Privacy Policy

• Account management: identifying you, sign-in (email, Google, Apple), preventing misuse, password resets, account closure, notices
• Sales of products and travel products: taking orders, processing and verifying payments, delivery, issuing travel vouchers, cancellations, exchanges, returns and refunds, and handling Partner Seller orders
• Member benefits: granting and using points, issuing coupons, calculating membership tiers
• Content and community: publishing posts, comments, reviews and product questions; follows and likes
• Customer support: answering inquiries and keeping records for dispute resolution
• Service improvement: visit and usage statistics, content view counts, error analysis
• Seller onboarding: verifying and contacting businesses that apply to sell with us
• Marketing (only with your optional consent): event and benefit information by email and app push

The mobile app may ask for camera/photo access (to upload photos) and notification permission. These are optional; without them you can still use everything else. We do not collect your permission settings or the list of photos on your device — only photos you choose to upload.

We delete personal information without delay once its purpose is fulfilled, except for the following:

We use personal information only for the purposes above and share it with third parties only with your consent or where the law permits (PIPA Articles 17 and 18).

This sharing happens only when you order a Partner Seller's product. You may refuse, but you then cannot buy that product. Creators receive only aggregated sales figures for settlement, never information that identifies buyers.

We entrust the following processors, contractually requiring them to comply with data-protection law, restrict sub-processing and maintain security, and we supervise them.

Our servers are located in Singapore and some processors are abroad, so personal information is transferred overseas as necessary to provide the Service (PIPA Art. 28-8(1)(3)). Transfers take place over the network whenever you use the Service.

If you do not want your information transferred abroad, you may choose not to register or close your account; however, these transfers are essential to the Service. You can opt out of Google Analytics as described in Section 7.

You can block cookies or clear site data in your browser settings. You can opt out of Google Analytics with Google's browser add-on (tools.google.com/dlpage/gaoptout). Clearing local storage may sign you out. We do not use your usage data for targeted advertising or share behavioural data with third parties for advertising.

We delete information without delay when its retention period ends or its purpose is fulfilled. Information we must keep by law is used only for that purpose and deleted at the end of the legal period. When you close your account, your sign-in credentials (email, password, social account identifier), name and phone number are immediately deleted or de-identified, and your saved addresses and wishlist are deleted; order and payment records are kept for the legal periods in Section 3. Electronic files are deleted irrecoverably and paper records are shredded or incinerated.

1. You may at any time request access to, correction or deletion of, or suspension of processing of your personal information, or withdraw consent.
2. In My Page you can view and edit your name and phone number, add or delete addresses, turn marketing consent on or off, change your password and close your account.
3. For other requests, email our Privacy Officer at [email protected]. We will respond within 10 days. You may also act through a legal representative or an authorised agent with a power of attorney.
4. Information we are legally required to keep cannot be deleted on request, and requests may be refused where they could harm another person's life, body or property; we will explain any refusal.
5. We do not accept registrations from children under 14 and delete any such information without delay once we become aware of it.
6. Please keep your information accurate and up to date.

If you live outside Korea, you may have additional rights under local law (for example, data portability or the right to object); we will honour them through the same contact.

• Administrative: access to personal information is limited by role (super admin, operations, staff, partner seller, creator); partner sellers and creators can access only their own data.
• Technical: passwords stored with one-way encryption (bcrypt); all traffic encrypted with HTTPS (TLS 1.3); token-based access control with ownership checks; rate limiting on sign-in and password recovery; payment credentials not stored (handled by the payment provider); uploaded images re-encoded to strip metadata such as photo location.
• Physical: servers run in a cloud data centre (Vultr) with access controls and security certifications; the database cannot be reached directly from the internet.

We do not process pseudonymised information.

For reports or advice on privacy infringement you may contact: Personal Information Dispute Mediation Committee (1833-6972, www.kopico.go.kr); Privacy Infringement Report Center, KISA (118, privacy.kisa.or.kr); Supreme Prosecutors' Office (1301, www.spo.go.kr); Korean National Police Agency Cyber Bureau (182, ecrm.police.go.kr). Users abroad may also contact the data protection authority in their country.

This Policy is effective from September 17, 2026. We will announce any additions, deletions or changes on the Notice board at least 7 days before they take effect (30 days for changes that significantly affect your rights).