Privacy Policy

Cozi Studio (코지스튜디오) (the “Company”) operates the COZi commerce service (www.cozi-studio.com, app.cozi-studio.com and related APIs; the “Service”). In accordance with Article 30 of the Personal Information Protection Act (PIPA), the Company establishes and discloses this Privacy Policy as follows in order to protect the personal information of data subjects and to handle related grievances promptly.

1. Items of personal information processed and methods of collection

The Company processes only the personal data necessary to provide the Service. The website and workspace process the items below for account use, store connections, integrated management and support requested by users. The actual items may vary with each store API and the seller’s settings.

2. Purposes of processing personal information

• Service provision: Member identification, account management, Service usage records, store connections, integrated product, order, inventory, delivery and inquiry management, and task history
• Service improvement: Identifying errors and improving quality
• Ensuring a safe usage environment: preventing fraudulent use, tracing requests (request IDs) and responding to failures
• Support: Receiving COZi service inquiries and communicating the outcome
• Tasks entrusted by sellers: Collecting and viewing connected-store orders, processing deliveries, reflecting inventory changes, viewing customer inquiries and performing supported reply actions, and exports requested by sellers. Available actions depend on store APIs and account permissions.

The Company does not use personal information for any purpose other than those above. If a purpose changes, the Company will take the necessary measures, such as obtaining separate consent, in accordance with Article 18 of the PIPA.

The Company processes personal data necessary for account registration, account management and services requested by members under Article 15(1)(4) of Korea’s Personal Information Protection Act (entering into and performing a contract). Sellers’ customer data is processed on the sellers’ instructions within their lawful basis for processing and the outsourcing relationship under Article 26. Where separate consent is required for optional processing or use outside the stated purposes, the Company provides separate information and obtains that consent.

3. Processing and retention periods of personal information

The Company applies the retention periods below according to the processing purpose and lawful basis and manages records subject to statutory preservation separately.

The following periods apply only when the Company’s own transactions create records subject to statutory preservation: contracts or withdrawal records, 5 years; payment and supply records, 5 years; consumer complaints or dispute-resolution records, 3 years (Act on Consumer Protection in Electronic Commerce). They do not mean that every customer order, contact or delivery record entrusted by a seller is retained for those periods.

4. Provision of personal information to third parties

The Company processes data subjects’ personal information only within the scope of the purposes set out in Section 2 and does not provide it to third parties except in cases falling under Articles 17 and 18 of the PIPA, such as where the data subject has given separate consent or where a law contains special provisions.

To perform delivery tasks requested by a seller, necessary sender, recipient and shipment data may be transmitted to the contracted carrier the seller connects and selects from the supported carriers (CJ Logistics, Korea Post contract parcels, Lotte Global Logistics and Logen). Processing follows the seller’s connected contract account and the entrusted tasks; data is not sent to every carrier for every seller. Required data-provision and processing procedures are distinguished according to the actual contractual relationship.

5. Outsourcing of personal information processing and overseas transfer

To operate the Service, the Company outsources personal information processing tasks as set out below, and some processors are located overseas. The method of transfer is transmission over information and communications networks at the time the Service is used, and the time of transfer is when the Service is used.

The Company stipulates safeguards for personal data in processing agreements and supervises processors. Changes to processors or their entrusted tasks are disclosed through this Policy.

Overseas storage, processing and access are managed by actual processing route and purpose. Vercel handles Service requests in the United States and Korea, while the primary Supabase database is in Seoul, Korea. Access by the Singapore service entity or, where necessary, its US affiliate for operations and support is distinct from database storage location. Storage in Seoul does not establish that there is no overseas access.

Necessary data is transmitted over networks when accessing web/API services or running features; database storage and queries occur during Service use. Company data follows Section 3, while provider-internal security and support processing is distinguished by its purpose. Refusing essential hosting prevents the related web/API functions; refusing database use prevents account and integration features requiring storage.

Google Cloud’s fixed-IP relay is used for store API communications. Source code uses encrypted HTTPS connections, but this alone does not verify every record or access scope on the operational server. The precise contracting service entity and retention of relay operational logs have not yet been verified. We do not represent the overseas-transfer disclosure for this part as complete. When verified evidence is obtained, we will supplement the entity, processing locations, retention and required procedures.

Channel Corp.’s public information distinguishes domestic infrastructure from support by affiliates in Japan or the United States where needed. This does not mean all COZi consultation data is transferred to those countries. If additional overseas support is needed, the applicable scope, legal basis and required procedures will be addressed.

Where overseas outsourced processing or storage is necessary to enter into or perform a contract and statutory disclosures have been provided, the basis is Article 28-8(1)(3) of Korea’s Personal Information Protection Act. Optional processing outside that exception is performed only after separate consent or another lawful basis is established. Sellers’ customer data is also subject to the sellers’ processing basis and processor/subprocessor relationships.

Data subjects who object to transfers may contact us through Section 10 or stop using the relevant feature or connection. Rejecting optional support or analytics does not restrict all unrelated services. Access, deletion and processing-restriction requests concerning stored data may be submitted under Section 8.

For subprocessing of sellers’ customer data, the Company obtains consent required under the processing agreement; a notice alone does not replace consent required by law.

6. Installation, operation and refusal of devices that automatically collect personal information (cookies)

The website does not currently collect optional visit statistics or load Google Analytics, NAVER Analytics or Vercel Web Analytics. Essential hosting and security access records are processed separately from optional analytics. Before introducing optional analytics, we will provide provider-specific information on data, purposes, retention and relevant overseas transfers, and distinguish consent to processing from any separately required transfer consent. Rejecting analytics will not restrict core features.

The Company uses cookies needed to maintain login sessions and remember the selected language. Cookies are small pieces of information sent by a server to the browser and stored on the user’s device.

Users may refuse or delete cookies in their browser settings (for example, in Chrome: Settings → Privacy and security → Cookies). Refusing essential cookies may prevent certain functions, such as workspace login.

Opening support chat may activate the provider’s device-identification and conversation-continuity functions. Chat cookies and connection data are distinguished from the pseudonymous member identifier sent by the workspace.

7. Procedures and methods for destroying personal information

• Destruction procedure: The Company destroys personal information without delay once its retention period has expired or the purpose of processing has been achieved. Information that must be preserved under applicable laws is stored separately and destroyed once the relevant period has passed.
• Destruction method: Information in the form of electronic files is deleted by methods that make it unrecoverable, and paper documents are shredded or incinerated.

The Company does not manually back up the database to separate files or external storage and does not use scheduled backups or point-in-time recovery (PITR) for the current project. This does not mean the provider performs no internal security or disaster-recovery processing. The provider’s processing scope is separately addressed in the outsourcing and overseas-transfer disclosures.

8. Rights and obligations of data subjects and how to exercise them

Data subjects may at any time request from the Company access to, correction or erasure of, or suspension of the processing of their personal information, and may withdraw their consent. Requests to exercise these rights may be made by phone or email to the privacy officer in Section 10, and the Company will take action without delay.

• Rights may also be exercised through a representative, such as a legal representative or a person who has been delegated authority. In this case, a power of attorney prepared in accordance with Annex Form 11 of the “Notice on Methods of Processing Personal Information” must be submitted.
• Requests for access and suspension of processing may be restricted under Article 35(4) and Article 37(2) of the PIPA.
• Erasure may not be requested for personal information that other laws specify as subject to collection.
• The Company verifies whether the person making a request is the data subject or a legitimate representative.

Sellers’ customers may also submit rights requests through the Company’s contact channel. After necessary identity verification, the Company cooperates with the relevant seller and processes requests in accordance with applicable law and the scope of the entrusted tasks.

9. Measures to ensure the security of personal information

• Protection of passwords and connection credentials: COZi account passwords are stored only as scrypt hash values, and the plaintext is not retained. Store app secrets, access and refresh tokens, and Imweb admin session information are encrypted with AES-256-GCM and stored on the server.
• Protection in transit: All communications are encrypted with HTTPS, and session cookies are protected with the HttpOnly and Secure attributes.
• Access control: Stores can be connected only from a signed-in workspace, and data is kept separate per workspace. The Origin of state-changing requests is verified.
• Data minimization in records: We process records necessary for request tracing and incident response and limit unnecessary recording of credentials and personal data. Order personal-data export records are separately managed to track access.
• Task-specific permissions: Permissions required for product, order, delivery, inventory and inquiry processing vary by connected store and feature. Supported modifications and transmissions are performed within the seller’s instructions and account permissions.

10. Privacy officer

The Company has designated the privacy officer below to take overall responsibility for tasks related to the processing of personal information and to handle data subjects’ complaints and provide relief for damage.

Data subjects may direct to the privacy officer all inquiries relating to personal information protection, complaint handling, relief for damage and other such matters arising from their use of the Service, and the Company will respond to and handle them without delay.

11. Remedies for infringement of rights and interests

Data subjects who need to report or seek consultation on an infringement of personal information may contact the organizations below.

• Personal Information Dispute Mediation Committee: 1833-6972 (in Korea, no area code), www.kopico.go.kr
• Korea Internet & Security Agency (KISA) Privacy Infringement Report Center: 118 (in Korea, no area code), privacy.kisa.or.kr
• Supreme Prosecutors’ Office Cyber Investigation Division: 1301 (in Korea, no area code), www.spo.go.kr
• Korean National Police Agency Cyber Bureau: 182 (in Korea, no area code), ecrm.cyber.go.kr

12. Changes to this Privacy Policy

This corrected Privacy Policy applies from October 21, 2026. It corrects the current Service processing scope and provider information and distinguishes unverified operational matters from established facts. The previous version is available through the history link on this page. Future changes will state their effective date and key changes, with required advance notice and consent procedures handled separately.

These factual corrections do not retroactively replace any lawful basis or consent required for past processing. Processing for new purposes or changes requiring separate consent will take effect only after the relevant procedures are completed.