Modern Web Labs
Privacy Policy
Effective
Modern Web Labs (represented by Bora Lee, "Modern Web Labs") operates www.modernweblabs.com and the portfolio workshop application page at workshop.modernweblabs.com (together, the "site"). This policy explains how the site handles personal data, as required by Article 30 of the Personal Information Protection Act of the Republic of Korea.
The site has no sign-up or login for visitors. The only account is the founder's administrator account used to manage content. Visitor data is collected only when a visitor enters it directly, for example to request a consultation, subscribe to the newsletter, apply for the premium newsletter, apply for the portfolio workshop, or report a problem. Data that is recorded automatically to operate the service is described separately.
1. Data we collect, why, and for how long
The table below lists data that visitors enter themselves. Each item is used only for the stated purpose.
| When | Data | Purpose | Retention |
|---|---|---|---|
| Consultation request form | Company or organization, contact name, email, phone (optional), areas of interest, audience size (optional), preferred timing (optional), request details | Reviewing and replying to the request, scheduling a consultation | 3 years from receipt (deleted at the first quarterly review after that). Deleted immediately on request |
| Newsletter subscription | Email, language (Korean or English), where you subscribed and the article that led you there, confirmation time, per-issue delivery, open and click events | Sending the biweekly newsletter and managing bounces and unsubscribes | Until you unsubscribe. The record is then kept for 1 year to recognize re-subscriptions and preserve delivery history, and deleted at the first quarterly review after that. Deleted immediately on request |
| Premium newsletter application | Name, email, mobile number, company or organization, job title (optional), companies or industries of interest (optional), traffic source, time of consent to data processing, time of consent to marketing messages | Confirming the application, sending the payment request (via KakaoTalk or SMS), sending the paid newsletter, launch, payment and renewal notices (only with marketing consent) | Name, mobile number, company, job title and interests are deleted at the first quarterly review one year after the subscription ends; applications that are never paid are deleted at the first quarterly review one year after the application date (after a re-application, nothing is deleted until one year after the new consent). Payment records (payment date, amount, service period) are kept for 5 years from each payment date as required by the Korean E-Commerce Act. The email address and the consent evidence (traffic source, time of consent to data processing, time of consent to marketing messages) are kept together with those payment records while they remain, then deleted at a quarterly review. On request, everything except payment records, the email address and the consent evidence is deleted immediately |
| Portfolio workshop application | Session date, name, email, mobile number, the kind of website you want to build, AI experience (optional), message to the instructors (optional), referral code (optional) with the regular fee, discount and final fee calculated from it, time of consent to data processing | Receiving the application, applying the referral code discount, notifying you whether your place is confirmed, sending the schedule, preparation notes and fee, and contacting you by phone if you cannot check email or sending you a card payment link via KakaoTalk message if you pay by card | Kept until the retention period agreed at the time of applying ends, then deleted automatically from the database. Applications made under the new schedule (November 14 or 15) are kept until November 15, 2027; applications made earlier under the previous schedule (November 7 or 8) are kept until November 8, 2027, as stated when they were submitted. These periods are not extended if the workshop date changes. Deleted immediately on request |
| Next workshop schedule notice signup | Email (required), schedule preference (optional), request identifier, consent, its time and notice version | Notifying consenting users of the next workshop schedule when the optional signup is available | Kept for 90 days after submission, then deleted by the next daily cleanup, normally within one day. Earlier withdrawal or deletion may be requested |
| Tutorial email verification | Email, 6-digit verification code (stored only as a hash, expires after 10 minutes), the tutorial where verification started | Confirming access to full tutorials. A completed verification registers a newsletter subscription | Same as the newsletter subscription |
| Site feedback | Your message, the page address you reported, email (optional), browser information (User-Agent) | Investigating and fixing the problem, replying if needed | 1 year after the report is handled (deleted at the first quarterly review after that) |
| Client-only content access | Per-client access code, client name, daily aggregate counts of code use and reads (per client, not per person) | Providing premium tutorials to members of contracted clients and reporting usage | Until the contract ends. At the first quarterly review after that, the access codes, client name and usage aggregates are deleted |
Consultation requests and site feedback are not stored in the database. Consultation requests are kept in the inbox (sent through Resend, see section 4) and the internal notification channel (Discord); site feedback is kept only in that notification channel (Discord).
Premium newsletter applications are stored in the database and also sent to the intake inbox and the operations channel (Discord). Payment is handled by Modern Web Labs sending a payment request through Gyeoljeseonsaeng (PayMint Inc., see section 4). Modern Web Labs never receives or stores card details.
Next workshop schedule notices are separate from course applications, seat reservations, payment and newsletter subscriptions. These terms apply only when the optional signup is available and you consent. Email (required), schedule preference (optional), request identifier, consent and its time and notice version are stored separately in the existing Supabase database in Seoul, South Korea, for next-schedule notices, and viewed by Bora Lee and Suzy Nam. Records are kept for 90 days after submission, then deleted by the next daily cleanup, normally within one day. You may request withdrawal and deletion earlier. You may decline consent and continue browsing, but cannot register for these notices. Request withdrawal or deletion at contact@modernweblabs.com; verification through the submitted email may be required. IP hashes used to limit automated submissions are kept separately in the existing request log and deleted after 30 days. Registration alone does not automatically send confirmation emails, newsletters or future schedule announcements.
Portfolio workshop applications are stored in the database and also sent to the intake inbox and a workshop-only operations channel (Discord). The applicant receives a confirmation email containing only the chosen date and area and the fee breakdown (referral code, regular fee, discount, final fee). The referral code is optional; if you enter one, the server checks it and calculates the discount and the final fee. When you try a code before applying, nothing but the code is sent and the code is not stored. No payment details are collected at the application stage. If you apply more than once with the same email, for another date or the same date, each application is stored separately and earlier applications are not overwritten. The applicant confirmation email is sent at most once per hour for the same email address. If a confirmation email to that address was attempted within the previous hour, even if that attempt failed, no further confirmation email is sent, and applications for different dates or from different IP addresses count together when the email is the same. If the limit cannot be checked, no confirmation email is sent. Every application is still stored and sent to the operators, including those that get no confirmation email.
A newsletter subscription is complete only after you click the link in the confirmation email. The link expires after 24 hours. Unconfirmed requests are never used for sending and are deleted at the quarterly review after the link expires, or promptly on request.
The following items are recorded automatically while operating the service, without any input from you.
- IP address (hashed): to block automated form submissions, the IP address of consultation, subscription, premium newsletter application, workshop application, referral code check and next-schedule notice signup, tutorial email verification, feedback and access-code requests is stored as a SHA-256 hash. The original address is never stored, and hashes are deleted automatically after 30 days.
- Email hash (workshop applications): to prevent repeated confirmation emails to the same address, when a workshop confirmation email is attempted, the email address, in the same normalized form stored with the application, is combined with a fixed label and stored as a SHA-256 hash in the same temporary request log as the IP hashes. The original email is not added to this log, and the hash is deleted automatically after 30 days. Storage and retention of the application itself are as described in the table above.
- Automatic image error reports: when an image fails to load, the page address (including its query string), image address and browser information are sent to the operations channel. Nothing you typed, such as a name or email, is included, and authentication-related parameters are stripped from the page address on the server. Like site feedback, these reports are deleted at the first quarterly review one year after they are handled.
- Hosting access logs: the hosting provider (Vercel) temporarily records IP address, request time and browser information under its own policy.
- Text you enter into the tokenizer tool in Lab is processed on the server and discarded immediately. It is neither stored nor sent to any external service. The legacy GET form of the API carries the text in the URL, so it can remain in browser history and hosting access logs.
2. Cookies and browser storage
These are the cookies and browser storage entries the site sets itself. All of them serve site functions; cookies set by the analytics and affiliate tools that run after consent are described in section 3.
| Name | Type | Purpose | Lifetime |
|---|---|---|---|
| mwl_email | Cookie | Marks that tutorial email verification is complete | 1 year |
| mwl_premium | Cookie | Client-only content access (signed access code) | 90 days |
| mwl_premium_hint | Cookie | Lets the page send personalization requests only when access exists | 90 days |
| mwl_announcements_dismissed | Cookie | Keeps dismissed announcement banners closed | 1 year |
| NEXT_LOCALE | Cookie | Language preference (Korean or English) | Browser session |
| mwl_admin_hint | Cookie | Set only in a browser signed in on the admin path. Decides whether admin shortcuts are shown | 1 year |
| cookie-consent-v2 | localStorage | Your decision on analytics cookies | Until you delete it |
| tutorial-series-overview:* | localStorage | Whether a tutorial series overview is expanded | Until you delete it |
| mwl-reported-image-errors | sessionStorage | Prevents duplicate image error reports | Until the tab is closed |
The administrator session cookie is created only under the admin path. It is never set in a regular visitor's browser.
You can block or delete cookies in your browser settings. If you do, tutorial email verification and client-only content access will not persist.
3. Analytics tools and external scripts
The tools below run only after you choose "Accept" in the cookie notice at the bottom of the site. Their scripts are not loaded before consent.
| Tool | Provider | Data collected | Purpose |
|---|---|---|---|
| Google Analytics 4 | Google LLC (United States) | Cookie identifier, pages visited, time on page, device and browser information | Visit statistics |
| Microsoft Clarity | Microsoft Corporation (United States) | Cookie identifier, page layout with click and scroll behavior, device and browser information. The consultation, subscription, tutorial verification, client access code, feedback and workshop application forms carry a masking attribute (data-clarity-mask) so typed content is not recorded, and the tool does not run on administrator screens | Session replay and heatmaps to improve usability |
| impact.com tracking tag | Impact Tech, Inc. (United States) | Cookie identifier, page impressions, affiliate link clicks | Measuring affiliate program performance. Rewrites advertiser links into tracking links |
When KakaoTalk sharing is enabled for the deployment, pages with a share button (insights, tutorials and Lab) load the Kakao JavaScript SDK (Kakao Corp., Republic of Korea). The SDK file is fetched from Kakao's servers when the page opens, so that request's connection data (IP address, browser information) reaches Kakao. Pressing the share button takes you to Kakao's service, and Kakao's privacy policy applies from there. Kakao is a domestic provider, so this is not an international transfer.
These tools set their own cookies after consent: Google Analytics uses _ga and _ga_* (2 years), Microsoft Clarity uses _clck (1 year) and _clsk (1 day), and impact.com cookies follow impact.com's policy. To withdraw consent, delete the cookie-consent-v2 entry from the site data in your browser. The cookie notice will appear again on your next visit and you can choose "Decline". Cookies the tools have already set must be removed with your browser's cookie deletion as well. Google Analytics can also be disabled with the Google Analytics opt-out browser add-on.
4. Processors and international transfers
Modern Web Labs entrusts the tasks below to the listed providers. Where a provider's servers are outside Korea, personal data is transferred abroad. The legal basis is Article 28-8(1)(3) of the Personal Information Protection Act (outsourcing and storage required to provide the service). Analytics tools transfer data only after consent, under Article 28-8(1)(1).
| Processor (contact) | Task | Data transferred | Country | When and how | Retention |
|---|---|---|---|---|---|
| Vercel Inc. (privacy policy) | Hosting and server execution | Access logs (IP address, request time, request URL with query string, browser information) | Servers run in the Republic of Korea (Seoul region). Access logs are stored in the United States | Over the network when you access the site | Per Vercel's log retention policy |
| Supabase Inc. (privacy policy) | Database | Newsletter subscription data, premium newsletter applications, portfolio workshop applications, Next workshop schedule notice signup data (email, schedule preference, request identifier, consent, its time and notice version), tutorial email verification data (code hash, expiry, attempt count, the tutorial where verification started), delivery, open and click events, client access codes and usage aggregates, IP hashes and workshop confirmation email hashes | Republic of Korea (Seoul region). No international transfer | Stored on entry | As in section 1 |
| Resend Inc. (privacy policy) | Email delivery and subscriber list | All consultation request fields (company, contact name, email, phone, areas of interest, audience size, preferred timing, request details) in the intake email to Modern Web Labs, only the contact name and request details in the confirmation email to the requester, tutorial verification code (verification email), newsletter subscriber email with delivery, open and click events, all premium newsletter application fields in the intake email with only the email address and the date of marketing consent in the confirmation email to the applicant, all portfolio workshop application fields in the intake email with only the recipient address, the chosen date and area, and the fee breakdown (referral code, regular fee, discount, final fee) in the confirmation email to the applicant | United States | Via API when an email is sent | Subscriber contacts are marked as not to be sent to on unsubscribe and deleted at the first quarterly review one year after unsubscribing, or on request. The content and delivery records of sent emails follow Resend's retention policy |
| Discord Inc. (privacy policy) | Intake notifications (internal operations channel) | All consultation request fields (request details up to 1,200 characters), feedback message with the reported page address, email and browser information, automatic image error reports with page address, image address and browser information, new subscriber email with language, subscription source and referring article, all premium newsletter application fields (companies or industries of interest up to 1,200 characters), all portfolio workshop application fields (message to the instructors up to 600 characters) | United States | Via webhook immediately on receipt | As in section 1 |
| PayMint Inc. (Gyeoljeseonsaeng) | Sending premium newsletter payment requests (KakaoTalk or SMS) and processing card payments | Name, mobile number, payment amount | Republic of Korea. No transfer abroad | Entered by Modern Web Labs when creating a payment request | Per PayMint's retention policy and the periods set by the Act on the Consumer Protection in Electronic Commerce |
| Google LLC (privacy policy) | Visit statistics (with consent) | Data listed in section 3 | United States | While browsing after cookie consent | Per Google Analytics retention settings |
| Microsoft Corporation (privacy policy) | Session replay and heatmaps (with consent) | Data listed in section 3 | United States | While browsing after cookie consent | Per Microsoft Clarity retention policy |
| Impact Tech, Inc. (privacy policy) | Affiliate performance measurement (with consent) | Data listed in section 3 | United States | While browsing after cookie consent | Per impact.com retention policy |
If you do not want the data you enter to be transferred abroad, do not use the consultation form, newsletter subscription, premium newsletter application, portfolio workshop application, tutorial email verification or site feedback. Choosing "Decline" in the cookie notice prevents transfers to the analytics tools. Hosting access logs are recorded whenever you open the site, and an automatic image error report (section 1) is sent only when an image fails to load, so the only way to avoid those is not to use the site. The rest of the site remains available if you skip those features.
Modern Web Labs uses Anthropic's API to translate and summarize published articles. Only the article's content and metadata such as its title and excerpt are sent. No visitor or subscriber data is ever sent to an AI service.
5. Disclosure to third parties
Modern Web Labs does not sell personal data and does not disclose it to third parties beyond the processors in section 4 and the connection data passed when the external script (Kakao SDK) in section 3 is requested, except where required by law or by a lawful request from an investigative authority.
6. Your rights and how to exercise them
You may exercise the following rights over your personal data at any time.
- Access
- Correction and deletion
- Suspension of processing
- Withdrawal of consent
Send your request to contact@modernweblabs.com. We reply with the outcome within 10 days of receipt. Where identity must be confirmed, we verify through the email address used in the request. A representative must include a letter of authorization.
Every newsletter issue carries an unsubscribe link that removes you from sending immediately. One-click unsubscribe in email clients is also supported.
Marketing messages such as premium newsletter launch, payment and renewal notices are sent only with your consent. The 'unsubscribe' link at the bottom of each paid newsletter stops delivery immediately. You can also reply to any notice or write to contact@modernweblabs.com; sending stops as soon as the request arrives, and you will be told the result. Unsubscribing does not cancel or refund the subscription; to receive the newsletter again, ask in the same way. Consent is reconfirmed every two years.
The legal guardian of a child under 14 may exercise the same rights on the child's behalf.
7. Deletion
Personal data whose retention period has ended or whose purpose is fulfilled is deleted by the procedure stated in this policy (automatic deletion, or manual deletion at the quarterly review). Deletion requests are handled without delay regardless of that schedule. Data that another law requires us to keep is stored separately for that period and then deleted.
- Database records are deleted irreversibly. On a deletion request, Modern Web Labs also deletes the matching contact by hand in the processor's (Resend) dashboard.
- Consultation, feedback and new-subscriber messages in the inbox and the operations channel are not purged automatically, so Modern Web Labs reviews them every quarter and deletes those past their retention period by hand.
- IP address hashes and workshop confirmation email hashes are purged automatically by the database every day once they are 30 days old.
- Next workshop schedule notice signup records are deleted after 90 days by the next daily cleanup, normally within one day. Earlier withdrawal or deletion requests are handled without delay after any necessary identity verification.
- Portfolio workshop applications are deleted automatically by the database when the retention period agreed at the time of applying ends: after November 8, 2027 for applications under the previous schedule (November 7 or 8), and after November 15, 2027 for applications under the new schedule (November 14 or 15). Copies left in the inbox and the workshop channel are deleted by Modern Web Labs without waiting for the quarterly review, on November 9, 2027 for the previous schedule and on November 16, 2027 for the new schedule.
8. Security measures
Modern Web Labs takes the following measures to keep personal data from being leaked or damaged.
- Row-level security is enabled on every database table, and the visitor-data tables described in this policy (subscribers, premium newsletter applicants, workshop applicants, verification, client codes, IP hashes) can be read only through the administrator session or the server-side key.
- Tutorial email verification codes and IP addresses are stored as hashes, never in the original form.
- The client-only content cookie (mwl_premium) is signed to prevent forgery, and the cookies that grant access (mwl_premium, mwl_email) are flagged HttpOnly so scripts cannot read them. The hint cookies (mwl_premium_hint, mwl_admin_hint) are script-readable but grant no access.
- All traffic is encrypted with HTTPS. The administrator account is used by the founder alone and protected by a password.
- Request rates are limited to block automated form submissions.
- Authentication-related parameters are stripped on the server from page addresses sent with feedback.
9. Children's data
The site is intended for companies and practitioners, not for children under 14. If we learn that we have collected a child's data, we delete it without delay.
10. Privacy officer
The person responsible for personal data processing, inquiries and complaints is listed below. There is no separate department or telephone desk. Every request, including access, correction, deletion and suspension requests, is received at the email address below.
- Name: Bora Lee (Founder, Modern Web Labs)
- Email: contact@modernweblabs.com
You may also contact the following Korean authorities to report or discuss a privacy violation.
11. Changes to this policy
This policy takes effect on November 10, 2026. Changes are posted on this page together with their effective date. Changes that affect your rights, such as new data items or new processors, are announced on the site at least 7 days before they take effect.