1. Personal data we collect
Through the inquiry form, we may collect your name, phone number, email address, and message content.
Privacy Policy
Studio NOL collects only the minimum personal data required for inquiries and consultation support.
2. Purpose of use
Collected data is used only to answer inquiries, support bookings, provide consultation, process customer requests, and send one email after you use a booked or ordered service asking whether you would leave a review. That email goes only for bookings and orders placed on or after September 27, 2026, once per booking or order, the day after the session or delivery, and never comes with an incentive.
3. Retention period
Personal data collected through inquiries is deleted without delay after the consultation is completed. Personal data collected through crowdfunding pledges (offered on our Korean pages only) is kept until one year after reward delivery and then destroyed, except for transaction records that Korean e-commerce law requires us to keep for up to five years. See the Korean privacy policy and funding terms for details.
4. Third-party sharing and outsourcing
We do not provide personal data to third parties. We do entrust processing: Resend (sending inquiry notifications to the studio, booking/order confirmation and cancellation emails, and forwarding messages sent to hello@) and Vercel (website and server hosting) receive the name, phone number, email address, and message you submit. Bookings and payments (offered on our Korean pages only) additionally involve Turso (booking and order database), Google LLC (calendar event for a confirmed booking) and Toss Payments (payment approval, cancellation, refund). Outsourcing for crowdfunding (reward pre-orders) is listed in section 9 of the Korean privacy policy, and media contact handling for press outreach in sections 6 to 8 below.
5. Your rights and how to exercise them
You may ask us at any time to access, correct or delete your personal data, or to stop processing it, and where we rely on your consent you may withdraw it. A legal representative may exercise the same rights on your behalf. Send your request to the privacy officer named in section 10 below; we look into it without undue delay, act on it, and tell you the outcome, with our reasons if we cannot do what you asked. Two limits apply. Data that another law requires us to collect cannot be deleted on request - the transaction records described in section 3 are of that kind, and they are destroyed once their retention period ends. And we may refuse a request to stop processing if that would make it impossible to perform a contract you hold with us and you have not clearly said that you wish to end it; if we refuse, we tell you why. Withdrawing consent stops the processing that rested on it, but it does not undo a contract already made or erase records we are required to keep. If you disagree with the outcome, you may apply for mediation to Korea's Personal Information Dispute Mediation Committee or report the matter to the Privacy Infringement Report Centre.
6. Media contact details for press outreach
For music release publicity, Studio NOL collects business contact details that press outlets, media companies, broadcasters, and music distributors have themselves made public (editorial desks, news tip lines, contribution intake channels, and similar) and uses them to send press releases. We use them only within the scope the data subject has made public, and we do not collect addresses that individuals use privately. Every email we send states where we found the address, and we will explain how it was collected on request.
7. Opt-out and retention of media contact details
If you tell us you do not wish to receive our emails, we remove you from the send list immediately and will not send to you again in any later campaign. We keep that opt-out record together with our send log to prevent the same email being sent twice - deleting the record would make us send it again.
8. Third-party sharing of media contact details
We never provide collected media contact details to third parties under any circumstances. The result reports we give to clients who commission publicity do not carry individual names or email addresses either: outlets that are companies or organisations are listed by their public domain, and individual reporters and critics are recorded only as a headcount.
9. How personal data is destroyed
Personal data is destroyed without delay once its purpose has been met or its retention period has passed; records that another law requires us to keep are destroyed once that period ends. An automated clean-up runs once a month and erases the stored value in our database, so no deletion waits on someone remembering that it is due. Where a field cannot be left empty we overwrite it with the mark "(personal data destroyed)". Where we hold data encrypted, we erase the encrypted text itself, so holding the decryption key makes no difference. Because the clean-up runs monthly, data is erased within a month of falling due for destruction. Inquiry data is destroyed once the consultation is finished. For orders, bookings and recurring payments (offered on our Korean pages only), the name, phone number and email address are overwritten with that mark five years after the order was placed or last changed, whichever is later - a refund or a cancellation counts as a change - or, for a subscription, five years after it ended. A recurring payment that never got as far as a registered card, or that we stopped - because charges kept failing, or because we suspended the billing ourselves - has no end date of its own, so we treat it as ended once three years have passed with no activity of any kind - no charge attempted, no card registered or changed, nothing else recorded against it. If no payment was ever taken, no contract was formed and no money changed hands, so there is no transaction record to keep: we erase the name, phone number, email address and any supporter display name at the same time. If payments were taken, we only mark the subscription as ended, and the five-year rule above then runs from that last activity. The same goes for a subscription left with a charge whose outcome we never heard back on: we mark it as ended but keep the contact details, because if that charge turns out to have gone through we have to be able to reach you about a refund. The raw response the payment provider returned when it approved a payment is erased five years after that approval, because the law requires us to keep the payment record for that long. Free-text notes and the reasons the provider gave for declining a payment are erased on shorter schedules: a declined payment forms no contract and moves no money, so it is not a record the law tells us to keep. What remains afterwards is the transaction record itself - order number, product, amounts, times, payment method and processing status.
10. Privacy officer
Studio NOL has named a privacy officer - gaeinjeongbo boho chaegimja, the role Korean privacy law provides for - who is responsible overall for how personal data is handled and who deals with questions, complaints and requests for redress from data subjects. Studio NOL is run by one person, so there is no separate department, and requests under section 5 reach the same contact. Name: 황경하 (Hwang Kyungha), operator of Studio NOL. Email: hello@studionol.co.kr. Phone: +82-10-4255-7893.
11. Cookies and other automatic collection
Studio NOL uses Google Analytics 4 and Vercel's visit and performance measurement to see which pages are read and how well they load. The scripts do not start as soon as a page opens; they load after you first move or tap, or after five seconds, and only on the studionol.co.kr domain. They record the page address and how you arrived, your browser, device and operating system, the time of the visit, performance figures, and actions such as pressing an inquiry button. We do not send them your name, phone number or anything else that identifies you directly, and pages whose address carries a payment identifier or a management token, along with the admin pages, are left out of measurement altogether. Google Analytics 4 stores an identifier cookie in your browser so that repeat visits can be told apart; we use it for visit statistics and for improving pages, not for advertising. The site has no opt-out switch of its own: blocking cookies in your browser settings, or deleting the ones already stored, is how you refuse, and the site works the same either way. Settings such as dark mode, a banner you have dismissed and a form you were part-way through stay in your browser and are never sent to our servers.