1. Roles and responsibilities
The MoaBoard service operator processes information for account management, service delivery, security and support. Board organizers decide what their boards collect and who may participate. Privacy responsibilities and processing arrangements must reflect how each board actually operates. Organizers should not request unnecessary personal information in posts.
2. Information and purposes
Organizer sign-in uses the provider’s account identifier and the email, name and profile information it supplies. Participation stores submitted posts, comments, display names, reactions, reports and timestamps. Member and invitation features use email addresses, names, access codes and verification status. Operations and abuse prevention may process IP addresses, browser information, country, request identifiers, referrers, paths, campaign values and activity identifiers. Support processes a reply address and request details. Legal bases and required or optional fields must be finalized against the collection screens before publication.
3. Visibility and organizer access
Published posts and display names are visible to people who can open the board. Shared links and QR codes remain subject to the board’s access rules. Organizers can view and manage posts, members, reports and operational information. Current post CSV exports may also contain access information such as IP addresses, browsers and referrers, so organizers must take care when sharing files. Visitor APIs do not provide these access details to ordinary visitors.
4. Retention and deletion
Account, content, membership, security and export data have separate retention rules. An analytics lookback is not a post-deletion deadline. Sign-in and member session cookies have a configured lifetime of 14 days; temporary sign-in verification cookies last 10 minutes. Export downloads expire 7 days after generation, which may differ from physical file deletion. Retention periods for other categories, statutory grounds and deletion or backup handling must be finalized before publication.
Retention baseline for launch
Active board content will not be deleted merely because it falls outside a plan’s analytics lookback. Account closure will include deletion of personal information no longer needed, with separate retention only for legally required records. Direct closure requires a recent sign-in and confirmation of scope; other personal-data requests use the help contact. The baseline is 30 days for raw visit and analytics data and 90 days for security and enforcement records. Records required for an investigation or dispute will be retained separately with a documented reason. Export downloads expire after 7 days; stored export files are to be removed within 7 further days. An effective date will be announced after implementation and verification.
Records retained by law after account closure
After closure, only necessary fields in records subject to statutory retention are kept separately from service data and destroyed when the period ends. For transactions covered by Korea’s electronic-commerce consumer-protection law, contract or withdrawal records and payment or supply records are retained for 5 years; consumer complaint or dispute records for 3 years. Tax and accounting evidence follows the scope and periods required by the applicable law. Each period follows its statutory starting point and is not restarted by account closure. A payment history does not justify keeping the entire profile, sign-in information or posts, or using retained records for marketing. Before paid checkout is opened, the actual retained fields, legal grounds, periods, access permissions and deletion process will be finalized and disclosed.
5. Providers and international processing
Cloudflare provides hosting, storage and security infrastructure. The selected social sign-in provider handles authentication. MoaHome-linked boards may process account and board integration information between services. Processors, countries, transferred fields, timing, methods, legal bases, retention and refusal options must be confirmed against actual contracts and deployment settings before publication. Payment processing information will be added before payment features are released.
6. Cookies and browser storage
Cookies support sessions and sign-in protection. Browser storage holds preferences such as language and appearance and may preserve work in progress. You can delete or block cookies and site data in your browser, which may affect sign-in persistence or draft recovery. Participating without an account does not mean that posts and access information are anonymized or not collected.
7. Rights and safeguards
Request access, correction, deletion or restriction of processing at hello@moaboard.com. We verify identity or valid representation only to the extent necessary. Within 10 days of receiving a correction or deletion request, we notify you of the action taken or the statutory reason for refusal and how to object. A recovery period for ordinary service closure is not automatically applied to a personal-data deletion request. Do not send passwords or sign-in codes. The guardian verification approach needed for children under 14 must be determined before publication.
Destruction procedure and methods
Personal information is destroyed without delay when its retention period ends or its purpose has been fulfilled. Information that another law requires us to retain is managed separately with its legal basis, categories and period recorded. Electronic files are deleted so they cannot be recovered or reproduced; printed personal information is shredded or incinerated. Hiding a post alone does not complete destruction. Procedures covering storage, caches, exports and backups must be verified before these policies take effect.
Personal information in public posts
Do not enter sensitive information, such as health details or beliefs, or other people’s personal information in public posts. If submitted, it may be visible to others under the board’s access rules. Do not publish information you want to keep private. If already posted, ask the organizer or support to hide or delete it. A posting code restricts writing; it does not make existing public posts private.
Security safeguards
The service uses transport protection, protected sign-in sessions, organizer authorization and request limits. Internal operations screens have separate access controls. Access to personal information is limited by operational need, and the operating standard records the scope, reason and outcome of manual deletion or evidence-retention work. Safeguards not yet implemented and operationally verified are not described as complete.
8. Contact and changes
The privacy contact is shown below. Changes will identify the version, effective date and updates. External rights and dispute-resolution resources are available through Korea’s Privacy Portal and Personal Information Dispute Mediation Committee.
Direct closure and automatic deletion
Request closure from the account page. Account data, posts, comments, attachments and CSV files on owned boards, and linked personal information, are deleted in stages. Account-linked content on other boards is deleted with replies and attachments; unlinked guest submissions need a separate request. Temporary failures are retried automatically and completion is shown after operational-storage processing finishes. The request reference and status are retained for 30 days after completion; the temporary account identifier and email are removed at completion. This does not mean previously downloaded files or provider backups are immediately recalled or erased.
Contact and rights requests
- Service operator
- 알앤와이랩
- Representative (registered name)
- 유주연
- Business registration number
- 877-10-00980
- Registered business address (Korean)
- 대전광역시 서구 대덕대로 325, 9층 971호(월평동)
- Telephone
- 070-7792-7788
- Privacy contact
- hello@moaboard.com