For Pro Inc. uses the account email of users who separately opt in to send airdesk product news, events, and offers. This optional choice is separate from required signup confirmations, business details, and analytics consent, and is unchecked by default. Declining does not affect signup or use of the service.
Marketing use of the email continues until withdrawal or account deletion. We record the current choice, its timestamp, and the notice version. Signed-in users may change this preference in My Page → Account. Withdrawal excludes the email from future marketing mailings; necessary account authentication and security notices are handled separately.
1. Controller and scope
For Pro Inc. (주식회사 포프로) is the controller for the airdesk website and its account, device and remote connection management service. This policy covers a service intended primarily for Korean users aged 14 or older and is separate from policies for other services.
Representative: 변지석. Registration: 669-88-02294. Address: Room 404, 109 Beodeunaru-ro, Yeongdeungpo-gu, Seoul, Republic of Korea. General contact: kdh@forpro.co.kr.
2. Basic registration and email verification
Basic registration requires an email and password. We use the email for account identification, verification, recovery and necessary service notices, and the password for authentication. Passwords are stored as one-way hashes. This minimum processing is necessary to establish and perform the service contract; an account cannot be created without it.
A requested six-digit email code is valid for 10 minutes. We process its verification hash, attempt count and sending time rather than storing the plain code. Hashed identifiers derived from the email and request IP, with rate-limit records, prevent sending abuse. No member account is created before email verification.
We record verification status, registration IP, the accepted document version and confirmation timestamps, and the confirmation of age 14 or older. Basic signup does not request a birth date, national identification number or identity document. Login IP and time, authentication sessions and any user-enabled two-factor credentials support authentication and abuse prevention.
3. Optional business information
Only users who select “I plan to use this for work” are asked for a name and team or organization. We use these details to understand business use, answer questions about adopting the service and provide support. Processing relies on separate optional consent, not advertising consent.
We retain these details until account closure or withdrawal of that consent. You may decline, omit this information and continue personal Free registration. Deselecting business use excludes the fields from the signup request. Contact chj@forpro.co.kr to withdraw consent without losing basic account access.
4. Information processed while using the service
Devices and sharing: account and device identifiers, computer names and hostnames, OS and app versions, device MAC addresses, authentication keys and certificate fingerprints, ownership, sharing and team permissions, public/private IPs and ports, and online status support identification, access control and connections.
Hardware capabilities: when the app checks hardware functionality, we may collect hardware encoder/decoder support and initialization results (success, failure or unknown) and store them on our servers linked to device identifiers. We use this information to assess whether low-resource remote mode is needed, determine which remote features are supported and recommend a suitable mode. These capability reports do not contain screen, file, audio or keystroke content.
Diagnostics: connection participants and start/end times, route and NAT state, latency, resolution, codec, bitrate, frame/packet counts and errors support connection diagnosis. The backend does not relay or store screen content, file contents, speech or keystroke contents. Authorized peers receive information needed for a direct connection; choose recipients carefully.
Inquiries: names, email addresses, organizations, messages and response records submitted through forms or email are used to handle the request. Please do not include passwords or sensitive personal data.
Operations and security: request IPs, paths, times, results, errors and email delivery results are logged for abuse prevention and troubleshooting. These operational logs may contain IPs separately from optional aggregate analytics.
Paid transactions: when online checkout is offered, account, order and payment IDs, product, seats, amount/currency, term, order/payment/verification times, payment status and cancellation status are used to verify payments, grant access, keep accounts and process refunds. The payment window may receive the account ID, email and any name/phone entered in the account. The payment provider processes card details in its payment window; our servers do not collect or store full card numbers or CVCs. Free registration does not require payment details.
5. Retention
Account information, acknowledgements and linked devices, permissions and connection history (including hardware capability information) are retained until account closure. Optional business information is retained until closure or withdrawal of that optional consent. Legally required records below are separated from ordinary service data and not used for other purposes.
Under Article 6 of Korea's Electronic Commerce Consumer Protection Act and Article 6 of its Enforcement Decree: contract/withdrawal and payment/supply records (order IDs, account identifiers, products, amounts and payment/cancellation details) are retained for five years; consumer complaints/disputes for three years; advertising records for six months. Ordinary inquiries are deleted when resolved unless the statutory three-year complaint/dispute period applies.
Registration codes expire after ten minutes. Verification attempts and sending-limit records are retained for 24 hours after the last handling. Expired records are eligible for cleanup every five minutes; delayed jobs or remaining batches may delay physical deletion. Expired codes remain unusable regardless of cleanup delay.
Service operation/security logs are managed against a maximum 30-day retention limit. Cloudflare Workers Logs may have shorter service limits. Cloudflare D1 Time Travel keeps recovery history for up to seven or 30 days depending on the plan; we therefore do not state that all recovery copies are deleted within 14 days. Separate operational-server database backups are managed against a 14-day maximum from creation. Recovery copies do not extend the retention of primary data or statutory transaction records. Earlier deletion/withdrawal requests are reapplied after restoration.
If dispute, incident or lawful preservation requires longer retention, the basis, scope and end condition are separated and data deleted when that reason ends. Optional Sentry reports have the separate period in section 7. Non-identifying totals by date, language and event may be retained for analysis. Ask chj@forpro.co.kr about retention or deletion.
6. Disclosures and connection recipients
We do not sell personal data or ordinarily disclose it outside its collection purpose. Where separate consent or a legal basis permits disclosure, we provide the required recipient, purpose, data and retention information and follow applicable procedures.
When you request device sharing, team participation or a remote connection, authorized recipients receive account identifiers, shared device names/status and network information needed to fulfill the connection. You may revoke sharing permissions. Avoid placing private information in device names.
7. Processors, storage and overseas transfers
Cloudflare, Inc. (legal@cloudflare.com) processes website/API execution (Workers), account/device/order databases (D1), authentication/connection state (Durable Objects), installer storage/delivery (R2), access protection and operational logs. Necessary personal data and request metadata are processed on our behalf. This infrastructure does not relay remote video, audio, file contents or keystrokes.
Overseas scope: Cloudflare uses its global network and overseas service/support environments. The current D1 and release R2 placement region is Asia-Pacific (APAC), with no jurisdiction restriction. APAC does not guarantee storage in Korea. Cloudflare's published developer-platform infrastructure regions include the United States, EEA, United Kingdom, Japan, Australia, Canada, Singapore and India. Group-company support access may occur in countries in its published list. This describes the provider's possible scope, not proof that an individual's data is stored in every listed country. See the official network and subprocessor links below.
Data: account/authentication, device, connection, inquiry and order fields necessary for a requested feature, plus IP/request time/path metadata. Purposes: website/API provision, storage, security and incident response. Timing/method: encrypted network processing when web/app features or mail requests are used. Retention: until the processing task or applicable period in section 5 ends; recovery history follows its separate period there. Contract-necessary processing/storage is handled subject to the notice requirements of PIPA Article 28-8(1)(3). Ask chj@forpro.co.kr to stop processing or close the account. Declining necessary infrastructure may prevent provision of the account service. This is separate from declining optional error reporting.
Verification, recovery and service mail is stored/sent in Korea through mail.forpro.co.kr. Addresses and message contents first pass through Cloudflare's mail-dispatch processing path before reaching that mail server. Storage at the final mailbox follows the user's chosen email provider. Any external mail operator and its tasks must be disclosed separately when used.
When online checkout is offered, Korea PortOne Co., Ltd. (PortOne) and Toss Payments Co., Ltd. process payment integration, authorization, verification and cancellation. Necessary data includes account/order IDs, email, any entered name/phone, product/amount and payment status. Payment providers collect payment instrument details directly under applicable law and their payment-window notices. Our transaction-record retention follows section 5. Free registration does not trigger payment processing.
We manage processing scope, purpose restrictions, safeguards, subprocessors and deletion, and implement required notice/procedures for changes to processors, actual countries and processing scope.
Optional desktop error reporting and overseas transfer (separate consent)
Processor/recipient: Functional Software, Inc. (Sentry); contact: compliance@sentry.io. Transfer/storage country: United States (US region). Purpose: analyzing and fixing crashes, screen capture, encoder and decoder errors.
Data: OS/app versions and modules; CPU, memory, GPU and driver details; error codes, codec, resolution, frame rate and related diagnostics. Crash reports may include process memory and file paths containing personal data. The app does not attach screen recordings or log files, or add account/authentication tokens to diagnostic fields. The recipient may process the connection IP at the network layer.
Timing/method: encrypted internet transfer when an error occurs after a separate opt-in in the app. Retention: up to 90 days from collection; the shorter error retention period of the applicable Sentry plan may apply. The consent notice version, choice and decision time are stored on the computer.
Declining/withdrawing: choose Decline in the notice or turn reporting off in Settings → App info → Error reporting. Basic remote features remain available; subsequent report collection/transmission stops. Contact chj@forpro.co.kr to request access to or deletion of previously sent reports. We identify relevant reports where possible, arrange deletion with the processor and explain the result. Installation, signup and updates do not constitute this optional overseas-transfer consent. An older error-reporting opt-in does not substitute for consent to the updated notice.
8. Erasure
When a retention period ends or a purpose is fulfilled, responsible personnel check any legal preservation requirement and erase the data without undue delay. Legally retained data is separated from normal service use with restricted purposes and access.
Electronic data is deleted using methods designed to prevent recovery; any paper records are shredded or incinerated. Closure includes handling associated authentication sessions, sharing access and personal data, rather than merely hiding the account. Residual backup copies are access-restricted for recovery and removed by rotation. After restoring a backup, we must reapply previously completed deletion and consent-withdrawal requests.
9. Your rights
You may request access, correction, deletion, processing restriction, withdrawal of optional consent or account closure. Use available account controls or contact chj@forpro.co.kr. Email requests are available even where no automatic closure screen exists.
After proportionate identity checks, we act without undue delay and report the result. Authorized representatives may act for you with proof of authority. If a request is lawfully restricted, we explain the basis, reason and appeal route. Withdrawing optional consent does not limit basic Free use; deleting data essential to account operation may end the service agreement.
10. Cookies, local storage and optional analytics
An HttpOnly access_token cookie maintains web authentication. Its default lifetime is 7 days and may be renewed. Browser settings can delete or block cookies, but blocking required cookies can prevent login and account management.
Analytics are off by default. Only after consent in the footer’s Analytics settings do we count pricing views, download clicks, signups, inquiries and checkout starts by date and language on our own server. The metrics table contains no email, user ID or individual visitor identifier. We use no advertising-tracking cookies or third-party advertising analytics. Transmission-related operational logs follow sections 4 and 5.
Local storage retains the analytics preference until changed or cleared, and may hold an internal post-login return route valid for up to 15 minutes. You can disable analytics at any time. See Cookie Settings for controls.
11. Security measures
We restrict personal data access to work-related needs and manage server access and database connections. Website/API traffic uses HTTPS, passwords are hashed, and one-time verification codes and request limits help protect authentication.
We review access, retention, backups and logs to address unauthorized access or leakage and act on detected security issues. Incidents are handled with notifications, reports and user protection measures required by applicable law.
12. Privacy contact
Privacy officer: 조희진. Role: information security lead (정보보안책임). Department: information security team (정보보안팀). Email: chj@forpro.co.kr.
Postal address: Privacy team, For Pro Inc., Room 404, 109 Beodeunaru-ro, Yeongdeungpo-gu, Seoul, Republic of Korea.
Contact this team for privacy questions, rights requests or complaints. General support is also available at kdh@forpro.co.kr.
13. Children, sensitive data and automated decisions
We do not accept registrations from children under 14. Registration requires a declaration of being at least 14, without collecting a birth date. If information from a child under 14 is identified, the privacy team takes appropriate measures and erases unnecessary data.
Basic registration does not collect sensitive data or statutory unique identifiers, nor provide a feature for making them public. We do not operate fully automated AI decisions with significant effects on your rights or obligations, personalized advertising, or pseudonymized research processing. Appropriate notice and rights procedures will precede changes to those practices.
14. External remedies
For unresolved Korean privacy complaints, contact the Personal Information Infringement Report Center (118 in Korea, privacy.kisa.or.kr) or the Personal Information Dispute Mediation Committee (1833-6972, kopico.go.kr). Criminal or urgent unauthorized-access incidents may be reported to the police at 112 in Korea.
15. Policy changes
Document version: 2026-10-22. Applies to new registrations when this version is published on the website. It does not retroactively limit existing users' rights or expand optional consent. We explain reasons and effective dates, give prior notice of material changes and obtain separate consent where legally required. Earlier documents are available in the policy history. Language differences do not limit mandatory legal rights.
