Terms of use

TMC Hub Privacy Policy (v2)

TMC ("the Operator") operates TMC Hub, the TMC plugin licensing service, and the website (tmcstudio.shop), and processes users' personal information in accordance with the Personal Information Protection Act (PIPA) and other applicable laws.

• Effective date: 2026-11-14
• Previous version: v1 (effective 2026-09-02)

1. Personal information processed and purposes

The Operator processes only the information listed below, as needed for license authentication, device limits, updates, technical support, prevention of misuse, and handling inquiries. The Operator does not use it for advertising or marketing and does not sell it.

• Account informationInformation: Email address, license key, account status, and inquiry handling notesPurpose of use: Verifying licenses, linking purchases to accounts, and handling inquiriesLegal basis: Contract
• Purchase information (received from Gumroad)Information: Purchaser name, purchased product and plan, order number, payment and settlement amounts and fees, country of purchase, discount code used, time of purchase, refund or dispute status, and permitted number of registered devicesPurpose of use: Issuing licenses, revoking licenses following refunds, and settling salesLegal basis: Contract
• Upgrade discount informationInformation: Pro upgrade discount code and discount amount for each Essential purchaserPurpose of use: Providing upgrade discountsLegal basis: Contract
• Device identifiersInformation: SHA-256 hash of the hardware UUID (on Windows, the motherboard's system UUID or, if unavailable, the Windows installation ID; on Mac, the hardware UUID), and a device authentication token issued by the server (stored only as a hash on the server)Purpose of use: Managing device limits and binding the license file to that deviceLegal basis: Contract
• Device informationInformation: Computer name, operating system type and versionPurpose of use: Identifying devices in the user's device list for deactivation or replacementLegal basis: Contract
• Computer specificationsInformation: CPU model, graphics card, CPU architecture (x64/ARM), whether running under Rosetta translation, and PC manufacturer and modelPurpose of use: Checking compatibility, providing technical support, and checking for license misuse through cloned systemsLegal basis: Legitimate interests
• Software informationInformation: Installed TMC plugins and their versions, After Effects version, and Hub versionPurpose of use: Providing updates and technical supportLegal basis: Contract
• Usage recordsInformation: Activation, deactivation, device replacement, and download records (including computer names before and after replacement), reasons for authentication rejection and the key and email entered at the time, and product, version, and error details when installation or updates failPurpose of use: Providing the service, resolving failures, and checking for misuseLegal basis: Contract, Legitimate interests
• Misuse alert recordsInformation: Alerts about unusual use, such as the same device being used in multiple countries or networks, and related accounts, emails, names, device identifiers, and IP addressesPurpose of use: Checking for license sharing or cloningLegal basis: Legitimate interests
• Connection informationInformation: IP address, country and network provider inferred from the IP address, and the request path and User-Agent for requests that trigger security alertsPurpose of use: Security, including blocking excessive requests, and checking for misuseLegal basis: Legitimate interests
• Inquiry and rights request informationInformation: Email address and content of inquiries, identity verification materials for rights requests, and a representative's written authorizationPurpose of use: Handling inquiries and personal information requestsLegal basis: Contract, Legal obligation

• Contract: Article 15(1)(4) of the PIPA. This information is necessary to provide the purchased license and is processed without separate consent. Without this information, license authentication and updates are unavailable.
• Legitimate interests: Article 15(1)(6) of the same Act. Information is processed only within a reasonable scope directly related to preventing license misuse and providing technical support.
• Legal obligation: Article 15(1)(2) of the same Act. This applies when handling personal information requests.
• Values received as hashes are also protected as personal information.
• Payment method information, such as card numbers, is not stored.

2. External connections and information not collected

TMC plugins check licenses only on the PC. Only TMC Hub communicates with the Operator's server. However, the following features connect directly to external addresses chosen by the user. The Operator receives no information from these connections. The privacy policy of the site visited applies.

• TMC Clipboard: Downloads files from the addresses of copied web images and media.
• TMC Toolbox Notes: Displays saved web links and YouTube and Vimeo videos within the panel.
• TMC Hub: Purchase and upgrade buttons open Gumroad pages in the browser. If WebView2 is not installed on Windows, the installer downloads it from Microsoft.

The Operator does not collect MAC addresses, device serial numbers, original hardware UUID values, project files, or the contents of users' work. When checking installed TMC plugins, only the After Effects plugin folder is examined, and only TMC product names and versions are sent.

3. How and when information is collected

Hub displays this policy on first launch. When a license is activated, it sends the account, device, and software information described in Section 1. While running, it renews the license every few hours. Only the operating system type is sent when checking for updates and news. Purchase information is received from Gumroad, and the IP address is automatically transmitted when connecting to the server.

The license file (including the purchaser's name and email) and authentication status information are stored on the user's computer. Plugins read the license file and write only status values to the PC to prevent clock manipulation.

4. Retention and deletion

Personal information is deleted without delay when its retention period ends or its processing purpose has been fulfilled. The retention periods for each category are as follows.

• Account information, purchase information, and upgrade discount information: While the account exists. If deletion is requested, within 10 days of receiving the request
• Device identifiers, device information, computer specifications, and software information: While the device is registered. Deleted when the device is deactivated or replaced
• License activation records (including computer names) and the IP address, country, and network provider at the time: 400 days
• Purchase account merger and refund handling records: 400 days
• Other usage records (authentication rejection, deactivation or replacement, downloads, and installation failures) and the IP address at the time: 60 days
• Misuse alert records: 400 days after the last observation
• List of devices blocked by the Operator (device identifier and reason for blocking): Until the block is lifted
• Inquiry and rights request information: 1 year after handling is completed
• Server security logs (including request IP addresses): 3 days
• Administrative access logs (records of the Operator viewing or modifying accounts): 400 days (retained for at least 1 year under Article 8 of the Standards for Ensuring the Safety of Personal Information)

• When an account is deleted, its usage records and alert records are also deleted. Devices blocked by the Operator remain blocked, but their links to the account are removed. Administrative access logs are retained for the period above as required by law, but details such as email addresses are removed.
• Deletion procedure and methods: Records whose retention periods have expired are automatically deleted from the database every 30 minutes so that they cannot be recovered. Paper printouts are shredded.
• Deleted information may remain in database disaster recovery records (Cloudflare D1 point-in-time recovery) for up to 7 days before being automatically deleted.

5. Disclosure to third parties

The Operator does not disclose or sell users' personal information to third parties. Exceptions apply only where specifically provided for by law or where an investigative authority requests it through legally prescribed procedures.

Relationship with Gumroad: Gumroad, Inc. (United States) handles payments as the seller, and the Gumroad Privacy Policy (https://gumroad.com/privacy) applies to the payment process. The Operator entrusts Gumroad with operating sales pages, storing purchaser information, issuing and verifying license keys, and processing discount codes, as described in Section 6.

6. Outsourced processing and international transfers

The Operator entrusts the following services to external providers. Cloudflare and Gumroad process information outside South Korea. As this involves outsourced processing and storage for the performance of a contract, the following information is disclosed under Article 28-8(1)(3) of the PIPA.

• Cloudflare, Inc. (privacyquestions@cloudflare.com)Entrusted services: Running the authentication server, storing the database, distributing plugin files, retaining server logs, hosting the website, and compiling visit statisticsInformation transferred: Information listed in Section 1Destination country: United States and countries with Cloudflare data centers (the database is in the Asia-Pacific region)Timing and method: Sent via HTTPS whenever Hub connects to the serverRetention period: As in Section 4
• Gumroad, Inc. (support@gumroad.com)Entrusted services: Operating sales pages, storing purchaser information, issuing and verifying license keys, and processing discount codesInformation transferred: Purchase information, license keys, and upgrade discount informationDestination country: United StatesTiming and method: Entered directly into Gumroad by the user at purchase. Exchanged with the Operator's server via HTTPSRetention period: As in Section 4. Payment records are subject to Gumroad's policy
• Kakao Corp.Entrusted services: Receiving and storing inquiry emailsInformation transferred: Inquiry and rights request informationDestination country: South Korea (no international transfer)Timing and method: When email is receivedRetention period: As in Section 4

• Sub-processors engaged by each provider are listed in the Cloudflare sub-processor list (https://www.cloudflare.com/gdpr/subprocessors/cloudflare-services/) and the Gumroad sub-processor list (https://gumroad.com/help/article/110-gumroads-subprocessors).
• Countries with Cloudflare data centers are listed on the Cloudflare network page (https://www.cloudflare.com/network/).

How to refuse international transfers and the consequences: You can choose not to use Hub, deactivate your device, or request account deletion using the contact details in Section 10. However, TMC licenses can only be authenticated through this server, so refusing transfers makes license authentication and updates unavailable.

7. Security measures

The Operator takes the following measures to prevent the loss, theft, disclosure, or alteration of personal information.

• Organizational measures: Only 1 person, the Operator, handles personal information. Data processing agreements are in place with the providers entrusted with processing.
• Technical measures: These include encryption in transit (HTTPS), encryption at rest (Cloudflare D1 AES-256 (https://developers.cloudflare.com/d1/reference/data-security/)), hashing of hardware identifiers, digital signatures for license files, and request rate limits.
• Access controls: Administrative functions require both a separate login and administrator authentication. IP addresses with repeated failed administrator authentication attempts are blocked for a period of time. Administrative access logs are retained for at least 1 year.

8. Your rights and how to exercise them

You may request access to, rectification or deletion of, or suspension of processing of your personal information at any time. You may also request suspension of processing based on Legitimate interests (Section 1). For children under 14, a legal representative may exercise these rights.

(1) Directly in Hub: You can deactivate this computer. If your device limit has been reached, you can view the registered device list and choose a device to replace. Registration information for a deactivated device is deleted, and related records are retained for the periods in Section 4.

(2) By email: Send a request to the contact in Section 10. The Operator will handle it and notify you of the result within 10 days. Please use the email address used for your purchase to verify your identity. You can also request deactivation of other devices by email.

(3) Through a representative: A legal representative or authorized person may also submit a request. An authorized person should include written authorization.

Deletion requests may be restricted for information that must be retained by law. If your account is deleted, authentication and updates for that license will be unavailable.

Automatic authentication restrictions: License conditions, such as exceeding the registered device limit, frequent device replacements within 30 days, or a mismatch with the purchase email, are applied automatically under predefined rules. If no purchases remain because of refunds or payment disputes, the account is automatically disabled. The Operator personally decides whether to block a specific device. You may request an explanation of or challenge these decisions.

9. Cookies, children, and users outside South Korea

Cookies and behavioral information: TMC Hub does not use cookies, advertising identifiers, or external analytics tools. The website (tmcstudio.shop) does not set cookies and stores only language preferences and news in browser storage. Visit statistics are compiled using Cloudflare Web Analytics. This tool does not use cookies or browser storage and does not identify individual visitors. It aggregates page URLs (excluding the query string), referral sources, countries, browser and device types, and page load speeds. You can block it using your browser's content blocking feature. YouTube videos on the website are loaded from youtube-nocookie.com, operated by Google LLC (United States), only when a visitor presses play. Pressing play sends connection information, including the IP address, to Google, and Google may use cookies. You can reject cookies in your browser settings.

Children: The service is not intended for children under 14.

Users in Europe (EU/EEA) and the United Kingdom:

• The controller is the Operator (Park Jeongbin (박정빈), contact details in Section 10).
• The legal bases in Section 1 correspond to the following under the GDPR: "Contract" is performance of a contract (Article 6(1)(b)), "Legitimate interests" is legitimate interests (Article 6(1)(f)), and "Legal obligation" is legal obligation (Article 6(1)(c)). The Operator's legitimate interests are preventing license misuse and providing technical support.
• Right to object: You may object at any time to processing based on Legitimate interests.
• You may request access, rectification, erasure, restriction of processing, and data portability, and lodge a complaint with the supervisory authority in your country of residence. UK users may first complain to the Operator and may also lodge a complaint with the Information Commission in the United Kingdom.
• Transfers from Europe to South Korea rely on the EU adequacy decision. Transfers to US providers rely on Cloudflare's EU-U.S. Data Privacy Framework certification and Standard Contractual Clauses, and on Gumroad's Standard Contractual Clauses. Copies are available on request.
• Purchase information is received from Gumroad.

Users in Japan:

• The purposes of use are in Section 1, the procedures for requests for disclosure and other rights are in Section 8, and the contact for complaints is in Section 10. The Operator's address will be provided without delay on request.
• Personal data is handled in South Korea (the Operator), the United States (Cloudflare and Gumroad), and countries with Cloudflare data centers. The Operator reviews each country's personal information protection system and implements security measures through data processing agreements with the entrusted providers.

10. Privacy officer and remedies

Please send inquiries, requests, and complaints about personal information to the privacy officer below.

• Privacy officer: Park Jeongbin (박정빈) (Representative)
• Contact: temacaworks@kakao.com

For advice or reports concerning personal information infringements, you may also contact the Personal Information Dispute Mediation Committee of South Korea (1833-6972), the Personal Information Infringement Report Center of South Korea (118), or the National Police Agency of South Korea (182). These are South Korean domestic telephone numbers.

Changes to this policy: Changes will be announced in Hub and on the website before they take effect. Users will be notified in advance of significant changes. Previous versions are available on the website.

• v2(2026-11-14): Corrected items that did not reflect actual processing, and added detail on outsourced processing and international transfers, retention periods, security measures, and the privacy officer
• v1(2026-09-02): First effective version