Privacy Policy — Frequenoir

This Privacy Policy explains how Layered Diary, operating the Frequenoir service ("Frequenoir," "we," "us," or "our"), handles personal information when you browse our website, create or use an account, purchase or download music, use a shared listening link, or contact us.

1. Controller and Contact Details

Legal business name: Layered Diary
Representative: SHIN SAETBYEOL
Business Registration No.: 308-18-02377
Mail-order Sales Registration No.: 2026-Gyeonggi Gimpo-6120
Online Music Service Provider Registration No.: 2026-000001 (Gimpo City; issued October 6, 2026)
Business address: Room 401-S82, 4F, 79, Gimpohangang 9-ro, Gimpo-si, Gyeonggi-do, 10071, Republic of Korea
Customer support: [email protected]
Telephone: +82 10-3204-8889

Privacy Officer: SHIN SAETBYEOL

2. Information We Process

We process only information reasonably needed for the service you use.

Website and audio use

IP address, browser and device information, request time, referring page, requested URL, and security/error logs generated by our hosting, content-delivery, and security infrastructure;
coarse product-analytics events such as page category, language category, viewport category, genre/album/track code, audio-preview milestones, cart action and quantity, subtotal and currency, and checkout handoff; and
for cookieless daily audience measurement, IP address, user-agent information, and hostname are transmitted to PostHog EU Cloud and processed transiently to create a one-day rotating hash. Frequenoir does not receive or store the source IP address or user-agent in PostHog event records, and PostHog strips the IP address before GeoIP enrichment and bot-detection processing; and
session-only selections, project queues, playback state, and cart-preview state stored in your browser.

Frequenoir does not send PostHog names, email addresses, account or customer identifiers, search text, payment details, cart identifiers, checkout URLs, raw page/referrer URLs, or audio URLs. Analytics autocapture, session replay, heatmaps, surveys, advertising profiles, cross-site tracking, and person profiles are disabled. The daily cookieless identifier changes each day and is not used to recognize a visitor across days.

Orders, payment, and digital delivery

name, email address, telephone number, company name, and billing details provided at checkout;
order number and date, product, track/album code, price, currency, payment/refund status, and transaction identifiers;
License Holder and governing license version recorded in the order confirmation;
download-link, delivery, access-count, fulfillment, IP/device, and fraud-prevention records; and
immediate-delivery acknowledgement, including its version and time, where collected.

We do not intend to receive or store full payment-card details directly. Payment information is handled by Shopify and the selected payment provider under their own security and legal obligations.

Accounts, contact form, and support

Shopify customer-account identifiers and login-related information when a customer chooses to create or use an account; guest checkout remains available;
when the website contact form is used: name, email address, selected inquiry topic, inquiry content and, where needed for that topic, order number, track title or reference code, and affected-content URL;
minimal security metadata needed to validate and protect the contact form, such as the request identifier and submission time, network and request information, Turnstile verification result, rate-limit signals, and technical error codes;
correspondence and attachments voluntarily provided through direct support email; and
details needed to review a Custom License request, such as organization, intended use, platform, territory, audience, and release plan.

The website contact form does not accept attachments. Contact-form information is used only to receive the inquiry, identify the person and any relevant order or content, provide a response, diagnose delivery errors, and prevent abuse. It is not sold, used to create advertising profiles, or combined with PostHog product analytics.

Do not send passwords, full payment-card numbers, government identifiers, or unrelated sensitive information through support channels.

3. Purposes and Legal Grounds

Service operation and security: operate the website and audio service, maintain security and availability, prevent fraud/abuse, and diagnose errors;
Contract performance: process carts, orders, payments, accounts, licenses, refunds, delivery, and related contractual steps;
Legal obligations: meet tax, accounting, consumer-protection, record-retention, and other legal requirements;
Customer requests and support: receive inquiries, identify the sender and any relevant order or content, respond to support, rights-related, privacy, refund, and Custom License requests, diagnose contact-delivery errors, and prevent form abuse;
Service and catalog improvement based on legitimate interests: measure aggregate interest in pages, genres, albums, tracks and preview milestones; understand cart and checkout-handoff demand; diagnose service friction; and prioritize catalog and storefront improvements. This limited cookieless processing is conducted under Article 15(1)(6) of the Korean Personal Information Protection Act. Frequenoir does not use it for advertising, cross-site tracking, individual profiling, or decisions that produce legal or similarly significant effects;
Legal claims: establish, exercise, or defend claims and resolve disputes; and
Marketing: send marketing communications only where any consent required by law has been obtained.

Where consent is required for a specific activity, we will request it separately. Withdrawal applies to future processing and does not affect processing lawfully carried out before withdrawal. Cookieless product analytics is not based on consent; when analytics is active, you may object at any time by selecting "Opt out of analytics" in the footer. The control is not shown when analytics is inactive. We also honor supported Global Privacy Control and Do Not Track signals before the analytics software loads.

4. Retention and Deletion

Contract, payment, supply, and cancellation records: 5 years;
Consumer complaint and dispute records: 3 years;
Display and advertising records: 6 months;
Order and license records: as long as reasonably necessary to evidence the existence, scope, and License Holder of the applicable license and to establish, exercise, or defend legal claims, subject to statutory retention requirements;
Support correspondence: 3 years after the matter closes, unless a longer period is required for an active dispute;
Contact-form security metadata: only for the short period needed for verification, rate limiting, abuse prevention, troubleshooting, and applicable provider-log retention, unless a longer period is required by law or an active security matter;
Technical security and delivery logs: according to documented provider/account settings and only as long as necessary for service, security, fraud-prevention, or claims purposes; and
Cookieless product-analytics events: up to one year under the current PostHog EU Cloud project retention setting. The cookieless audience hash uses a salt that changes daily and is deleted after that day's events are processed; and
Browser session storage: until the browser session or relevant local storage is cleared.
When the applicable retention period expires or the purpose of processing has been achieved, personal information will be deleted without undue delay unless continued retention is required or permitted by applicable law.
Electronic records are securely deleted using methods intended to prevent recovery or reconstruction, and paper records, if any, are shredded or otherwise securely destroyed. Where information is retained separately because of a legal obligation, access to that information is restricted and it is used only for the applicable legal purpose.
Processor backups may take additional time to cycle out in accordance with documented backup and retention schedules.

5. Service Providers and International Processing

5.1 Processing on our behalf and independent payment services

Provider	Role	Main function
Shopify Commerce Singapore Pte. Ltd. and Shopify group/subprocessors	Processor / platform provider	Storefront, accounts, checkout, orders, fraud prevention, and transactional communications
Kestrel Commerce, LLC d/b/a FileFlare	Processor	Post-payment digital delivery, download links, access limits, and delivery support
Cloudflare, Inc.	Processor / infrastructure and contact-form relay provider	DNS, security, CDN, R2 audio storage/streaming, Pages Function contact processing, Turnstile verification, and Email Service relay
PostHog, Inc.	Processor / EU-hosted product-analytics provider	Cookieless aggregate measurement of catalog interest, audio-preview milestones, cart activity, and checkout handoffs
Google LLC / Google Workspace	Processor	Final support mailbox, support correspondence, replies, and transactional email delivery
PayPal Pte. Ltd.	Independent payment provider/controller	Payment, payer authentication, fraud/risk controls, refunds, disputes, and legal compliance

PayPal applies its own privacy notice to payment-account and transaction processing. Eximbay and Toss Payments are not active at the date of this draft and are not listed as current recipients. This Policy will be updated before any additional payment provider is activated.

5.2 International transfer details

Personal information may be transferred outside the Republic of Korea where necessary to provide the requested service, perform a contract with you, process a payment, protect the service, or perform the limited product analytics described above. The applicable legal basis for each transfer is stated below. Transfers necessary for the conclusion or performance of a contract are made in accordance with Article 28-8(1)(3) of the Korean Personal Information Protection Act. Transfers to an EU/EEA country recognized by the Personal Information Protection Commission as providing a substantially equivalent level of protection are made in accordance with Article 28-8(1)(5), subject to the other safeguards required by law.

Recipient / Contact	Country	Purpose	Data	Timing / Method	Retention	Legal Basis
Shopify Commerce Singapore Pte. Ltd.; Shopify group companies and listed subprocessors	Singapore; Canada; United States; Ireland; and other countries identified in Shopify’s current subprocessor list	Storefront, checkout, guest checkout, customer accounts, order processing, fraud prevention, transactional communications, and payment integrations	Name, email address, telephone number, billing/company information, customer/account identifiers, order and transaction details, payment/refund status, IP address, device and technical information	When a person visits the service, creates or uses an account, checks out, places an order, or uses related service functions; transferred through encrypted network or API connections	For the period necessary to provide the service and fulfill the stated purposes, subject to Shopify’s applicable retention practices and legal obligations	Overseas processing and storage necessary for the conclusion or performance of a contract with the data subject, pursuant to Article 28-8(1)(3) of the Korean Personal Information Protection Act
Kestrel Commerce, LLC d/b/a FileFlare — [email protected]	United States and any applicable subprocessor locations disclosed by FileFlare	Digital-file delivery, download links and access limits, delivery security, fraud prevention, and delivery support	Name, email address, Shopify customer/order identifiers, product and order information, order IP address, download time, file-access information, IP address, browser/device information and bandwidth information; address or telephone number only where an enabled feature requires it	After a paid order and whenever a delivery page or digital file is accessed; transferred through encrypted Shopify app/API and network connections	For the period necessary to provide digital delivery and related support, subject to FileFlare’s applicable retention and deletion practices and legal obligations	Overseas processing and storage necessary for the performance of the purchase and digital-delivery contract, pursuant to Article 28-8(1)(3) of the Korean Personal Information Protection Act
Cloudflare, Inc. — [email protected]	United States and countries in Cloudflare’s global network or applicable subprocessor locations	DNS, website and service security, content delivery, audio storage/streaming, and contact-form validation and relay through Pages Functions, Turnstile, and Email Service	For ordinary website use: IP address, requested URL or object, request headers, browser/device information, cache information, security and diagnostic data, and access information. When the contact form is submitted: name, email address, selected inquiry topic, inquiry content, any topic-relevant order number, track title/reference code or affected-content URL, and minimal request, Turnstile, rate-limit, and error metadata	Whenever the website, an audio preview, or another hosted object is requested and, for contact-form data, when the person submits the form; transferred through encrypted network connections where supported. Cloudflare validates and relays the inquiry but is not the final support mailbox	According to applicable account settings and Cloudflare’s documented retention practices, only for as long as necessary for service operation, contact relay, security, abuse prevention, troubleshooting, provider logs, or legal obligations; stored audio objects remain until deleted by Frequenoir	Overseas processing and storage necessary for provision and security of the requested online service and response to the person's request, pursuant to Article 28-8(1)(3) of the Korean Personal Information Protection Act
PostHog, Inc. — PostHog Cloud EU	Germany (EU Cloud data region)	Cookieless aggregate product analytics used to improve the catalog, previews, cart, and checkout handoff	IP address, user-agent information, and hostname processed transiently to create a rotating daily hash; page category, coarse language/viewport category, genre/album/track code, audio-preview milestone, cart action/quantity, subtotal/currency, checkout-handoff event, release/environment identifier, and the resulting daily hash. No name, email, customer/account identifier, search text, payment information, cart/checkout secret, raw page/referrer URL, or audio URL is intentionally sent	When a visitor uses an instrumented storefront function and has not opted out; transferred through an encrypted network connection to the configured EU ingestion endpoint	Event records for up to one year under the current project setting. The source IP address is stripped before GeoIP processing; the daily hash salt is deleted after that day's events are processed. Frequenoir's footer opt-out and supported GPC/DNT signals prevent future collection	Frequenoir's collection and use is based on legitimate interests under Article 15(1)(6). The transfer to the configured German EU Cloud data region is based on the EU/EEA protection-level recognition under Article 28-8(1)(5), together with the applicable processing agreement and security safeguards
Google LLC / Google Workspace and applicable subprocessors	United States and other countries in which Google or its applicable subprocessors process data	Final customer-support mailbox, support correspondence and replies, and transactional email delivery	Email address, email content, attachments sent through direct email, delivery metadata, support history, and order- or content-related information included in correspondence	When Cloudflare Email Service relays a submitted contact-form inquiry to the Frequenoir mailbox, when a person contacts Frequenoir directly by email, or when Frequenoir sends a reply or transactional communication; transferred through encrypted network connections where supported	Until deleted by Frequenoir or under the applicable Google Workspace retention settings, subject to backup cycles and legal obligations	Where the communication relates to a purchase, account, delivery, or other contractual service: overseas processing necessary for performance of the relevant contract under Article 28-8(1)(3). For other processing, Frequenoir relies on another lawful basis available under applicable law, including consent where required
PayPal Pte. Ltd.; PayPal group companies and processors — [email protected]	Singapore; United States; and other countries identified in PayPal’s applicable privacy or third-party notices	Payment processing, payer authentication, fraud and risk controls, refunds, chargebacks and disputes, and compliance with financial or legal obligations	Name, email address, telephone number, billing/payer information, PayPal or payment identifiers, order and transaction information, amount, currency, transaction status, IP address, device and technical information. Frequenoir does not directly receive full payment-card details	When PayPal is selected and in connection with payment, refund, chargeback, dispute, or related transaction events; transferred through encrypted redirect, network, or API connections	According to PayPal’s applicable privacy and retention policies and any applicable legal, regulatory, audit, investigation, or claims requirements	To the extent Frequenoir transfers information to PayPal in order to complete a payment requested by the purchaser, the transfer is necessary for the conclusion or performance of the relevant purchase contract under Article 28-8(1)(3). PayPal also processes certain information independently under its own privacy notice and applicable legal bases

Where an international transfer is necessary to provide a requested service, complete a purchase, deliver digital content, process a selected payment method, or respond to a request, Frequenoir may be unable to provide the relevant service without that transfer.

Where applicable law gives you a right to refuse or object to a particular international transfer, you may exercise that right by contacting us at [email protected]. Refusing a necessary transfer may prevent use of the relevant account, purchase, payment, delivery, or support function. Where a reasonably available alternative payment method or service does not require the same transfer, you may choose that alternative.

Rights concerning personal information independently controlled by PayPal may also be exercised directly with PayPal in accordance with its applicable privacy notice.

6. Cookies and Browser Storage

The website uses browser storage for selections, project queues, playback continuity, cart-preview state, account/security functions, and your analytics opt-out preference. The opt-out entry is used only to remember that analytics must remain disabled.

Frequenoir's configured product analytics operates in PostHog's always-cookieless server-hash mode. It does not place an analytics identifier in cookies, local storage, or session storage. Person profiles, identification, session replay, surveys, automatic interaction capture, and advertising tracking remain disabled. When analytics is active, select "Opt out of analytics" in the footer to stop future analytics collection on that browser. The control is hidden when analytics is inactive. Supported Global Privacy Control and Do Not Track signals are honored before the analytics software loads.

Shopify and other production providers may use cookies or similar technologies that are necessary for checkout, account security, fraud prevention, and preferences under their applicable notices. Non-essential advertising or identifier-based analytics cookies will not be activated without any notice or consent required by applicable law. Clearing browser storage or cookies may reset selections, carts, account sessions, or preferences, including the saved analytics opt-out.

7. Your Rights

Subject to applicable law, you may request access, correction, deletion, or suspension of processing and may withdraw consent where processing is based on consent. You may also exercise additional rights available under applicable law, including objection to legitimate-interest processing, restriction, portability, and information concerning disclosures and international transfers. You may stop future cookieless analytics immediately through the footer control without contacting us.

Send requests to [email protected]. We may request information reasonably necessary to verify identity and protect customer records. Certain information may be retained or continue to be processed where required or permitted by law, including to establish, exercise, or defend legal claims.

8. Children

Frequenoir is not directed to children under 14 and does not knowingly collect their personal information without consent of a legal representative where required by law. If you believe a child has provided information improperly, contact us.

9. Security

We apply reasonable administrative, technical, and organizational safeguards appropriate to the nature of the information, including access restriction, provider controls, secure transmission where supported, update management, and incident response. No internet transmission or storage method is completely secure.

10. Third-Party Links and Shared Listening Links

The service may link to third-party services. Their practices are governed by their own notices. A shared listening link may be accessible to anyone who receives it; do not place personal or confidential information in a shareable URL.

11. Changes to this Policy

We may update this Policy when the service, providers, or law changes. We will post the updated version and effective date and provide additional notice when required. Material changes will be announced before they take effect where required.

12. Contact and Complaints

For privacy questions or rights requests, contact [email protected] or the Privacy Officer at the address above. You may also contact the Personal Information Protection Commission or another competent authority where you live.