jifei Privacy Policy

corebeau (Korean trade name: 코러보; registered English name: COREBEAU; the "Company") establishes and discloses this Privacy Policy as follows, in accordance with Article 30 of the Personal Information Protection Act (개인정보 보호법, the "PIPA"), in order to protect the personal data of data subjects and to handle related grievances promptly.

This document is not subject to consent; it is subject to disclosure (notice). The consent obtained at sign-up is "consent to the collection and use of personal data," and its content is set by Sections 1 and 2 below.

1. Personal Data the Company Processes

1.1 Items Collected and Purposes

Information stored in cookies is set out separately in Section 7.

Note: In a Seller page view record, the only information about the Member is "who." Therefore, the Company severs this record's link to the Member instead of deleting the record — from that point on, the Company can no longer know whose record it was, and the information about the Member is thereby destroyed.

The link is severed at whichever of the following two comes first.

1. When 90 days have passed from the date of Observation — the Company processes this automatically every day. The purpose for keeping this information linked to the Member requires it only for a much shorter period than that.
2. When the Member closes their jifei account.

Note: No value identifying the User and no IP address is attached to error diagnostic information. The Company configures the error diagnostic tool so that it does not send User identification information along with it, and does not turn on the screen-recording feature (session replay). However, the address of the screen where an error occurred may contain search terms entered by the User.

Note: The Company does not collect passwords. At present, sign-up is possible only through a Google account, and the Company keeps passwords neither in plain text nor as hashes. Even if sign-up with email and password is opened, authentication will be performed by the integrated account system operated by the Company, and that system likewise does not keep passwords in a form from which they can be recovered.

1.2 Information the Company Does Not Collect

Payment methods · card numbers · bank account information · shipping addresses · real names · dates of birth · phone numbers

Because the Company does not receive payment for goods and does not deliver goods, it does not need this information. The Company does not take contact details for an Expression of Interest in a buying agent either — because it is a measurement of demand, not the acceptance of an application.

Once the User presses "Go to seller" and moves to a Seller, that Seller's privacy policy applies, and the Company is not involved in the processing that takes place there.

1.3 Right to Refuse Consent and the Resulting Disadvantages

Users may refuse to consent to the collection and use of personal data. However, a User who does not consent cannot create an account and cannot use the Save, alert and Expression of Interest features. The feature for searching products and prices without signing up may be used regardless of whether the User consents.

2. Processing and Retention Periods for Personal Data

Note: "Closing the jifei account" and "deleting the account" are different. A Member's account resides in the integrated account system operated by the Company and may also be used for the Company's other services. When a Member closes their jifei account, the information kept by jifei (saved sizes, alert records, and Expressions of Interest in a buying agent) is destroyed without delay and Seller page view records are unlinked from the Member, but the account itself and the email address may remain so that the Company's other services can be used. A Member who wishes the account itself to be deleted may request it by the method in Section 6, and the Company will process the request; in that case, the Member will no longer be able to use any of the Company's services.

Note: Some records remain after the jifei account is closed, for the retention periods in the table above — consent records and account closure records (three years after closure), service access records (one year), error diagnostic information (up to 90 days), and records of consumer complaints or dispute handling (three years). Other information held by jifei is destroyed without delay, or its link to the Member is cut, as described immediately above. Why consent records are kept — the fact that consent was obtained and the version it covered are materials proving the lawfulness of the consent; if they were destroyed at the moment of closure, the Company could no longer prove the very fact that it lawfully obtained consent. These records contain only a value identifying the User and the consent item, version, time, and screen language, and do not include saved sizes or alert contents. The period was set at 3 years in consideration of the period during which the lawfulness of consent may be disputed, and it is the same length as the retention period that Article 6 of the Enforcement Decree of the Act on the Consumer Protection in Electronic Commerce sets for records of consumer complaints and dispute resolution.

Note: About "usage statistics." From the server records above, the Company aggregates how many people viewed which screens. What remains as the result of aggregation is numbers; the Company does not create lists or profiles of individual Users. This is not for advertising, is not provided to third parties, and no new items are collected for this purpose — the records already described above are used as they are. The Company does not install tools for tracking in Users' browsers or devices (Section 7).

Note: "Service access records" contain two things together. One is the server log in which Users' requests are recorded; the other is the "access logs" (records of personal data handlers accessing the personal data processing system) that the PIPA and its subordinate statutes require to be kept for at least 1 year. Because the Company keeps both in the same store, it applies 1 year, the longer of the two.

Note: About records of consumer complaints and dispute resolution. The Company applies this period on the premise that it is regarded as an online marketplace intermediary (mail-order brokerage). When an inquiry or complaint is received, its content and the result of handling it are kept for 3 years; the channel for receipt is the email address in Section 6(3).

Because the Company is not involved in the sale, payment, or delivery of goods, it does not keep records on contracts or withdrawal of offers, payment, or the supply of goods.

3. Provision of Personal Data to Third Parties

The Company does not provide Users' personal data to third parties. This does not apply, however, where laws or regulations specifically provide otherwise or where an investigative agency requests it in accordance with the procedures and methods prescribed by laws or regulations.

Note: The links in the Service that take Users to Sellers are not a provision of personal data. The Company does not tell Sellers which User pressed a link.

Note: "Provision to third parties" and "entrustment of processing" are different. Processors that process data for the Company and on the Company's instructions (cloud and error diagnostics) are not a provision to third parties and are set out separately in Section 4.

4. Entrustment of Personal Data Processing

When entering into an entrustment contract, the Company specifies in the contract, in accordance with Article 26 of the PIPA, matters concerning responsibility, such as restrictions on re-entrustment, security measures, management and supervision, and compensation for damages.

The Company operates the integrated account system itself. Account creation and authentication are processing within the Company, so they do not constitute entrustment and are not listed separately in this table (account-related email is sent using the sending function of the cloud processor above). A Member's account may also be used for other services operated by the Company, but this is use within the same personal data controller and not a provision to third parties.

4.1 Cross-Border Transfer

Users' account information and Service usage records are not transferred outside the Republic of Korea. The Company's servers and databases are operated in a region within the Republic of Korea (ap-northeast-2, Seoul), and the counterparty to the cloud contract is also a Korean entity (Amazon Web Services Korea LLC). However, when you connect from abroad, your requests pass through a delivery point outside Korea close to you (content delivery — Section 4); they are processed there only for as long as needed to deliver them and are not stored there — service access records are kept in the Korean region.

However, the "error diagnostic information" in Section 1 is transferred to the United States. Because this constitutes entrustment of processing necessary for the performance of a contract under Article 28-8(1)3 of the PIPA, the Company discloses the matters listed in the subparagraphs of paragraph (2) of that Article as set out below in lieu of consent, and does not obtain separate consent.

Note: About re-entrustment (sub-processing). The recipient entrusts part of the processing in turn to cloud infrastructure providers, affiliates, and others. The Company consented to that re-entrustment in advance through the recipient's data processing agreement (Article 26(6) of the PIPA), and is notified of changes to the list of sub-processors and may object to them. If sub-processors are added and the countries to which data is transferred change, the Company will update this Section.

Note: There is no on-screen switch to turn this off. This information is not sent at the User's request but is generated automatically when an error occurs, so there is no point at which it can be turned off or on for each User. Instead, the items sent have themselves been narrowed as described above. Users do have the right to demand that this processing be stopped (demand to suspend processing — Section 6(1)4), and such demands are received through the channel in Section 6(3). Effect of refusal (suspension of processing) — error diagnostic information carries no value that identifies the User, so the Company cannot single out and stop transmission for a particular User. To refuse, block the error-reporting address (sentry.io) with your browser's content-blocking feature; doing so does not affect your use of the Service — the Company simply cannot diagnose errors that occur in that browser.

5. Procedures and Methods for Destroying Personal Data

1. When personal data becomes unnecessary because the retention period has expired or the purpose of processing has been achieved, the Company destroys that personal data without delay (within 5 days, unless there is a justifiable reason).
2. Where personal data must be preserved under other laws or regulations, the Company preserves it by moving it to a separate database or by storing it in a different location.
3. The methods of destruction are as follows.
   • Electronic files — permanent deletion by a method that prevents recovery or restoration
   • Paper documents — shredding or incineration
4. Where only part of a record is personal data, the Company may destroy it by erasing that part so that the individual can no longer be identified. Seller page view records are such a case: once the link to the Member is severed, the individual can no longer be identified, and the record is not personal data (see Section 1).

6. Rights and Obligations of Data Subjects and Legal Representatives, and How to Exercise Them

1. Users may exercise the following rights against the Company at any time.
   1. Demand for access to personal data (Article 35 of the PIPA)
   2. Demand for correction where there are errors or the like (Article 36)
   3. Demand for deletion (Article 36)
   4. Demand to suspend processing (Article 37)
   5. Withdrawal of consent and closure of the jifei account
2. The following rights may be exercised directly on screens within the Service.
   • Access — "Download my data" on the Manage account screen (JSON file)
   • Deletion and suspension of processing — saved sizes one at a time on the Alerts screen; all of them through "Close your jifei account" on the Manage account screen
3. Other demands (correction, deletion of the account itself, access to Service access records and to account information (email)) may be made by email to junsoo.ahn@corebeau.ai or in writing (the Company's address is displayed at the bottom of the Service screens), and the Company will take action and inform the User of the result within 10 days from the date it receives the demand.
4. In accordance with Article 38(4) of the PIPA, the Company makes the methods and procedures for exercising rights no more difficult than the methods by which it collects personal data — because sign-up takes place on screen, closing the jifei account also takes place on screen. Note: However, two matters are handled only through the channel in paragraph (3). (i) Closing the jifei account is not deletion of the account itself (see Section 2). (ii) Service access records and account information (email) are not included in the download file — access records are kept in server logs and account information in the integrated account system, so they cannot be provided through that route.
5. Rights may also be exercised through a legal representative or a person delegated by the User; in that case, a power of attorney must be submitted.
6. Users must not infringe the personal data or privacy of others processed by the Company in violation of the PIPA or other relevant laws and regulations.
7. Children under the age of 14 may not sign up as Members, and the Company does not collect personal data of children under the age of 14.

7. Devices That Automatically Collect Personal Data (Cookies)

The Company uses cookies to keep Users signed in, to complete the sign-up process, and to remember the display settings the User chose (language · delivery country · currency). The Company does not use tracking tools for advertising or for analyzing User behavior — it does not install tools that collect advertising identifiers or behavioral information, and it does not record Users' screens. The Company does use a tool for diagnosing errors in the Service, as described in Sections 1, 4, and 4.1. That tool does not use cookies.

Note: However, the address and time of the Seller product pages a Member opens in the app, and the product information displayed on that page at that time, are recorded ("Seller page view records" in Section 1). This is not for advertising or profiling, and the link to the Member is severed after 90 days or upon closure of the jifei account.

jf_cs contains the items the User consented to at sign-up, the versions of those documents, the time of consent, and the language of the consent screen. Consent is obtained before the account is created, but recording it requires an account, so this value is kept temporarily in the browser only until the social login process is complete and the account is confirmed. It is deleted immediately once recording is complete and expires after 1 hour at the latest. It contains no information identifying the User, such as name or email.

The language, delivery country, currency and reload cookies contain no information that identifies the User and are used only to remember those choices for the next visit.

Users may refuse the storage of cookies in their web browser settings. However, a User who refuses authentication cookies cannot use the features that require sign-in (Save and alerts).

The screen brightness setting (light/dark) is kept in the browser's local storage, not in a cookie, and does not leave the User's device.

8. Measures to Ensure the Security of Personal Data

In accordance with Article 29 of the PIPA and Article 30 of the Enforcement Decree of the PIPA, the Company takes the following measures.

1. Administrative measures
   • Minimizing the number of personal data handlers, and granting differentiated access rights
   • Internal management plan — The Company is a small business owner that processes personal data concerning fewer than 10,000 data subjects, and accordingly, under the proviso to Article 4(1) of the Standards for Personal Information Security Measures (개인정보의 안전성 확보조치 기준), it has not established an internal management plan. When the number of data subjects reaches 10,000, the Company will establish and implement one.
2. Technical measures
   • Management of access rights to the personal data processing system, and retention of access logs for at least 1 year
   • Encryption in transit (HTTPS)
   • Delivering authentication tokens only in httpOnly cookies that scripts cannot read, and using SameSite=Lax so that authentication cookies are not attached to requests sent from other sites (except when the User follows a link to the Service)
   • An architecture that does not keep passwords in a recoverable form — authentication is performed by the integrated account system operated by the Company, and the jifei Service does not receive passwords
   • Malware prevention — the personal data processing system is periodically replaced by rebuilding it from images that incorporate security updates, and on the work devices of personal data handlers, the malware-blocking features provided by the operating system are turned on and security updates are applied automatically
3. Physical measures — provided through the cloud provider's data center access controls

9. Automated Decisions

The Company does not make automated decisions using personal data. The Company does not analyze Users' personal data to make decisions that have a legal effect or a comparably significant effect on Users, and the order of the products and prices displayed on screen is determined not by Users' personal data but by the observed prices and stock and the search conditions selected by the User. (Article 37-2 of the PIPA)

10. Chief Privacy Officer

Users may direct all inquiries, complaints, and requests for remedies relating to personal data protection to the contact below, and the Company will respond and handle them without delay.

• Chief Privacy Officer — Junsoo Ahn (안준수) / Representative
• Contact — junsoo.ahn@corebeau.ai

11. Remedies for Infringement of Rights and Interests

To obtain remedies for infringement of personal data, Users may apply to the organizations below for dispute resolution or counseling.

In addition, a person whose rights or interests have been infringed by a disposition or omission of a public institution in response to a demand under Article 35, 36, or 37 of the PIPA may file an administrative appeal as prescribed by the Administrative Appeals Act (행정심판법).

12. Changes to the Privacy Policy

1. This Privacy Policy applies from October 15, 2026 (first in force September 8, 2026).
2. When the Company changes this Privacy Policy, it announces the reasons for and content of the changes through a notice within the Service starting 7 days before the changes take effect. However, where there is a material change to Users' rights, the Company announces it starting 30 days before.
3. The Company also posts earlier versions within the Service so that Users can directly compare and confirm the content before and after a change.

13. For Users Residing in Japan

Because the Company also provides the Service to Users residing in Japan, it announces below the matters that the Act on the Protection of Personal Information of Japan (the "APPI") requires to be made public. Matters not set out in this Section follow the other Sections of this Privacy Policy.

14. Language of This Privacy Policy

1. This Privacy Policy is made in Korean and English, and the two versions have equal force.
2. Where the two versions differ in interpretation, the interpretation more favorable to the User prevails.
3. Any version the Company provides in another language is a reference translation for convenience only and has no legal effect.

Revision History