Privacy Policy

1. Information We Collect

We collect information you provide directly when you:

• Create an account: name, email address, password
• Place an order: shipping address, phone number, product URLs
• Make a payment: payment is processed by PayPal; we do not store credit card numbers
• Contact us: email content and attachments

We automatically collect:

• IP address and browser type (for rate limiting and security)
• Pages visited and interaction data (via Vercel Analytics, if enabled)

2. How We Use Your Information

• Process and fulfill your orders
• Send order confirmation, shipping updates, and payment receipts
• Respond to customer service inquiries
• Prevent fraud and abuse
• Generate customs documents (CN22, commercial invoice) required for international shipping
• Improve our service

3. Information Sharing

We share your personal data only when necessary to provide our service:

• Shipping carriers: name, address, phone number for delivery
• Payment processors: PayPal processes your payments under their own privacy policy
• Customs authorities: as required by law for international shipments

We do not sell your personal information to third parties.

4. Data Storage & Security

Your data is stored securely on Supabase (PostgreSQL) with row-level security policies. Passwords are hashed. Admin access is protected by HMAC session tokens with timing-safe comparison. All communication is encrypted via HTTPS.

5. Cookies

We use essential cookies only: authentication session tokens and Supabase auth cookies. We do not use advertising or third-party tracking cookies.

KoreaBox uses first-party page analytics to understand site traffic. We store normalized page paths, referrer origin, campaign tags, approximate region headers, user-agent-derived browser/device signals, crawler guesses, bounded user-agent strings, and hashed IP-derived visitor buckets. Raw IP addresses are not stored. We may use localStorage and sessionStorage identifiers to avoid double-counting visits.

6. Your Rights

You may:

• Request access to your personal data
• Request correction or deletion of your data
• Cancel your account at any time

To exercise these rights, contact us at [email protected].

7. Data Retention

We retain order data for 5 years for tax and legal compliance. Account data is deleted within 30 days of account cancellation, except where retention is required by law.

8. Children's Privacy

Our service is not directed to individuals under 18. We do not knowingly collect personal information from children.

9. Changes to This Policy

We may update this privacy policy from time to time. We will notify you of any changes by posting the new policy on this page and updating the "Last updated" date.

10. Contact Us

If you have any questions about this privacy policy, please contact us at [email protected].

KoreaBox
Business Registration No. 838-49-01140
Republic of Korea