개인정보 처리방침

1. Information we collect

We collect the following categories of information:

• Account data you provide directly — name, email address, password (stored only as a salted hash), and profile image.
• Billing data processed by our payment provider (Stripe). We store a customer identifier, your orders and membership status, but never your full card number. Sellers also provide payout details directly to Stripe Connect.
• Marketplace data— your purchases, library, reviews, and, for sellers, your public profile, kits and uploaded files.
• Usage data collected automatically — log data, device and browser information, IP address, and pages and kits viewed, which we use to operate and secure the Service.
• Cookies and similar technologies used for authentication, preferences, and (optionally) privacy-friendly analytics.

2. How we use information

We use information to:

• provide, operate, secure, and improve the Service;
• authenticate you and manage your account;
• process payments and prevent fraud or abuse;
• deliver purchased kits, share sales and payout information with sellers, and show public reviews and seller profiles;
• send transactional emails and, where you have opted in, product updates and newsletters; and
• comply with legal obligations.

3. Legal bases (GDPR)

Where the GDPR applies, we process personal data on the bases of performance of a contract (providing the Service), legitimate interests (securing and improving the Service), consent (marketing and optional analytics), and compliance with legal obligations.

4. Sharing and sub-processors

We do not sell your personal information. We share data only with sub-processors that help us operate the Service, under appropriate data protection terms — for example our hosting provider, database, payment processor (Stripe), email provider (Resend) and file storage (S3-compatible). When you buy a community kit, the seller receives your order details and, where needed to provide support, your name and email address. We may also disclose information when required by law.

5. Data retention

We retain personal data for as long as your account is active or as needed to provide the Service, comply with legal obligations, resolve disputes, and enforce agreements. You may delete your account at any time from your settings, which removes your associated data subject to limited retention required by law.

6. Your rights

Depending on your location, you may have the right to access, correct, export, restrict, or delete your personal data, and to object to or withdraw consent for certain processing. Residents of the EEA/UK (GDPR) and California (CCPA/CPRA) have specific rights. To exercise them, contact us at [email protected].

7. Security

We use industry-standard measures including encryption in transit, hashed passwords, scoped access tokens, and rate limiting. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

8. International transfers

Your information may be processed in countries other than your own. Where required, we rely on appropriate safeguards such as Standard Contractual Clauses for cross-border transfers.

9. Children's privacy

The Service is not directed to children under 13 (or the minimum age in your jurisdiction), and we do not knowingly collect their data.

10. Changes and contact

We may update this policy from time to time; material changes will be posted here with a new “last updated” date. Questions can be sent to [email protected].

This document is a template and should be reviewed by qualified legal counsel before production use.