Previous Privacy Policy

Cozi Studio (코지스튜디오) (the “Company”) operates the COZi commerce service (www.cozi-studio.com, app.cozi-studio.com and related APIs; the “Service”). In accordance with Article 30 of the Personal Information Protection Act (PIPA), the Company establishes and discloses this Privacy Policy as follows in order to protect the personal information of data subjects and to handle related grievances promptly.

1. Items of personal information processed and methods of collection

The Company processes only the minimum personal information necessary to provide the Service. The website does not collect personal information entered directly by users, and the workspace processes the items below in the course of signing up and connecting stores.

2. Purposes of processing personal information

• Providing the Service: identifying members and managing accounts, managing the granting and use of credits, connecting stores, and executing product copy jobs and providing their history
• Improving the Service: analyzing visit and usage statistics, identifying errors and improving quality
• Ensuring a safe usage environment: preventing fraudulent use, tracing requests (request IDs) and responding to failures
• Responding to inquiries: receiving inquiries and providing notice of the results

The Company does not use personal information for any purpose other than those above. If a purpose changes, the Company will take the necessary measures, such as obtaining separate consent, in accordance with Article 18 of the PIPA.

3. Processing and retention periods of personal information

The Company processes and retains personal information within the retention period under applicable laws or the period consented to by the data subject.

However, where retention is required under the following laws, the Company keeps the information for the relevant period: records of contracts or withdrawal of subscriptions, etc., for 5 years; records of payment and supply of goods, etc., for 5 years; records of consumer complaints or dispute resolution for 3 years (Act on the Consumer Protection in Electronic Commerce); and access logs related to the use of the Service for 3 months (Protection of Communications Secrets Act).

4. Provision of personal information to third parties

The Company processes data subjects’ personal information only within the scope of the purposes set out in Section 2 and does not provide it to third parties except in cases falling under Articles 17 and 18 of the PIPA, such as where the data subject has given separate consent or where a law contains special provisions.

5. Outsourcing of personal information processing and overseas transfer

To operate the Service, the Company outsources personal information processing tasks as set out below, and some processors are located overseas. The method of transfer is transmission over information and communications networks at the time the Service is used, and the time of transfer is when the Service is used.

Data subjects may refuse the collection of analytics cookies by the methods described in Section 6. When entering into outsourcing contracts, the Company stipulates matters for the secure management of personal information and supervises the processors. Any change of processors will be disclosed through this Privacy Policy.

6. Installation, operation and refusal of devices that automatically collect personal information (cookies)

The Company uses cookies to provide users with customized services and to understand usage. Cookies are small pieces of information that the server used to operate a website sends to the user’s browser, and they are stored in the storage of the user’s device.

Users may refuse the storage of cookies or delete them in their browser settings (e.g., in Chrome: Settings → Privacy and security → Cookies). Users may also opt out of Google Analytics with the Google Analytics Opt-out Browser Add-on. If essential cookies are refused, some parts of the Service, such as workspace login, may be difficult to use.

7. Procedures and methods for destroying personal information

• Destruction procedure: The Company destroys personal information without delay once its retention period has expired or the purpose of processing has been achieved. Information that must be preserved under applicable laws is stored separately and destroyed once the relevant period has passed.
• Destruction method: Information in the form of electronic files is deleted by methods that make it unrecoverable, and paper documents are shredded or incinerated.

8. Rights and obligations of data subjects and how to exercise them

Data subjects may at any time request from the Company access to, correction or erasure of, or suspension of the processing of their personal information, and may withdraw their consent. Requests to exercise these rights may be made by phone or email to the privacy officer in Section 10, and the Company will take action without delay.

• Rights may also be exercised through a representative, such as a legal representative or a person who has been delegated authority. In this case, a power of attorney prepared in accordance with Annex Form 11 of the “Notice on Methods of Processing Personal Information” must be submitted.
• Requests for access and suspension of processing may be restricted under Article 35(4) and Article 37(2) of the PIPA.
• Erasure may not be requested for personal information that other laws specify as subject to collection.
• The Company verifies whether the person making a request is the data subject or a legitimate representative.

9. Measures to ensure the security of personal information

• Protection of passwords and connection credentials: COZi account passwords are stored only as scrypt hash values, and the plaintext is not retained. Store app secrets, access and refresh tokens, and Imweb admin session information are encrypted with AES-256-GCM and stored on the server.
• Protection in transit: All communications are encrypted with HTTPS, and session cookies are protected with the HttpOnly and Secure attributes.
• Access control: Stores can be connected only from a signed-in workspace, and data is kept separate per workspace. The Origin of state-changing requests is verified.
• Minimal logging: Logs record only the request ID, method, response status and processing time; request bodies, authentication headers and customer information are not recorded.
• Least privilege: Only read permissions for products and categories are requested for the source store.

10. Privacy officer

The Company has designated the privacy officer below to take overall responsibility for tasks related to the processing of personal information and to handle data subjects’ complaints and provide relief for damage.

Data subjects may direct to the privacy officer all inquiries relating to personal information protection, complaint handling, relief for damage and other such matters arising from their use of the Service, and the Company will respond to and handle them without delay.

11. Remedies for infringement of rights and interests

Data subjects who need to report or seek consultation on an infringement of personal information may contact the organizations below.

• Personal Information Dispute Mediation Committee: 1833-6972 (in Korea, no area code), www.kopico.go.kr
• Korea Internet & Security Agency (KISA) Privacy Infringement Report Center: 118 (in Korea, no area code), privacy.kisa.or.kr
• Supreme Prosecutors’ Office Cyber Investigation Division: 1301 (in Korea, no area code), www.spo.go.kr
• Korean National Police Agency Cyber Bureau: 182 (in Korea, no area code), ecrm.cyber.go.kr

12. Changes to this Privacy Policy

This Privacy Policy takes effect on September 27, 2026. If content is added, deleted or modified due to changes in laws or the Service, the Company will give notice on this page starting 7 days before the changes take effect. If there is a material change to the rights of data subjects, the Company will give notice 30 days before the change takes effect.