AirDesk Inc. uses the account email of users who separately opt in to send AirDesk product news, events, and offers. This optional choice is separate from required signup confirmations, business details, and analytics consent, and is unchecked by default. Declining does not affect signup or use of the service.
Marketing use of the email continues until withdrawal or account deletion. We record the current choice, its timestamp, and the notice version. Signed-in users may change this preference in My Page → Account. Withdrawal excludes the email from future marketing mailings; necessary account authentication and security notices are handled separately.
1. Controller and scope
AirDesk Inc. (주식회사 에어데스크) is the controller for the AirDesk website and its account, device and remote connection management service. This policy covers a service intended primarily for Korean users aged 14 or older and is separate from policies for other services.
Representative: 변지석. Registration: 238-87-04204. Address: Room Ra4, 6F, 5 Dangsan-ro 28-gil, Yeongdeungpo-gu, Seoul, Republic of Korea (Dangsan-dong 3-ga, Daeseong Building). General contact: privacy@airdesk.co.kr.
2. Basic registration and email verification
Basic registration requires an email and password. We use the email for account identification, verification, recovery and necessary service notices, and the password for authentication. Passwords are stored as one-way hashes. This minimum processing is necessary to establish and perform the service contract; an account cannot be created without it.
A requested six-digit email code is valid for 10 minutes. We process its verification hash, attempt count and sending time rather than storing the plain code. Hashed identifiers derived from the email and request IP, with rate-limit records, prevent sending abuse. No member account is created before email verification.
We record verification status, registration IP, the accepted document version and confirmation timestamps, and the confirmation of age 14 or older. Basic signup does not request a birth date, national identification number or identity document. Login IP and time, authentication sessions and any user-enabled two-factor credentials support authentication and abuse prevention.
3. Optional business information
Only users who select “I plan to use this for work” are asked for a name and team or organization. We use these details to understand business use, answer questions about adopting the service and provide support. Processing relies on separate optional consent, not advertising consent.
We retain these details until account closure or withdrawal of that consent. You may decline, omit this information and continue personal Free registration. Deselecting business use excludes the fields from the signup request. Contact privacy@airdesk.co.kr to withdraw consent without losing basic account access.
4. Information processed while using the service
Devices and sharing: account and device identifiers, computer names and hostnames, OS and app versions, device MAC addresses, authentication keys and certificate fingerprints, ownership, sharing and team permissions, public/private IPs and ports, and online status support identification, access control and connections.
Hardware capabilities: when the app checks hardware functionality, we may collect hardware encoder/decoder support and initialization results (success, failure or unknown) and store them on our servers linked to device identifiers. We use this information to assess whether low-resource remote mode is needed, determine which remote features are supported and recommend a suitable mode. These capability reports do not contain screen, file, audio or keystroke content.
Diagnostics: connection participants and start/end times, route and NAT state, latency, resolution, codec, bitrate, frame/packet counts and errors support connection diagnosis. The backend does not relay or store screen content, file contents, speech or keystroke contents. Authorized peers receive information needed for a direct connection; choose recipients carefully.
Inquiries: names, email addresses, organizations, messages and response records submitted through forms or email are used to handle the request. Please do not include passwords or sensitive personal data.
Operations and security: request IPs, paths, times, results, errors and email delivery results are logged for abuse prevention and troubleshooting. These operational logs may contain IPs separately from optional aggregate analytics.
Paid transactions: when online checkout is offered, account, order and payment IDs, product, seats, amount/currency, term, order/payment/verification times, payment status and cancellation status are used to verify payments, grant access, keep accounts and process refunds. In Korean checkout, the payment window may receive the account ID, email and any name/phone entered in the account. In international checkout, Paddle acts as Merchant of Record and collects payment details directly; we receive from Paddle the transaction ID, product and quantity, amount and currency, term, payment, subscription and refund status, buyer email and billing country needed to grant access and provide support. The payment provider or Paddle processes card details in its payment window; our servers do not collect or store full card numbers or CVCs. Free registration does not require payment details.
Optional diagnostic log submission (consent for each report)
AirDesk Inc. receives logs only when you review the contents and consent in Settings → App info → Send diagnostic logs in the Windows or Mac app. The purpose is investigating the error or connection problem for which you request support. Uploads are not automatic, and basic remote features remain available if you decline. This is separate from Sentry error-reporting consent.
Data: the signed-in account identifier and association with its existing email, app version and operating system, up to 128 KiB of recent app/host logs, an optional problem description, report ID, submission time and consent notice version. Logs may contain error messages, connection/device state and file paths. The app and server mask known patterns for authentication tokens, passwords, emails, IPs and user paths; this does not guarantee removal of all personal data. Review the preview and description and cancel if personal or secret information remains. This feature does not attach remote video, audio, keystroke contents or the contents of files you transfer.
Processing: the signed-in app sends the report to the API over HTTPS; authorized support administrators view it in a private console. AWS Lambda and DynamoDB are used, so the processor and overseas-processing notice in section 7 applies. Connection IPs may also be processed for network/security purposes. Sending a report consents to that report only, without enabling later uploads or Sentry reports.
Retention/deletion: reports are retained for 30 days from submission, become unavailable to administrators immediately at expiry, and are deleted through DynamoDB expiry processing. Delays may defer physical deletion. Deletion of linked reports may be requested when account closure is processed. Recovery history follows the separate periods and restoration/deletion rules in section 5. Request earlier deletion or withdraw consent at privacy@airdesk.co.kr with the account email and report ID. Declining only prevents diagnosis using these logs. Notice version: diagnostic-logs-2026-11-04.
5. Retention
Account information, acknowledgements and linked devices, permissions and connection history (including hardware capability information) are retained until account closure. Optional business information is retained until closure or withdrawal of that optional consent. Legally required records below are separated from ordinary service data and not used for other purposes.
Under Article 6 of Korea's Electronic Commerce Consumer Protection Act and Article 6 of its Enforcement Decree: contract/withdrawal and payment/supply records (order IDs, account identifiers, products, amounts and payment/cancellation details) are retained for five years; consumer complaints/disputes for three years; advertising records for six months. Ordinary inquiries are deleted when resolved unless the statutory three-year complaint/dispute period applies.
Registration codes expire after ten minutes. Verification attempts and sending-limit records are retained for 24 hours after the last handling. Expired records are eligible for DynamoDB expiry processing, and physical deletion may be delayed. Expired codes remain unusable regardless of cleanup delay.
Where a legal retention obligation applies to service access records such as login times and connection IPs, the applicable statutory retention period applies. AWS CloudWatch operational logs are managed under their configured retention period. DynamoDB point-in-time recovery (PITR) history may be retained for up to 35 days depending on its settings, so not all recovery copies are necessarily deleted within 14 days. Any separate backups follow their own configured retention periods. Recovery copies do not extend the retention of primary data or statutory transaction records. Restoration should include checking whether earlier deletion and withdrawal requests have been applied.
If dispute, incident or lawful preservation requires longer retention, the basis, scope and end condition are separated and data deleted when that reason ends. Optional Sentry reports have the separate period in section 7. Non-identifying totals by date, language and event may be retained for analysis. Ask privacy@airdesk.co.kr about retention or deletion.
6. Disclosures and connection recipients
We do not sell personal data or ordinarily disclose it outside its collection purpose. Where separate consent or a legal basis permits disclosure, we provide the required recipient, purpose, data and retention information and follow applicable procedures.
When you request device sharing, team participation or a remote connection, authorized recipients receive account identifiers, shared device names/status and network information needed to fulfill the connection. You may revoke sharing permissions. Avoid placing private information in device names.
7. Processors, storage and overseas transfers
Amazon Web Services (AWS) processes personal data and request metadata needed for website/API execution (Lambda), account, device, order and diagnostic storage (DynamoDB), file storage and delivery (S3 and CloudFront), connection signaling (AWS IoT Core), some authentication email request processing (SQS), and operational logging (CloudWatch). This infrastructure does not relay or store remote video, audio, file contents or keystrokes.
Cloudflare, Inc. (legal@cloudflare.com) provides domain DNS services. Enterprise TURN relay is available only when separately configured and enabled. If an authorized Enterprise connection fails to connect directly and both devices support relay, Cloudflare Realtime TURN may relay connection IPs and ports and end-to-end encrypted data. We do not view or store relayed video, audio, files or input.
Processing locations: account-home data is processed and stored in its assigned Seoul (ap-northeast-2), US Virginia (us-east-1), or Ireland (eu-west-1) Region; existing accounts remain in Seoul. Information needed for regional request routing and connections to another account may be transferred between the corresponding account homes. Limited account-routing information and shared release files are managed in Seoul. CloudFront uses a global edge network, so request metadata may be processed outside Korea depending on the point of access. See the official AWS service and subprocessor information below. This does not mean each person’s data is replicated in every listed Region.
Data: account/authentication, device, connection, inquiry and order fields necessary for a requested feature, plus IP/request time/path metadata. Purposes: website/API provision, storage, security and incident response. Timing/method: encrypted network processing when web/app features or mail requests are used. Retention: until the processing task or applicable period in section 5 ends; recovery history follows its separate period there. Contract-necessary processing/storage is handled subject to the notice requirements of PIPA Article 28-8(1)(3). Ask privacy@airdesk.co.kr to stop processing or close the account. Declining necessary infrastructure may prevent provision of the account service. This is separate from declining optional error reporting.
Verification, recovery and service mail passes through the AWS application processing path and, where needed, an encrypted queue to the SMTP mail server operated internally by the company. The mail server’s storage country and scope of overseas access depend on its operating configuration. The final mailbox location follows the recipient’s email provider.
When online checkout is offered, Korean checkout uses Payple (주식회사 페이플) to process payment integration, authorization, verification and cancellation. Necessary data includes account/order IDs, email, any entered name/phone, product/amount and payment status. Payple collects payment instrument details directly under applicable law and its payment-window notices.
For international checkout, Paddle.com Market Limited and its affiliates (Paddle) sell as Merchant of Record and independently process the buyer’s name, email, billing country/address, payment instrument details, IP address and transaction history for payment, tax, invoicing, refunds and fraud prevention under their own privacy notice (https://www.paddle.com/legal/privacy). We receive from Paddle the transaction ID, product and quantity, amount and currency, term, payment, subscription and refund status, buyer email and billing country to grant access and provide support. This processing is necessary to perform the contract with you and takes place over the network when you choose international checkout. Paddle may process data outside Korea, including in the United Kingdom, the United States and the EU, and retains it under its own policy and applicable law. Declining international checkout does not affect Free use. Our transaction-record retention follows section 5. Free registration does not trigger payment processing.
We manage processing scope, purpose restrictions, safeguards, subprocessors and deletion, and implement required notice/procedures for changes to processors, actual countries and processing scope.
Optional desktop error reporting and overseas transfer (separate consent)
Processor/recipient: Functional Software, Inc. (Sentry); contact: compliance@sentry.io. Transfer/storage country: United States (US region). Purpose: analyzing and fixing crashes, screen capture, encoder and decoder errors.
Data: OS/app versions and modules; CPU, memory, GPU and driver details; error codes, codec, resolution, frame rate and related diagnostics. Crash reports may include process memory and file paths containing personal data. Sentry reports do not attach screen recordings or log files, or add account/authentication tokens to diagnostic fields. The recipient may process the connection IP at the network layer.
Timing/method: encrypted internet transfer when an error occurs after a separate opt-in in the app. Retention: up to 90 days from collection; the shorter error retention period of the applicable Sentry plan may apply. The consent notice version, choice and decision time are stored on the computer.
Declining/withdrawing: choose Decline in the notice or turn reporting off in Settings → App info → Error reporting. Basic remote features remain available; subsequent report collection/transmission stops. Contact privacy@airdesk.co.kr to request access to or deletion of previously sent reports. We identify relevant reports where possible, arrange deletion with the processor and explain the result. Installation, signup and updates do not constitute this optional overseas-transfer consent. An older error-reporting opt-in does not substitute for consent to the updated notice.
8. Erasure
When a retention period ends or a purpose is fulfilled, responsible personnel check any legal preservation requirement and erase the data without undue delay. Legally retained data is separated from normal service use with restricted purposes and access.
Electronic data is deleted using methods designed to prevent recovery; any paper records are shredded or incinerated. Closure includes handling associated authentication sessions, sharing access and personal data, rather than merely hiding the account. Residual backup copies are access-restricted for recovery and removed by rotation. After restoring a backup, we must reapply previously completed deletion and consent-withdrawal requests.
9. Your rights
You may request access, correction, deletion, processing restriction, withdrawal of optional consent or account closure. Use available account controls or contact privacy@airdesk.co.kr. Email requests are available even where no automatic closure screen exists.
After proportionate identity checks, we act within 10 days of receiving your request and report the result. If that is not possible, we tell you the reason and the expected completion time. Authorized representatives may act for you with proof of authority. If a request is lawfully restricted, we explain the basis, reason and appeal route. Withdrawing optional consent does not limit basic Free use; deleting data essential to account operation may end the service agreement.
10. Cookies, local storage and website analytics
An HttpOnly access_token cookie maintains web authentication. Its default lifetime is 7 days and may be renewed. Browser settings can delete or block cookies, but blocking required cookies can prevent login and account management.
Our own optional metrics are off by default. Only after consent in the footer’s Analytics settings do we count pricing views, download clicks, signups, inquiries and checkout starts by date and language on our own server. The metrics table contains no email, user ID or individual visitor identifier. We use no advertising-tracking cookies or third-party advertising analytics. Transmission-related operational logs follow sections 4 and 5.
Local storage retains the analytics preference until changed or cleared, and may hold an internal post-login return route valid for up to 15 minutes. You can disable these first-party metrics at any time. See Cookie Settings for controls.
On AirDesk's cloud website, Google Analytics 4 is separate from our optional first-party metrics and runs by default without a consent popup, in a mode that does not read or write analytics cookies. Advertising storage, ad personalization and Google Signals are disabled. Public page paths and device/browser information are sent to Google LLC; account identifiers and URL queries or fragments are not sent. The connection IP address is transmitted to Google during network communication and may be used to derive approximate location. Information may be processed for visit analytics on Google LLC servers outside Korea (including the United States), and retention depends on the Google Analytics property settings. You can stop Google Analytics collection in Analytics settings in the footer; previously saved refusals remain respected. Google privacy information: https://policies.google.com/privacy
If the stop setting cannot be saved in local storage, this tab temporarily keeps its refusal in session storage under airdesk-ga4-session-disabled until the tab closes. If both stores are blocked, collection stops on the current page but the setting may not persist.
11. Security measures
We restrict personal data access to work-related needs and manage server access and database connections. Website/API traffic uses HTTPS, passwords are hashed, and one-time verification codes and request limits help protect authentication.
We review access, retention, backups and logs to address unauthorized access or leakage and act on detected security issues. Incidents are handled with notifications, reports and user protection measures required by applicable law.
12. Privacy contact
Privacy officer: 김도현 (Kim Do-hyun). Role: information security lead (정보보안책임). Department: information security team (정보보안팀). Email: kdh@airdesk.co.kr. Privacy inquiries mailbox: privacy@airdesk.co.kr.
Postal address: Privacy team, AirDesk Inc., Room Ra4, 6F, 5 Dangsan-ro 28-gil, Yeongdeungpo-gu, Seoul, Republic of Korea (Dangsan-dong 3-ga, Daeseong Building).
Contact this team for privacy questions, rights requests or complaints. General support is also available at support@airdesk.co.kr.
13. Children, sensitive data and automated decisions
We do not accept registrations from children under 14. Registration requires a declaration of being at least 14, without collecting a birth date. If information from a child under 14 is identified, the privacy team takes appropriate measures and erases unnecessary data.
Basic registration does not collect sensitive data or statutory unique identifiers, nor provide a feature for making them public. We do not operate fully automated AI decisions with significant effects on your rights or obligations, personalized advertising, or pseudonymized research processing. Appropriate notice and rights procedures will precede changes to those practices.
14. External remedies
For unresolved Korean privacy complaints, contact the Personal Information Infringement Report Center (118 in Korea, privacy.kisa.or.kr) or the Personal Information Dispute Mediation Committee (1833-6972, kopico.go.kr). Crimes may be reported to the National Police Agency Cyber Crime Reporting System (ecrm.police.go.kr, 182 in Korea), and urgent danger to 112.
15. Policy changes
Document version: 2026-11-04.1. Applies to new registrations when this version is published on the website. It does not retroactively limit existing users' rights or expand optional consent. We post reasons and effective dates on the website, give 30 days’ prior notice of changes that materially affect your rights, and obtain separate consent where legally required. Summaries of earlier changes are available in the policy history. Language differences do not limit mandatory legal rights.
