개인정보처리방침

Privacy Policy (English)

This is the complete English version of the Korean policy above. Milestone Financial Group (“the Company”) processes the personal data of stock EAGLE (“the Service”) users as described below, in accordance with the Personal Information Protection Act of the Republic of Korea. Where the two versions differ, the Korean text governs.

1. Personal data we collect and how we collect it

stock EAGLE lets a user record the Korean-listed stocks they hold and see end-of-day (EOD) valuation, profit and loss, risk and theme exposure calculated from those entries. The Service does not connect to brokerage accounts and does not place orders. We use the data below to authenticate members and provide the Service. We do not collect resident registration numbers or brokerage account passwords.

We do not store password plaintext in the member database. Passwords are stored as PBKDF2-SHA256 hashes with a random salt and 600,000 iterations. Accounts created through social sign-in have no Service password, and we never receive the password held by Google or any other provider.

2. Purposes of processing

• Member identification and authentication — account creation, sign-in, linking the same user's accounts, handling password reset requests.
• Approval and access management — staff review a member's email, name, sign-up and approval status to approve access, and access is granted according to the approved role.
• Providing the Service — storing the holdings a user enters and returning valuation, profit and loss, risk and theme exposure, and watchlist information.
• Security and request handling — limiting repeated authentication attempts, preventing forged sign-in requests, and handling account enquiries and data-subject requests.

Approval status is shown on the Service's sign-in and pending-approval screens. We do not use personal data for advertising or marketing messages.

3. Retention periods

The recipient address and content of a password reset notice currently remain in server operational records, and that notice contains the reset link, so a deletion request for an account may also cover those records. Where a law requires separate retention, we keep the data on that legal basis for the required period and use it for no other purpose.

4. Provision to third parties

We do not sell personal data and do not provide it for the independent purposes of any third party, including advertising and marketing companies. Where there is a legal basis or a lawful request, we process data within that scope. Processing entrusted to service providers is described separately in Section 5.

5. Entrusted processing

The Service does not currently send email through AWS SES. Password reset notices remain in server operational records and are not automatically delivered to the user's mailbox, and no automated notice is sent on approval. If we begin entrusting email delivery, we will update this policy to reflect the actual work and data involved. We manage entrusted processing so that data is handled only within the stated purpose and scope; privacy enquiries are received by the officer named in Section 13.

6. Transfer of personal data abroad

The Service's servers, databases and backups are located in Japan. When you sign up, sign in or use the Service, data is transmitted to and processed and stored on servers in Japan.

A user who does not want their data transferred abroad may stop using the Service and request suspension or deletion at the address above. Because the Service performs member authentication and data storage on servers in Japan, we cannot provide the member service if this processing is refused.

7. Cookies and browser storage

oauth_state is the only cookie the Service sets. We do not use advertising or behavioural cookies and do not embed third-party analytics or advertising tools. You may block or clear cookies and site data in your browser, though social sign-in or staying signed in may then not work.

8. Data collected through social sign-in

When a user signs up or signs in with a Kakao, Google or Naver account, we process the identifier, email address and name or nickname supplied by that provider within the permissions granted. We never receive the password held by the provider.

We look up an existing link using the provider name and member identifier. If a link exists, we update the sign-in time and the provider email. If the user changes their email at the provider, we still match the same identifier; that change is not automatically applied to the Service member email or name.

You can disconnect the Service in each provider's account settings. Disconnecting is separate from deleting data already stored by stock EAGLE — to delete member data, make a request under Section 10.

9. Google user data

stock EAGLE uses Google sign-in as a means of member authentication. We use the basic account information received from Google to create a Service account or link an existing one. The stock holdings shown in the Service are entered by the user and are never retrieved from a Google account.

Scopes requested and data used

We request only openid, email and profile. We do not access, and do not request access to, Gmail messages, Google Drive files, Calendar events or Contacts. The basic profile response may include additional fields such as a picture URL or locale; the Service neither uses nor stores those fields.

Access

Each time a user signs in with Google, our server exchanges the authorization code for an access token and calls the user-info API. This is not limited to the first sign-up. The call happens during that sign-in only; we do not query the Google account in the background afterwards. We do not receive Google passwords and do not request offline access or refresh tokens.

Use

• Identifier — to find the linked account and treat the sign-in as the same user.
• Email and verification status — to create a new member account and to decide whether to link an existing account with the same email. We check Google's email verification status when first linking to an existing account, and we do not store the verification value itself.
• Name — used as the member name of a new account and in the link record. Access to or correction of the name can be requested at the address in Section 10.
• Member administration — approving staff review the member email, name, sign-up and approval status to grant access. Signing up with Google follows the same approval process.

We do not use Google user data for advertising, advertising profiles, data sales, or artificial intelligence or machine learning model training.

Storage and protection

The Google identifier, email and name are stored as member data and as a social link record, which also holds the provider name, Service member number, link creation time and last sign-in time. They are stored on AWS servers and databases in Tokyo, Japan; retention on account closure and in backups follows Section 3. A Google access token is used only to retrieve user information during that server-side sign-in request. We do not store Google access tokens, ID tokens, refresh tokens or the email verification status in the member database or in browser storage. The token stored in the browser is a separate stock EAGLE session token. Protection measures such as transport encryption and per-account authorization are described in Section 12.

Sharing and transfer

We do not sell Google user data or provide it for the independent purposes of a third party. AWS performs hosting, storage and backup work as described in Section 5, in Japan as described in Section 6. Except for lawful legal requests, we do not pass this data to other external companies for advertising or analytics. Company staff access it only as needed for member approval, handling a support or data-subject request from the user, security, or legal obligations.

Deletion and revocation

To access, correct or delete stored Google link data and member data, or to close your account, email vostage99@gmail.com with the account email and the action you want. We verify the requester before acting. Please do not send passwords or authentication codes. An account closure request covers the Google link record, member data, portfolio and watchlist entries and related per-member records; backup rotation follows Section 3.

You may also revoke stock EAGLE's access in your Google account connections. Revoking access does not automatically delete data already held in the stock EAGLE database and does not immediately invalidate a Service session token that has already been issued. To stop using the Service and delete stored data, sign out of stock EAGLE and send a closure request to the address above.

Compliance with the Google API Services User Data Policy

10. Your rights and how to exercise them

You may request access to, correction of, deletion of, or suspension of the processing of your personal data. A legal representative or an authorised agent may also make the request.

• Directly in the Service — the account screen shows your email, and accounts with a Service password can change it. You can edit or delete holdings on the portfolio screen and add or remove items on the watchlist screen.
• By email — to correct a member email or name, close an account, or delete Google link data and other personal data, write to vostage99@gmail.com. The account screen currently has no feature to edit the email or name directly or to close the account.
• What to include — the member email and the action you want, for example “close my account and delete the Google link data”. We act without undue delay after verifying that you are the member or an authorised representative.

How to disconnect the Service at Google and how to delete data held by the Service are described in Section 9. If you request suspension or deletion of data required to identify and authenticate a member, use of that account may be restricted.

11. Destruction of personal data

We destroy personal data without undue delay once the retention period ends or the purpose is achieved. Closure and deletion requests are handled by the privacy officer after verifying the requester and the scope of deletion. Live data and backups are handled separately; backups are subject to the rotation periods in Section 3. If a legal retention obligation prevents immediate deletion, we tell the requester the basis and the period.

12. Security measures

• Password protection — PBKDF2-SHA256 with a random salt and 600,000 iterations; no password plaintext in the member database.
• Transport protection — HTTPS for access to the Service and for Google authentication and user-info calls.
• Access control — per-member data authorization, and administrator and approver roles with approval-status checks.
• Authentication protection — rate limiting of repeated attempts and state validation of social sign-in requests. Changing or resetting a password invalidates existing Service session tokens.
• Recovery — daily and weekly database backups with rotation according to their retention periods.

13. Privacy officer

Please direct enquiries, complaints and remedy requests about the processing of personal data to the contact below. We will respond without undue delay.

14. Remedies for infringement

If you need to report or consult about a privacy infringement, you may contact the Korean authorities below.

• Personal Information Dispute Mediation Committee — 1833-6972 (kopico.go.kr)
• Privacy Infringement Report Centre — 118 (privacy.kisa.or.kr)
• Supreme Prosecutors' Office, Cyber Investigation Division — 1301 (spo.go.kr)
• National Police Agency, Cyber Bureau — 182 (ecrm.police.go.kr)

15. Changes to this policy

If we change this policy we will give notice on this page and in the Service at least 7 days before the effective date, and at least 30 days before for changes that materially affect user rights. If we change the purpose or scope of processing of Google user data, we will give notice and obtain any required consent before applying the change.