Version 2026-10-18 · Effective 18 October 2026
1. Purposes
Stairno ("the operator") processes personal data only for the purposes below and announces any change of purpose in advance, asking for consent where required. The Korean version governs.
Signing up and confirming identity, signing in and staying signed in, signing in to Stairno sites, account security (device management, limits on repeated attempts, preventing takeover), sending account mail (email confirmation, password reset, email change) and answering questions.
Personal data is not used for advertising or marketing.
2. Data processed
Required at sign-up: email, name, password (stored only as an irreversible hash), language, the accepted terms version and time.
Created or collected during use: IP address and browser details (User-Agent) of signed-in devices, sign-in times, records of account mail sent, connected Stairno sites and when they were connected.
Nothing else is collected, and no behavioural tracking or tracking tools are used.
3. Retention
Account data is kept until you leave and deleted at once when you do.
Sign-in sessions last 30 days after last use and records of repeated attempts one minute, after which they expire. Records of account mail are deleted with the account.
If the law ever requires keeping some data, the basis and period will be added to this policy.
4. Destruction
At the end of retention or when you leave, data is deleted from the database without delay and cannot be recovered. No personal data is kept on paper.
5. Sharing with third parties
Personal data is not given or sold to third parties.
When you use "Sign in with Stairno" on a Stairno site, that site receives your email, whether it is confirmed, your name and your language. All Stairno sites are run by the operator.
6. Processors
The following processors are used to run the service; the contracts with them set the data protection they must provide.
Cloudflare, Inc.: hosting and network delivery.
Neon, LLC (part of Databricks, Inc.): database storage.
Plus Five Five, Inc. (Resend): sending account mail.
7. Transfers abroad
The processing in section 6 transfers personal data abroad. As processing and storage needed to conclude and perform the contract, it is disclosed here under Article 28-8(1)(3) of the Korean Personal Information Protection Act. Transfers happen over the network when you use the service.
Cloudflare, Inc. (United States, 101 Townsend St, San Francisco, CA 94107, dpo@cloudflare.com): everything exchanged while using the service, at each use, for hosting and network delivery, for the retention in section 3.
Neon, LLC (data stored in Singapore, privacy@databricks.com): all data in section 2, at sign-up and each use, for database storage, for the retention in section 3.
Plus Five Five, Inc. (Resend, United States, support@resend.com): email, name and mail content, when account mail is sent, for sending it, for that provider’s retention after sending.
To refuse the transfer, do not sign up, or leave. The account service cannot be provided without this processing, so signing up and using it is not possible.
8. Safeguards
Administrative: only the operator can access personal data.
Technical: all traffic is encrypted with HTTPS; passwords are stored only as scrypt hashes and passwords known from data breaches are refused; database credentials and secrets are kept only in a separate secret store, and system logs carry no emails or tokens; sign-in attempts are rate-limited.
9. Cookies and similar storage
Only a session cookie that keeps you signed in, and browser storage that remembers your theme, are used. No advertising or analytics cookies are used.
You can refuse cookies in your browser settings, but then you cannot sign in.
10. Children under 14
Children under 14 cannot sign up and their personal data is not processed. If such a sign-up comes to light, the account is deleted.
11. Your rights
You can ask at any time to see, correct, delete or stop the processing of your personal data.
In the account center you can see (overview, profile, signed-in devices, connected sites), correct (name, language, email) and delete (delete account) it yourself. Send other requests to contact@stairno.com; the result is sent within 10 days.
You can also make requests through a representative, with documents showing the authorisation.
12. Privacy officer
The privacy officer oversees the processing of personal data and handles questions and complaints.
Name: YooSung Nam, contact: contact@stairno.com
13. Remedies
For remedies for infringement of personal data you can apply for dispute resolution or advice to the following Korean bodies.
Personal Information Dispute Mediation Committee: 1833-6972, www.kopico.go.kr
Personal Information Infringement Report Center: 118, privacy.kisa.or.kr
Supreme Prosecutors’ Office: 1301, www.spo.go.kr
Korean National Police Agency: 182, ecrm.police.go.kr
14. Changes
When this policy changes, the version goes up and the changes and the effective date are announced on this page from 7 days before. Important changes, such as more data or new purposes, are announced from 30 days before and also sent to the email you signed up with.