PRIVACY POLICY
We explain transparently what data we use, why we use it, who processes it and how it is protected.
Effective · July 19, 2026 · Version 2026.07.19
DATA CONTROLLER
아기돌풍 · Representative 김종란
Business registration no. 435-50-01307 · 서울시 노원구 · Submit privacy enquiries through online customer care
WHAT WE PROCESS
SSELING collects only what is necessary to provide the service. Optional data is not required for basic product browsing.
Required
Email address, social login provider and identifier, account status
Optional
Name, mobile phone number
Retention
Until membership withdrawal. However, information requiring statutory retention or dispute resolution shall be separately retained for the applicable period.
Required
Order number, product, option, quantity, recipient, contact information, delivery address, and delivery and customs clearance status information
Optional
Delivery instructions and information separately disclosed during customs clearance
Retention
Five years for records concerning contracts, withdrawal, payment, and supply.
Required
Payment amount, payment method category, approval, cancellation and transaction identifiers, and receipt information
Optional
None
Retention
Five years for records concerning payment and the supply of goods. The Company does not directly store card numbers or CVCs.
Required
Inquiry type, title and content, account and order identifiers, and response and handling history
Optional
Images, desired price, product URL, and other information added by the user
Retention
Three years for records concerning consumer complaints or dispute resolution.
Required
Firebase registration token or installation identifier, platform, notification permissions and topics, and most recent registration time
Optional
App version and language
Retention
Until membership withdrawal or termination of use of the notification function. Identifiers confirmed as invalid by the provider shall be deactivated.
Required
Access time, IP address, browser and device information, and request and error logs
Optional
None
Retention
Deleted without delay upon fulfillment of the purpose. Records relating to security incidents or disputes shall be separately retained until resolution and for the statutory retention period.
STATUTORY RETENTION
PROCESSORS
We entrust only necessary work to providers reviewed for contract and security compliance, and control secondary or out-of-scope processing.
| Processor | Service | Data | Retention |
|---|---|---|---|
| Supabase, Inc. | Member authentication, database and file storage, and security operations | Service-processing information, including account, order, and inquiry information | Until membership withdrawal or termination of the outsourcing agreement, excluding information subject to statutory retention. |
| Vercel Inc. | Web and API hosting, transmission, and incident and security logging | Access information and service request data | Until the purposes of service provision and security are fulfilled or the agreement terminates. |
| Toss Payments Co., Ltd. | Payment approval, cancellation, refunds, and fraudulent transaction prevention | Payment and transaction information | For the period prescribed by applicable laws and regulations and the payment service provider’s policies. |
| Google LLC (Firebase Cloud Messaging) | Transmission of mobile push notifications | App installation and registration identifiers, platform, and notification content | Until termination of notification provision or the outsourcing agreement. |
| Google LLC / Apple Inc. | Login using Google and Apple accounts | Login identifier, email address, and profile information the user has consented to provide | Until membership withdrawal, unlinking of the account, or termination of the outsourcing agreement. |
OVERSEAS TRANSFER
Data is transferred only when needed for overseas purchasing and global infrastructure. The seller, logistics provider and country are disclosed when confirmed for an order.
Country · United States
Country · United States
Country · United States
Country · Country of product origin and transit countries, as individually disclosed on the order screen
Information is collected during membership registration, ordering and payment, customer inquiries, social login, app notification permission settings, and use of the services. Optional information is identified as optional when collected. The Company does not solicit membership from children under 14 years of age.
As a general rule, the Company does not provide personal information to third parties without consent. Where information is provided to overseas sellers or logistics and transportation providers as necessary to fulfill an order, the recipient, country, purpose, and information items shall be disclosed during the ordering process or in this Policy. Information shall otherwise be provided only where required by law.
A user who does not want personal information transferred overseas may discontinue use of social login, app notifications, or overseas purchasing agency services and request account deletion through the customer service center. However, if such processing is necessary for an essential function of the services, the user may be unable to use some or all of the services.
Information whose retention period has expired or whose processing purpose has been fulfilled shall be destroyed without delay in a manner that makes recovery difficult. Electronic files shall be processed using secure deletion methods, and printed materials shall be shredded or incinerated. Information retained pursuant to law shall be subject to separate access controls and used solely for the applicable statutory purpose.
Users may request access to and transmission of their personal information, correction or deletion, suspension of processing, withdrawal of consent, and membership withdrawal. These rights may be exercised after identity verification through the account settings in the app or on the website or through the customer service center. A legal representative or authorized person may also submit a request in accordance with procedures prescribed by law.
Cookies and similar storage technologies may be used for essential functions such as maintaining login status, security, and shopping carts. Users may refuse storage through their browser settings, but certain functions, including login, may be restricted. Behavioral information for personalized advertising is not processed without separate consent.
The Company applies encryption during transmission, protection of passwords and authentication information, role-based least-privilege access, audit logs of administrator activities, row-level database access controls, server-only storage of secret keys, log reviews, and incident response procedures.
Requests concerning personal information may be submitted through the online customer service center. Users requiring further assistance may use the consultation and redress procedures of relevant institutions, including the Personal Information Infringement Report Center (118), the Personal Information Dispute Mediation Committee (1833-6972), and the Korean National Police Agency (182).
Privacy enquiries and your rights
After identity verification, customer care will explain the process and result. Material policy changes and their effective date will be announced in the service.
