Privacy Policy

Innostock (the "Company") complies with the Personal Information Protection Act and other applicable laws of the Republic of Korea, and establishes and discloses this Privacy Policy as follows to protect users' personal information. In this Policy, "Service" refers to Innostock provided by the Company.

1. Personal Information We Collect

The Company collects the following personal information to provide the Service.

Users may optionally enter information such as the representative's name, contact person's name, phone number, and email address on the Service's 'Company Information' and 'Supplier Management' screens, and the Company stores this solely to create and print purchase orders. With respect to this information, the Company acts as a processor entrusted by the user; see Section 5-2 for details. Users must not enter unique identifiers such as resident registration numbers, sensitive information, or purchaser information such as orderers and recipients.

※ The Company does not, in principle, collect personal information of children under the age of 14.

2. Purpose of Collection and Use

• Responding to sign-up / inquiry requests, service guidance, and customer support
• Member identification and provision of the Service (demand forecasting, ordering, inventory management)
• Payment and settlement of fees, and issuance of tax invoices
• Service improvement through usage statistics and behavioral analysis, new feature announcements, and delivery of notices
• Prevention of misuse and ensuring service stability

※ The Company does not make automated decisions (including profiling) that produce legal effects concerning users or similarly significantly affect them using their personal information. Service outputs such as demand forecasts and order recommendations are a reference tool that supports the user's own decisions; the final judgment and responsibility rest with the user.

3. Retention and Use Period

As a rule, the Company destroys personal information without delay once the purpose of collection and use has been achieved. However, where retention for a certain period is required under applicable law, the information is kept for that period.

• Member information: until membership withdrawal (destroyed immediately upon withdrawal, except that email is retained for 30 days to prevent misuse)
• Sign-up requests: 1 year from the date of collection
• 1:1 inquiries: 1 year from the date of collection
• Access logs: 6 months
• Records on contracts, payment, and supply of goods: 5 years (Act on Consumer Protection in Electronic Commerce)
• Records on consumer complaints or dispute resolution: 3 years (Act on Consumer Protection in Electronic Commerce)
• Records on labeling and advertising: 6 months (Act on Consumer Protection in Electronic Commerce)
• Books and supporting documents under tax law: 5 years (Framework Act on National Taxes, Corporate Tax Act)
• Information subject to a statutory retention obligation: the period prescribed by the relevant law
• Contact information entered by users (entrusted processing): retained until the user deletes it or the use contract terminates; after termination, destroyed in accordance with Article 15 of the Terms of Service

※ Payment is processed via a payment processor (Paddle) and bank transfer. Payment-method details such as card numbers are handled and stored directly by the payment processor, and the Company does not store them. Payment and transaction records are retained for the statutory periods above.

4. Provision to Third Parties

The Company does not use users' personal information beyond the scope stated in this Policy or provide it to third parties, except in the following cases:

• When the user has given prior consent
• When required by law or by a lawful request from an investigative agency

5. Outsourcing and Overseas Transfer of Processing

To provide the Service smoothly, the Company outsources personal information processing tasks as follows. Some processors are located overseas, and personal information may therefore be transferred abroad.

※ Processing of personal information by the above processors is subject to safeguards applied through outsourcing contracts under Article 26 of the Personal Information Protection Act. Member information is stored on servers within the Republic of Korea (Supabase Seoul region).

※ Timing and method of overseas transfer: transmitted automatically over the network at the time the Service is used. Retention/use period of the recipient: until the purpose of the outsourcing is achieved or the outsourcing contract terminates, within the scope of the purposes above.

※ Users may refuse the overseas transfer of their personal information by sending a list of the personal information they do not wish to be transferred to the Personal Information Protection Officer's email (support@getinnostock.com). However, because the above overseas transfers are essential to providing the Service (member authentication, data storage, payment, etc.), users who refuse the transfer may be unable to use all or part of the Service.

※ Among the processors above, those that store the information entered by users (Section 5-2) are sub-processors; additions or changes to sub-processors follow Section 5-2(5).

5-2. Entrusted Processing of Information Entered by Users

1. (Scope) User-side information: representative name, contact person name, phone number, email address, address, business registration number ('Company Information' screen) / Supplier-side information: contact person name, phone number, email address, address ('Supplier Management' screen)
2. (Purpose) Creating, displaying, printing, and storing purchase orders
3. (The Company's status) The user determines whether and for what purpose this information is entered; the Company processes it, as entrusted by the user, only within that purpose. The Company does not use it beyond the entrusted scope or provide it to third parties.
4. (Retention and destruction) Retained until the user deletes it or the use contract terminates; after termination, destroyed in accordance with Article 15 of the Terms of Service.
5. (Sub-processing) The Company sub-delegates storage to the processor listed in the table above (Supabase, Inc.). If a sub-processor is added or changed, the Company will give prior notice, and users may object.
6. (User responsibility) The user must secure the legal basis required under applicable law for the data subjects of the entered information (their own employees, supplier contacts, etc.).
7. (Rights of data subjects) If a data subject of the above information requests access, correction, or deletion, the Company will notify the user and process it in accordance with the user's instructions.

6. Rights of Data Subjects and Legal Representatives, and How to Exercise Them

Users (data subjects) and their legal representatives may at any time request access to, correction, deletion, or suspension of processing of their personal information. Such requests may be made via the Personal Information Protection Officer contact below, and the Company will act without delay.

In addition, under Article 35-2 of the Personal Information Protection Act, users may request that their personal information be transmitted to themselves or to another personal information controller or a specialized personal information management institution. The method of requesting transmission and of checking transmission status and records may be applied for via the Personal Information Protection Officer contact below, and the Company processes such requests within the scope prescribed by applicable law.

7. Destruction Procedure and Method

When personal information becomes unnecessary — for example, upon expiry of the retention period or achievement of the processing purpose — the Company destroys it within 5 days thereof.

• Electronic files: permanently deleted by a method that prevents recovery or reproduction
• Paper documents: shredded or incinerated
• Entrusted-processing information: upon the user's deletion request or termination of the contract, destroyed within the period set out in Article 15 of the Terms of Service

8. Measures to Ensure Security

a. Administrative measures — Establishment and implementation of an internal management plan; minimization of access privileges (least privilege)

b. Technical measures — One-way hash storage of passwords (cannot be decrypted), TLS 1.2+ encryption across the entire transmission path, per-user data isolation via database row-level security (RLS), enforcement of HTTPS and security headers (CSP, HSTS, X-Frame-Options), and blocking of abnormal access (rate limiting)

c. Backups — The Company does not operate routine backups of personal information.

※ For convenience, some data may be temporarily cached in the user's browser local storage (localStorage), and this copy may be stored in plain text on that device. We recommend logging out and clearing browser data on shared devices.

8-2. Notification and Reporting of Personal Information Breaches

If the Company becomes aware of the loss, theft, leakage, forgery, alteration, or damage of personal information (collectively, a "breach"), it will, in accordance with Article 34 of the Personal Information Protection Act and applicable laws, notify the affected data subjects without delay (within 72 hours, absent justifiable grounds) of ① the items of personal information involved, ② the time and circumstances of the breach, ③ measures the data subject can take to minimize harm, ④ the Company's response measures and remediation procedures, and ⑤ the department and contact for reports and inquiries. In addition, where the breach affects 1,000 or more data subjects or results from unauthorized external access, the Company will report it to the Personal Information Protection Commission or the Korea Internet & Security Agency (KISA) within 72 hours.

If the Company becomes aware of a breach of information it processes as entrusted by a user (Section 5-2), it will inform the relevant user without delay and cooperate so that the user can fulfill its legal obligations, such as notifying data subjects.

9. Operation of Cookies

The Company may use cookies to provide the Service, for user convenience, and for service usage and behavioral analytics (Google Analytics, Microsoft Clarity). Users may refuse the storage of cookies.

• You may refuse cookie storage in your web browser — Chrome: Settings > Privacy and security > Cookies and other site data / Edge: Settings > Cookies and site permissions / Safari: Preferences > Privacy > Manage cookies and website data / Firefox: Settings > Privacy & Security > Cookies and Site Data
• In each browser's settings you can choose "Block third-party cookies" or "Block all cookies."
• Resetting mobile advertising identifiers — iOS: Settings > Privacy & Security > Tracking (limit app tracking) / Android: Settings > Privacy > Ads (reset/delete advertising ID)
• If you refuse cookie storage, some Service features may be limited.

10. Personal Information Protection Officer

The Company designates a Personal Information Protection Officer who oversees matters relating to personal information processing.

• Name: Eyrom Moon (Personal Information Protection Officer)
• Phone: 070-8058-9569
• Email: support@getinnostock.com

Requests for access, correction, deletion, or suspension of processing of personal information are received and handled by the department below.

• Access request reception/processing: Personal Information Protection Officer (Eyrom Moon) · Email: support@getinnostock.com

11. Remedies for Infringement of Rights

For reports or consultation regarding personal information infringement, you may contact the following organizations (Korea):

• Personal Information Dispute Mediation Committee: 1833-6972 (privacy.go.kr)
• Personal Information Infringement Report Center (KISA): 118 (privacy.kisa.or.kr)
• Supreme Prosecutors' Office Cybercrime Investigation: 1301
• National Police Agency Cyber Bureau: 182

12. Duty of Notice

Any addition, deletion, or modification of this Privacy Policy will be announced through the website's notices before it takes effect.

This English version is provided for reference only. In case of any conflict or difference in interpretation between the Korean and English versions, the Korean version shall prevail.