Advance notice: Version 3 applies until 13 October 2026 at 00:00 (Europe/Amsterdam). Version 4 below applies from that time. It takes out the text about direct PayPal payment in the Shop (paying through the studio’s own PayPal payment link on the Shop page), together with the download link by email and the order-withdrawal form that came with it. Direct PayPal payment was never offered to buyers. How we handle sales through Gumroad, including paying with PayPal at Gumroad’s checkout, does not change (see section 15). Earlier versions: version 2, version 1

This policy explains how STstudio, run by Yirang Ok (“the studio”, “we”), handles personal data through the website www.ststudio.co.kr, its contact form, the address and sales of the digital templates listed on its Shop page (/shop/, “the Shop”). It is written to meet Articles 13 and 14 of the EU General Data Protection Regulation (GDPR) and Article 30 of the Korean Personal Information Protection Act (PIPA). We process only the data we need, we do not advertise, and we do not sell personal data. This policy is published in Korean and English; if they differ, the Korean text prevails for the Korean PIPA and the English text for the GDPR.

1. Who is responsible

• Controller: Yirang Ok (옥이랑), trading as STstudio (생태제작소) — a sole proprietorship (eenmanszaak) in the Netherlands and an individual business (개인사업자) in Korea
• Netherlands: · KvK 98086030 · VAT ID NL005307209B29
• Korea: · business registration no. 398-55-00964
• Email:

We work from the Netherlands and Korea and follow both the GDPR and the Korean PIPA. We have not appointed a data protection officer, because the GDPR (Article 37) does not require one for a studio of this kind; the privacy contact in section 12 handles all privacy questions.

2. What we process, why, and on what legal basis

We use personal data only for the purposes below. If a purpose changes, we will first take the steps the law requires.

a. Processing that does not rely on consent

These visit records are separate from Google Analytics. They use no cookies and store nothing on your device, so the cookie banner does not cover them — Dutch Telecommunicatiewet Art. 11.7a applies to storing or reading data on your device. You can object to this processing at any time (section 11), and turning JavaScript off in your browser stops the record being made.

The pseudonymous identifier uses a different secret key from the today’s-visitor hashes and changes each month. It can be checked against an IP address using the secret key, so it is not anonymous and remains protected as personal data. When the weekly summary is built, we ask an external lookup service (ipwho.is) which country a visit came from. We send only the network block of the IP address — the /24 for IPv4 (last group replaced with 0), the /48 for IPv6 — never the full address. Visit records retain only this shortened block. Blocks and country results already looked up are cached separately on our server so we do not ask again.

Where we rely on legitimate interest, we do so only where that interest clearly outweighs your rights, is substantially connected to the processing, and stays within a reasonable scope. You can object to it at any time (section 11).

b. Processing based on your consent

Google Analytics is loaded only after you tick both “collection and use” and “transfer abroad” in the cookie notice and press “Allow”; until then nothing is sent to Google. Before you choose, the notice shows the data, the recipient and countries, how it is sent, and how long it is kept. Declining does not limit your use of the site in any way. We have switched off Google signals (cross-device tracking) and ad personalisation.

3. How long we keep it

4. How we delete it

When data reaches the end of its retention period or is no longer needed, it is deleted without delay. Email and documents we hold ourselves are identified and deleted by the owner: electronic files are deleted so they cannot be recovered, including emptying the trash, and printouts are shredded. Server logs, today’s-visitor records, email delivery records and the form provider’s copy are deleted automatically by those systems at the end of the periods in section 3. Records the law requires us to keep are stored separately from other personal data.

5. Sharing with third parties

We do not give personal data to third parties, except where the law requires or specifically permits it (Korean PIPA Articles 17 and 18; GDPR Article 6(1)(c)). When a contract is signed, tax law requires us to report transactions to the tax authorities (Korea’s National Tax Service, the Dutch Belastingdienst), including the client’s trade name, representative’s name, business registration or VAT number and the amount.

6. Service providers (processors)

Web3Forms, Cloudflare, fortrabbit, Google Analytics and Gumroad are bound by data processing terms, which limit use to our instructions, require appropriate security, restrict further sub-processing and set out liability. Gmail is used under Google’s standard terms. If a provider changes, we update this policy.

7. Transfers outside the EU and Korea

Because we work from both the Netherlands and Korea and use the providers above, personal data is transferred across borders as follows. Every transfer is an encrypted transmission over the internet (HTTPS/TLS).

How to refuse, and what happens.

• Google Analytics: leave the consents unticked or press “Decline” and nothing is transferred, with no disadvantage.
• Contact form: “Something else” enquiries can be sent only after ticking the form’s consent to the transfer abroad. If you do not want to, or prefer not to use the form, email directly — nothing then goes to Web3Forms (India etc.). Email passes through Cloudflare and Google (USA); if you do not want that either, write to our Netherlands address by post.
• Website hosting (fortrabbit, Ireland): needed to deliver the pages, so it cannot be refused separately; if you prefer, contact us by post instead of using the website. Today’s-visitor records are not created if JavaScript is switched off in your browser.
• Shop orders: if you do not want your data to go to Gumroad (USA), do not buy through Gumroad; you then cannot buy the Shop’s templates. The notifications we receive about an order (Gumroad’s sale notification and, if you pay with PayPal at Gumroad’s checkout, PayPal’s payment notification) are stored with Google (USA), and email that reaches about an order passes through Cloudflare (USA) and is stored with Google. If you do not want that, do not buy from the Shop; without this transfer we cannot process an order. To ask us something before paying without going through Cloudflare or Google, write to our Netherlands address by post.

For transfers outside the EU we rely on the European Commission’s EU–U.S. Data Privacy Framework adequacy decision (Cloudflare, Google, and Amazon Web Services as fortrabbit’s subcontractor) and on Standard Contractual Clauses (Web3Forms, Gumroad). fortrabbit stores the website’s data in the EU region we chose (Ireland); where its subcontractor Amazon Web Services (a US company) takes part in processing, the same adequacy decision applies. You can ask us for a copy of the safeguards at .

8. Cookies and similar storage

A cookie is a small file a website stores in your browser; local storage (localStorage) is a similar way to keep a setting in your browser. This site uses:

Local-storage values stay on your device and are never sent to our server. The today’s-visitor dots, the visit records and the server logs use no cookies.

Refusing or withdrawing. Leave the consents unticked or press “Decline” in the notice on your first visit, and withdraw at any time with “Cookie settings” at the bottom of every page. Withdrawing deletes the _ga cookies and shows your Analytics identifier in the cookie settings; send it to and we delete the statistics already collected with Google Analytics’ user-deletion tool within 10 days of your request. Withdrawal does not affect the lawfulness of processing before it.

Open cookie settings

You can also delete or block cookies and site data in your browser settings (menu names vary by version): Chrome — Settings › Privacy and security; Edge — Settings › Cookies and site permissions; Safari on Mac — Settings › Privacy › Manage Website Data; Safari on iPhone — Settings › Apps › Safari › Clear History and Website Data; Firefox — Settings › Privacy & Security › Cookies and Site Data; Samsung Internet — Settings › Privacy and security › Delete browsing data. The site keeps working if you block cookies.

9. Information external services receive directly

We do not pass personal data to the services in the table below. When a page opens, your browser fetches a typeface or video from them and in doing so sends them some information directly; each company handles it under its own privacy policy (adobe.com/privacy/policies/adobe-fonts.html, vimeo.com/privacy). We do not receive that information and do not use it to identify you or for advertising. Under the GDPR we are jointly responsible with each company for collecting and transmitting it when the page loads (our legitimate interest in showing the work with its intended typefaces and videos, Art. 6(1)(f)), and you can exercise your rights about it with us or with them; for anything they do afterwards, they alone are responsible.

If you prefer, you can block these services with a browser extension; some typefaces or videos may then not appear. Adobe and Vimeo are certified under the EU–U.S. Data Privacy Framework.

Shop payments are made on Gumroad’s checkout, where you enter your payment details yourself (with PayPal, if you choose it there). The Shop page only links to Gumroad — it loads none of its scripts — and we send Gumroad no personal data about you during checkout. If you buy on Gumroad, Gumroad, Inc. (USA) is the seller (merchant of record) and handles payment, fraud checks and tax independently under its own privacy policy (gumroad.com/privacy). If you choose PayPal as the payment method inside Gumroad’s checkout, that is still a Gumroad order: Gumroad delivers the file and refunds are handled through Gumroad. In that case, however, the payment is made to our own PayPal account, so PayPal shows us your name, PayPal email address, the amount and the transaction ID and emails us a payment notification, and we handle any PayPal dispute about that payment in our PayPal account. PayPal then handles the payment as an independent controller under its own privacy statement (paypal.com/legalhub/paypal/privacy-full), and which PayPal company that is depends on your country of residence (for example PayPal (Europe) S.à r.l. et Cie, S.C.A. in Luxembourg for EU/EEA residents, PayPal Pte. Ltd. in Singapore for residents of Korea). What we receive after payment is listed in section 2.

10. Security

• Organisational: only the owner has access to personal data, and data past its retention period is deleted.
• Technical: the website and the contact form are served over HTTPS. The today’s-visitor feature stores only a keyed hash of the IP address, alongside visit records in a folder that cannot be reached from the web. The two record sets are not linked. From the effective date, new visit records replace full IP addresses with monthly pseudonymous identifiers made using a separate key. If that key cannot be obtained, the visit record is skipped rather than storing the full IP address. To reduce transfers, the Jost and Space Mono typefaces and the three.js script are served from our own server, and the statistics tool is not loaded before consent.

11. Your rights

You can ask us at any time to:

• give you access to your personal data, correct it, delete it, or restrict its processing;
• stop processing that relies on legitimate interest (objection);
• give you the data you provided to us — through the contact form, by email, for a project or for a Shop order — in a structured, commonly used, machine-readable format, or send it to another organisation where technically feasible;
• and you can withdraw consent at any time.

Email . We act on your request and tell you the result within 10 days of receiving it; if we need to confirm that you are the person concerned or their authorised representative, we ask for what we need within that time. Server logs, today’s-visitor records and our own visit records carry no names, so to find them we need the date of your visit and the IP address you used. Monthly pseudonymous identifiers can also be checked using the secret key. If the law limits a request, we tell you why and how to challenge the decision. Statistics consent can be withdrawn immediately under “Cookie settings”.

12. Privacy contact

Yirang Ok, owner, is responsible for personal data at the studio and handles questions, complaints and access requests: · post: .

13. Complaints

You can complain to the Dutch data protection authority, the Autoriteit Persoonsgegevens (Postbus 93374, 2509 AJ Den Haag, autoriteitpersoonsgegevens.nl), or to the authority in the EU/EEA country where you live or work. In Korea you can contact the Personal Information Dispute Mediation Committee (1833-6972, kopico.go.kr), the Privacy Infringement Report Center at KISA (118, privacy.kisa.or.kr), the Supreme Prosecutors’ Office (1301, spo.go.kr) or the National Police Agency’s cyber crime reporting system (182, ecrm.police.go.kr).

14. Other information

• Nobody is required to give us personal data. To answer an enquiry we need a name, an email address, the enquiry type and a message; without an email address we cannot reply. To buy from the Shop you have to give Gumroad a name and an email address; without an email address we cannot deliver the file.
• The website is not aimed at children under 14, and we do not knowingly collect their data.
• We do not process special categories of data or national identification numbers.
• Pseudonymising our own visit records is a safeguard to reduce exposure within the legitimate-interest processing in section 2. We do not invoke the special regime of PIPA Article 28-2 for a separate statistical or research purpose, and we make no automated decisions and build no profiles.

15. Changes to this policy

Version 4 is announced on 6 October 2026 and takes effect on 13 October 2026 at 00:00 (Europe/Amsterdam). Until then version 3, in effect since 5 October 2026, applies. We have decided not to offer direct PayPal payment in the Shop (paying through the studio’s own PayPal payment link on the Shop page), so this version takes the text about it — the buyer and transaction details of direct PayPal orders, the download link sent by email and the Shop’s order-withdrawal form — out of sections 2, 3, 6, 7, 9, 11 and 14. Direct PayPal payment and the order-withdrawal form were never offered to buyers. The description of PayPal in section 9 (independent controller, which PayPal company) now refers to paying with PayPal at Gumroad’s checkout. How we handle sales through Gumroad does not change, and choosing PayPal as the payment method at Gumroad’s checkout is still handled as a Gumroad order (section 9). Earlier versions: version 3, version 2, version 1. If it changes again, we will announce the change on this page before it takes effect and publish what changed together with the previous version.