Privacy Policy

Effective 2026-11-15

1. What we collect and why

What	When	Why
Name, email, phone, shipping address, order details	When you order	To make, ship and support your order
Payment approval details (never your full card number)	When you pay	To take payment and make refunds
Name, email, Instagram (optional), country, your request, reference images, budget, timing	Custom order form	To reply to your request and quote
Photos you upload	Locket Bag DIY orders	To print your cards
Name, email and your message	When you write to us	To answer you
Visit records (IP address, browser, pages, time)	When you visit	To keep the site secure and working

2. How long we keep it

We delete personal data once its purpose is done, except where Korean law requires us to keep it:

Contracts, cancellations, payment and delivery records: 5 years (Act on Consumer Protection in Electronic Commerce)
Complaints and dispute records: 3 years (same Act)
Records of advertising and product displays: 6 months (same Act)
Tax and accounting records: 5 years (Framework Act on National Taxes)
Website visit records: 3 months (Protection of Communications Secrets Act)
Custom requests that don't become an order: deleted 1 year after our last message
Photos uploaded for Locket Bag cards: deleted [90 days] after delivery, unless you ask us to keep them for a reorder

3. Who helps us

These partners process data for us only to provide their service:

Partner	What they do
PayPal Pte. Ltd.	International payments and refunds
UDID Inc. (PayApp, 유디아이디)	Card and easy-pay payments in Korea
Korea Post (우정사업본부)	Delivery in Korea (parcel) and abroad (EMS)
Cloudflare, Inc. (USA)	Website hosting and security; forwarding of our [email protected] inbox (Cloudflare Email Routing)
Resend (Plus Five Five, Inc., USA)	Order, shipping and form notification emails

We don't sell your data or give it to anyone else, except where the law requires it or you agree.

4. Data sent outside Korea

Some partners process data outside Korea. You can refuse this, but we then can't take international payments or ship abroad.

Recipient (country)	Data	When and how	Why	Kept for
PayPal Pte. Ltd. (Singapore) and its affiliates, including in the USA · privacy contact in Korea: [email protected]	Name, email, shipping address, order amount	At payment, over an encrypted connection	Payment and refunds	As set by PayPal and the law
Cloudflare, Inc. (USA, global network) · [email protected]	Visit records, form submissions, emails sent to [email protected]	When you use the site or email us, over an encrypted connection	Hosting, security and email forwarding	As long as needed for the service, as set by Cloudflare's policy and the law
Resend (Plus Five Five, Inc., USA) · [email protected]	Name, email, order or request details in the email	When an order or form email is sent, over an encrypted connection	Sending order and notification emails	Email logs about 30 days, as set by Resend's policy
Postal operators and customs in your country	Name, address, phone, contents and value	At shipping	Delivery and customs clearance	As set by them

5. Your rights

You can ask at any time to see, correct or delete your personal data, to stop its processing, or to withdraw your consent. Write to our privacy officer below and we'll respond within 10 days. A legal guardian, or someone you authorise, can ask on your behalf. We don't knowingly collect data from children under 14 without a guardian's consent.

6. How we delete data

When the retention period ends or the purpose is done, we delete electronic files so they can't be recovered, and shred any paper records.

7. How we protect it

Encrypted connections (HTTPS), no storage of full card numbers, access limited to the owner, strong passwords and two-step sign-in on our accounts, and locked storage for any paper records.

8. Cookies and browser storage

We don't use analytics or advertising cookies. Your cart and display settings are saved only in your own browser and aren't sent to us. PayPal and our hosting provider may set cookies needed for payment and security. You can clear or block these in your browser settings, but the cart or checkout may then not work.

9. Privacy officer

Jae Hee Kwon (권재희), Representative · [email protected] · +82 10-6690-4507

10. Getting help

Customers in Korea can also contact the Personal Information Dispute Mediation Committee (1833-6972, www.kopico.go.kr), the Personal Information Infringement Report Center (118, privacy.kisa.or.kr), the Supreme Prosecutors' Office (1301, www.spo.go.kr) or the Korean National Police Agency (182, ecrm.police.go.kr). If you live outside Korea, you can also contact your local data protection authority.

11. Visitors outside Korea

If the GDPR or a similar law applies to you: we use your data to carry out our contract with you, to meet legal obligations, and for our legitimate interest in running a safe shop. You can also ask for a copy of your data in a portable format, and object to its processing.

12. Changes

We'll post any change here, with its effective date, at least 7 days before it applies. This policy applies from 2026-11-15.