Privacy Policy

Effective date: July 29, 2026. LUMYSEOUL ("we", "us") respects your privacy. This policy explains what we collect, why, who processes it, and the choices and rights you have. We are based in the Republic of Korea and serve customers internationally, so your information is transferred and processed across borders as described below.

WHAT WE COLLECT. Information you give us: name, email address, shipping address, phone number, order history, product reviews, support messages, and any account preferences. Payment information: your card or account details are entered with and processed by PayPal — we never see or store full card numbers. Automatically collected: device and usage data such as pages viewed, approximate location derived from IP address, and referral source, via analytics tools.

WHY WE USE IT. To take payment and fulfil and ship your order; to provide tracking, support, returns and refunds; to send transactional emails such as order confirmations and shipping notices; to send marketing emails only where you have opted in, which you can withdraw at any time; to detect and prevent fraud and abuse; to keep records we are required to keep; and to improve the site and our product range.

WHO PROCESSES YOUR DATA FOR US. We use a small number of service providers, each of which processes data only to provide their service to us: Supabase (database and account hosting), Cloudflare (website hosting, delivery and security), PayPal (payment processing), Resend (transactional and marketing email delivery), Korea Post and its partner carriers (shipping and tracking), Google Analytics 4 (site analytics), and Telegram (internal order and safety alerts to our own team). These providers operate in various countries, which means your data may be processed outside your country of residence.

WE DO NOT SELL YOUR PERSONAL INFORMATION. We do not sell, rent or trade your personal information, and we do not share it for cross-context behavioural advertising.

MARKETING CONSENT IS SEPARATE AND OPTIONAL. Consent to receive marketing email is asked for separately from consent to process your order, and is never bundled into it. You can decline marketing and still buy from us — we will not refuse you goods or services, or offer you worse terms, because you declined marketing. You can withdraw consent at any time using the unsubscribe link in any marketing email or in your account settings, and we act on it immediately. Transactional messages about an order you placed (confirmation, dispatch, tracking, refund) are not marketing and are sent because they are necessary to perform our contract with you.

CROSS-BORDER TRANSFER OF YOUR INFORMATION. We are based in the Republic of Korea and our service providers operate internationally, so your information is transferred and processed outside your country and outside Korea. Specifically: account and order data is stored with Supabase; the site is served and protected by Cloudflare; payments are processed by PayPal; email is delivered by Resend; shipping and tracking data is passed to Korea Post and its destination-country partner carriers, and where required to customs authorities so your parcel can clear; site analytics are processed by Google Analytics 4; and our own team receives internal order and safety alerts through Telegram. We transfer only what each provider needs to perform its function, and only for the purposes described in this policy.

LEGAL BASIS AND APPLICABLE LAW. As a Korean business we process personal information in accordance with the Personal Information Protection Act (PIPA) of the Republic of Korea. Where you are located in a region with its own applicable data protection law — for example the EU or UK (GDPR), or California (CCPA/CPRA) — we also honour the rights that law gives you, as set out on our Your Privacy Rights page. Our bases for processing are: performing our contract with you (fulfilling and shipping your order, support, returns), your consent (marketing email), our legitimate interests (fraud prevention, product safety, improving the service) and compliance with legal obligations (accounting, customs declarations, product-safety records).

ADVERSE REACTION REPORTS. If you report a skin reaction, we keep a record of your report, the affected product and batch, and our response. We do this to investigate the issue and protect other customers, and we may retain it longer than ordinary support messages for product-safety purposes.

HOW LONG WE KEEP IT. Order and transaction records are kept as long as needed for accounting, tax, warranty and dispute purposes. Marketing contact details are kept until you unsubscribe or ask us to delete them. Analytics data is retained according to the provider’s standard retention settings.

YOUR CHOICES AND RIGHTS. You can view and update your details, addresses and email preferences in your account at any time, and unsubscribe from marketing using the link in any marketing email. Depending on where you live you may also have the right to request access to your data, correction, deletion, a copy in portable form, restriction of processing, or to object to certain processing, and to withdraw consent. To exercise any of these, email hello@lumyseoul.com and we will respond as required by the law that applies to you. You will not be treated differently for exercising these rights.

CHILDREN. The site is not directed at children and we do not knowingly collect information from anyone under 16. If you believe a child has given us information, contact us and we will delete it.

SECURITY. We use encrypted connections (HTTPS), restricted administrative access, and processors that maintain their own security programmes. No method of transmission or storage is completely secure, so we cannot guarantee absolute security.

COOKIES. See our Cookie Policy for what we set and how to control it.

CHANGES AND CONTACT. We will update this page and its effective date if our practices change. Questions or requests: hello@lumyseoul.com.