Privacy notice
Last updated: 11 August 2026 · RedactCheck
Who I am
Yunseon Hong, a sole developer. RedactCheck is a personal project, not a registered company. I am the controller for the personal data described here. You can reach me at im@redactcheck.com, and I will give a postal address on request. Korean law wants a named person accountable for how personal data is handled; on a one-person project that is the same person, so it is me at the same address.
What this notice covers
RedactCheck is in development. Today this website does one thing: it collects an email address from people who want to be told when the free scan is live. There is no product to sign into, and no document processing is running yet. When that changes, this notice will be rewritten before the feature is switched on, and the sub-processor handling document text will be named here.
What I collect, and why
| Data | Why | Lawful basis | Kept for |
|---|---|---|---|
| Your email address | To send you one message when the free scan is live | Consent (UK GDPR Art. 6(1)(a)) | Until you withdraw, or 24 months after collection if the product has not launched — whichever comes first |
| Email correspondence, if you write to me | To answer you, and to keep notes on how practitioners handle redaction | Legitimate interests (Art. 6(1)(f)) — understanding a market before building for it | 24 months |
I do not collect names, job titles, IP-based profiles or anything else through this site, and I do not buy or enrich contact data.
Cookies and analytics
This site sets no cookies and runs no tracking scripts. There is no analytics on it either. Cloudflare, which serves the site, produces aggregate request counts from its own server logs as part of hosting; those show how many times a page was fetched, not who fetched it, and I add nothing to them.
Who else sees it
- Buttondown, LLC — holds the list. The signup form posts your address to Buttondown, and that is where it stays until the one email goes out or you unsubscribe. Processor.
- Google — hosts my email, so any message between us sits in that mailbox. Processor, under the Google Workspace terms and the Cloud Data Processing Addendum I accepted on 10 August 2026, with the European terms applied.
- Cloudflare, Inc. — serves this website, and its server logs are where the request counts above come from. Processor.
I do not sell personal data, and I do not share it for anyone else’s marketing.
Where it is processed
I am in South Korea, so that is where an address you give me is read and acted on. Both the UK and the EU have decided that South Korea offers an adequate level of protection, which means that leg needs no further safeguard: the European Commission's adequacy decision of 17 December 2021, and the Data Protection (Adequacy) (Republic of Korea) Regulations 2022 on the UK side.
Because I am in South Korea, two Korean laws land on top of the UK and EU rules, and they ask for different things. The first one treats handing your address to a mail provider as part of performing the subscription itself, so it wants that set out in a notice rather than behind a tick box. That is what the list below is, and the same five details sit next to the signup form so you can read them before you decide rather than after.
The second is the reason there is a tick box at all. Korean law counts an announcement from someone who intends to sell something as a marketing message, and a marketing message needs its own explicit consent before it is sent. That box covers one email: the one telling you the scan is live. If I ever want to write to you about anything else, I will ask you again first.
The processors sit elsewhere. Korean law asks me to set each one out in full rather than in summary, so here they are.
| Who | Where, and how it gets there | What is sent | Why, and for how long | Transfer rests on |
|---|---|---|---|---|
| Cloudflare, Inc. legal@cloudflare.com |
United States, and the edge locations it runs worldwide. Sent automatically the moment your browser asks for a page | IP address, time of the request, the page requested, browser and device details | To serve the site, answer DNS, and turn away hostile traffic. Held under Cloudflare's own log retention while the arrangement lasts | EU Standard Contractual Clauses and the UK Addendum, in its data processing addendum |
| Buttondown, LLC Richmond, Virginia |
United States, on Heroku and Amazon Web Services. Sent when you submit the signup form | Your email address, and the dates you subscribed and confirmed | To hold the list and send one email when the scan is live. Until you unsubscribe, or 24 months from signup if it has not launched | EU Standard Contractual Clauses (module two) and the UK Addendum. Sub-processors listed at buttondown.com/legal/subprocessors |
| United States and other countries it runs data centres in. Sent when either of us emails the other | Your email address, and whatever the message and its attachments contain | To send, receive and hold mail. 24 months from receipt | The Cloud Data Processing Addendum I accepted on 10 August 2026, with the European terms applied |
If you would rather none of this happened. Cloudflare cannot be refused separately, because it is how the page reaches you at all; not visiting the site is the only way to avoid it. Buttondown you avoid by not subscribing, or by unsubscribing afterwards, and you can still ask me by email to tell you when the scan is live. Google you avoid by not emailing me. Refusing costs you nothing beyond the thing refused.
Your rights
You can ask me for a copy of the data I hold about you, ask me to correct or delete it, object to how I use it, or withdraw consent. Given the scale of this — an address on a list — the fastest route is to email me and I will act on it. I have to respond within one month.
Korean law gives you the same set in its own words, since that is where I am: under the Personal Information Protection Act you may ask to see what I hold, have it corrected or deleted, or have the processing stopped. I answer within ten days there rather than a month, so that is the deadline I work to for everyone.
If you are unhappy with how I handle it, you can complain to the Information Commissioner's Office (ico.org.uk), to the supervisory authority in your own country, or to the Personal Information Protection Commission in South Korea (pipc.go.kr).
Unsubscribing
Reply “stop” to any email from me, or use the unsubscribe link. Your address is removed, not suppressed and retained.
Changes
If this notice changes materially before the product launches, I will say so in the launch email rather than change it quietly.
← Back to RedactCheck