Privacy Policy

1. Data we collect and how

• Account sign-up: email address and name (for Google sign-in, the email and profile information of your Google account)
• Purchases: order history and payment method details. Sensitive payment data such as card numbers is processed by our payment providers (Toss Payments for KRW orders, Paddle.com for international USD orders) and is never stored by the Company.
• License activation: a hardware identifier (HWID) — a one-way SHA-256 hash of device information that cannot identify an individual on its own.
• Automatically collected during use: IP address, cookies, access logs.

We do not allow account registration by children under 14. Accounts found to belong to a child under 14 are suspended and their data deleted.

2. Purposes of processing

• Account management: providing member services, identity verification, preventing misuse
• Service delivery: purchases and payments, license issuance and verification, order management
• Customer support: responding to inquiries, notices, update notifications
• Service improvement: usage statistics
• Marketing: emails about new products, updates, events and promotions

You can opt out of marketing emails at any time via the unsubscribe link at the bottom of each email or by contacting contact@iiiahalab.com. Transactional emails about your orders, licenses and membership are sent regardless of marketing preferences.

3. Retention

• Account data: until account deletion (deleted without delay upon request)
• Order and payment records: 5 years (Korean e-commerce consumer protection law)
• Records of consumer complaints and dispute handling: 3 years
• Access logs: 3 months (Korean communications privacy law)

4. Disclosure to third parties

We do not disclose personal data to third parties except with your prior consent or where required by law or by a lawful request from a competent authority.

5. Processors and international transfers

We use the following service providers to operate the Service:

• Supabase Inc. (USA) — storage of account, order and license data (AWS)
• Vercel Inc. (USA) — website hosting
• Cloudflare, Inc. (USA) — video streaming
• Toss Payments Co., Ltd. (Korea) — payment processing for KRW orders
• Paddle.com Market Limited (UK) / Paddle.com Inc. (USA) — payment processing, tax and invoicing for international USD orders, as Merchant of Record
• Google LLC (USA) — Google sign-in, usage analytics (Google Analytics 4)
• Resend, Inc. (USA) — transactional and service emails

Data transferred to these providers (account details, order and payment information, license information, access logs) is transmitted encrypted over the internet and stored in their data centres in the USA and UK. Each provider maintains recognised security standards (GDPR, SOC 2, ISO 27001). You may object to international transfers, but the Service may then be unavailable to you.

6. Deletion

Personal data is deleted without delay once its retention period expires or its purpose is fulfilled. When you delete your account, your data is removed from our database immediately; data that must be retained by law is stored separately and deleted when the retention period ends.

7. Your rights

You may at any time request access to, correction or deletion of your personal data, request that processing be suspended, and opt out of marketing emails. You can exercise these rights from My Page or by emailing contact@iiiahalab.com.

8. Cookies

We use essential cookies (login session, cart state) and analytics cookies (Google Analytics 4, anonymised usage statistics). We do not use advertising or tracking cookies. Marketing emails may include a 1×1 pixel used only to measure open rates in aggregate. You can block cookies in your browser settings or install the Google Analytics opt-out add-on; some features may then be limited.

9. Security

• Technical: HTTPS encryption, restricted database access, hashed password storage
• Organisational: data minimisation, access control

10. Data protection officer

• Name: Sanghoon Lee
• Email: contact@iiiahalab.com

11. Changes to this policy

Changes to this policy are announced on the Site at least 7 days before they take effect. This English translation is provided for convenience; in the event of any inconsistency, the Korean version prevails.