OPUS Privacy Policy
This policy describes how OPUS (the "Service") collects, uses, stores, and disposes of your personal information. The Service is designed according to the principles of Security by Design and Privacy by Design, and is intended to comply with Japan's Act on the Protection of Personal Information (APPI), Korea's Personal Information Protection Act (PIPA), and — where applicable — the EU / UK General Data Protection Regulation (GDPR).
1. Operator and Contact
- Operating entity: E-Gimation Inc. (주식회사 이지메이션), representative Jung Hun
- Address: 4F–6F, 8F, Seoul Fintech Lab — HP Building, 83 Uisadang-daero, Yeongdeungpo-gu, Seoul 07325, Republic of Korea
- Business registration no. (Korea): 649-81-00202
- Data Protection Officer / Personal Information Protection Manager: Representative director — admin@opus-store.com
- Contact: admin@opus-store.com (We do not publish a phone line; please contact us by email.)
2. Personal Information We Collect
Depending on the stage of service usage, we may collect the following items.
- Account & authentication: email address, password (stored only in a hashed, non-reversible form), display name, role (artist, collector, etc.)
- Service usage: metadata for non-reproducible digital artworks, editions, provenance, and ownership history (The Chronicle and linked records)
- Technical information: IP address, cookies and local storage, device and browser information, access and usage logs
- Analytics (where applicable): de-identified and aggregated usage statistics (e.g., page views, event counts). Analytics are designed to not directly identify individuals.
3. Purposes of Use
- Member identification, login and session management, prevention of abuse
- Delivering the ownership, provenance, and viewing experience of authenticated digital editions, and maintaining the integrity and auditability of The Chronicle
- Customer support, announcements, notice of terms and policy changes
- Service quality improvement (statistics, security monitoring, logs with minimal PII exposure)
The Service may employ NFT and distributed-ledger technology as a technical means, but does not process personal information for the purposes of investment, yield, or financial products.
4. The Vault and Cryptographic / Security Controls
OPUS applies encryption and access controls to sensitive data at rest and in transit.
- The Vault: a logical private storage and processing zone within operating infrastructure. Personal information, submitted assets, and audit logs are stored — strictly on a need-to-know, least-privilege basis — only in this zone or an environment with equivalent control level.
- Encryption: transport is protected by industry-standard TLS. Data at rest is protected with encrypted storage and encrypted backups (specific algorithms and key management follow internal security and infrastructure documents).
- Access control: least-privilege RBAC, separation of operation and development, and audit logs with masking of identifiers by default.
- Integrity: zones requiring immutable, append-only records (e.g., The Chronicle) support integrity verification via hash chaining and similar mechanisms. Even in such zones, direct identifiers are separated and minimized whenever feasible.
5. Third-Party Disclosure and Processing Consignment
- As a general rule, we do not provide personal information to third parties without your consent (APPI Art. 27, PIPA Art. 17).
- Where processing is consigned to a contractor (hosting, payment processing, analytics tools, etc.), we require contractual prohibition of use beyond the purpose and technical and organizational safeguards, and disclose contractors and processing scope in this policy or a linked annex (APPI Art. 25, PIPA Art. 26).
5.1 Consigned Payment Processing — Merchant Onboarding in Progress
OPUS plans to consign credit-card and other Japanese domestic payment processing to a Japan-based payment processor (PSP). KG Inicis Japan is currently the leading candidate and merchant onboarding is in progress. Until onboarding is finalized, the recipient name, country, processing scope, and related fields in this section are provisional; at the time of onboarding completion, this table will be finalized, this policy will be updated, and users will be notified separately. Regardless of which payment processor is ultimately selected, card numbers and related payment credentials will never traverse OPUS servers; they will be collected and held directly by the selected payment processor within a PCI DSS-compliant environment.
| Item | Detail (provisional — to be finalized upon onboarding) |
|---|---|
| Name of recipient | To be finalized at onboarding completion (current candidate: KG Inicis Japan) |
| Country of recipient | Japan (based on the current candidate; updated if a different PSP is selected) |
| Consigned processing | Payment session creation, collection and tokenization of payment credentials, payment-result notifications (webhooks), and refund processing |
| Personal information provided | OPUS order ID, payment amount (JPY), currency, and result code. Card number, expiry, and security code are not collected or retained by OPUS — the selected payment processor holds them directly. |
| Recipient retention / use period | Per the selected payment processor's policy and PCI DSS / other applicable legal and industry requirements. |
| Safeguards | Selection of a PCI DSS-certified processor, TLS transport encryption, and tokenization so the merchant (OPUS) does not retain card data. The consignment contract additionally requires prohibition of use beyond the purpose and technical/organizational safeguards. |
| Withdrawal of consent | You may avoid this consignment by not proceeding to checkout. For completed transactions, refunds are handled under the separate refund procedure. |
| Effective date | This table will be finalized once merchant onboarding is complete and updated live alongside the service launch. |
If additional payment processors or related consignees are introduced in the future, this section will be updated before such processing begins, using the same disclosure format.
6. Cross-Border Transfer to Third Parties
When you choose Google or LINE Sign-In / sign-up, your personal information is transferred to a third party for authentication purposes. Google is based in the United States; LY Corporation (which operates LINE Login) is based in Japan. Consent to these transfers is included in the "I agree to the Terms of Service and Privacy Policy" checkbox on the sign-up / login screen, and the specific contents are disclosed in this section in advance. This section is designed to cover the information required by APPI Art. 28 (provision to third parties in a foreign country), PIPA Art. 28-8(2) (prior notice of outbound transfer), and, where applicable, GDPR Chapter V (transfers to third countries). For users physically located in Japan, the transfer to LY Corporation (§6.2) is a domestic transfer and does not fall under APPI Art. 28; the same record is provided here for cross-locale consistency.
6.1 Google LLC (United States) — Account Authentication
| Disclosure Item | Content |
|---|---|
| Recipient | Google LLC |
| Recipient country | United States of America |
| Timing & method of transfer | At the moment you elect Google Sign-In or sign-up, via HTTPS-based OAuth 2.0 / OpenID Connect standard flow |
| Categories transferred | Email address, Google display name, profile image URL, Google account unique identifier (OIDC sub) |
| Recipient's purpose of use | User identification, issuance of authentication tokens, maintenance of service login state |
| Recipient's retention period | On Google's side, governed by Google's Privacy Policy. On OPUS's side, retained until your account deletion or consent withdrawal |
| Safeguards | TLS transport encryption, minimized OAuth scopes (profile and email only), access control (RBAC) and audit logging within OPUS internal storage |
| PI protection framework in recipient country | The United States has no single comprehensive federal privacy law; enforcement is sectoral and through the FTC Act §5 (prohibition on unfair or deceptive practices). Google LLC implements protections through its Privacy Policy, applicable Standard Contractual Clauses (SCCs), and aligns processor-side controls with the EU General Data Protection Regulation. |
| Measures taken by recipient | Internal controls aligned with the OECD Privacy Principles, industry-standard encryption, and GDPR-aligned processor agreements |
| Method of withdrawing consent | You may refuse this transfer by not selecting Google Sign-In. After a transfer has occurred, you may withdraw consent via OPUS account deletion request. |
6.2 LY Corporation (Japan) — LINE Login
Note (APPI Art. 28 scope): LY Corporation is incorporated in Japan. For users physically located in Japan, this is a domestic third-party provision and does not fall under APPI Art. 28 (provision to a third party in a foreign country). For users outside Japan, the transfer is a cross-border transfer subject to PIPA Art. 28-8 / GDPR Chapter V / equivalent rules of your jurisdiction. This row is provided here for cross-locale disclosure consistency.
| Disclosure Item | Content |
|---|---|
| Recipient | LY Corporation (Japanese entity formed on 2023-10-01 through the integration of LINE Corporation, Yahoo Japan Corporation and related group entities) |
| Recipient country | Japan (headquartered in Tokyo) |
| Timing & method of transfer | At the moment you elect LINE Login, via HTTPS-based OAuth 2.0 / OpenID Connect (LINE Login v2.1) standard flow |
| Categories transferred | LINE-issued OIDC sub (user-unique identifier), email address (where the user explicitly consents), LINE display name, profile image URL |
| Recipient's purpose of use | User identification, issuance of authentication tokens, maintenance of service login state |
| Recipient's retention period | On LY Corporation's side, governed by the LY Corporation Group Privacy Policy. On OPUS's side, retained until your account deletion or consent withdrawal |
| Safeguards | TLS transport encryption, verification of the LY-signed ID Token (JWT) signature and expiry, minimized OAuth scopes (profile openid email only), access control (RBAC) and audit logging within OPUS internal storage |
| PI protection framework in recipient country | Japan is governed by the Act on the Protection of Personal Information (APPI) and supervised by the Personal Information Protection Commission (PPC). While Korea's PIPC has not separately designated Japan as an adequacy-recognized country under PIPA Art. 28-8(1), APPI is generally considered to provide a level of protection comparable to PIPA. This transfer therefore relies on prior-notice consent under PIPA Art. 28-8(2). |
| Measures taken by recipient | LY Corporation implements safety control measures, sub-processor management, and data-subject rights handling (disclosure / correction / deletion etc.) under APPI and its group-wide data protection policies. |
| Method of withdrawing consent | You may refuse this transfer by not selecting LINE Login. Alternative options include Google Sign-In or email-based sign-in. After a transfer has occurred, you may withdraw consent via OPUS account deletion request. |
6.3 Other Cross-Border Transfers
Any cross-border transfer outside §6.1 ~ §6.2 (e.g., addition of another OAuth provider, overseas analytics or hosting contractors) will be disclosed in this Section 6 — recipient, country, items, period, right to refuse, and safeguards — before that processing begins. Changes are announced via in-service notice and/or email.
6.4 Notes for EEA / UK Residents
Where GDPR applies, transfers outside the EEA / UK rely on (i) the European Commission's adequacy decisions where available, (ii) Standard Contractual Clauses (SCCs) of the applicable Commission or UK variant, and (iii) supplementary safeguards as needed. You may request a copy of the safeguards in use for your data.
7. Your Rights
You may request the following with respect to your personal data.
- Access (APPI Art. 33, PIPA Art. 35, GDPR Art. 15)
- Correction / addition / deletion for inaccurate data (APPI Art. 34, PIPA Art. 36, GDPR Art. 16)
- Cessation of use / erasure (APPI Art. 35, PIPA Art. 37, GDPR Art. 17 "right to be forgotten")
- Suspension of third-party provision (APPI Art. 35, PIPA Art. 37)
- Data portability, where applicable (GDPR Art. 20)
- Withdrawal of consent at any time, through the service settings or the contact window
Requests are processed within a reasonable period after verifying your identity, subject to statutory exceptions and the integrity requirements of The Chronicle (see Section 8).
8. Retention and Disposal
- Upon account closure or expiry of the retention period, related personal information is disposed of without delay. Where a statute requires longer retention, we keep the data separately until the statutory period ends and then dispose of it.
- Records kept for audit and integrity purposes — such as The Chronicle — may be retained indefinitely in blockchain, hash, or immutable log form. Even in such cases, direct identifiers are separated and de-identified to the extent technically feasible.
9. Cookies and Similar Technologies
The Service uses cookies and similar technologies for session, preferences, and security purposes. Analytics cookies, where consent is required, are gated behind a separate consent UI.
10. Children's Personal Information
The Service does not knowingly collect personal information from persons under 16 years of age (or the age of a child under the applicable jurisdiction). If we become aware of such collection, we will delete the information without delay.
11. Breach Notification
If a personal-data breach occurs and meets the reporting thresholds of APPI (Art. 26, Enforcement Regulations Art. 7), PIPA, or GDPR (Art. 33 & 34), we will promptly notify the supervisory authority (PPC, PIPC, EU DPA) and affected individuals as required.
12. Changes to This Policy
We may amend this policy when laws or services change. Material changes are announced via in-service notice or email, with adequate lead time where legally required.
Document version: v1.0.0 | Effective: 2026-05-23 | Last updated: 2026-05-23 | Next review: statutory & jurisdictional alignment