Connection Log Retention Notice

Summary

1. Legal Basis and Retention Period

1. Article 15-2 of the Protection of Communications Secrets Act (통신비밀보호법) requires telecommunications business operators to retain data for the period prescribed by Presidential Decree in order to cooperate with requests from investigative agencies and others for communication confirmation data.
2. Article 41(2) of the Enforcement Decree of the same Act requires internet log records and access location tracking data that can identify the location of information and communications devices to be retained for at least 3 months.
3. Because 3 months is at most 92 days depending on the month, we set the retention period at 93 days so that the statutory period is met in every case. Records older than 93 days are deleted by the database’s automatic expiry function, and we do not keep them longer at our own discretion.

2. Records Kept for the App VPN (iOS, Android and Desktop)

The WireGuard VPN servers collect records of new connections in 1-minute batches and send them to our database over an encrypted connection (HTTPS).

App VPN records do not include the destination’s domain (host name). DNS queries are also handled inside the VPN tunnel, but we do not record which domains were queried.

3. Records Kept for StageVPN for Chrome

The Chrome extension sends browser traffic to the HTTPS proxy on our servers. The proxy servers collect connection records in 1-minute batches and send them to our database.

The proxy records only the destination host name needed for the connection (e.g., www.example.com). It does not record page paths, search terms, query strings or page content. For HTTPS sites, the proxy does not decrypt the encrypted content.

4. Information We Do Not Keep

• The content of communications sent and received: web page content, email and message bodies, voice and video, files
• URL paths and search terms, query strings, values entered in forms, cookie values
• Domain names queried through the app VPN (DNS query content) and lists of domains visited
• Decrypted content of HTTPS traffic (we do not intercept or decrypt encrypted communications)
• Precise device location information such as GPS

5. Limits on Use and Safeguards

1. We use connection logs only when necessary to protect the service, such as to respond to requests for data made under law or to verify reports of abuse such as attacks and spam.
2. We do not use connection logs for advertising, user profiling, sale to third parties or similar purposes.
3. Access to connection logs is limited to the minimum number of staff who strictly need it for their work, and access history is managed.
4. Records are encrypted in transit and stored in our database. The VPN and proxy servers keep records only temporarily in order to transmit them. Records that cannot be transmitted because of network problems are stored temporarily on the server until retransmission succeeds and are deleted after transmission.

6. Procedure for Disclosure to Investigative Agencies and Others

1. Communication confirmation data: Provided only when a prosecutor, a judicial police officer or the head of an intelligence and investigative agency requests it in writing with court permission (including subsequent permission under the law in urgent cases) under Article 13 and other provisions of the Protection of Communications Secrets Act.
2. Review: We check the requirements of the request and the court permit, as well as the period and scope covered. For requests that do not meet the requirements or are excessive in scope, we ask for them to be supplemented or refuse to provide data. Data is provided only to the minimum extent necessary within the scope of the request.
3. Records: As required by law, we report on the status of data provision and keep a register recording each provision, together with the requests and other related documents, for 7 years from the date of provision.
4. Notification: Investigative agencies and others that receive data notify the data subject of the provision under the Protection of Communications Secrets Act.
5. Subscriber information: For requests for subscriber information (통신자료) under Article 83 of the Telecommunications Business Act (전기통신사업법), we review the lawfulness and necessity of the request and respond only to the minimum extent necessary.
6. Foreign authorities: We respond to requests from foreign governments or authorities only when they have gone through the procedures prescribed by Korean law, such as international mutual legal assistance in criminal matters.

7. Rights of Data Subjects

1. After identity verification, members may ask whether their connection logs are retained and request access to their content. However, access may be restricted under Article 35(4) of the Personal Information Protection Act (개인정보 보호법, PIPA), in which case we will inform you of the reasons.
2. Because of the statutory retention obligation, connection logs within the retention period cannot be deleted before the period ends, even if deletion is requested. Even if a member deletes their account, connection logs already created are deleted after 93 days have passed.
3. Please send inquiries and requests to the Chief Privacy Officer (privacy@stagevpn.com) or the customer center (support@stagevpn.com).

Revision history