Privacy policy and terms of service

Article 1. Purposes of processing

Netty Co., Ltd. ("CLIFF", "we") processes personal data only for the purposes below. If a purpose changes we obtain separate consent or take the measures the Personal Information Protection Act requires.

• Sign-up and account management: identifying you, sign-in, email verification, preventing duplicate or fraudulent accounts, handling deletion and its cancellation.
• Service delivery: playing stories, keeping your library, saved works, follows, likes, viewing progress and comments; operating creator channels and uploads.
• Service analytics (CLIFF itself, not Google): analysing performance per work and per marketing channel, attributing rentals to works, measuring retention and improving the service, using how you arrived at CLIFF and, for signed-in users, which works and episodes you watched.
• Purchases: recording coin and purchase history, refunds and creator settlement, and keeping the records tax and e-commerce law require.
• Safety and support: handling reports and blocks, answering support requests, investigating abuse and disputes, and keeping evidence.
• Notices: sending service notices such as terms changes and account security alerts. We do not send marketing email without separate consent.
• Website analytics: measuring traffic sources, search (SEO) performance and how pages are used on watchcliff.com and studio.watchcliff.com, with Google Analytics (Article 9).
• Advertising, once we enable Google Ads: measuring and optimizing conversions such as sign-ups, and, where the law permits or you have consented, personalized advertising of CLIFF (Article 9).

Article 2. Personal data we process

We process the following items. Items marked optional are only processed if you choose to provide them.

• Sign-up (required): email address, password (stored one-way hashed), display name. With Google sign-in: the Google account identifier, email and name Google provides.
• Profile (optional): profile image, channel name and description, works and media you upload as a creator.
• Generated while you use the service: sign-in records (IP address, browser or device information, time), viewing progress, saves, follows, likes, comments, reports and blocks, support messages, coin and purchase history.
• Service analytics (first-party, recorded by CLIFF): how a visitor arrived (UTM campaign parameters, CLIFF short links and the referring site host, not full URLs), and for signed-in users the viewing history (which works and episodes were watched and on which days).
• Collected automatically on our websites (Article 9): cookie identifiers, device and browser information (type, language, screen size), approximate location (country, region, city) that Google derives from your IP address, the referring page and campaign tags (UTM parameters and ad click IDs such as gclid), and the pages you view and how you interact with them. On work, episode, Shorts and watch pages only an opaque work reference is sent, never the title or episode.
• We do not collect your phone number, date of birth, gender, government ID, precise location, contacts or mobile advertising identifier (IDFA/AAID).

Article 3. Retention periods

We keep personal data while your account exists and destroy it when you delete your account, except for the records below, which we keep for the period the law requires after replacing your identity with a withdrawal marker. Website analytics data and cookies follow the periods in the last rows.

Article 4. Provision to third parties

We do not provide personal data to third parties. Exceptions are your separate consent, a legal obligation, or a lawful request from an investigating or judicial authority. Comments and channel content you publish are visible to other users by design.

What our websites send to Google LLC is described in Articles 5 and 9. Google Analytics processes it on our behalf. Once we enable Google Ads advertising features, Google may also use the data it receives through those features (cookie identifiers, ad click IDs and page activity, never your name, email address or account ID) for its own advertising purposes as an independent controller under Google's privacy policy, to the extent the law and your Cookie settings allow.

Article 5. Processors and overseas transfer

We entrust the following processors with parts of the service and supervise them under written agreements. Because our servers are outside Korea, the data below is stored or processed abroad. For the processors other than Google LLC, you can refuse the transfer by not using CLIFF or by deleting your account; the service cannot be provided without it.

Transfer method: encrypted network transmission at the time of each use. Transfer time: continuously while the service operates.

Google LLC (website analytics, and advertising measurement once we enable Google Ads): the items in the table are sent over the network to Google's servers in the USA and other countries where Google operates data centres whenever you open a page of watchcliff.com or studio.watchcliff.com, as your Cookie settings allow. Unlike the other processors, you can refuse this transfer and keep using CLIFF: use Cookie settings in the site footer, block cookies in your browser, or install the Google Analytics opt-out add-on (Article 9). If you refuse, your visits are not counted in our statistics and advertising results cannot be measured; nothing else changes.

Google sign-in is not a processor: if you choose it, Google (USA) provides your account identifier, email and name to us under Google's own privacy policy, and we send Google nothing beyond the sign-in request.

Article 6. Destruction and account deletion

You can request account deletion at any time from Settings › Advanced settings › Delete account on the web or in the app. The request immediately deactivates the account and signs out every device. Data is destroyed after a 5-day grace period. To cancel before then, sign in again and choose "Keep my account". Signing in alone does not cancel the deletion.

• Destroyed: account, email, profile, password, Google link, sessions, saves, follows, viewing progress, notification settings, and your identity on uploaded media.
• Kept without your identity, per Article 3: purchase, coin and settlement records, support and report records, access logs, and the email hash for 6 months.
• Comments stay with the author shown as "Deleted user"; you can delete them yourself before withdrawing.
• A channel's sole owner must make the channel private and stop sales before deleting the account.
• Electronic records are destroyed so they cannot be restored. Data kept under Article 3 is separated from live data.

Article 7. Your rights

You may at any time access, correct, delete or suspend processing of your personal data. Profile items can be changed in Account; other requests go to hi@netty.fun or Support and are answered within 10 days. A legal representative may act for you. We may refuse a request only where the law allows and will explain why.

Article 8. Security measures

• Passwords are stored one-way hashed; all traffic is encrypted in transit (TLS).
• Access to personal data is limited to the minimum staff, by role, with access records kept.
• Video, database and mail credentials are held only by the server components that need them.
• Sessions are revoked on deletion, and withdrawn emails are kept only as a hash.

Article 9. Cookies, automatically collected data and behavioural information

Our websites (watchcliff.com and studio.watchcliff.com) use cookies and similar technologies. Strictly necessary cookies keep you signed in (session_token), remember your language (cliff_locale) and your cookie choice (cliff_consent) and, on the development site, record the access code (cliff_development_access). They are always on; if you block them in your browser, signing in and saving your choices do not work. Every cookie and outside recipient is listed in the Cookie notice (watchcliff.com/legal/cookies).

Google Analytics 4 (Google LLC) runs on these websites to measure traffic, search performance and page use. It sets first-party cookies (_ga, _ga_*) and sends Google the items in the table below. We do not send Google your name, email address, account ID or any hashed contact data; Google signals are off, and Analytics data is not shared with Google for its other products. On work, episode, Shorts and watch pages we replace the address with an opaque work reference and a fixed page title, so the title, episode or playback of what you watch is never sent.

Google Ads conversion measurement and advertising: our cookie settings already include advertising choices, but as of the effective date of this policy no Google Ads tag is loaded. If we enable Google Ads, it will measure conversions (such as sign-ups) and optimize our advertising, and, where the law permits or you have consented, Google may use cookies to show you personalized CLIFF ads on other websites (remarketing). The same choices below apply, and we will update the Cookie notice when we enable it.

Default settings depend on the region your browser's time-zone setting indicates (we do not use your IP address for this). In the EEA, Switzerland and mainland China, no Google tag is loaded until you accept. In the UK, analytics is on with this notice and can be turned off with one click, and advertising cookies are used only if you accept. In Brazil, analytics is on based on legitimate interests and can be turned off, and advertising requires your acceptance. In all other regions, including Korea, the United States, Japan and Taiwan, analytics and (once enabled) advertising are on by default and you can turn them off at any time. If your browser sends a Global Privacy Control (GPC) signal, we treat it as an opt-out of sale, sharing and targeted advertising: advertising cookies and advertising data are turned off for that browser.

How to refuse: (1) Cookie settings or "Do Not Sell or Share My Personal Information" in the site footer; (2) block or delete cookies in your browser settings; (3) the Google Analytics opt-out browser add-on (https://tools.google.com/dlpage/gaoptout); (4) Google's ad settings (https://adssettings.google.com). Your choice is stored in the cliff_consent cookie for 12 months and applies to that browser and device. Refusing analytics or advertising does not limit your use of CLIFF; your visits are simply not counted, or ads are less relevant. The mobile apps currently send no data to analytics or advertising providers.

Article 10. Children

CLIFF is not directed at children. We do not knowingly accept sign-ups from anyone under 14 (under 13 in the US, under 15 in Japan). If we learn a child has registered, we delete the account.

We do not knowingly use children's data for personalized advertising.

Article 11. Privacy officer

Privacy officer: Saerochan Lee, CEO, Netty Co., Ltd. · hi@netty.fun · 070-8080-4323. Questions, complaints and rights requests about personal data go to the officer and are handled without delay.

Article 12. Remedies

In Korea you may also contact the Personal Information Dispute Mediation Committee (1833-6972, kopico.go.kr), the KISA Privacy Center (118, privacy.kisa.or.kr), the Supreme Prosecutors' Office (1301) or the National Police Agency (182, ecrm.cyber.go.kr). Outside Korea you may contact your local data protection authority.

Article 13. Notices for users outside Korea

The notices below and Articles 14 and 15 add to the rest of this policy for users in those places.

• Japan: under the Act on the Protection of Personal Information, your data is handled by the processors in Article 5 located in Singapore and the USA; each operates under its own privacy framework and our contract. Requests under the APPI go to hi@netty.fun. What our websites send to outside parties (Google LLC), the purposes and how to stop it are published on the page "外部送信について" (watchcliff.com/ja/legal/cookies). We do not link the cookie identifiers and browsing history sent to Google with your name, email address or account.
• Brazil (LGPD): we process data to perform our contract with you, to comply with legal obligations, for legitimate interests (security and website analytics, which you can refuse in Cookie settings) and with your consent (advertising cookies). You can exercise your rights under Article 18 of the LGPD at hi@netty.fun and complain to the ANPD. International transfers are described in Article 5.
• Taiwan: this policy provides the notice required by the Personal Data Protection Act (who collects, purposes, data categories, period, region, recipients and method of use, your rights, and the effect of not providing data). You can object to the use of your data for marketing at any time in Cookie settings or at hi@netty.fun.
• Mexico: this policy is our privacy notice (aviso de privacidad). Our websites use cookies and similar remote technologies described in Article 9, which you can turn off in Cookie settings. You can exercise your rights of access, rectification, cancellation and opposition (ARCO) at hi@netty.fun.
• Mainland China: Google tags load only after you give consent in the cookie banner, and you can withdraw it at any time in Cookie settings.
• The CLIFF app is not distributed in app stores of European Union member states or the United Kingdom. Our websites can be visited from there, and Article 14 applies to those visits.

Article 14. EEA, UK and Switzerland

If you use CLIFF from the European Economic Area, the United Kingdom or Switzerland, Netty Co., Ltd. (contact in Article 11) is the controller and the following also applies.

• Legal bases: performance of our contract with you (account, playback, purchases); legal obligations (the records in Article 3); legitimate interests (security, abuse prevention and support); and consent (analytics cookies in the EEA and Switzerland, and advertising cookies and personalized advertising in all three). In the UK, analytics cookies are used only for statistics to improve our websites, under the statistical-purposes exception in UK law and our legitimate interests; you can object with one click ("Reject analytics" or Cookie settings).
• You can withdraw consent at any time in Cookie settings; withdrawal does not affect processing before it.
• International transfers: Korea is covered by an EU adequacy decision and UK adequacy regulations. Google LLC is certified under the EU-U.S. Data Privacy Framework, its UK Extension and the Swiss-U.S. Data Privacy Framework. The other processors in Article 5 are bound by data processing terms with safeguards such as standard contractual clauses.
• Your rights: access, rectification, erasure, restriction, data portability, objection (including to processing based on legitimate interests and to direct marketing), and not to be subject to solely automated decisions with legal or similarly significant effects (we make no such decisions). Write to hi@netty.fun; we answer within one month.
• You may lodge a complaint with the supervisory authority where you live or work (in the UK, the Information Commissioner's Office; in Switzerland, the Federal Data Protection and Information Commissioner).

Article 15. United States

This article is our notice under the California Consumer Privacy Act as amended by the CPRA and other US state privacy laws.

• Categories collected in the last 12 months: identifiers (email address, account ID, cookie identifiers, IP address); commercial information (coin and purchase records); internet or other electronic network activity (pages viewed, interactions, referrer); approximate geolocation (derived by Google from the IP address on our websites); audio and visual information (media you upload as a creator); and profile information (display name, image). Sources: you, your device and Google sign-in. Purposes: Article 1. Retention: Article 3.
• Disclosures for business purposes: identifiers, commercial information and internet activity to the service providers and processors in Article 5.
• Sale and sharing: we do not sell personal information for money. As of the effective date, we do not sell or share personal information, and we have not done so in the past 12 months; Google Analytics is used under Google's data processing terms with Google signals and data sharing turned off. Once we enable Google Ads remarketing or personalized advertising, making cookie identifiers and internet activity available to Google for cross-context behavioral advertising may be "sharing" under the CCPA and "targeted advertising" under other state laws. You can opt out at any time with "Do Not Sell or Share My Personal Information" in the site footer, which opens Cookie settings.
• Global Privacy Control: we honor GPC as a valid request to opt out of sale, sharing and targeted advertising for the browser that sends it.
• We do not sell or share sensitive personal information or use it to infer characteristics, and we do not knowingly sell or share the personal information of consumers under 16.
• Your rights: to know and access, delete, correct, opt out of sale, sharing and targeted advertising, and not to be discriminated against for exercising them. Send requests to hi@netty.fun or Support; we verify them against your account email, and an authorized agent may submit them for you. We respond within 45 days. If we decline, you can appeal by writing to hi@netty.fun with the subject "Privacy appeal"; we answer appeals within 60 days, and if you are not satisfied you may contact your state Attorney General.
• Video viewing: pages that identify what you watch send Google only an opaque work reference and a fixed page title. We do not disclose to Google the titles of the videos you request or watch.

Article 16. Language versions

This policy is published in English, Korean, Japanese, Traditional Chinese, Simplified Chinese, Portuguese and Spanish. The English version is the original; all other language versions are translations. If any language version conflicts with the English version, the English version prevails.