Privacy Policy

1. Membership registration & account management: identity verification, social login linking, age verification, session management, prevention of fraudulent use
2. Service provision: sheet music search, preview, purchase, viewing, download, audio playback, library, group, custom order, and customer support
3. Contract and payment: orders, payments, credits, membership, refunds, receipts, and authority management
4. AI functions: processing of inputs and attached files according to user consent, result generation, safety checks, usage limits and record management
5. Service improvement and analysis: usage statistics, service usage flow, error and performance analysis based on user consent
6. Legal obligations and safety: compliance with laws, security incident response, dispute handling, rights infringement and fraud prevention
7. Marketing: provision of event and advertising information only when separate consent is obtained

The Company shall destroy personal information without delay once the processing purpose has been achieved. However, the following information may be retained separately for periods required by law, dispute response, or fraud prevention.

Currently, member withdrawal immediately terminates service access and active sessions. Transaction, consent, and audit records may remain limitedly according to applicable laws and dispute response purposes, and physical deletion/anonymization of account and profile data follows a separate data lifecycle policy. Users can request view, export, or deletion via the ‘Personal Information & Data’ menu of their account.

The Company does not provide users’ personal information to third parties in principle. It is provided only within the necessary scope when the data subject gives separate consent or when a special legal basis exists. Processing by external vendors related to payment, hosting, authentication, email, analytics, and AI functions may constitute personal information processing entrustment, third‑party provision, or overseas transfer depending on the actual contract and processing purpose; specific details are provided in the following articles and related items.

The Company may transfer and store the following personal information abroad during service use. When the user utilizes the relevant function or when processing is required for contract performance, the transfer occurs continuously via TLS‑encrypted networks. The legal basis for each transfer is applied according to consent, contract formation/performance, or processing entrustment as stipulated in the Personal Information Protection Act Article 28‑8 and related statutes.

Users may refuse overseas transfer by not using optional AI functions, optional analytics, or overseas payments, or by withdrawing related consent. Refusing processing necessary for login authentication, hosting, database, or essential email sending may make related functions or services difficult to provide. Inquiries and member withdrawal requests are received via the ‘Personal Information & Data’ menu of the account or at support@sheetmusic.kr.

1. AI functions process text, image, file inputs entered directly by the user and generated results for the purposes of function provision, safety checks, error response, and usage limit management.
2. Users must not input sensitive information, resident registration numbers, or other uniquely identifying information under the Korean Personal Information Protection Act, nor any other person’s private personal information without lawful authority, into AI functions.
3. The service does not use users’ AI inputs or outputs as training data for its own general models. The Company uses external AI providers’ APIs or enterprise settings, and where supported, configures them so that inputs and outputs are not used for the provider’s general model training. Retention periods and safety review methods vary by provider, model, and contract terms.
4. Consent for AI processing can be withdrawn at any time in the ‘Personal Information & Data’ section of the account. Withdrawal does not affect the legality of prior processing, but AI functions will be limited thereafter.
5. Improper AI results or personal information related objections can be reported to support@sheetmusic.kr.

1. The service uses cookies and browser local·session storage to maintain login, security, language settings, shopping cart, and function states.
2. Google Analytics 4 may process randomly generated analysis identifiers, internal identifiers for analysis of logged-in users, page paths, service usage events, language settings, device·browser information, and access timestamps when the user has given consent.
3. Cloudflare Web Analytics and service performance analysis functions may process page request, device·browser, and network‑related information; actual identification methods and retention scopes follow the applied product settings.
4. Analysis consent can be refused or withdrawn via the banner or the ‘Personal Information & Data’ section of the account. Refusal does not prevent use of core services.
5. Cookies can be blocked in browser settings, but blocking essential cookies may cause login, payment, and other functions to malfunction.

1. Data subjects may request access, correction·deletion, suspension of processing, and withdrawal of consent to the extent permitted by applicable law. They may also obtain a copy of their personal data via the Company’s data export function.
2. Requests can be made through the ‘Personal Information & Data’ menu, email, or phone; the Company will verify the identity of the requester or legitimate representative and process the request in accordance with applicable law.
3. If legal preservation obligations exist or there is a risk of infringing another’s rights, some requests may be limited, and the reasons will be communicated.
4. The service does not allow membership registration for children under 14 years of age. If the Company becomes aware that a child under 14 has registered, it will verify age, restrict account use, and delete personal information as necessary. However, information that must be retained by law may be kept separately for the required period.

1. Information whose retention period has expired or whose processing purpose has been achieved shall be destroyed without delay.
2. Information required to be retained by law shall be stored with restricted access so that it is not used for other purposes, and destroyed after the retention period ends.
3. Electronic files containing personal information shall be deleted or anonymized using secure methods that make recovery or reconstruction difficult.

1. Administrative measures: limit personnel who can access personal information to the necessary scope and manage related work procedures and protection standards.
2. Technical measures: access rights management, authentication and access control, TLS encryption for transmission, separation and secure storage of critical information, and vulnerability checks.
3. Physical measures: apply physical security and access control of the cloud and data center providers used by the Company.
4. Incident response measures: security incident detection, log inspection, backup·recovery, and operation of incident assessment·response procedures.

1. Personal Information Infringement Reporting Center: 118, privacy.kisa.or.kr
2. Personal Information Dispute Mediation Committee: 1833-6972, www.kopico.go.kr
3. Supreme Prosecutors’ Office: 1301, www.spo.go.kr
4. National Police Agency: 182, ecrm.police.go.kr

When the processing policy is changed, the effective date and major changes will be disclosed in the service and policy change history. Changes that significantly affect the rights or obligations of data subjects will be separately notified in advance in accordance with the period prescribed by law or a reasonable period.