Este documento está disponible en coreano e inglés.
greyd Privacy Policy
ARBAIM INC. (the "Company") operates the greyd app and the greyd website (greyd.app; together, the "Service"). This Privacy Policy explains how we collect, use, store, transfer and protect your personal information in accordance with the Personal Information Protection Act of the Republic of Korea, the Act on Promotion of Information and Communications Network Utilization and Information Protection, the Act on Consumer Protection in Electronic Commerce and other applicable laws. The Korean version is the binding text; this English version is provided for convenience.
Effective date: November 5, 2026 (version 2026-11-05)Article 1 (Personal Information We Collect and How)
1. We collect the following personal information.
a. Account sign-up (app)
- Required: name or nickname, email address, mobile phone number, age (confirmation that you are 14 or older), country, login identifier (the account identifier provided by Google, Apple, Kakao or another social login provider)
- Optional: profile photo, Instagram account, access tokens of SNS accounts you connect (TikTok, YouTube, etc.)
b. Product orders and group-buy participation (members and guests)
- Required: recipient name, mobile phone number, shipping address and postal code, country, order details, payment amount
- Required for international shipping, optional in Korea: email address
- Optional: delivery note
- Payment details (card or bank account numbers) are received and processed directly by our payment processors (Toss Payments, Stripe). We keep only the approval result, order number and receipt URL.
c. Creator and seller activity
- Review videos, photos and posts; bank account information needed for payouts; business registration details (sellers)
d. Inquiries (web form, email, chatbot)
- Name, company name, phone number, email address, message
e. Information generated automatically while you use the Service
- Access logs (time and IP address), device information (OS, model, app version, language), advertising identifiers (ADID/IDFA), push notification tokens, usage records (views, purchases, posts), error logs, cookies (Article 9)
2. How we collect it
- You enter it on sign-up, order and inquiry screens in the app or on the website
- From social login or SNS providers, within the scope you authorize
- Automatically through analytics tools and server logs while you use the Service
- From carriers and payment processors as delivery and payment resultsArticle 2 (Purposes of Use)
We use personal information only for the purposes below. If a purpose changes, we obtain separate consent as required by Article 18 of the Personal Information Protection Act.
1. Account management: confirming sign-up, verifying identity, blocking sign-ups under age 14, preventing abuse, sending notices, handling complaints
2. Providing the Service: posting and viewing video reviews, translating reviews, showing product information, processing group buys and orders, payment, shipping and tracking, refunds, receipts, order lookup
3. Creator and seller payouts: calculating and paying revenue, tax processing
4. Notifications: order, shipping and group-buy status (push, KakaoTalk/SMS, email)
5. Improving the Service: usage statistics, collecting and fixing errors, developing new features
6. Marketing and advertising (with separate consent): events, new products, measuring ad performance
7. Legal obligations: keeping e-commerce records, responding to lawful requests from authoritiesArticle 3 (Retention Period)
1. We destroy personal information without delay when you close your account or the purpose of collection is fulfilled, except for the following records kept for the periods below.
a. Required by law
- Records on contracts and withdrawal of offers: 5 years (E-Commerce Act)
- Records on payment and supply of goods: 5 years (E-Commerce Act)
- Records on consumer complaints and dispute resolution: 3 years (E-Commerce Act)
- Records on labeling and advertising: 6 months (E-Commerce Act)
- Records on electronic financial transactions: 5 years (Electronic Financial Transactions Act)
- Access logs (login records, IP addresses): 3 months (Protection of Communications Secrets Act)
b. Company policy
- Identifiers of closed accounts (one-way hashed email and phone number) to limit re-registration and prevent abuse: 6 months after closure
- Guest order information: 5 years after the transaction (same as the E-Commerce Act period)
2. Accounts inactive for one year or more may have their personal information stored separately from other users; we notify you by email at least 30 days before doing so.Article 4 (Provision to Third Parties)
We do not provide your personal information to third parties beyond the purposes in Article 2, except when:
1. You have given prior consent
2. Required by law, or requested by an investigative agency following the procedures set out in law
3. Passing the recipient's name, phone number and address to the seller so that an order can be shipped (limited to what the order requires)Article 5 (Outsourcing of Processing)
1. We outsource the following work to domestic processors. Our contracts require them to comply with privacy law, prohibit use for other purposes, restrict sub-processing and set out liability, and we supervise them.
- Toss Payments Co., Ltd.: domestic payment processing (cards, easy pay, bank transfer), approval and cancellation, cash receipts and receipts
- KOVAN Co., Ltd.: domestic payment processing (being migrated to Toss Payments; outsourcing ends when migration completes)
- Delivery carriers (CJ Logistics and other carriers assigned per order): shipping
- Tracker (tracker.delivery): domestic shipment tracking
- SOLAPI (when integrated): KakaoTalk notifications and SMS
2. Changes to the outsourced work or processors are published in this Policy without delay.
3. Processors and storage located outside Korea are covered by Article 6.Article 6 (Overseas Transfer of Personal Information)
1. To provide the Service we transfer (outsource and store) personal information overseas as follows.
a. Stripe, Inc.
- Country: United States
- Data: name, email address, payment method information (card token), payment amount, order number
- Purpose: processing international payments
- When and how: encrypted transmission at the time of an international payment
- Retention: 5 years after payment (E-Commerce Act)
- Contact: privacy@stripe.com
b. Google LLC (Google Cloud, Firebase)
- Country: United States
- Data: account identifier, push notification token, app usage records, uploaded videos and photos
- Purpose: login authentication, push notifications, video storage, transcoding and translation, usage statistics
- When and how: encrypted transmission as you use the Service
- Retention: until account closure or the end of the outsourcing contract
- Contact: https://support.google.com/policies/contact/general_privacy_form
c. Amazon Web Services, Inc.
- Country: United States (some data is stored in the Korea region)
- Data: email address, stored Service data in general (member, order and post databases and files)
- Purpose: sending email, content delivery (CDN), server and database hosting
- When and how: encrypted transmission and storage as you use the Service
- Retention: until account closure or the end of the outsourcing contract
- Contact: aws-korea-privacy@amazon.com
d. Functional Software, Inc. (Sentry)
- Country: United States
- Data: device information, error logs (may include an account identifier)
- Purpose: collecting and analyzing app and server errors
- When and how: transmitted when an error occurs
- Retention: 90 days
- Contact: privacy@sentry.io
e. Meta Platforms, Inc.
- Country: United States
- Data: advertising identifier, app events (install, purchase, etc.) / if you connect Instagram, your Instagram account token and posted content
- Purpose: measuring ad performance / cross-posting reviews to Instagram
- When and how: while you use the app; when you connect your account
- Retention: until you disconnect (advertising identifiers follow Meta's policy)
- Contact: https://www.facebook.com/help/contact/
f. TikTok Pte. Ltd.
- Country: Singapore, United States
- Data: if you connect TikTok, your TikTok account token and posted content
- Purpose: cross-posting reviews to TikTok
- When and how: when you connect your account
- Retention: until you disconnect
- Contact: https://www.tiktok.com/legal/report/privacy
g. 17TRACK (Hong Kong) Technology Limited
- Country: Hong Kong
- Data: tracking number
- Purpose: international shipment tracking
- When and how: when an international shipment is tracked
- Retention: deleted after delivery is complete
- Contact: service@17track.net
2. Consent to and refusal of overseas transfer
- Consent to overseas transfer is obtained through a checkbox separate from the Terms of Service and the consent to collection and use of personal information.
- You may withdraw or refuse consent through customer support (info@arbaim.com, +82 10-9655-6410) or in the app settings.
- If you refuse, you cannot use the features that depend on the transfer: international payment (Stripe), push notifications, SNS cross-posting and international shipment tracking. The rest of the Service remains available.
- We bind each recipient by contract to apply the protective measures required by the Personal Information Protection Act.Article 7 (Destruction of Personal Information)
1. We destroy personal information without delay once its retention period ends or its purpose is fulfilled. Information that must be kept by law is moved to a separate database, kept only for the required period and then destroyed.
2. Electronic files are deleted using methods that prevent recovery; printed materials are shredded or incinerated.
3. You can close your account in the app under My Info > Settings > Delete Account. If you cannot use the app, email info@arbaim.com from your registered email address.Article 8 (Your Rights and How to Exercise Them)
1. You may at any time request access to, correction or deletion of, suspension of processing of, or withdrawal of consent for your personal information.
2. You can exercise these rights in the app settings or by contacting the privacy officer (Article 12) in writing, by email or by phone. We act without delay.
3. Personal information under a correction or deletion request is not used or provided until the request is completed.
4. Rights may also be exercised through a legal representative or an authorized agent, who must submit a power of attorney in the form prescribed by the Notice on Personal Information Processing Methods (Annex Form No. 11).
5. Requests may be limited where the law requires the information to be collected or where another person's rights could be infringed.Article 9 (Cookies and App Analytics Tools)
1. Website (greyd.app)
- The website uses a single cookie, "greyd_lang", to remember the language you chose (kept for 1 year). It contains no information that identifies you.
- The website uses no analytics or advertising cookies or trackers.
- You may refuse cookies in your browser settings; the only effect is that your language choice is not remembered.
2. App (greyd)
The app uses the tools below. The resulting overseas transfers are listed in Article 6.
- Firebase Analytics (Google): usage statistics, error analysis
- Meta SDK (Meta Platforms): ad performance measurement (install and purchase events)
- Sentry (Functional Software): error collection
- You can limit ad tracking in your device settings. iOS: Settings > Privacy & Security > Tracking. Android: Settings > Google > Ads > Delete advertising ID or opt out of ads personalization.Article 10 (Children Under 14)
We do not accept sign-ups or orders from children under 14 and do not collect their personal information. You must confirm "I am 14 years of age or older" when signing up or ordering. If we learn that a user is under 14, we delete the account and destroy the information collected.Article 11 (Security Measures)
Under Article 29 of the Personal Information Protection Act we take the following measures.
1. Administrative: an internal management plan, minimal staff with access to personal information and regular training, supervision of processors
2. Technical: access-right management and access control for processing systems, encryption of passwords and unique identifiers, encryption in transit (TLS), installation and updating of security software, retention of access logs (at least 1 year) with protection against tampering
3. Physical: servers are located in the access-controlled data centers of our hosting provider (Amazon Web Services); access to storage areas for data in our offices is controlledArticle 12 (Privacy Officer)
We have designated the following privacy officer to oversee personal information processing and to handle complaints and remedies.
- Privacy officer: Ryan Hyungeu Seol (CEO)
- Email: info@arbaim.com
- Phone: +82 10-9655-6410 (weekdays 10:00–18:00 KST)
- Address: 304, 333 Gwonsamdeuk-ro, Deokjin-gu, Jeonju-si, Jeonbuk State, Republic of Korea / 319, Building 3, Pangyo Startup Campus, 20 Pangyo-ro 289beon-gil, Bundang-gu, Seongnam-si, Gyeonggi-do, Republic of Korea
You may direct any privacy-related inquiry, complaint or request for remedy to the contact above, and we will respond and act without delay.Article 13 (Remedies for Infringement)
You may report or seek advice on personal information infringement from the following Korean authorities.
- Personal Information Infringement Report Center (KISA): 118, privacy.kisa.or.kr
- Personal Information Dispute Mediation Committee: 1833-6972, www.kopico.go.kr
- Supreme Prosecutors' Office Cyber Investigation Division: 1301, www.spo.go.kr
- National Police Agency Cyber Bureau: 182, ecrm.police.go.krArticle 14 (Changes to This Policy)
1. When this Policy is added to, deleted from or amended, we announce the changes and the effective date at least 7 days in advance through a banner on the website's first screen, an in-app notice at launch and a "Revision notice" at the top of the legal pages.
2. Changes material to your rights, such as the data collected, purposes of use or overseas transfers, or changes unfavorable to you, are announced at least 30 days in advance and notified individually to your registered email address or phone number. For unfavorable changes we show a summary on your first visit after the revision and ask for your consent again.
3. Versions are identified by their effective date (YYYY-MM-DD).
Addendum
1. This Policy takes effect on November 5, 2026.
2. Revision history
- January 1, 2021: first version
- November 5, 2026: full revision — new overseas transfer clause, updated processors, privacy officer and contact details, disclosure of cookies and app analytics tools, no sign-ups under age 14, notice periods for revisions (30 days / 7 days) (announced October 5, 2026)