Privacy Policy

- Account creation and login (authentication) - Service provision: spa/sauna/hot spring/aesthetics place curation and mood-based recommendations - Community service: posting and displaying reviews, photos, and videos - Service quality improvement (error analysis, performance optimization), security/fraud prevention

Required: Email (account), Authentication information (passwords are stored as hash/authentication system) Service Data: Mood check records, favorited places, search and usage history Community Data: Nickname, review/post text, uploaded photos and videos, likes/favorites records Access Logs: Access records for security and operations

Retention/Deletion: Service records are deleted immediately upon account deletion request. Minimum payment-related information (transaction ID, payment date/time, amount) may be retained when legally required, in accordance with applicable laws, for the minimum required period.

- Supabase: authentication/database/storage - Vercel: web hosting and service deployment - Email delivery service: newsletter delivery (when in use) - Google Analytics (GA4): anonymous usage statistics and service improvement (uses cookies) - Naver Analytics: usage statistics analysis (uses cookies) Cookies and Tracking Technologies: - Functional cookie for language preference (luwei_locale) - Analytics cookies for usage statistics (Google Analytics, Naver Analytics) - Authentication cookies for maintaining login sessions - You may disable or delete cookies through your browser settings. However, some service features may be limited.

- You may request access, correction, deletion, or suspension of processing - Delete your account in Settings or request via email (business@luwei.kr)

- Destroyed without undue delay upon expiration of retention period or achievement of purpose - Electronic files are deleted in an irrecoverable manner (physical deletion or rendering inaccessible through encryption key deletion)

- Encryption of transmission (HTTPS) - Minimization of access rights - Security checks and protective measures

LUWEI transfers (stores) personal information overseas as described below in order to operate the service, in accordance with Article 28-8 of the Korean Personal Information Protection Act. 1) Supabase Inc. (United States) — data physically stored in the AWS India (ap-south-1) region - Items transferred: email, authentication credentials, nickname, service usage records, community posts (including photos and videos), booking information - Purpose: user authentication, database and storage operation - Timing and method: transmitted over the internet with TLS encryption at the time of service use - Retention period: until account deletion or termination of the processing agreement - Contact: privacy@supabase.io 2) Vercel Inc. (United States) — global edge network - Items transferred: access IP address, browser information, requested URLs and other server access logs - Purpose: web hosting and service delivery - Timing and method: transmitted over the internet with TLS encryption at the time of each page request - Retention period: until termination of the processing agreement - Contact: privacy@vercel.com 3) Google LLC (United States) — Google Analytics (GA4) - Items transferred: cookie-based anonymous identifiers, device and browser information, page view records - Purpose: usage statistics analysis and service improvement - Timing and method: transmitted over the internet with TLS encryption at the time of each page view - Retention period: as defined by Google Analytics policy (up to 14 months) - Contact: https://support.google.com/policies 4) Resend, Inc. (United States) — email delivery - Items transferred: email address, name, and the minimum information required for booking and settlement notifications - Purpose: sending welcome, booking, and settlement notification emails - Timing and method: transmitted over the internet with TLS encryption at the time each email is sent - Retention period: until termination of the processing agreement - Contact: privacy@resend.com ※ Payment card details are handled directly by NICE Payments Co., Ltd., a Korean payment gateway, and are not transferred overseas. LUWEI does not store card details. ※ You may refuse the cross-border transfer of your personal information. However, the transfers above are essential to providing the service, so refusal may prevent account registration and use of the service. To refuse, please contact business@luwei.kr.

Data Protection Officer - Name: Yujin Kim (Owner, LUWEI) - Position: Owner - Email: business@luwei.kr Please contact the address above for inquiries, complaints, or remedies related to personal information processing. We respond without undue delay. Remedies for infringement If you need to report or consult about a personal information breach, you may contact the following Korean authorities. - Personal Information Dispute Mediation Committee: +82-1833-6972 (www.kopico.go.kr) - Privacy Infringement Report Center: 118 (privacy.kisa.or.kr) - Supreme Prosecutors’ Office Cyber Investigation Division: 1301 (www.spo.go.kr) - National Police Agency Cyber Bureau: 182 (ecrm.police.go.kr) In addition, if your rights or interests are infringed by a disposition or omission by the head of a public institution regarding a request under Articles 35 (access), 36 (correction/deletion), or 37 (suspension of processing) of the Personal Information Protection Act, you may file an administrative appeal under the Administrative Appeals Act.