "we," "our," or "us"). For the purposes of EU/UK GDPR, Korean PIPA, Japanese APPI, and U.S. state privacy laws, Devign29 is the "controller" / "personal information handler" / "business" of the personal data described in this Policy.

1.2 What this Policy covers

This Policy explains what personal data we process in connection with: (a) the desktop and mobile Phazic applications; (b) the activation server at phazic.pages.dev; (c) the marketing website at www.phazic.com and its subdomains; and (d) email-based customer support. It does not cover the practices of third-party services You may use alongside the Software (e.g., cloud storage to which You manually export Your project files).

1.3 Who "You" are

"You" means any natural person whose personal data we process — typically an individual who downloads, activates, or uses the Software, or who contacts us for support, sales, or legal matters. Where the Software is acquired by an organization, "You" includes Authorized Users designated by that organization.

2.1 "Personal Data" / "Personal Information"

any information relating to an identified or identifiable natural person, as defined under GDPR Art. 4(1), CCPA §1798.140(v), PIPA Art. 2(1), and APPI Art. 2(1).

2.2 "Processing"

any operation performed on Personal Data, including collection, recording, organization, storage, alteration, retrieval, consultation, use, disclosure, transmission, restriction, erasure, or destruction.

2.3 "Processor" / "Sub-processor"

a natural or legal person that processes Personal Data on Devign29's behalf and only on its documented instructions, as defined under GDPR Art. 4(8).

2.4 "Device Fingerprint"

a 16-character hexadecimal hash derived locally on Your device from non-personally-identifiable hardware/OS characteristics. The hash is one-way (SHA-2 family, truncated); the underlying raw values never leave Your device.

2.5 "License File"

a small JSON/JWT artifact, written to Your local profile directory upon successful activation, containing Your customer email, SKU identifier, License Key, expiry timestamp, and the Device Fingerprint. The License File is signed by Devign29 and read locally by the Software to gate paid features.

2.6 "Activation Server"

the HTTPS endpoint at phazic.pages.dev (deployed on Cloudflare Pages and Cloudflare Workers) that issues, validates, and counts activations of License Keys.

2.7 "KV Edge Cache"

Cloudflare Workers KV, a globally distributed key-value store on Cloudflare's edge network used by Devign29 to store the (License Key → activation-count, Device-Fingerprint set, customer-email) mapping.

We process only the minimum data needed for the purpose, in line with the data-minimization principle (GDPR Art. 5(1)(c), PIPA Art. 3).

3.1 At purchase

3.2 At activation and during use

The IP address derived from Your activation request is itself Personal Data within the meaning of GDPR Article 4(1) and the CJEU judgment in Breyer (C-582/14); it is processed only for the purpose stated in the table below and is retained for the period set out in Article 8. The local reading of hardware/OS characteristics to compute the Device Fingerprint involves access to information stored in Your terminal equipment; this access relies on the "strictly necessary to provide an information society service explicitly requested by the user" exemption under Article 5(3) of the ePrivacy Directive (2002/58/EC) and the EDPB Guidelines 2/2023, because it is required to deliver the licence activation You have requested.

3.3 At support contact

When You contact Devign29 by email (support@devign29.com) or other channel, we receive the contents of Your message, Your email address, and any attachments You voluntarily send (such as a project file, log excerpt, or screenshot). You control what You share. We do not request that You send sensitive personal data.

3.4 At website visit

The marketing website www.phazic.com serves static content and is hosted on Cloudflare Pages. Standard server-side request logs (IP address, user agent, referrer, requested path, timestamp) are processed by Cloudflare on Devign29's behalf for ninety (90) days, solely for security and aggregate traffic statistics. We do not deploy advertising cookies, marketing trackers, or third-party analytics.

For the avoidance of doubt and as a positive commitment, Devign29 does not collect, transmit, or store:

• the contents of Your simulation project files (.json, .cbor, .phazic);
• the contents of any data You import (n,k files, CSV/TXT inputs);
• the contents of any Output You generate (R/T/A results, dispersion curves, exported images);
• raw machine identifiers (MAC address, motherboard serial, disk serial, full machine GUID, IMEI);
• application telemetry, feature-usage metrics, or behavioral analytics;
• automatic crash reports or stack traces — these can be sent only by Your explicit action through the in-Software "Send report" button, and the report content is shown to You first;
• geolocation finer than the country-level inference from Your activation IP;
• information from third-party social media accounts;
• advertising identifiers (IDFA, AAID) or cross-site tracking signals.

Phazic is built to function fully offline once activated, except for the periodic license re-validation described in EULA Article 3.1, which transmits only the Device Fingerprint and License Key.

The table below maps each category of Personal Data to its purpose and to the legal basis under GDPR Art. 6(1), PIPA Art. 15, and (where applicable) the equivalent provisions of APPI and U.S. state privacy laws.

5.1 Legitimate interest — balancing

Where we rely on legitimate interest (security, fraud prevention, aggregate statistics), we have conducted a balancing test and concluded that Devign29's interest in protecting the Software's economic and security integrity does not override Your reasonable expectations of privacy, given the narrow scope of the data, short retention, and absence of any profiling or marketing use.

5.2 No secondary use

We do not use Personal Data collected for one of the purposes above for any other purpose without first obtaining a new legal basis (e.g., fresh consent).

Devign29 engages a small number of carefully selected processors that act on Devign29's documented instructions only.

An up-to-date list of sub-processors is maintained in this Privacy Policy (see the sub-processor table above). Devign29 gives at least thirty (30) days' notice of any new sub-processor by updating this Policy.

6.1 No sale or sharing

Devign29 does not sell, rent, or share Personal Data for cross-context behavioral advertising or for any other purpose within the meaning of the CCPA/CPRA §1798.140(ad), (ah). Devign29 has not done so in the preceding 12 months.

6.2 Required disclosures

We may disclose Personal Data when compelled by a valid court order, subpoena, or other lawful demand of a competent authority. We assess each demand for legal validity and, where lawful and consistent with the rights of data subjects, notify You before complying.

6.3 Corporate transactions

In the event of a merger, acquisition, or sale of all or substantially all of Devign29's assets, Personal Data may be transferred to the successor entity, subject to confidentiality undertakings substantially equivalent to those in this Policy. You will be notified by email and by an in-Software notice.

Devign29 is established in the Republic of Korea. Cloudflare KV edge cache stores activation data at Cloudflare data centers worldwide, which may include the United States, EEA Member States, the United Kingdom, Japan, Singapore, and the Republic of Korea, among others.

7.1 Transfers from the EEA / UK / Switzerland

Where Personal Data is transferred outside the EEA, UK, or Switzerland to a country that has not received an adequacy decision (e.g., the Republic of Korea is the subject of an adequacy decision adopted on 17 December 2021; the United States is covered for DPF-certified recipients), Devign29 relies on:

• EU Standard Contractual Clauses (Implementing Decision (EU) 2021/914 — "SCCs," module two — controller-to-processor), with the UK International Data Transfer Addendum or UK IDTA where required by UK GDPR;
• the EU–U.S. Data Privacy Framework (and its UK and Swiss extensions) where the recipient (e.g., Cloudflare, Google) is self-certified to DPF;
• and supplementary technical and organizational measures (TLS in transit, KV encryption at rest, strict purpose limitation) as required by the Schrems II judgment.

A copy of the SCCs used can be obtained from privacy@devign29.com.

7.2 Transfers from the Republic of Korea

For Korean residents, the cross-border transfer of Personal Data to Cloudflare (USA), Google LLC (USA), and Paddle.com Market Ltd (United Kingdom) is conducted on the basis of Your separate, prior consent obtained through the in-Software first-run consent gate, in compliance with Article 28-8 of the Personal Information Protection Act. The matters disclosed at the time of consent — recipient, purpose, items, retention/use period in the recipient country, refusal right and resulting limitations — are summarized in the Cross-Border Transfer Notice below.

7.3 Transfers from Japan

For Japanese residents, transfers to processors in the USA (Cloudflare and Google) are conducted on the basis of (a) Your consent, or (b) the processor's adoption of an APPI-equivalent personal-information-protection system (Article 28 APPI), as confirmed in the relevant DPA. The transfer to the payment processor Paddle.com Market Ltd (United Kingdom) relies on the United Kingdom's recognition by the Personal Information Protection Commission of Japan as a foreign country providing protection at a standard equivalent to APPI, together with Your consent.

7.4 Cross-Border Transfer Notice (PIPA Article 28-8)

The following table sets out, in respect of each recipient, the information that Article 28-8 of the Personal Information Protection Act requires Devign29 to disclose prior to obtaining Your consent: recipient and its data-protection contact, country, transfer date and method, items transferred, recipient's purpose and retention period, and the procedure and effect of refusal.

7.5 Refusal right

You may refuse the cross-border transfer. However, refusing the transfer to Cloudflare will prevent activation, and paid features of the Software will not function. The Software will remain usable in Demo Mode.

Devign29 retains Personal Data only as long as necessary for the purposes for which it was collected, plus any period required by law.

8.1 Deletion procedure

At the end of the retention period, Personal Data is securely deleted from primary systems within thirty (30) days, and from backup media at the end of the next backup-rotation cycle (currently up to ninety (90) days). Where deletion is technically infeasible (e.g., immutable audit logs), the data is anonymized or access-restricted instead.

Subject to applicable law, You have the following rights with respect to Your Personal Data:

• Right of access — confirmation of whether we process Your data and a copy of it (GDPR Art. 15; PIPA Art. 35; APPI Art. 33; CCPA §1798.110);
• Right to rectification — correction of inaccurate or incomplete data (GDPR Art. 16; PIPA Art. 36; CCPA §1798.106);
• Right to erasure ("right to be forgotten") — deletion of Your data where processing is no longer necessary or where You withdraw consent (GDPR Art. 17; PIPA Art. 36; CCPA §1798.105);
• Right to restriction of processing (GDPR Art. 18; PIPA Art. 37);
• Right to data portability — receipt of Your data in a structured, commonly used, machine-readable format (GDPR Art. 20);
• Right to object to processing based on legitimate interest (GDPR Art. 21);
• Right to withdraw consent at any time, without affecting the lawfulness of prior processing (GDPR Art. 7(3); PIPA Art. 37);
• Right to opt out of sale or sharing (CCPA §1798.120) — Devign29 does not sell or share, so opt-out is built in;
• Right to limit use of sensitive personal information (CPRA) — Devign29 does not process sensitive PI;
• Right to lodge a complaint with a supervisory authority — see Article 17 below.

9.1 How to exercise

Send a request to privacy@devign29.com, including enough information to verify Your identity (we typically require confirmation from the email address linked to the License Key). We will respond within 30 days (GDPR / PIPA) or 45 days (CCPA), extendable once for complex requests with notice to You.

Where You cannot receive email at the address linked to Your License Key (for example, because You have changed jobs or lost access), please contact privacy@devign29.com from any address and provide alternative verification — such as Your License Key, the date of purchase, and the last four digits of the payment instrument used — consistent with the reasonable-verification standards under PIPA Article 38(5), CCPA §1798.130(a)(7), and the EDPB Guidelines on data-subject rights. Devign29 will not refuse a request solely because of difficulty contacting the linked address, provided that identity can be reasonably verified by other means.

9.2 No fee; no retaliation

Requests are handled free of charge, except where they are manifestly unfounded or excessive (e.g., repetitive). We do not retaliate against You for exercising any privacy right (CCPA §1798.125).

9.3 Authorized agents

You may use an authorized agent to submit requests on Your behalf, subject to verification of authorization.

9.4 Appeals (U.S. state privacy laws)

If Devign29 declines to act on Your rights request, You may appeal that decision by emailing privacy@devign29.com within a reasonable period after receiving the denial, with "Privacy Appeal" in the subject line. Devign29 will review the appeal and respond to You in writing with its decision and the reasons for it within sixty (60) days. If the appeal is denied, You may submit a complaint to the Attorney General of Your state of residence. This appeal mechanism is provided in accordance with the Virginia VCDPA §59.1-577(C), the Colorado CPA §6-1-1306(3), and the equivalent provisions of the Connecticut, Texas, and other U.S. state comprehensive privacy laws.

Devign29 implements technical and organizational measures appropriate to the risk:

• Transport security. All communication with the activation server, the website, and processors is over HTTPS using TLS 1.2 or higher with modern cipher suites.
• At-rest encryption. Cloudflare KV provides at-rest encryption for stored values; emails at Google Workspace are encrypted at rest.
• One-way hashing. Device identifiers are hashed locally on Your device before transmission; raw identifiers never leave Your device.
• Code-signing & integrity. Software binaries are code-signed; the License File is cryptographically signed by Devign29 and verified locally.
• Anti-debug & tamper resistance. The Software includes AV-safe anti-debug routines and tamper-resistance measures to deter unauthorized access to the license-enforcement layer.
• Access controls. Administrative access to processors' consoles requires multi-factor authentication; access is limited to personnel with a need-to-know.
• Periodic review. Devign29 reviews its security posture at least annually, and after any material change to the architecture or sub-processor list.
• Breach notification. In the event of a Personal Data breach likely to result in a risk to data subjects, Devign29 will notify the competent supervisory authority within the timeframes required by applicable law: 72 hours under GDPR Article 33 and UK GDPR. Under PIPA Article 34 and its Enforcement Decree, Devign29 will notify the affected data subjects and report to the Personal Information Protection Commission (PIPC) (and the Korea Internet & Security Agency (KISA)) without delay and in any event within 72 hours of becoming aware of a qualifying personal-data breach — the reporting threshold being a breach affecting approximately 1,000 or more data subjects, a breach involving sensitive data or unique identifiers, or a breach caused by external intrusion. The separate 24-hour reporting regime that formerly applied to information and communications service providers under Network Act Article 39-4 no longer applies, that regime having been unified into PIPA with effect from 15 September 2023. Affected data subjects will be notified without undue delay where required (GDPR Article 34; PIPA Article 34; APPI Article 26; CCPA §1798.82 and equivalent U.S. state breach-notification statutes).

11.1 Website

The marketing website www.phazic.com uses a minimal set of cookies / local storage, classified as follows in accordance with the EDPB Guidelines 05/2020 on consent under EU ePrivacy Directive Article 5(3):

No advertising cookies, no analytics cookies, no social-media trackers, no tracking pixels of any kind. Strictly necessary cookies do not require consent under Article 5(3) of the EU ePrivacy Directive. The functional phazic_lang cookie is set only after You actively select a non-default language via the language toggle, which Devign29 treats as informed opt-in consent under EDPB Guidelines 05/2020 §3.1; You can withdraw consent at any time by clearing the cookie via Your browser settings, after which the Site will display in its default language without setting the cookie again unless You re-select.

11.2 Desktop and mobile Software

The Software stores configuration, recent files, and the License File in Your local profile directory. None of this is sent to Devign29 except as described in Article 3.

The Software is a professional engineering tool intended for adults and is not directed to children. Devign29 does not knowingly collect Personal Data from children under the age of (a) 14 in the Republic of Korea, (b) 13 under the U.S. COPPA, or (c) 16 (or such lower age as set by the relevant Member State) in the EEA, or any equivalent age in other jurisdictions. If You believe we have inadvertently collected such data, please contact privacy@devign29.com and we will delete it.

Devign29 does not subject You to automated decision-making, including profiling, that produces legal or similarly significant effects (GDPR Art. 22), with one narrow exception: the activation server makes an automated decision to allow or deny activation based on (a) whether Your License Key is valid and within its activation count, and (b) whether Your IP is located in an OFAC/EU sanctioned jurisdiction.

If activation is denied for either reason, the Software displays the reason and provides You with a path to contest the decision by contacting support@devign29.com, where a human reviewer will assess Your request. This satisfies the right to human review under GDPR Art. 22(3). On request to privacy@devign29.com, Devign29 will also provide meaningful information about the logic of the automated check — namely, what fields are evaluated (License Key validity, current activation count vs. the SKU limit, country inferred from the activation IP, and presence of that country on applicable sanctions lists) and on what criteria — and about the significance and envisaged consequences of the processing, as required by GDPR Articles 13(2)(f), 14(2)(g), and 15(1)(h).

Devign29 sends marketing emails (release notes, feature announcements) only to recipients who have opted in. Activation does not opt You in. You may withdraw consent at any time by clicking "unsubscribe" in any marketing email or by emailing privacy@devign29.com. Withdrawal of marketing consent does not affect transactional emails essential to Your license (e.g., renewal reminders, security advisories, breach notifications).

The following provisions apply only where Your habitual residence is in the specified region and prevail over conflicting provisions of this Policy.

Devign29 may amend this Privacy Policy from time to time. Material changes (changes that meaningfully expand the categories of data collected, the purposes of processing, recipients, or international transfers, or reduce data subject rights) will be notified by email to the address You provided and by an in-Software notice at least thirty (30) days before they take effect. Non-material changes (clarifications, typographical fixes) will be reflected in the Version History below. Continued use of the Software after the effective date constitutes acknowledgment of the change; this does not constitute consent where consent is the lawful basis (we will re-seek consent in such cases).

17.1 Contact Devign29

17.2 Supervisory authorities

• Republic of Korea — Personal Information Protection Commission (pipc.go.kr); KISA Privacy Infringement Reporting Center (privacy.kisa.or.kr · ☎ 118)
• European Union — the supervisory authority of Your habitual residence (list at edpb.europa.eu/about-edpb/about-edpb/members)
• United Kingdom — Information Commissioner's Office (ico.org.uk)
• Switzerland — FDPIC (edoeb.admin.ch)
• United States — California — California Privacy Protection Agency (cppa.ca.gov); state Attorney General
• Japan — Personal Information Protection Commission (ppc.go.jp)