Privacy Policy

1. Personal data we collect

We collect only the items below. We do not collect dates of birth or card numbers.

• When you sign in with Google — email address, name and profile picture. Google passes these to us with your consent; your password is never passed on.
• When you place an order — recipient name, destination country and address, contact number, order contents, and a payment reference returned by the payment provider.
• If you choose to tell us — age band, gender, phone number, skin concerns and skin type. All optional; leaving them blank does not limit your use of the store.
• Automatically when you visit — country code, display language, and a session identifier held in a cookie. The country code sets your language and currency and feeds country-level sales figures.

2. What we use it for

• Identifying you and keeping you signed in
• Taking orders, confirming payment, international shipping and customs clearance, returns and exchanges
• Sending order and shipping notices (transactional messages, sent regardless of marketing consent)
• Only where you have consented: repurchase reminders and marketing messages. These are consented to separately and can be withdrawn separately at any time.
• Recommending products that match your skin concerns
• Country-level sales figures and stock planning, viewed only in aggregate form that does not identify individuals

3. How long we keep it

• Account data — until you close your account or withdraw consent. We delete it without delay on request.
• Transaction records — under Korean e-commerce law: contract and withdrawal records 5 years, payment records 5 years, consumer complaint and dispute records 3 years.
• Access logs — 3 months, under the Korean Protection of Communications Secrets Act.

4. Sharing with third parties

We do not sell personal data or hand it over for advertising. We share it only to ship what you ordered — recipient details and address go to the carrier and the customs broker — and where a lawful request from an authority requires it.

5. Processors and transfers abroad

We entrust processing to the providers below to run the store; their servers may sit outside the Republic of Korea. Each receives only what its role requires.

• Google LLC (United States) — Google account sign-in
• PayPal (United States, Singapore) — overseas payment and refunds
• Vercel Inc. (United States) — website hosting
• Neon Inc. (United States) — member and order database
• Resend Inc. (United States) — order and shipping emails
• International carriers and customs brokers — delivery and clearance

6. Cookies

We use cookies to keep you signed in, to remember the destination country you picked, and to hold your cart. All are needed for the store to work; we do not use cookies that follow you across other sites for advertising. Blocking cookies in your browser will stop sign-in and the cart from working.

7. Your rights

You may view, correct or delete your personal data, ask us to stop processing it, and withdraw consent, at any time. Change it yourself in your account page, or write to the contact below. Transaction records subject to the statutory retention periods in section 3 are kept for those periods.

8. How we keep it safe

• All traffic to the store is encrypted with HTTPS.
• Sign-in sessions are signed so that only the server can verify them, and the cookie is not readable by JavaScript.
• We never store card or bank account numbers. Payment happens on the payment provider’s own screens and we receive only a transaction reference.
• Access to personal data is limited to the smallest number of staff whose work requires it.

9. Data protection officer

Send questions about personal data, requests to view, correct or delete it, and complaints to the contact below. We reply within 10 business days of receipt.

Company

Alplab Korea CORP.

Officer

Jeong Wonjae

Email

contact@alplab.co.kr

Tel

070-4571-8534

Address

B-919, 920, Public Gasan, 178 Digital-ro, Geumcheon-gu, Seoul 08513, Republic of Korea

10. Changes to this policy

We announce changes on this page at least 7 days before they take effect. For changes that work against you — collecting more items, or changing who we entrust data to — we give 30 days’ notice and ask for your consent again.