1. Why We Process Your Information

• Account management: identifying you, maintaining your membership and preventing misuse
• Bookings: receiving and confirming bookings, arranging schedules with Partner Shops and sending booking emails
• Payments: approving and cancelling payments, issuing refunds and keeping transaction records
• Customer support: answering inquiries, handling complaints and resolving disputes
• Improving the Service and marketing: usage analytics, measuring ad performance and, only with your separate consent, sending offers and event news

2. What We Collect and How

• Creating an account (Google or Apple sign-in)
  • Required: name, email address and social account identifier
  • If you use Apple's Hide My Email, we receive the relay email address Apple provides.
• Booking requests
  • Required: first and last name, email address, mobile phone number, number of guests, preferred dates and times, and the service booked
• Payments
  • PayPal transaction ID, payment method (PayPal account or card), card brand and last four digits, amount and time of payment, and cancellation and refund history
  • Full card numbers, PayPal account details and other payment details are entered directly into PayPal and handled by PayPal under its own privacy policy. We do not receive or store them.
• Customer support (Channel Talk and email)
  • Name, email address, the content of your inquiry and how you found us (UTM)
• Collected automatically when you use the Service
  • IP address, cookies, device and browser information, visit times, pages viewed and advertising identifiers
• We do not, as a rule, collect sensitive information such as health data. If you tell us about skin conditions or allergies so your service can be performed safely, we ask for your separate consent and use that information only for that booking.

3. How Long We Keep Your Information

We delete your personal information without delay when you close your account or once the purpose of processing has been achieved. However, we keep the following records for the periods required by law.

• Records of contracts and order withdrawals: 5 years (Act on Consumer Protection in Electronic Commerce)
• Records of payments and supply of goods or services: 5 years (same Act)
• Records of consumer complaints and dispute handling: 3 years (same Act)
• Records of labeling and advertising: 6 months (same Act)
• Access logs: 3 months (Protection of Communications Secrets Act)

4. How We Delete Your Information

• When the retention period ends or the purpose has been achieved, we delete your personal information without delay. Records we must keep by law are stored separately.
• Electronic files are deleted so they cannot be recovered, and paper documents are shredded or incinerated.

5. Sharing with Third Parties

We share your personal information with third parties only with your consent or where the law allows. To carry out your booking, we share the following.

• Recipient: the Partner Shop providing the Beauty Service you booked
  • Purpose: confirming your booking and providing the Beauty Service
  • Information shared: your name, number of guests, booking date and time, the service booked and, if you told us, notes relevant to your treatment
  • Retention: deleted without delay after the service is provided, unless a longer period is required by law
• You may refuse this sharing, but if you do, we will not be able to process your booking.

6. Service Providers

We use the following service providers to process personal information on our behalf.

• PayPal Pte. Ltd.: payment processing, cancellations and refunds
• Channel Corporation: customer support chat (Channel Talk)
• Supabase, Inc.: sign-in, database and file storage
• Vercel Inc.: website hosting
• Resend (Plus Five Five, Inc.): booking emails
• Google LLC: website analytics (Google Tag Manager and Google Analytics)
• Our contracts with these providers require them to keep your information secure, and we supervise how they handle it. If our providers or the work they do for us change, we will update this policy.

7. International Transfers

To provide the Service under our contract with you, we entrust the processing and storage of personal information to the following providers outside Korea.

• PayPal Pte. Ltd. (Singapore) — www.paypal.com/kr/legalhub/privacy-full
  • Information: order number, service booked, payment amount, and refund amount and reason if you are refunded
  • Purpose: payment processing, cancellations and refunds
  • Any payment details or PayPal account information you enter on PayPal's payment screen are collected and handled directly by PayPal under its own privacy policy.
• Supabase, Inc. (United States) — privacy@supabase.io
  • Information: account details, booking details and payment records
  • Purpose: sign-in, database and file storage
• Vercel Inc. (United States) — privacy@vercel.com
  • Information: access logs, IP address and other information sent when you use the Service
  • Purpose: website hosting
• Resend (Plus Five Five, Inc., United States) — privacy@resend.com
  • Information: name, email address and booking details
  • Purpose: booking emails
• Google LLC (United States) — googlekrsupport@google.com
  • Information: cookies, device and browser information and usage records
  • Purpose: usage analytics
• When and how: transmitted over the network at the time you use the Service
• Retention: until you close your account or our contract with the provider ends, unless a longer period is required by law
• You may refuse these transfers, but because these providers are essential to the Service, you will not be able to use it if you do. You can refuse analytics through your cookie settings.

8. Your Rights

• You may ask at any time to access, correct or delete your personal information, to suspend its processing, or to withdraw your consent.
• Send your request to help@kbeautytrip.app and we will act on it without delay. A legal representative or a person you authorize may also make a request on your behalf.
• Records we are required to keep by law may be retained for the required period even if you ask us to delete them.

9. How We Keep Your Information Safe

• We limit access to personal information to the fewest people necessary and apply row-level access controls to our database.
• Data in transit is encrypted with HTTPS. Payment details are handled by our payment provider and are not stored by us.
• We keep access logs and review them regularly.

10. Cookies

• We use cookies and similar technologies to keep you signed in, analyze how the Service is used and measure ad performance.
• Through Google Tag Manager, we may use Google Analytics and tools from advertising platforms such as Meta. These platforms may collect behavioral information, such as the pages you visit and how you use them.
• You can refuse or delete cookies in your browser settings, although some features, such as signing in, may not work.

11. Children

• We do not accept members under the age of 14 and do not knowingly collect personal information from children under 14.

12. Privacy Officer

• Privacy Officer: Sunyoung Lee (CEO)
• Email: help@kbeautytrip.app
• Please contact us with any questions, complaints or requests about how we handle your personal information. We will respond without delay.

13. Other Places to Get Help

If you need to report or get advice about a privacy violation, you can also contact the following Korean authorities.

• Personal Information Dispute Mediation Committee: 1833-6972 (www.kopico.go.kr)
• Personal Information Infringement Report Center: 118 (privacy.kisa.or.kr)
• Supreme Prosecutors' Office: 1301 (www.spo.go.kr)
• Korean National Police Agency: 182 (ecrm.police.go.kr)

14. For Users Outside Korea

• If you are in the European Economic Area, the UK or elsewhere, we process your information to perform our contract with you (bookings and payments), to comply with legal obligations, for our legitimate interests (keeping the Service secure and improving it), and with your consent (marketing and analytics cookies).
• Depending on the laws where you live, you may have the right to access, correct, delete, restrict, port or object to the processing of your information. You can exercise these rights by emailing us at the address above.

15. Changes to This Policy

• This policy applies from October 1, 2026.
• If we add, remove or change anything, we will announce it on the Service at least 7 days before it takes effect, or at least 30 days before for changes that significantly affect your rights.
• This policy is provided in Korean and English. If there is any difference in interpretation between the two, the Korean version prevails.