Privacy Policy

🔒 Quick summary: We collect only what's needed for bookings. We never sell your data. You can delete your account anytime. We use Supabase (database), Toss Payments (payments), Resend (email), and OpenAI (AI translation) — that's it.

1. Data Controller

MADEINPEOPLE Co., Ltd. ((주)메이드인피플) — 개인정보처리자 / Data Controller
사업자등록번호 (Business Registration No.): 371-81-01481
Representatives: 설동원, 장명석
Address: 대구광역시 동구 송라로 78-1, 4층

개인정보 보호책임자 (Privacy Officer)

• Name: 메리 (매니저)
• Email: mary@madeinpeople.co.kr
• Phone: 010-9553-1729

2. What we collect

When you sign up

• Email, name, password (hashed), country, date of birth
• Optional: phone number, profile photo, bio
• Google OAuth: email, name, profile photo (with your consent)

When you book

• Booking details (experience, dates, participants)
• Payment information (handled by Toss Payments — we only see last 4 digits and card brand)
• Special requests you provide

Automatically collected

• IP address, browser, device type (for security & analytics)
• Cookies (essential, functional, analytics — you can opt out of analytics)

3. Why we use your data

We process your data only for these purposes (legal basis: Article 15 PIPA / Article 6 GDPR):

• To provide the service — process bookings, payments, communicate with you
• Legal obligations — tax records (5 years), consumer protection (3 years)
• Security — prevent fraud, abuse, hacking attempts
• With your consent — marketing emails, newsletter, AI translation

4. Who we share data with

We share data only with these processors (개인정보 처리위탁):

• Supabase (USA) — database hosting
• Toss Payments (Korea) — payment processing
• Resend (USA) — transactional emails
• OpenAI (USA) — AI-powered translations (text only, no personal data)
• Hosts — your name, email, phone (only after booking, only for active host)

We never sell your data to third parties. Government requests handled per Korean law.

5. International transfers

Some processors are based outside Korea (USA). We use Standard Contractual Clauses (SCC) and ensure equivalent privacy protection. If you're in EU/UK, you can request more details.

6. How long we keep your data

• Account data: until you delete your account
• Bookings & payments: 5 years (Korean tax law requirement)
• Refunds: 3 years (consumer protection law)
• Marketing consent: until you unsubscribe

7. Your rights

Under PIPA and GDPR, you can:

• Access all data we have about you (download from My Page)
• Correct inaccurate data
• Delete your account (some legal records kept anonymized)
• Withdraw consent for marketing/optional uses anytime
• Object to processing
• Data portability — export in machine-readable format
• Lodge a complaint with Korean PIPC (개인정보보호위원회) at 1833-6972

To exercise these rights: email mary@madeinpeople.co.kr or use My Page settings.

8. Cookies

We use 3 types of cookies:

• Essential — login, security, cart (cannot be disabled)
• Functional — language preference, recent searches
• Analytics — usage statistics (anonymous, opt-out available)

You'll see a cookie banner on your first visit. Manage preferences anytime via the footer.

9. Children

We don't allow accounts for children under 14 (Korean PIPA Article 22). If you're 14–18, you need legal guardian consent. We don't knowingly collect data from minors without consent.

10. Security

We protect your data with:

• HTTPS/TLS encryption everywhere
• Passwords hashed (bcrypt/scrypt — we never store plaintext)
• Card data handled only by PCI DSS Level 1 processor (Toss)
• Limited employee access (role-based, audited)
• Regular security audits

11. Changes

Material changes to this policy will be notified 7 days in advance via email and website banner. Date at top shows last update.