Privacy Policy
This policy explains how Unbound Lab ("we"), the operator of Plymo, handles personal data under Korea's Personal Information Protection Act (PIPA). If the Korean and English versions differ, the Korean version prevails.
1. Our two roles
- Customer data (people who build forms): we are the controller and decide the purposes and means.
- Respondent data (people who answer forms): the customer is the controller and we are the processor acting on the customer's instructions. Please send access, correction and deletion requests about respondent data to the customer who made the form. We process it only on the customer's instructions and under the Terms.
2. Data we collect
We do not knowingly collect personal data of children under 14.
| Category | Items | How |
|---|---|---|
| Account | Email address, name, Google account identifier, language setting, sign-in records (time and a hash of the IP) | When you sign in with Google |
| Workspace data | Forms and questions, files, inbox status, assignees and notes, team member emails, integration settings | When you use the Service |
| Billing | Plan, payment status, customer and subscription identifiers issued by the payment provider. We do not store card numbers; the payment provider handles them. | When you pay for Pro |
| Respondent data (processor) | Answers and files a respondent submits, submission time. The IP is kept only as a hash for rate limiting and spam prevention. | When a respondent submits |
| Automatic | Cookies (below), usage and error records | When you use the Service |
3. Purposes
- Account verification, sign-in and providing the Service (publishing forms, collecting responses, inbox, notification mail, integrations)
- Billing, refunds and customer support
- Running features you ask for, such as AI form generation
- Reliability, security, and spam and abuse prevention
- Meeting legal obligations
4. Retention
- Account and workspace data: kept until you delete your account, then destroyed without delay.
- Respondent data: follows the retention period the customer sets on the form. When retention is on, expired responses move to trash and are deleted for good 30 days later. When off, they are kept until the customer deletes them or the account.
- Billing records: kept as required by Korea's Act on Consumer Protection in Electronic Commerce: records of contracts and withdrawals 5 years, records of payment and supply 5 years, records of consumer complaints and disputes 3 years. They are kept separately for those periods even after you delete your account.
- Access records (usage records and access logs): 3 months under the Protection of Communications Secrets Act.
5. How we destroy data
- Personal data whose retention period has ended or whose purpose has been met is destroyed without delay. Data we must keep by law is stored separately from other data and destroyed when its period ends.
- Electronic files are deleted in a way that cannot be recovered. We do not keep personal data on paper.
6. Processors and overseas transfers
We entrust processing or storage to the companies below. Data is transferred to companies outside Korea over the network whenever the Service is used, and is kept until you leave the Service or the contract with the company ends (or longer where the law requires). The destination is the country of the company's data centers; the table lists the main one.
If you refuse a transfer to a "Required" company you cannot use the Service. Data goes to the other companies only when you use the related feature (payments, integrations, AI form generation and so on), so you can refuse by not using it. Questions can go to each company's privacy contact or to our privacy officer below.
Deliveries to webhook URLs you set, to external accounts you connect, and imports of forms from other services happen on your instruction and are not processing we entrust.
| Company | Country | Purpose | Data transferred | Notes |
|---|---|---|---|---|
| Cloudflare, Inc. | United States and other countries with Cloudflare data centers | Hosting, database (D1), file storage (R2), bot protection (Turnstile), notification email (Email Sending) | All Service data | Required |
| Polar Software, Inc. | United States | USD subscription billing (merchant of record) | Email, payment details | When paying in USD |
| Toss Payments Co., Ltd. | Republic of Korea | KRW subscription billing | Email, payment details | When paying in KRW. Payments through a customer's payment block go to the customer's own merchant account, not through us. |
| Stripe, Inc. and affiliates (when the customer chooses it) | United States and other countries with Stripe data centers | International payments in a customer's payment block (the customer's own Stripe account) | Payment details the respondent enters on Stripe's checkout page, order name and amount, order ID | Only on forms where the customer picked Stripe in the payment block. Respondents enter payment details directly with Stripe and the payment goes to the customer's Stripe account; we never receive card details or hold the funds. |
| Anthropic, PBC | United States | AI form generation | The description text you enter | Only when you use it. Respondent data is not sent. |
| Google LLC | United States and other countries with Google data centers | Sign-in with your Google account, Google Sheets integration | Name, email and Google account identifier that Google returns when you sign in, response content sent to the sheet you connect | When you sign in, when you turn the integration on |
| Slack Technologies, LLC | United States | Slack notifications | Notification content (fields you choose) | When you turn it on |
| Notion Labs, Inc. | United States | Notion integration | Response content sent to the page you connect | When you turn it on |
| NHN Cloud Corp. | Republic of Korea | KakaoTalk AlimTalk and SMS delivery | Recipient mobile number, message content | Sent from our Kakao channel only for forms where the customer turned AlimTalk on, to respondents who consented and to numbers the customer set. |
7. Your rights and how to exercise them
- You may ask to access, correct, delete, restrict processing of, or withdraw consent for your personal data.
- Customers can edit their data and delete the account in settings.
- Respondents should ask the customer who made the form first. If you cannot identify them or it is not resolved, contact us below and we will help pass the request on.
- Send requests to the privacy officer's email below. We handle them within 10 days of receipt; if there is a justified reason we cannot, we tell you the reason and when we will.
- For remedies, you can contact the Personal Information Infringement Report Center (privacy.kisa.or.kr, 118) or the Personal Information Dispute Mediation Committee (kopico.go.kr, 1833-6972).
8. Cookies
We use only the cookies we need. No advertising or tracking cookies.
You can block or delete cookies in your browser settings, but without the sign-in cookie you cannot use features that need you to be signed in.
| Name | Purpose | Lifetime |
|---|---|---|
| lang | Remembers your language | 1 year |
| theme | Remembers light or dark display | 1 year |
| sid (__Host-sid on https) | Keeps you signed in | 30 days |
| ws | Remembers the workspace you last opened | 1 year |
| fpa_(form ID) | Keeps a password-protected form unlocked | 12 hours |
| fp_oauth | Security check while connecting an integration | 10 minutes |
| fp_glogin | Security check while signing in with Google | 10 minutes |
9. Security measures
- Encryption in transit (HTTPS) and encrypted storage of integration tokens and payment keys
- Minimal administrator access and workspace-level access control
- IP addresses kept only as hashes
10. Privacy officer
Officer: Jaecheol Jeong (Representative)
Email: anjwoc@gmail.com
Contact the officer for privacy questions, complaints and remedies. Full business details are at the bottom of the page.
11. Changes to this policy
We announce changes on screen 7 days before they take effect, and 30 days before for changes important to your rights, such as new data items, purposes or processors.