Privacy Policy
Effective November 7, 2026 · English version
1. About this policy
Apertix (the "Operator"), based in the Republic of Korea, is the data controller for the website Signature Studio. This policy explains how we handle personal information under the Korean Personal Information Protection Act and US privacy laws, including California law. Contact: help@apertix.ai. The Service in English is for people in the United States who are 14 or older. It is not offered in the European Economic Area or the United Kingdom. We give every user the rights in section 8, whether or not a law requires it.
2. What we collect
When you join
| Item | How |
|---|---|
| Email address | An invited person enters it |
| Password (the original isn't stored; only a value converted by the authentication service) | You enter it |
| Whether and when you accepted the terms and overseas transfer | Recorded automatically when you agree |
| Age group (14 to 17, or 18 and older), when you confirmed it and the site language. We don't store your birth month and year | You enter it when you sign up or when first asked |
| Your agreement to send your name for Hangul spelling suggestions | Recorded when you agree |
When you use the Service
| Item | How |
|---|---|
| User ID | Created automatically when you join |
| The name, initials and emblem you enter (including words you type), and the styles and pen you pick | You enter them to make a signature |
| Generated images and signatures you choose | Created as you use the Service |
| Usage records (viewing and rating options, choosing, downloading, saving, visit dates), your answers (intended use, price opinion), error codes | Created automatically as you use the Service |
| Which invite link you joined with | Recorded automatically when you join, to see which channels bring people who use the Service |
| Result reports (target and reason) | You enter them when you report |
| Email address and content of messages to us | When you email us |
If you buy a pack
| Item | How |
|---|---|
| Order number, pack, price, status, time, who paid (you or a parent), the reseller's transaction number | Created when you buy |
| A parent or guardian's email, if you ask them to pay | You enter it; we use it only to send the payment link and don't store it |
If you join the waitlist (before we open)
| Item | How |
|---|---|
| Email address | You enter it |
| Whether you confirmed it, and whether you chose news and offers | Recorded when you confirm on the page the confirmation email opens |
| Which link you came from (for example, our Instagram link) | Read from the link you opened, if it has a code |
| A one-way code made from your IP address range and basic browser details (browser type, screen size, time zone, language), used only to count how many times one device joins. It can't be turned back into those details and isn't stored with your email | Made automatically when you join, to stop one person from claiming the waitlist bonus with many emails |
3. Why we use it
| Purpose | Items | Why we may use it |
|---|---|---|
| Managing members: identifying accounts, sending first-login codes and password reset links | Email, password, user ID | To provide the Service you asked for |
| Checking the minimum age | Age group and the time you confirmed it | Our legitimate interest in keeping the Service to people old enough to use it |
| Making and providing signatures | Name, initials, emblem, style and pen, generated images, chosen signatures | To provide the Service you asked for |
| Suggesting Hangul spellings, when you ask | The name you enter for it | To provide the feature you asked for |
| Improving the Service, fixing errors and seeing which invite channels bring people who use it | Usage records, invite link, your answers, error codes | Our legitimate interest in keeping the Service working and useful |
| Safety (handling inappropriate results) and protecting accounts | Result reports, login attempt limits | Our legitimate interest in keeping people and accounts safe |
| Answering you | Email address and content of messages | Our legitimate interest in answering what you ask |
| Confirming your waitlist spot, telling you once when we open, and giving the waitlist bonus when you sign up with the same email | Waitlist email, the link you came from | Your request to join the waitlist |
| Sending news and offers, only if you chose them when you confirmed | Waitlist email | Your consent, which you can withdraw with the unsubscribe link in any email |
| Preventing waitlist abuse | Device code | Our legitimate interest in giving the waitlist bonus once per person |
You are required to provide your email, password, age and name only if you want to use the Service, because we can't provide it without them. Survey answers are optional, and only people who are at least 18 are asked about price. We don't make automated decisions that have legal or similarly significant effects on you. AI draws the images you ask for, and you choose what to keep. You can object to uses based on our legitimate interest (see section 8).
The consent you give at sign-up records that you accepted these terms and the transfer described in section 6. Where we rely on consent, you can withdraw it at any time by deleting your account. This doesn't affect processing before you withdrew.
4. How long we keep it and how we delete it
| Item | Kept for |
|---|---|
| Records and images | 1 year after your last visit, or until you delete them. Deleting a request also deletes its name, initials and typed words |
| Until you delete your account | |
| Result reports | 90 days after handling; deleted with the target or account |
| Messages to us | 3 years after handling (Korean E-Commerce Act: consumer complaint and dispute records) |
| Purchase records | 5 years (Korean E-Commerce Act: records of contracts and payment). If you delete your account, the record stays without your user ID |
| Waitlist email | Until you sign up with it (we then delete the email and keep only a coded mark that the bonus was given), until you ask us to delete it, or 60 days after launch, whichever comes first. If you asked for news and offers, until you unsubscribe or ask us to delete it. You can stop emails with the unsubscribe link |
| Device code (waitlist) | Only as a counter, deleted automatically after a day |
| Deletion record | After account deletion, only the user ID and deletion time are kept, to re-apply the deletion |
| Server access logs | Not kept. Server error logs hold only a request ID and error code, not IP addresses, emails or names |
Backups are deleted in rotation when their retention ends. If we restore from a backup, deletion records are re-applied before the Service reopens. Retention on the provider's side follows the provider's terms, and the Operator can't delete it.
When the period ends or you ask for deletion, we delete the data from the database and storage so it can't be recovered. We don't keep personal information on paper.
5. Sharing with third parties
We don't sell personal information and don't share it for advertising. We don't provide it to third parties except:
- When you agreed in advance (including the overseas transfer in section 6)
- When a law specifically requires it or it's unavoidable to meet a legal duty
- When an investigative agency requests it under the procedure set by law
- When it's urgently needed to protect someone's life, body or property
- When you buy a pack: our online reseller sells it to you as Merchant of Record. We send the reseller only the order number and the pack; the reseller collects your email, payment and billing details at checkout and uses them as an independent controller under its own privacy policy, which is linked at checkout. We don't receive your card details
6. Storage in Korea and overseas transfer
Accounts, the database and images are stored in Seoul, South Korea, and our servers run in South Korea. If you use the Service from another country, your information is handled in South Korea.
When drawing a signature, only the name, style, initials, emblem, pen and character are sent to the overseas image provider, OpenAI (United States). When you ask for Hangul spelling suggestions, only the name you enter for it is sent to Anthropic (United States). Email, account ID and IP address aren't sent. See Who gets your data.
OpenAI and Anthropic handle this information as our service providers under their contracts with us. OpenAI keeps requests for up to 30 days to monitor for abuse, longer if the law requires it or it's needed to protect its services or others from harm, and doesn't use them for training. Anthropic deletes requests within 30 days, or keeps them longer if the law requires it or a request is flagged under its usage policy (up to 2 years), and doesn't use them for training. Other parties don't collect information about your activity over time or across other sites through the Service.
7. Service providers
| Provider | Work |
|---|---|
| Supabase (Seoul region, South Korea) | Accounts, database, image storage |
| Naver Cloud (servers in South Korea) | Web pages and server processing |
| Whois (South Korea, mail service) | Sending access codes, reset links and operating alerts; receiving messages |
| OpenAI (United States) | Drawing signature images (section 6) |
| Anthropic (United States) | Suggesting Hangul spellings when you ask (section 6) |
8. Your rights
- Access: see your records and signatures anytime in "My signatures".
- Deletion: delete records, signatures and your account yourself in "My signatures". How to delete your account
- Correction or stopping processing: ask by email (help@apertix.ai).
- Withdrawing consent: deleting your account also withdraws your consent.
If you can't log in or can't do something yourself, email us. We handle it within 10 days after confirming it's you.
Everyone can also ask us by email to get a copy of their data in a portable format, to restrict how we use it, or to object to uses based on our legitimate interest. We respond within one month and won't treat you differently for asking.
California residents: sections 2 and 3 list the categories of personal information we collect and why, and section 7 lists who handles it for us. You can ask to know, correct or delete your information, and an authorized agent can ask for you with your signed permission. We don't sell personal information or share it for targeted advertising, and we don't disclose it to third parties for their direct marketing. If you are under 18, you can remove what you entered and made yourself in "My signatures", or ask us by email to remove it. Removal may not delete copies you already downloaded or shared. You can complain to the California Attorney General.
9. Cookies and browser storage
| Cookie | Purpose | Type |
|---|---|---|
| ss_at | Keeps you logged in (access token) | Required; a secure cookie scripts can't read |
| ss_rt | Keeps you logged in (refresh token) | Required; a secure cookie scripts can't read |
| lang | Remembers the site language. It lasts until you close the browser, or 1 year if you pick a language with the button | Preference you asked for |
| age_block | Limits re-entry for a day after an age answer that doesn't qualify | Age check |
| ss_seen | Remembers the date this browser first opened our home page, so we can count first and repeat visits as daily totals | Our own analytics; 1 year |
| ss_use_intent, ss_use_intent_en, ss_price_intent_en_v1, ss_notify_paid | Browser storage that remembers you already answered a survey question, so we don't ask again | Preference |
| Cart, name you typed, and request keys | Browser storage for this tab only, so what you entered isn't lost | Required for the feature you're using; cleared when the tab closes |
We don't use advertising cookies or third-party analytics or tracking tools (ss_seen is our own visit count), so we don't show a cookie consent banner. The waitlist device code (section 2) is used only to stop repeat bonus claims and isn't used to track you. We don't track you across other sites, so a browser's Do Not Track or Global Privacy Control signal doesn't change what we do. If you block cookies, you can't log in. The practice sheet PDF is made on your device and isn't uploaded to our servers. If you save or share, a copy goes to the app you choose and can't be taken back.
10. How we protect it
- All traffic is encrypted (HTTPS).
- Browsers and apps don't access the database directly. Our server reads and writes only after checking account ownership.
- All database tables use row-level access control, with no public access.
- Service keys and provider API keys stay on the server, and operating access is kept to a minimum.
- Server logs don't hold IP addresses, emails or names.
- After several wrong passwords, login is locked, and logging out or changing a password applies to all devices.
11. Children and teens
The Service isn't for anyone under 14, and we don't knowingly collect their personal information. If you believe someone under 14 has given us information, email us and we will delete it. If you are under 18, please use the Service with the permission of a parent or guardian. A parent or guardian can ask us by email to delete a teen's account. We don't use anyone's data for advertising.
12. Privacy officer
- Privacy officer
- Jongkyung Han
- help@apertix.ai
- Business name
- Apertix
- Address
- 401-GA25, 454 Gangseo-ro, Gangseo-gu, Seoul, 07582, Republic of Korea
You can also report or get advice on privacy problems from these Korean agencies:
- Personal Information Infringement Report Center (privacy.kisa.or.kr, 118 in Korea)
- Personal Information Dispute Mediation Committee (kopico.go.kr, 1833-6972 in Korea)
- Supreme Prosecutors' Office Cyber Investigation (1301 in Korea), National Police Agency Cyber Bureau (182 in Korea)
13. Changes to this policy
If this policy changes, we announce it in the Service 7 days before it takes effect (30 days if the change is unfavorable to you).
From November 16, 2026 (planned), server processing moves from Naver Cloud to Amazon Web Services (Seoul region, South Korea), and sending mail moves from Whois to Amazon SES (Seoul region, South Korea). If the schedule changes, we will tell you again. Since November 4, 2026, signatures you make are kept for 1 year after your last visit.