Privacy Policy

1. Purposes of Processing

The Company processes personal information for the following purposes only. If a purpose changes, the Company takes necessary measures such as obtaining separate consent under Article 18 of the Act.

• Membership registration and management: confirming intent to register, identification and authentication, maintaining membership, preventing misuse, notices, handling grievances
• Provision of goods or services: delivering products, providing services, sending contracts and invoices, identity verification, payment and settlement, managing order history
• Handling grievances: verifying the complainant, checking the complaint, contacting for fact-finding, notifying results
• Handling exchanges, returns and refunds, and responding to disputes

2. Personal Information Collected and Methods

• Registration (e-mail): required — e-mail address, password (stored encrypted), name / optional — mobile phone number
• Registration (social login such as Kakao): required — social account identifier, e-mail address, name (nickname) / optional — profile image
• Orders and delivery: required — recipient name, mobile phone number, postal code and address, delivery note, order and payment history
• Payment: payments are processed by payment gateways (Toss Payments, Smartro). The Company does not store card or bank account numbers, and keeps only the approval number, payment method type and amount.
• Exchanges, returns and refunds: required — reason, refund account details (for bank-transfer refunds)
• Automatically generated during use: IP address, access time, service usage records, device and browser information, cookies

Methods: entered directly by the user at registration, ordering or customer inquiries; provided by the social login provider; generated automatically during service use.

3. Processing and Retention Period

The Company retains personal information within the period required by law or agreed at collection.

• Membership: until withdrawal; if an investigation under applicable law is in progress, until it ends; if claims or obligations remain, until they are settled
• Goods or services: until supply and payment settlement are complete, subject to the following statutory retention under the Act on Consumer Protection in Electronic Commerce
• Records on contracts or withdrawal of offers: 5 years
• Records on payment and supply of goods: 5 years
• Records on consumer complaints or dispute handling: 3 years
• Records on labeling and advertising: 6 months
• Access records (login records, IP) under the Protection of Communications Secrets Act: 3 months
• Records on electronic financial transactions under the Electronic Financial Transactions Act: 5 years

4. Provision to Third Parties

The Company processes personal information only within the purposes in Section 1 and provides it to third parties only with the data subject's consent or where Articles 17 and 18 of the Act apply.

For delivery, the Company provides information as follows:

• Recipient: the courier designated at order time (e.g. CJ Logistics, Lotte, Hanjin, Korea Post) / Items: recipient name, mobile phone number, address, delivery note / Purpose: delivering products / Retention: until delivery is complete and the courier's statutory retention period ends

5. Outsourcing of Processing

The Company outsources processing as follows:

• Supabase, Inc.: member authentication and database hosting (servers in the Seoul, Republic of Korea region)
• Vercel, Inc.: website hosting and deployment
• Toss Payments Co., Ltd. and Smartro Co., Ltd.: payment processing and settlement
• Resend, Inc.: sending transactional e-mails about orders and delivery
• Kakao Corp.: identity confirmation for social login

Under Article 26 of the Act, outsourcing contracts specify prohibition of processing beyond the outsourced purpose, technical and managerial safeguards, restrictions on sub-outsourcing, supervision and liability, and the Company supervises the processors. Changes to the outsourced work or processors are disclosed through this Policy without delay.

6. Cross-border Transfer

Under Article 28-8(1)(3) of the Act (outsourcing or storage necessary to conclude and perform a contract with the data subject), the Company transfers personal information abroad as follows:

• Recipient: Vercel, Inc. / Country: United States / When and how: transmitted over the network when the service is used / Items: IP address, device and browser information, usage records / Purpose: website hosting and deployment / Retention: until the outsourcing contract ends
• Recipient: Resend, Inc. / Country: United States / When and how: transmitted over the network when an e-mail is sent / Items: e-mail address, name, order details / Purpose: sending transactional e-mails / Retention: 30 days after sending

Data subjects may refuse the cross-border transfer by contacting the privacy officer in Section 12. Refusal may limit use of the service.

7. Destruction of Personal Information

1. The Company destroys personal information without delay when it becomes unnecessary, such as when the retention period expires or the purpose is achieved.
2. Where information must be kept under other laws after the period expires or the purpose is achieved, it is moved to a separate database or storage location.
3. Procedure: the Company selects the information to be destroyed and destroys it with the approval of the privacy officer.
4. Method: electronic files are deleted using technical methods that prevent recovery; printed information is shredded or incinerated.

8. Rights of Data Subjects and Legal Representatives

1. Data subjects may at any time request access, correction, deletion or suspension of processing and withdraw consent.
2. Rights may be exercised through My Page (edit profile, withdraw membership) or by contacting the privacy officer in Section 12 in writing, by phone or by e-mail. The Company acts without delay.
3. Rights may be exercised through a legal representative or an authorized agent, in which case a power of attorney in the form prescribed by the Notice on Personal Information Processing Methods must be submitted.
4. Requests for access or suspension may be limited under Articles 35(4) and 37(2) of the Act.
5. Deletion cannot be requested where other laws designate the information as subject to collection.
6. The Company verifies that the person making a request is the data subject or a legitimate agent.

9. Security Measures

• Managerial: establishing and implementing an internal management plan, minimizing and training staff handling personal information
• Technical: managing access rights to processing systems (separated administrator roles), access control (row-level security), one-way encryption of passwords, encryption in transit (HTTPS), retention of access logs
• Physical: the database is stored in a data center in Seoul, Republic of Korea, with controlled physical access

10. Cookies and Automatic Collection

1. The Company uses cookies and browser storage to store and retrieve usage information for personalized service.
2. Items used: login session cookie (authentication), language preference cookie (lavi-locale), guest cart (browser local storage). The Company does not use cookies for advertising or behavioral tracking.
3. You may refuse cookies in your browser settings (Settings > Privacy > Cookies and other site data). Refusing cookies may limit some features such as staying logged in.

11. Children under 14

The Company does not accept registration from, or collect personal information of, children under 14. If it learns that such information has been collected, it destroys it without delay.

12. Privacy Officer

The Company designates the following privacy officer to take overall responsibility for processing and to handle complaints and remedies.

• Privacy officer: 박윤진 (Representative) / Contact: 010-8452-7820 / Address: 경기도 용인시 처인구 금학로515 나동

Data subjects may direct all privacy-related inquiries, complaints and remedy requests to the privacy officer, who will respond and act without delay.

13. Remedies for Infringement

Data subjects may apply for dispute resolution or consultation with the following bodies in the Republic of Korea:

• Personal Information Dispute Mediation Committee: 1833-6972 (www.kopico.go.kr)
• Personal Information Infringement Report Center (KISA): 118 (privacy.kisa.or.kr)
• Supreme Prosecutors' Office: 1301 (www.spo.go.kr)
• Korean National Police Agency: 182 (ecrm.police.go.kr)

A person whose rights or interests are infringed by a disposition or omission of the head of a public institution in response to a request under Articles 35, 36 or 37 of the Act may file an administrative appeal under the Administrative Appeals Act.

14. Changes to this Policy

1. This Policy applies from 2026-09-07.
2. Additions, deletions or amendments due to changes in law, policy or security technology are announced through the Store's notices at least 7 days before they take effect.
3. This Policy was written in Korean. If a translated version differs from the Korean version, the Korean version prevails.