nimuni.com Privacy Policy

Version: 1.0.0 Effective date: October 12, 2026

Summary

• The operator receives your name, email address, and message from the contact form and the blog comments. The operator uses them only to reply and to show comments.
• The operator deletes the personal information of a finished inquiry after 1 year. The operator deletes the email address of a comment after 1 year and the IP address after 90 days.
• The operator does not give personal information to third parties (Cloudflare collects the information in Article 8 directly). Resend sends the emails. Cloudflare relays connections and stops spam.
• The operator does not use cookies for advertising, behavioral analysis, or visit statistics.
• To access, correct, delete, or stop the processing of your information, send a request to [email protected].

Contents

Article 1 Purposes · Article 2 Items and legal basis · Article 3 Retention periods · Article 4 Destruction · Article 5 Provision to third parties · Article 6 Outsourcing · Article 7 Transfer to other countries · Article 8 Processing by Cloudflare for its own purposes · Article 9 Automatic collection devices · Article 10 Security measures · Article 11 Children younger than 14 · Article 12 Your rights · Article 13 Protection officer · Article 14 Advertising information · Article 15 Remedies · Article 16 Changes

The operator of nimuni.com (the "operator") makes and publishes this privacy policy under Article 30 of the Personal Information Protection Act of the Republic of Korea (the "PIPA"). The operator is an individual. This privacy policy applies to the nimuni.com site. The blog, the contact form, and the administrator screens are on this site. The nimuni account (auth.nimuni.com) and each product follow their own privacy policies. The product terms and privacy policies that nimuni.com publishes (/policy/...) also apply to each product.

Article 1 (Purposes of processing)

The operator processes personal information only for the purposes that follow. If a purpose changes, the operator first does the steps that the law requires.

1. Replies to inquiries: To reply to product inquiries and to contract work or coaching inquiries
2. Replies to resume requests: To reply to a person who asks for the resume
3. Blog comments: To approve and show comments, and to contact you about your comment
4. Prevention of spam and misuse: To stop automatic input in the contact form, and to stop too many comments from the same source
5. Site management: Administrator sign-in, security of the administrator screens, administrator access records, and incident response
6. Policy agreement records: To record that an account signed in to nimuni.com agreed to the terms or a privacy policy that nimuni.com publishes

The operator does not collect visit statistics.

Article 2 (Personal information that the operator processes, and the legal basis)

The operator processes only the items that follow. The operator gets consent only for blog comments. There are four legal bases:

• Consent: The name, email address, and text of a blog comment (PIPA Article 15(1)1). The comment form has a required check box for consent. The operator stores the time of consent with the comment. You can refuse consent. If you refuse, you cannot write a comment.
• Your request: Processing to reply to an inquiry from the contact form. This is an action that you ask for in the process to make an agreement (PIPA Article 15(1)4). This basis applies only to inquiries. Administrator accounts and policy agreement records use the same legal basis because the account asks for the function.
• Legitimate interest: Processing that is necessary to prevent spam and misuse, and for security (PIPA Article 15(1)6).
• Security obligation: Keeping the administrator access records (PIPA Article 29).

• The operator does not store the IP address from the contact form. The operator uses the IP address only for the spam check and for rate limits.
• The public pages show only the name, the comment, and the date of a comment. The operator does not show the email address or the IP address of a comment.
• The policy agreement records do not contain an IP address or browser information.
• The operator does not collect resident registration numbers, home addresses, or dates of birth. The contact form has no phone number field.

Article 3 (Retention periods)

• "The day when the operator finished the inquiry" is the day when the operator changed the handling status to "Answered" or "Archived". A change between "Answered" and "Archived" does not change this day. If the operator changes the status back to "New" or "Read" and then finishes the inquiry again, the period starts on the day of that last finish.
• The operator keeps an inquiry that is not finished until the operator finishes it.
• The notification email and the reply email of an inquiry stay in the mailbox of the operator. When the operator deletes the information of an inquiry, the operator also deletes these emails.
• An administrator sign-in session is valid for a maximum of 7 days from its last use. Without "Stay signed in", the maximum is 1 day.
• A two-factor authentication progress value expires after 10 minutes. A trusted device value expires after 30 days.

Article 4 (Destruction procedure and method)

1. When a retention period ends or the purpose is complete, the operator destroys the personal information without delay.
2. A scheduled job of the operator deletes the information whose retention period ended.
   • Inquiry: The job deletes the name, the email address, the message, and the handling note. Only the inquiry type, the time of receipt, the handling status, and the time of completion stay.
   • Comment that is not on the site: The job deletes the full pending comment or spam comment after its period. For a comment that has replies from other persons, the job does not delete the row but deletes the name and the text, so that those replies do not show without context. The job deletes the email address and the IP address of that comment after the same periods as a comment on the site.
   • Comment on the site: The job deletes the email address and the IP address after their periods. The name and the text of the comment stay.
   • Administrator sign-in sessions and sign-in values: The job deletes expired values.
   • Administrator access record: The job deletes records after their period.
3. In the cases that follow, the operator deletes the information immediately. The copy in a database backup is destroyed within 30 days as paragraph 4 says.
   • The operator deletes a comment, or you ask the operator to delete your comment: The operator deletes the name, the email address, the IP address, and the text of that comment. Replies from other persons to that comment stay.
   • You ask the operator to delete your inquiry: The operator deletes the name, the email address, the message, and the handling note of that inquiry. The operator also deletes the notification email and the reply email in the mailbox.
4. The information in a database backup is destroyed with the backup when the retention period of the backup ends. When the operator restores a backup, the operator deletes the information that was already deleted again.
5. The operator deletes electronic files with a method that does not let anyone recover them. The operator does not print personal information on paper.

Article 5 (Provision to third parties)

The operator does not give personal information to third parties. But if a law has a special provision, the operator obeys that provision. In the processing in Article 8, Cloudflare collects the information directly from the visitor and processes it under its own responsibility. The operator does not give the information to a third party.

Article 6 (Outsourcing of processing)

The operator outsources the tasks that follow.

• The operator does not store personal information of visitors in R2. R2 contains only the site images that the operator uploaded.
• Subcontractors of Cloudflare: www.cloudflare.com/gdpr/subprocessors/cloudflare-services
• Contract (DPA) and subcontractors of Resend: resend.com/legal/dpa, resend.com/legal/subprocessors
• Subcontractors of Google: Google privacy policy (policies.google.com/privacy)
• If an outsourced task or a contractor changes, the operator changes this policy immediately.

Article 7 (Transfer to other countries)

The operator transfers personal information to other countries as follows. The legal basis of the transfer is Article 28-8(1)3 of the Personal Information Protection Act. The transfer is outsourcing and storage necessary to make and perform a contract with the data subject (for example, answering an inquiry), and this policy discloses it.

• To refuse the transfer for the contact form, do not use the contact form. Then the operator cannot reply to your inquiry.
• All connections to nimuni.com go through Cloudflare. If you refuse the transfer for the relay of connections, you cannot open nimuni.com.

Article 8 (Information that Cloudflare processes for its own purposes)

1. Cloudflare can process the information from Turnstile and its security functions under its own responsibility. The purposes are to improve bot detection and for security.
2. The items are the IP address and the signals of the browser and the device. The countries are the United States and the countries with Cloudflare data centers.
3. Cloudflare receives this information directly from the browser of the visitor and processes it under its own responsibility. The operator does not decide the purposes or the methods of this processing. This processing follows the Cloudflare privacy policy (www.cloudflare.com/privacypolicy).
4. To refuse this processing, do not use the contact form. Send an email to [email protected] instead. The contact form does not load Turnstile before you first select or type in a field.

Article 9 (Automatic collection devices)

1. nimuni.com uses the cookies and the browser storage that follow.

   Name	Type	Who	Purpose	Duration
   NEXT_LOCALE	Cookie	A visitor who changed the language, or who opened an address in a language that is different from the browser language	To keep the language	Until the browser closes, or 1 year
   theme	Browser storage	A visitor who changed the theme	To keep the light or dark theme	Until the visitor deletes it
   blog:viewed:<post address>	Browser storage	A visitor who opened a blog post	Not to count a view of the same post again within 24 hours	Until the visitor deletes it
   better-auth.session_token	Cookie	An administrator	To keep the sign-in	A maximum of 7 days
   better-auth.dont_remember	Cookie	An administrator	To mark a sign-in without "Stay signed in"	Until the browser closes
   better-auth.two_factor	Cookie	An administrator	To keep the state during two-factor authentication	10 minutes
   better-auth.trust_device	Cookie	An administrator	To skip two-factor authentication on a trusted device	30 days
   sidebar_state	Cookie	An administrator	To keep the administrator menu open or closed	7 days

2. On HTTPS connections, the names of the cookies that start with better-auth. have the prefix __Secure-.

3. The values in the browser storage stay only in the browser of the visitor. nimuni.com does not send these values to the server.

4. When you first select or type in a field, the contact form loads Cloudflare Turnstile for the spam check. Turnstile sends signals of the browser and the device to Cloudflare. (Article 7, Article 8)

5. The operator does not use cookies or scripts for advertising, behavioral analysis, or visit statistics.

6. You can refuse or delete the cookies and the browser storage in your browser settings.

   • If you refuse them, the language and the theme go back to the default.
   • An administrator cannot sign in.
   • If you block Turnstile, you cannot send the contact form.

Article 10 (Security measures)

The operator does the steps that follow.

1. The operator stores administrator passwords as one-way encrypted values.
2. Administrator accounts keep two-factor authentication on.
3. Only accounts with an administrator role can use the administrator screens and functions.
4. All connections use encrypted communication (HTTPS).
5. Scripts cannot read the sign-in session cookie.
6. Management access to the server of the operator is possible only through a private network and access keys. The database is not open to the internet.
7. The operator records persons who try to sign in as an administrator and callers of administrator functions and own-account functions as administrator access records. A record contains the success or failure of a sign-in attempt, two-factor authentication pending, and the success or failure of a request. The administrator ID is empty in a record of a person who is not an administrator. The operator keeps these records for 1 year and checks them once a month.
8. The contact form and the comments have rate limits.
9. The operator applies security updates to the server and the programs.

Article 11 (Children younger than 14)

1. nimuni.com has no sign-up for visitors.
2. The operator does not ask your age when you send an inquiry or a comment. The operator does not collect dates of birth.
3. A child younger than 14 asks a parent or guardian to send an inquiry. The contact form shows this notice.
4. If the operator learns that a child younger than 14 sent an inquiry or a comment, the operator deletes that personal information without delay.

Article 12 (Your rights and how to use them)

1. You can ask for the items that follow at any time:
   • Access to your personal information
   • Correction
   • Deletion
   • Suspension of processing
2. Send your request to [email protected]. Write "[Privacy request]" in the subject line.
3. The operator checks that the email address of your request is the same as the email address in your inquiry or your comment. For a record whose email address was already deleted, the operator uses information that identifies the record, for example the date, the post address, the author name, and the text. The operator does not ask for more information, for example an identity card.
4. The operator takes action and tells you the result within 10 days from the day when the operator received your request.
5. If the operator refuses your request, the operator tells you the reason and how to object.
6. A representative can make a request for you. In this case, you tell the operator about the authorization from the email address in your inquiry or your comment.
7. The legal representative of a child younger than 14 can use the rights in paragraph 1 for the personal information of that child. The legal representative uses the method in paragraph 2.
8. If you ask the operator to delete your comment or your inquiry, the operator deletes that information immediately as Article 4(3) says.
9. You can withdraw your consent for a blog comment at any time. Use the method in paragraph 2. The operator then deletes the personal information of that comment immediately as Article 4(3) says.
10. If you object to the processing of the operator, you can send an objection to [email protected] or apply to an organization in Article 15.

Article 13 (Personal information protection officer)

The operator is the personal information protection officer.

• Name: Yimoon Kang (강이문)
• Contact: [email protected]

Send questions, complaints, and requests for remedies about personal information to the contact above.

Article 14 (Advertising information)

The operator does not send promotional emails to the email addresses from inquiries or comments.

Article 15 (Remedies for infringement)

You can ask the organizations that follow for advice and remedies about the infringement of personal information. These organizations are in the Republic of Korea, and they use Korean.

Article 16 (Changes to this policy)

1. If this policy is different from the actual processing, the operator corrects it immediately to agree with the facts. The operator also publishes a comparison table with the changes and the reasons.
2. If a change makes the processing larger, for example a new item or a new transfer to another country, the operator publishes the change before that processing starts. This is also true for a change that starts visit statistics.
3. The operator keeps the previous versions and their application periods public.
4. This policy has a Korean version and an English version. If the two versions are different, the Korean version applies.

Change history