Privacy Policy
Effective 2026-11-13
1. General
Pudding Club (the "Service") complies with applicable data protection laws, including the Korean Personal Information Protection Act, and publishes this policy to explain how we handle your personal data.
2. Data we collect and how
Data is either entered by you during sign-up and payment, or generated and collected automatically while you use the Service.
- Sign-up and login: email address, password (stored only as a hash, never in plain text), and, if you use social login (Google or Kakao), the provider and your unique identifier at that provider.
- Use of the Service: reading history, favorited works, and the version and time of your agreement to the Terms.
- Payments and Diamonds: top-up order, approval and refund records, Diamond top-up and usage history (balance, expiry, rentals, owned episodes and Pass access), and payment method display information (card issuer and last 4 digits). We do not store your full card number; the payment processor handles it.
- Collected automatically: access logs (IP address, access time, device and browser information) and usage analytics (pages visited, events).
3. Purposes of use
- Identifying members, login, verification and account management
- Processing Diamond top-ups and usage, providing Passes, processing refunds, and showing payment and usage history
- Personalization such as reading history and favorites
- Keeping the Service stable, preventing abuse and responding to incidents
- Usage statistics and improvement of the Service
- Answering inquiries and sending notices
4. Retention
We delete personal data without delay once its purpose has been achieved. The following are kept for the periods required by law.
- Member information: until you withdraw or request deletion
- Records of contracts, withdrawals, payments and supply of goods or services: 5 years (Korean Act on the Consumer Protection in Electronic Commerce)
- Records of consumer complaints and dispute handling: 3 years (same Act)
- Access logs: 3 months (Korean Protection of Communications Secrets Act)
5. Provision to third parties
We do not provide your personal data to third parties beyond what is described in this policy, except where required by law or requested by an investigating authority through lawful procedures.
6. Processors
We manage and supervise processors so that they handle personal data safely.
- Toss Payments Co., Ltd.: approval of card payments and payment cancellation (refunds)
- Stripe, Inc.: approval of card payments, payment cancellation (refunds) and fraud detection for sales by Paprika US, Inc. (users in Japan and the US)
- Cloudflare, Inc.: operating infrastructure such as servers, databases and image storage, and network security
- xAI Corp.: an operations automation agent (Grok), acting on the owner's delegation, handles member inquiries, refunds, Diamond grants and content operations
| Processor | Task | Data processed | Retention |
|---|---|---|---|
| Toss Payments Co., Ltd. (Korea) | Approving card payments, cancelling payments (refunds) | Payment method details, order, payment and refund records | Until the processing agreement ends or the legal retention period |
| Stripe, Inc. (United States) | Approving card payments, cancelling payments (refunds) and detecting fraud for sales by Paprika US, Inc. (users in Japan and the US) | Payment method details, order, payment and refund records, IP address, device information (card numbers are not stored in our database; only payment identifiers and the card issuing country are) | Until the processing agreement ends or the legal retention period |
| xAI Corp. (United States) | An operations automation agent (Grok), acting on the owner's delegation, handles member inquiries, refunds, Diamond grants and content operations, and may access member-identifying information in the process | Masked email address; Diamond top-up and usage history; summary of top-up and payment records (excluding card details, passwords, payment keys and Stripe IDs) | Until the delegation ends (subject to xAI's policies) |
7. Analytics and transfers abroad
We use Google Analytics 4 (GA4) and PostHog to analyze usage. These tools are configured not to use cookies, and we do not send them information that directly identifies you, such as your email address.
Through our processors and analytics tools, personal data may be processed on servers outside Korea (for example in the United States). Only the data needed for the relevant function, from the items in section 2, is transferred, and it is transferred over the network when you use the Service. If you do not want your data transferred abroad, parts of the Service may not be available; please contact contact@quelworks.com.
When and how: transferred over the network (encrypted in transit) when you use the Service. Contact details of the recipients and of our data protection officer are in each recipient's privacy policy and in section 12 below.
Users in Japan: payment information of users in Japan may be transferred to Stripe, Inc. in the United States. For information on the US personal data protection regime, see the materials published by Japan's Personal Information Protection Commission (ppc.go.jp).
| Recipient (country) | Data transferred | Purpose | Retention | How to refuse |
|---|---|---|---|---|
| Google LLC (United States) | Provider type and unique ID when you use social login; GA4 usage analytics (pages visited, events) | Social login authentication; usage analytics | Until the purpose is achieved, or the period set by the recipient's policy | Sign up with email instead of social login, or ask us by email to stop the transfer |
| PostHog Inc. (United States) | Usage analytics (pages visited, events) | Analyzing and improving the Service | Until the purpose is achieved, or the period set by the recipient's policy | Ask us by email to stop the transfer |
| Cloudflare, Inc. (United States) | Access logs (IP address, etc.) and data processed while you use the Service | Hosting (servers, database, image storage), CDN, network security | Until the processing agreement ends or the purpose is achieved | Ask us by email (if you refuse, use of the Service is limited) |
| Stripe, Inc. (United States) | Payment method details, payment and refund records, IP address, device information (fraud detection) | Processing card payments, cancelling payments (refunds) and detecting fraud for sales by Paprika US, Inc. (users in Japan and the US) | Until the processing agreement ends or the legal retention period | Ask us by email to stop the transfer (if you refuse, users in Japan and the US cannot top up) |
| xAI Corp. (United States) | Masked email address; Diamond top-up and usage history; summary of top-up and payment records (excluding card details, passwords, payment keys and Stripe IDs) | Operations automation agent (Grok) handling member inquiries, refunds, Diamond grants and content operations | Until the delegation ends (subject to xAI's policies) | Ask us at contact@quelworks.com to stop the transfer |
8. Cookies
We use an essential session cookie to keep you signed in. We do not use advertising or analytics cookies. If you block cookies in your browser, features that require signing in will not work.
9. Your rights
You may at any time request access, correction, deletion or restriction of processing of your personal data, and withdraw consent. Email contact@quelworks.com and, after verifying your identity, we will handle the request without delay and within the deadlines set by law.
To request deletion of your account, you must first request a refund of any Paid Diamond balance or agree to forfeit it. Data we are required by law to keep is held separately for the periods in section 4 and then destroyed.
10. Destruction
Personal data whose retention period has passed or whose purpose has been achieved is deleted in a way that cannot be restored. Data kept under law is separated from other data and used only for that purpose.
11. Security measures
- One-way hashing of passwords
- Encryption in transit (HTTPS)
- Minimal access rights and separation of administrator roles
- Paid images are delivered only to signed-in users who are entitled to them
12. Data protection officer and contact
Data protection officer: Operator / Contact: contact@quelworks.com
Send questions, complaints and requests for remedy about personal data to contact@quelworks.com. In Korea you can also contact the Personal Information Infringement Report Center (privacy.kisa.or.kr, 118) and the Personal Information Dispute Mediation Committee (kopico.go.kr, 1833-6972).
13. Changes
We post changes to this policy on this page at least 7 days before they take effect, and at least 30 days before for significant changes affecting your rights.
14. Governing law and jurisdiction
Disputes about payments and the handling of personal data are governed by the law of the selling entity. Sales by the Korean operating company, Snake Steak (Toss Payments), are governed by the laws of the Republic of Korea, and sales by Paprika US, Inc. (Stripe) by the laws of the State of Delaware, USA. Mandatory consumer protection laws of your country of residence are not excluded. Jurisdiction does not limit your right to bring a claim in the courts of your country of residence. This matches article 14 of the Terms.
Revision history
- Effective 2026-11-20 (scheduled): xAI added as a processor, with Diamond top-up and usage history among the items shared (announced 7 days in advance)
- Added Stripe (United States) as a processor and overseas recipient, and a governing-law section (announced 7 days in advance)