Privacy Policy

Echo Vision Lab (“Operator”) describes the personal information processed through DSUB.IO and related APIs in this Policy.

1. Information Processed

The following information is processed according to the features used.

Personal information included by users in Content or files is also processed. Unnecessary sensitive information or resident registration numbers should not be entered.

2. Collection Methods

Information is collected directly from users, from their chosen login providers, and from records generated during use of the Service.

• Registration and account or profile settings

• Content and file uploads, comments and form responses

• Newsletter subscriptions, consent choices and requests to exercise rights

• Google or GitHub login and account linking selected by the user

• Records generated by browsers, networks, sessions, security and file processing

3. Purposes

Information is used to the extent needed for the following purposes.

• Registration, member verification, profile display and account inquiries

• API token management and authentication, rate limiting and abuse prevention

• Login, identity verification, account recovery and protection

• Permission checks, collaboration, visibility and shared-link access management

• Content storage, publication, search, playback and downloads, and administrator translation or editing

• File uploads, conversion, retries and error handling

• Handling applications or inquiries submitted through forms, preventing duplicate submissions, and sending requested newsletters and Service emails

• Remembering cookie choices, maintaining consent records, and analyzing visits and use where consent is given

• Responding to outages, security incidents and abuse; handling rights requests; identifying former members, cross-checking incident records and cooperating with lawful investigative requests

4. Legal Bases and Information Choices

Processing follows the grounds and necessary scope established by the Personal Information Protection Act and other applicable laws for each purpose.

• Processing needed to enter into or perform a contract for accounts, Content and other Service features

• Separate consent for optional analytics and advertising notices

• Retention and disclosure obligations established by law

• Processing based on the Operator's legitimate interests only where those interests clearly prevail over the user's rights, are substantially related to the processing and do not exceed reasonable bounds

• Failure to provide information needed for account identification and authentication may restrict member features. Optional profile fields, newsletters and analytics depend on user choice. Each form identifies its required fields and purpose.

Analytics consent does not affect ordinary use of the website.

5. Cookies and Analytics

Cookies needed for login, security, sessions and remembering cookie choices are used.

The browser's cookie-choice value is retained for up to one year.

Google Analytics is used only after consent to analytics cookies. Withdrawing consent in cookie settings stops subsequent analytics and clears the relevant analytics cookies.

6. Retention and Deletion

Personal information is deleted when its purpose is fulfilled or its retention period ends. Records subject to statutory retention must be managed for the applicable period and restricted purpose.

Access records for personal information processing systems must be retained and managed for at least one year, or at least two years where statutory conditions apply, such as processing legally defined unique identification information or sensitive information, or processing personal information on 50,000 or more people (Article 8 of the Standards for Measures to Ensure the Safety of Personal Information). When records arise from product sales or similar activities, display and advertising records are retained for six months, contracts and withdrawal and payment and supply records for five years, and consumer complaints and disputes for three years (Article 6 of the Enforcement Decree of the Act on Consumer Protection in Electronic Commerce). Tax books and supporting documents are retained for five years from the day after the statutory tax filing deadline, or seven years for offshore transactions, subject to statutory exceptions (Article 85-3 of the Framework Act on National Taxes). Commercial books and important business documents subject to the Commercial Act are retained for ten years, and vouchers and similar documents for five years; the period for commercial books starts when they are closed (Article 33 of the Commercial Act). Buyer information needed as transaction evidence is retained with the relevant record. Where several obligations apply, each must be satisfied. Electronic records, files and paper documents are destroyed by methods that prevent recovery.

7. External Processing and Disclosure

Personal information is not sold. External services are used to the extent needed to provide features.

Before providing material to an investigative agency, the Operator checks the agency's authority, legal basis and scope and provides only necessary material.

OpenDiscogs uses Discogs' public data dumps. Requests to correct or delete personal information in names, credits, biographies or links, or to identify its source, can be sent to privacy@dsub.io.

• Cloudflare: web and API request handling and security. For OpenDiscogs, authentication tokens, member identifiers, IP addresses and request information are used for authentication, rate limiting and abuse prevention. Authentication tokens are not forwarded to the origin catalog server.

• Google and GitHub: social login and account linking chosen by the user.

• AWS SES: email delivery, processing recipient addresses, message bodies, delivery and bounce information. The Seoul region is used.

• Google Analytics: analysis of visits and use by users who consent to analytics.

• Google Gemini API: processing documents, instructions and results selected for administrator translation or editing. The paid service is used, and inputs and responses are not used to improve products. Related material may be retained for 55 days under Google's abuse-prevention rules.

External maps, embeds and administrative clients may receive requests, Content and authorized responses needed for the respective feature or connection. Retention by other administrative clients follows their providers' policies and contracts.

Before introducing product sales, the Operator will disclose information collected and external processors needed for ordering, payment, delivery, cancellation and refunds.

8. Processing Abroad

The Operator's own servers and backups are in the Republic of Korea. Requests, authentication and analytics information, or Content selected by administrators, may be processed abroad when external services are used.

Users may choose or withdraw social account connections and analytics consent. Translation, AI editing and MCP are used by administrators with the required permissions and are separate from general member features.

9. User Rights

Users may exercise the following rights under applicable law.

• Access to personal information

• Correction of inaccurate information

• Deletion of personal information

• Suspension of processing

• Withdrawal of consent

• Withdrawal of analytics cookie consent and changes to cookie choices

Users can manage their profile, authentication connections, sessions, API token and subscriptions in account settings, or contact privacy@dsub.io.

If a request is restricted by law, the reasons and appeal method will be explained. Users will be informed how to request action from providers holding their information.

Identity or representative authority may be verified when handling a request. Responses are provided within the period required by law.

10. Safeguards and Access

Authentication and permission checks, access restrictions and transport protection are applied, and security and administrative activity records are kept.

• Access restrictions based on account roles

• Checks of Content and file visibility and download permissions

• Authentication and login session management

• Protection and expiration management of authentication information

• Transport security

• Records of administrative actions, including personal information access

• Security event review and response

Public profiles, Content and credits are visible to other users and may be saved externally. Private material, form responses and files are provided according to access permissions. Users should check Content and access settings before publishing or sharing, and obtain the required authorization to upload another person's personal information.

11. Children's Information

Where consent is required to process the personal information of a child under 14, consent and verification of the legal representative are required.

Inquiries about children's information and a legal representative's exercise of rights may be sent to privacy@dsub.io.

12. Changes to This Policy

This Policy may be amended to reflect changes in features, processing purposes, retention periods, external services or law.

Changes and their effective date will be disclosed on the Privacy Policy page. Material changes will be announced using legally required methods.

13. Operator and Contact

• Personal information controller: Echo Vision Lab (에코비전랩)

• Representative: Seungyhun Bae (배승현)

• Service: DSUB.IO · https://www.dsub.io

• Business form: sole proprietorship in the Republic of Korea

• Privacy officer: Seungyhun Bae (배승현), representative of Echo Vision Lab

• Privacy inquiries: privacy@dsub.io

• Terms and rights inquiries: legal@dsub.io

• Phone: +82 10-6380-9646

• Address: Room 505-S80, 5F, 30, Nonhyeon-ro 10-gil, Gangnam-gu, Seoul, Republic of Korea

Business registration number: 111-42-04359 · Last updated: 2026-10-10