Privacy Policy
Announced October 1, 2026 · Effective October 8, 2026
This is a translation of the Korean original. If the translation and the Korean version differ, the Korean version prevails.
그로브센트 (the “Company”) establishes and publishes this Privacy Policy under Article 30 of Korea's Personal Information Protection Act (PIPA) to protect personal information and promptly handle related concerns. It applies to patterners and Atelier.
1. Purposes of Processing
The Company processes personal information for the following purposes. If a purpose changes, it takes the required steps, such as obtaining separate consent under Article 18 of PIPA. 1. Membership: identification, sign-in, abuse prevention, notices 2. Providing the Service: saving and syncing patterns and Papers, share links, export, AI features, notifications 3. Paid services: payment, subscription management, refunds, receipts 4. Atelier: artist profiles, pattern publishing and review, receive/purchase history, questions to artists 5. Artist identity: verifying seller identity under Article 20-4 of the E-Commerce Act and providing it in disputes 6. Support requests and dispute handling 7. Improving the Service: usage statistics, behaviour analytics, error diagnosis
2. Personal Information Processed
The Company processes only the minimum personal information the Service needs.
| Category | Items | Source and legal basis |
|---|---|---|
| Sign-up (email) | Required: email, password (stored hashed) Optional: nickname, profile photo | Entered by member · performance of contract (Art. 15(1)4) |
| Social sign-in | Required: social account ID, email If provided: name, profile image | Provided by Google or Kakao · performance of contract |
| Using the Service | Content such as patterns, Papers and images; work and version history; notifications | Generated through use · performance of contract |
| AI features | Text, images and pattern data entered; usage counts; request and result logs | When used · performance of contract |
| Payments | Payment ID, billing key, payment method type, card issuer, amount and time, subscription status (the Company does not store card numbers) | From payment gateways and PortOne · performance of contract, E-Commerce Act |
| Atelier artists | Required: artist name, handle Optional: profile photo, bio, external links | Entered by artist · performance of contract |
| Artist identity verification | Name, mobile number, date of birth, connecting information (CI, stored as a hash), time of verification | From an identity verification agency · legal obligation (E-Commerce Act Art. 20-4; PIPA Art. 15(1)2) |
| Artist payouts (for paid sales) | Bank, account number, account holder, business registration number (business artists) | Entered by artist · performance of contract, tax law |
| Atelier buyers | Receive/purchase history, likes, questions to artists | Generated through use · performance of contract |
| Support requests | Name, email, message, attached images | Entered with the request · performance of contract (members), consent (non-members) |
| Partner referrals | Referral code, arrival time | Cookie set on visiting a referral link · performance of contract (partner payouts) |
| Collected automatically | IP address, access time, browser and device information, cookies, usage records such as pages visited, clicks and scrolling | Generated automatically · legitimate interest (Art. 15(1)6) |
3. Children Under 14
The Company does not accept members under 14. If it learns that personal information of a child under 14 has been collected, it deletes it without delay.
4. Retention Periods
The Company destroys personal information without delay when a member withdraws or the purpose is achieved, except that the following is kept for the periods shown.
| Information kept | Basis | Period |
|---|---|---|
| Member information and content | Performance of contract | Until withdrawal |
| Records of contracts and order withdrawals | E-Commerce Act | 5 years |
| Records of payment and supply of goods | E-Commerce Act | 5 years |
| Records of consumer complaints and disputes (including support requests) | E-Commerce Act | 3 years |
| Records of labelling and advertising | E-Commerce Act | 6 months |
| Sign-in records, access location | Protection of Communications Secrets Act | 3 months |
| Artist identity verification data | E-Commerce Act Art. 20-4 · dispute handling | 3 years from the last transaction (receive or purchase); if none, until the artist withdraws |
| Payout and tax records | Framework Act on National Taxes | 5 years |
5. Destruction
① Personal information is destroyed without delay once its retention period ends or its purpose is achieved. ② Information the law requires us to keep is stored separately from other personal information and used only for that purpose. ③ Electronic files are deleted so they cannot be recovered; paper documents are shredded or incinerated.
6. Provision to Third Parties
The Company uses personal information only within the purposes above and in principle does not provide it to third parties, except in the following cases.
| Recipient | Purpose | Items | Retention |
|---|---|---|---|
| Dispute mediation bodies such as the Korea Consumer Agency and the E-Commerce Mediation Committee | Mediation (E-Commerce Act Art. 20-4) | Artist's name, mobile number, email | Until the mediation ends |
| Courts | Litigation etc. (E-Commerce Act Art. 20-4) | Artist's name, mobile number, email | Until the proceedings end |
| The buyer in the transaction, if the artist consents | Resolving a dispute | Artist's name, mobile number, email | Until the dispute is resolved |
The Company may also provide information where the law specifically requires it or investigative authorities request it through legal procedures. When a buyer asks an artist a question, the artist sees the buyer's nickname and message; this is a feature the user chooses to use.
7. Processors
The Company entrusts the following processing to provide the Service smoothly.
| Processor | Task |
|---|---|
| Korea PortOne Co., Ltd. | Payment integration, mobile identity verification integration |
| KG Inicis Co., Ltd., Toss Payments Co., Ltd., Kakao Pay Corp. | Payment processing (payment gateway) |
| Identity verification agency (connected via PortOne) | Mobile identity verification |
| Supabase, Inc. | Member authentication, database and file storage |
| Vercel Inc. | Website hosting and delivery |
| Plus Five Five, Inc. (Resend) | Sending email |
| OpenAI, L.L.C. | Processing AI features |
| Microsoft Corporation | Clarity behaviour analytics |
| Google LLC | Google Analytics visit statistics |
Under Article 26 of PIPA, the Company's contracts with processors prohibit processing beyond the entrusted task and set out security measures, limits on sub-processing, supervision and liability, and the Company supervises processors' handling of personal information. Any change of task or processor will be reflected in this policy.
8. International Transfers
To perform the service contract, the Company entrusts and stores personal information overseas as follows, under Article 28-8(1)3 of PIPA. All transfers take place over an encrypted connection (HTTPS) when the Service is used.
| Recipient (contact) | Country | Items | Purpose | Retention |
|---|---|---|---|---|
| Supabase, Inc. (supabase.com/privacy) | Japan (Tokyo region) | Service data in general, including member information, content, payment and Atelier records, identity verification data | Data storage, authentication | Until withdrawal or the end of the contract |
| Vercel Inc. (privacy@vercel.com) | United States and delivery regions | IP address, request information, access logs | Website hosting and delivery | Until the end of the contract (access logs kept briefly under the processor's policy) |
| OpenAI, L.L.C. (dsar@openai.com) | United States | Text, images and pattern data entered into AI features | Generating AI results | Deleted after up to 30 days under the processor's policy |
| Plus Five Five, Inc. (resend.com/legal/privacy-policy) | United States | Email address, message content | Sending email | Until the end of the contract |
| Microsoft Corporation (aka.ms/privacyresponse) | United States | Cookie IDs, visit, click and scroll records, device information, member ID (when signed in) | Behaviour analytics | Per the processor's policy (up to 13 months) |
| Google LLC (policies.google.com/privacy) | United States | Cookie IDs, visit records, device information | Visit statistics | Up to 14 months |
If you do not want your information transferred overseas, you can withdraw or stop using the relevant feature. Transfers to Supabase and Vercel are essential to the Service, so refusing them means you cannot use it; refusing the OpenAI transfer only means you cannot use AI features. You can refuse the Microsoft and Google analytics tools as described in section 10 without affecting your use of the Service.
9. Security Measures
① Administrative: an internal management plan, a minimal number of staff handling personal information, regular checks ② Technical: encryption in transit (HTTPS), one-way hashing of passwords, hashed storage of CI, row-level access control in the database, logs of administrator access ③ Physical: access control at processors' (cloud providers') data centres
11. Your Rights
① You may at any time ask to access, correct or delete your personal information, suspend its processing or withdraw consent. ② You can make changes in Account settings or ask through Contact or by email (grovescent.rim@gmail.com); the Company acts within 10 days and tells you the result. ③ A legal guardian or authorised representative may exercise these rights by submitting a power of attorney. ④ Deletion may be limited for information the law requires us to keep. ⑤ The Company does not make decisions that significantly affect your rights or obligations by fully automated means.
12. Privacy Officer
For questions, complaints or remedies regarding personal information, contact: Privacy officer: 이형민 (Representative) Email: grovescent.rim@gmail.com Phone: 010-8460-3729
13. Remedies
For advice or dispute resolution on privacy infringements, you can contact these Korean bodies: Personal Information Dispute Mediation Committee: 1833-6972 (www.kopico.go.kr) Privacy Infringement Report Center: 118 (privacy.kisa.or.kr) Supreme Prosecutors' Office: 1301 (www.spo.go.kr) Korean National Police Agency: 182 (ecrm.police.go.kr)
14. Changes to This Policy
This policy applies from October 8, 2026. Changes are announced on the notice board 7 days before they take effect (30 days for material changes). Previous policy: applied from August 22, 2026 to October 7, 2026 (available on request)