Privacy Policy

Last updated: 2026-11-16

This Privacy Policy explains how Roundnest Games, which operates Steadnode ("Steadnode", "we", "us" or "our"), processes personal data when you visit steadnode.com, create an account, use our services, contact support or report abuse.

We are based in the Republic of Korea, and this policy is our privacy policy under the Korean Personal Information Protection Act (PIPA). It also provides the information required by the EU General Data Protection Regulation (GDPR) and the UK GDPR for users in the European Economic Area and the United Kingdom.

Summary in plain language

• We collect what we need to run your account and services: your email, name, country, IP address, billing records and support messages, plus registrant details if you register a domain.
• Payments are handled by PayNow (paynow.gg), our payment processor and merchant of record. We never receive or store your full card number.
• Our services run on infrastructure in several countries (the EU, the United States, Singapore, Japan and Korea), so your data may be transferred abroad. We explain where and why in section 7.
• Domain registrant details must be passed to the registrar and the registry, and may be published where WHOIS privacy is not available.
• An AI assistant answers questions in the chat window on our website and may help answer support requests; your messages are then processed by an AI provider. You can always ask for a human instead.
• We keep data only as long as we need it or the law requires it. For example, Korean law requires us to keep payment records for 5 years and access logs for 3 months.
• We only use essential cookies (login session, language and country). We do not use advertising or tracking cookies, and we do not sell your data.
• You can access, correct and delete your data and exercise your other rights by contacting support@steadnode.com.

1. Who is responsible for your data

The controller of your personal data is:

• Roundnest Games (Steadnode)
• Representative: Choi Wonho
• Address: Bldg. 1, Unit 402, 44 Gyeongchung-daero 2313beon-gil, Bubal-eup, Icheon-si, Gyeonggi-do, South Korea
• Phone: +82 70-8064-5829
• Email: support@steadnode.com

Our privacy officer (개인정보 보호책임자) is named in section 17.

This policy does not cover personal data that our customers store or process using our services, for example on their websites, game servers or bots. For that data, the customer is responsible, and we act only on the customer's behalf (see section 8).

2. Personal data we collect

2.1 Account data (required)

• Email address
• Name
• Password (stored only as a one-way cryptographic hash)
• Country
• Preferred language

2.2 Billing data (required when you pay)

• Orders, services, plans and billing cycles
• Order, payment, subscription and refund records that we receive from PayNow, such as the order ID, amounts, tax, country, status, subscription status and dates
• Limited details provided to us by PayNow, such as the transaction reference, currency and type of payment method

We never receive or store full card numbers or card security codes. These are entered directly with PayNow.

2.3 Technical and security data (collected automatically)

• IP addresses used to access our website, dashboard and control panel
• Login records, access logs and timestamps
• Browser type and device information sent by your browser (user agent)
• Security events, such as failed logins and signals used to detect fraud and abuse
• Service records, such as the IP addresses assigned to your services, their location and resource usage

2.4 Support data

• Content of support tickets, emails and attachments
• Conversations with our AI support assistant

2.5 Domain registrant data (required when you register or transfer a domain)

• Name and, optionally, organization
• Postal address
• Telephone number
• Email address
• The same details for any administrative or technical contact you provide

2.6 Information about refused orders

If our automated risk checks refuse an order and you contact us about it, we may ask you for additional information, such as confirmation of your identity or a description of the intended use. We only collect what is necessary to look at your case.

2.7 Abuse reports

If you report abuse, we collect your email address (if you provide it), the content of your report and the IP address from which it was submitted.

2.8 Data we receive from others

We may receive information about you or your services from our Suppliers (for example, abuse complaints or notices about network incidents), from PayNow (for example, order, payment, subscription and refund status, and chargebacks) and from people who report abuse.

2.9 Data we do not collect

We do not collect resident registration numbers or other national identification numbers, and we do not intentionally collect sensitive data (such as health data or political opinions). Please do not include such data in support messages.

3. Why we use your data and our legal bases

We use personal data for the following purposes. Under PIPA, we process data necessary to conclude and perform our contract with you, to comply with legal obligations and, where clearly justified, to pursue our legitimate interests, without needing your consent. Where consent is required, we ask for it separately. For users in the EEA and the UK, the corresponding GDPR legal bases are shown in brackets.

• Creating and managing your Account, including email verification and login (performance of a contract).
• Providing, operating and supporting the services you order, including provisioning, maintenance and communication about your services (performance of a contract).
• Billing, including orders, payments, subscriptions, renewals, refunds and regional prices based on your country (performance of a contract).
• Keeping records required by law, such as transaction, tax and access records (legal obligation).
• Security and fraud prevention, including blocking disposable email addresses, automated risk checks on orders, limits for new accounts, and protecting our systems and other customers (legitimate interests, and in some cases legal obligation).
• Handling abuse reports and enforcing our Terms of Service and Acceptable Use Policy, including cooperation with our Suppliers (legitimate interests).
• Domain registration, including passing registrant data to the registrar and the registry (performance of a contract, and your consent where required, see section 5).
• Answering questions and support requests, including answers in the website chat and first responses to tickets by an AI assistant (performance of a contract and legitimate interests).
• Legal claims and requests from authorities (legal obligation and legitimate interests).
• Marketing messages, only if you have opted in (consent).

We may use or provide personal data for purposes that are reasonably related to the original purpose without separate consent, where the law allows this. Before doing so, we consider the relationship to the original purpose, the context in which the data was collected, the foreseeable impact on you, and whether appropriate safeguards such as encryption are in place.

4. How long we keep your data

We keep personal data only for as long as necessary for the purposes above, and then destroy it without delay, generally within 5 days. The following retention periods apply.

4.1 Data we keep for our own purposes

• Account data: until your Account is closed.
• Support messages and AI assistant conversations: while your Account is open; after closure, for 3 years where they are records of complaints or disputes, otherwise deleted with your Account. Conversations in the website chat are not stored on our servers: your browser keeps them for up to 24 hours or until you start a new conversation, unless you send one to us as a ticket.
• Security logs (including IP addresses and login records): 1 year, which includes the 3-month period required by law (see 4.2), unless needed longer for a specific ongoing investigation.
• Abuse reports and enforcement records: 3 years after the case is closed, or longer if needed for legal proceedings.
• Data to prevent re-registration after serious abuse, fraud or chargebacks: if we terminate an Account for these reasons, we keep the minimum data needed (such as the email address and the reason) for 3 years.
• Domain registrant data: for the duration of the registration, and afterwards for the period required by ICANN rules and our agreement with the registrar (generally up to 2 years).
• Data on your services (Customer Content): until the service is deleted. After deletion, it cannot be recovered.

4.2 Data we must keep by law

Even after your Account is closed, we must keep the following records for the periods required by Korean law:

• Records of contracts and withdrawals of orders: 5 years (Act on the Consumer Protection in Electronic Commerce)
• Records of payments and supply of services: 5 years (Act on the Consumer Protection in Electronic Commerce)
• Records of consumer complaints and dispute handling: 3 years (Act on the Consumer Protection in Electronic Commerce)
• Books and supporting documents for tax purposes: 5 years (Framework Act on National Taxes)
• Records of access to our website and services (log records and IP address records): 3 months (Protection of Communications Secrets Act)

Data kept for these legal reasons is stored separately and used only for the purpose for which the law requires it to be kept.

5. Provision of personal data to third parties

We do not sell your personal data and do not share it for targeted advertising. We provide personal data to third parties only in the following cases.

• Domain registrar and registries: When you register, renew or transfer a domain, we provide your registrant data to the registrar whose reseller program we use and to the registry for the domain extension (and, under ICANN rules, to data escrow agents). They use it to register and manage the domain, provide registration data services (WHOIS/RDAP) and meet their ICANN and registry obligations, and keep it for the periods set by their policies. We ask for your consent to this when you register a domain. You may refuse, but then we cannot register the domain. Registrars and registries may be located outside Korea (see section 7).
• Public registration data: Under ICANN rules, personal data in public registration data services is generally redacted. Where WHOIS privacy is available, we offer it. For some domain extensions, registrant data is published or disclosed by the registry under its rules, and registrars and registries may disclose registrant data to persons with a legitimate interest (such as law enforcement or rights holders) as permitted by law.
• Certificate authorities: When you order an SSL certificate, we provide the data in your certificate request (such as domain names, and for organization-validated certificates your organization's details and contact person) to the certificate authority for validation and issuance. Issued certificates are recorded in public Certificate Transparency logs.
• Infrastructure Suppliers in abuse and legal cases: When an abuse complaint or legal request concerns your service, we may provide the Supplier hosting that service with the information needed to resolve it, based on our legitimate interests and within the scope of the original purpose.
• Authorities: when required by law, for example under a warrant, court order or other request that we are legally obliged to follow, or where it is urgently necessary to protect someone's life, body or property.
• Business transfers: if our business is transferred, for example by a sale or merger, we will notify you in advance as required by law, and you may then ask for your data not to be transferred by closing your Account.

6. Outsourcing of processing (processors)

We use the following categories of service providers to process personal data on our behalf. They may use the data only to perform the work we give them, and we supervise them as required by law.

• PayNow (payment processor and merchant of record): payment processing, subscriptions, refunds, chargebacks and fraud prevention. Because PayNow acts as the merchant of record and may act as an independent controller, its own privacy policy also applies.
• Email delivery provider: sending account and service emails, such as verification codes, receipts and notices.
• Infrastructure Suppliers (cloud and data center providers): hosting our website and systems, and hosting your services and Customer Content in the location you choose.
• Providers of shared hosting, business email and SSL systems, including the registrar's reseller platform: operating these services for you.
• AI provider: generating answers in the website chat and first responses to support requests.
• Content delivery and security network: delivering our website, protecting it against attacks and determining the country of visitors from their IP address.

If we add or change a processor in a way that matters for you, we update this policy. You can request the names and contact details of our current processors at any time from support@steadnode.com.

7. International transfers of personal data

Because we serve customers worldwide using infrastructure in several countries, personal data is transferred outside Korea, and outside your own country, as described below. Transfers take place over encrypted network connections when you use the relevant service. Transfers needed to provide the services you ordered are made because they are necessary for concluding and performing our contract with you, and are disclosed in this policy as permitted by PIPA. The transfer of registrant data to registrars and registries is made with your consent.

7.1 Infrastructure Suppliers

• Data transferred: Customer Content, service configuration, IP addresses assigned to your services, and, where needed for abuse handling, your Account identifiers
• Countries: the country of the location you choose for each service (EU member states, the United States, Singapore, Japan or Korea), and the countries where our own systems are hosted
• When: when you order a service and while it is running
• Purpose and retention: hosting your services and our systems, until the service is deleted or our contract with the Supplier ends
• How to refuse: you can choose the location of your services where several are available. If you do not want your data transferred abroad, you can choose a location in Korea where available, or not use the service. Without the transfer, we cannot provide services in other locations.

7.2 Payment processor (PayNow)

• Data transferred: email address, name, country, IP address, amount and transaction details
• Countries: the countries where PayNow operates, including the United States and the EU
• When: when you pay for an order or a renewal, or receive a refund
• Purpose and retention: processing payments and preventing fraud, for the periods required by PayNow's legal obligations
• How to refuse: you can refuse by not making a payment, but then you cannot order or renew paid services.

7.3 Email delivery provider

• Data transferred: email address, name and the content of the emails we send you
• Countries: the countries where the provider operates, which may include the United States and the EU
• When: whenever we send you an email
• Purpose and retention: delivering emails, for a limited period needed for delivery and troubleshooting
• How to refuse: account and service emails are necessary to provide the services, so they cannot be refused while you have an Account.

7.4 AI provider

• Data transferred: the content of your chat questions and support messages, and the Account and service details needed to answer them
• Countries: the United States
• When: when you ask a question in the chat on our website, or send a support request that the AI assistant answers
• Purpose and retention: generating responses on our behalf, retained by the provider only for the limited period set in its terms for operating and securing its service
• How to refuse: you don't have to use the chat; you can contact us by ticket or email instead, and ask in your request that it be handled by a member of staff without the AI assistant. A human will then answer, which may take longer.

7.5 Content delivery and security network

• Data transferred: IP address, browser information and the content of requests to our website
• Countries: the countries of the provider's global network, including the United States
• When: whenever you visit our website or dashboard
• Purpose and retention: delivering and protecting our website, for a short period
• How to refuse: this is necessary to use our website, so it cannot be refused while you use it.

7.6 Domain registrar and registries

• Data transferred: registrant data (see 2.5)
• Countries: the country of the registrar and of the registry for the domain extension (for example, the United States for .com), and the countries of their data escrow agents
• When: when you register, renew or transfer a domain
• Purpose and retention: registering and managing the domain, for the periods set by ICANN and registry rules
• How to refuse: you can refuse your consent, but then we cannot register the domain.

7.7 Safeguards for users in the EEA and the UK

Korea and Japan benefit from adequacy decisions of the European Commission, and Korea also benefits from UK adequacy regulations. For transfers to the United States, we rely on the EU-US Data Privacy Framework (and its UK extension) where the recipient is certified, and otherwise on the standard contractual clauses approved by the European Commission (with the UK addendum where applicable). Transfers to Singapore and other countries without an adequacy decision are based on standard contractual clauses. Transfers of registrant data to registrars and registries are also necessary to perform the domain registration you requested. You can ask us for more information about these safeguards.

8. Data you store on our services

When you or your End Users store personal data on our services (for example, data on your website, player data on your game server or user data processed by your bot), you are the controller of that data and we, together with our Suppliers, process it only on your behalf to provide the services. We do not use it for our own purposes. You are responsible for informing your End Users and for having a legal basis for processing their data. Business Customers who need a data processing agreement can contact us.

9. Automated decisions and AI

We use automated checks to protect our services, for example to detect disposable email addresses, which cannot be used to create an Account, and to assess risk signals that decide whether an order is accepted before payment. Decisions to suspend an Account for suspected fraud are made or reviewed by a member of our staff, and a refused order can be reviewed by a person on request.

If an automated decision significantly affects you, you can ask us to explain it, to have it reviewed by a person, or to object to it, by contacting support@steadnode.com.

Our AI assistant is used to answer questions and support requests. It does not make decisions about your Account, such as refunds, suspensions or terminations.

10. Cookies and similar technologies

We only use cookies that are strictly necessary for our website to work:

• sn_session: keeps you logged in (up to 30 days, renewed while you use the dashboard)
• sn_locale: remembers your language (1 year)
• sn_country: remembers your country, as detected from your IP address, to show suitable prices and currency (30 days)

We do not use advertising, analytics or tracking cookies, and we do not collect behavioral data for targeted advertising. Our content delivery and security network may set strictly necessary security cookies to protect our website against attacks. When you pay, PayNow's checkout pages may use their own cookies under their own policies.

You can block or delete cookies in your browser settings (for example, in the privacy or security section of Chrome, Edge, Firefox or Safari). If you block the cookies above, you may not be able to log in or use the dashboard.

11. Your rights

11.1 Rights of all users

You have the right to:

• access your personal data and receive information about how we process it;
• correct inaccurate or incomplete data;
• have your data deleted;
• ask us to suspend (restrict) the processing of your data;
• withdraw your consent at any time, where processing is based on consent, without affecting processing carried out before the withdrawal;
• refuse an automated decision or request an explanation of it, as described in section 9.

These rights may be limited where the law requires or allows it, for example where we must keep records by law, or where deleting the data would prevent us from providing a service you are still using. In that case, we tell you the reason.

Many details can be viewed and updated directly in your dashboard.

11.2 Additional rights in the EEA and the UK

If the GDPR or the UK GDPR applies to you, you also have the right to:

• receive the data you provided to us in a structured, commonly used and machine-readable format and to have it transmitted to another controller (data portability);
• object at any time to processing based on our legitimate interests, on grounds relating to your particular situation, and to object to direct marketing;
• lodge a complaint with a data protection supervisory authority, in particular in the country where you live or work or where the alleged infringement took place. In the UK, this is the Information Commissioner's Office (https://ico.org.uk).

12. How to exercise your rights

Send your request to support@steadnode.com from the email address of your Account, or through a support ticket. You can also contact our privacy officer (section 17). You may exercise your rights through a legal representative or an agent with a power of attorney.

We may ask you to confirm your identity before acting on a request. We respond within 10 days as required by Korean law, and in any case within one month for requests under the GDPR (which can be extended by two further months for complex requests, in which case we tell you). Exercising your rights is free of charge, unless requests are clearly unfounded or excessive.

If we refuse a request, we tell you the reasons and how you can challenge the decision.

13. Destruction of personal data

Procedure: When the retention period ends or the purpose of processing has been achieved, we identify the personal data concerned and destroy it without delay, under the supervision of our privacy officer. Data that we must keep by law is moved to separate storage and destroyed when the legal retention period ends.

Method: Electronic data is deleted using technical methods that make it impossible to restore. Paper records, if any, are shredded or incinerated.

Data on deleted services is removed from our and our Suppliers' systems and cannot be recovered.

14. Security measures

We take the following measures to protect personal data:

• Administrative measures: an internal management plan for personal data, access only for people who need it for their work, and regular review of our practices.
• Technical measures: encryption of data in transit (TLS), one-way hashing of passwords, encryption of sensitive credentials stored in our systems, access controls and logging for administrative systems, prompt security updates, protection against network attacks, and retention of access records.
• Physical measures: our systems are hosted in data centers operated by our Suppliers, which control physical access to their facilities.

No system is completely secure. If a personal data breach occurs, we notify you and the competent authorities as required by law.

15. Children

Our services are not intended for children under 14, and we do not allow them to create an Account. If we learn that we have collected data from a child under 14, we delete it. Users between 14 and the age of majority need the consent of a parent or legal guardian to use our services, as explained in our Terms of Service.

16. Marketing communications

We send you emails that are necessary for your Account and services, such as verification codes, receipts, renewal and payment notices, security alerts and notices about changes to our terms. We do not send advertising messages without your prior consent. If you have agreed to receive them, you can withdraw your consent at any time using the link in the message or in your Account settings.

17. Privacy officer and complaints

Our privacy officer (개인정보 보호책임자) handles all questions and complaints about personal data:

• Name: Choi Wonho
• Position: Representative
• Email: support@steadnode.com

If you have a complaint, please contact us first. You can also contact the following Korean bodies for advice or remedies regarding infringements of personal data:

• Personal Information Dispute Mediation Committee: 1833-6972, https://www.kopico.go.kr
• Personal Information Infringement Report Center (KISA): 118, https://privacy.kisa.or.kr
• Supreme Prosecutors' Office: 1301, https://www.spo.go.kr
• Korean National Police Agency, Cyber Bureau: 182, https://ecrm.police.go.kr

Users in the EEA and the UK can also lodge a complaint with their supervisory authority (see section 11.2).

18. Changes to this policy

We may update this policy when our processing or the law changes. We announce changes on our website at least 7 days before they take effect, and at least 30 days before important changes that affect your rights, such as new purposes or new recipients. Where the law requires your consent to a change, we ask for it.

This policy is written in English. If a translation differs from the English version, the English version prevails, except where mandatory law requires otherwise.

This version takes effect on 2026-11-16.