Privacy Policy

Draft. Counsel will finalize the wording before NUVI launches. The text below is the draft prepared for that review, not final legal wording. Words in [SQUARE BRACKETS] are values counsel or NUVI has still to fill in.

1. Who this Policy covers

This Policy explains how NUVI handles personal information when you use our service.

NUVI is operated by [COMPANY_LEGAL_NAME], located at [COMPANY_ADDRESS], Republic of Korea.

This Policy applies when you create an account, browse while signed in, send a request, upload photos, receive quotes, confirm a provider, contact our operations team, or exercise your privacy rights.

NUVI is designed for adults aged 18 or older.

2. What we collect

We collect only the information needed to operate the service described below.

Account information

| Information | Required? | Why we collect it | |---|---:|---| | Name as shown on your passport | Yes | So you and the chosen provider can identify the booking correctly | | Email address | Yes | Sign-in, account security, and transactional notices | | Nationality | Yes | To create the first part of your member number and help operations prepare for language/time-zone needs | | Mobile number | Yes | To contact you about your request and quotes | | Date of birth | Yes | To confirm that the service is used by an adult | | Confirmation that you are 18+ | Yes | Age eligibility record |

We do not collect your passport number or passport scan at this stage.

We do not collect your home address, gender, payment-card details, or marketing consent.

If you choose Google sign-in, Google provides the account information needed for sign-in, such as your email/profile information used by the authentication process.

Information in a request

When you send a request, we collect:

- procedure category and sub-category; - up to five providers you selected; - optional budget; - optional preferred visit period; - your free-text note; - up to five optional photos; - the messenger or phone channel you want us to use; and - the ID or number for that contact channel.

We do not store the contents of conversations that take place outside NUVI on WhatsApp, LINE, WeChat, KakaoTalk, or by phone.

A free-text note or photo may reveal health-related information depending on what you choose to send. NUVI uses that information only for the service purpose described in this Policy. Whether additional separate consent is required for particular health-related information must be confirmed and reflected in the service before launch as required by Korean law.

Records NUVI creates

NUVI also creates service records, including:

- your member number; - case number; - request status; - quotes received; - your confirmation; - consent type, document version, and consent time; - transactional email logs; - staff audit logs; and - a record of which authorised staff member viewed a request photo and when.

Photos

Request photos are stored in private storage. Metadata such as EXIF data is stripped on upload.

Photos are shared only with the providers you selected for that request, subject to the applicable sharing consent.

You can delete a photo at any time, including after confirmation.

Provider profile photos are handled separately from customer request photos.

3. Why we use your information

We use personal information to provide NUVI, comply with law, and protect the service. We do not use it for advertising.

Our main purposes and legal bases are:

| Purpose | Main information | Basis used by NUVI | |---|---|---| | Create and secure your account | Name, email, nationality, mobile, date of birth, 18+ confirmation | Necessary to provide the service / take steps at your request | | Create your member number and case | Account and request data | Necessary to provide the service | | Prepare and send your request | Request details, selected providers, contact details | Necessary to provide the service; provider sharing is subject to the required consent | | Share request details/photos with providers you selected | Relevant account/request data and optional photos | Your consent to sharing with the selected provider | | Gather and display quotes | Case details and provider quotes | Necessary to provide the service | | Record your confirmation and coordinate dates | Case, quote, confirmation, contact channel | Necessary to provide the service | | Send transactional email | Email and limited event information | Necessary to operate your account and service | | Security, fraud prevention, and audit | Account, access, staff-action and system records | Legal obligations and legitimate service/security needs where permitted | | Keep records required by law | Relevant transaction/business records | Legal obligation |

NUVI does not sell personal information.

NUVI does not use your personal information for behavioural advertising.

At the time of this Policy, NUVI does not send marketing email.

4. Sharing with clinics and esthetics studios

Your request is shared only with the providers you choose.

When you send a request, the service records sharing consent for each provider selected.

The provider receives only the information needed to review your request, prepare a quote, and, if you later choose that provider, help arrange the next steps.

Depending on your request, this can include your name, request details, preferred visit period, optional budget, free-text note, contact information needed for coordination, and photos you chose to attach.

Before consent is recorded, the selected provider is identified to you in the service.

The purpose of the sharing is to prepare and respond to your quote request and, if confirmed, coordinate the provider connection.

The provider's retention and use of information it receives may also be governed by its own legal duties and privacy policy. Any provider-specific retention information required for consent must be shown at the time of consent.

If you withdraw sharing consent while a request is in progress, NUVI will stop further sharing where required and will tell the relevant provider that the NUVI request should stop. Information already lawfully received and retained by the provider may remain subject to the provider's own legal duties.

5. Service providers and processing locations

NUVI uses other companies to run parts of the service.

| Service | Purpose | Information involved | |---|---|---| | Supabase | Database, authentication, private file storage | Account, case, consent, quote and photo data | | Vercel | Hosting and application delivery | Web requests and application processing | | Resend | Transactional email delivery | Recipient email and transactional email content | | Google | Optional Google sign-in | Authentication/profile information needed for sign-in |

Our Supabase project is hosted in Seoul, Republic of Korea (AWS ap-northeast-2). Vercel server functions are configured for Seoul (icn1), while public pages may use a global edge network that does not intentionally cache personal account data.

Before launch, NUVI must confirm the actual processing and transfer locations for Resend, Google, Vercel, and any sub-processors. The final disclosure will be inserted here: [CROSS_BORDER_PROCESSOR_DETAILS].

Where a processor handles personal information outside Korea, NUVI will use a lawful basis and provide the disclosures required by Korean privacy law.

We do not authorise these service providers to use your NUVI personal information for their own advertising.

6. Cookies and tracking

NUVI uses strictly necessary cookies or similar storage for sign-in sessions and security.

At the time of this Policy, NUVI does not use advertising cookies, behavioural tracking, or third-party advertising scripts.

NUVI also does not use analytics tracking scripts at the time of drafting.

If analytics or other non-essential tracking is added later, we will update this Policy and obtain consent where required before using it.

Blocking strictly necessary session cookies may prevent sign-in or other account functions from working.

7. How long we keep information

We keep information only for as long as needed for the service or a legal requirement.

The proposed retention schedule is:

| Record | Proposed period | Reason | |---|---|---| | Active account information | While the account is active | Provide the service | | Requests that never reach confirmation | Until account deletion or earlier service-purpose deletion | Service operation | | Confirmed/completed case records | Service period, then only the minimum record required for legal/business retention | Transaction and dispute record obligations where applicable | | Contract/withdrawal records, if the Electronic Commerce Act applies | 5 years | Proposed statutory retention | | Payment/supply records handled in NUVI's system, if applicable | 5 years | Proposed statutory retention; NUVI itself does not process provider payments | | Consumer complaint/dispute records, if applicable | 3 years | Proposed statutory retention | | Display/advertising records, if applicable | 6 months | Proposed statutory retention | | Request photos | Until you delete them, otherwise [PHOTO_RETENTION_AFTER_CASE_CLOSE] after the case closes | Data minimisation | | Consent records | For the period needed to prove the applicable consent and legal compliance | Compliance | | Security/access records | For the period required by applicable law and security policy | Security and legal compliance | | Commission ledger with providers | For the business/accounting retention period required by law | Business record obligation |

Every statutory period above must be confirmed by Korean counsel for NUVI's final legal classification.

When a law requires a record to be retained after other account data is deleted, NUVI will separate that record from active personal information where required.

8. Deleting your account and information

You can delete your NUVI account using the account deletion process. We confirm the request with a one-time code sent to your email.

When deletion is completed, NUVI deletes your active account and personal profile information, including your name, email, nationality, mobile number, date of birth, messenger IDs, and request photos, subject to records that must legally be retained.

Requests that never reached confirmation are deleted with the account.

For completed or confirmed cases, NUVI may retain the minimum business or transaction record required by law. Where the retained service record is described as anonymised, it must no longer contain your name, member number, contact details, or another reasonably usable link back to you.

NUVI also keeps its commission ledger with providers for the period required for accounting or other business records.

Deleting your NUVI account does not automatically delete information already held by a separate provider under that provider's own legal obligations. You may need to contact the provider about those records.

9. Your privacy choices and rights

You can:

- access the account information NUVI makes available to you; - correct your mobile number in your account; - contact us to correct your name or date of birth if it is wrong; - delete your account; - delete request photos; - withdraw consent where processing is based on consent; - ask us to stop processing where the law gives you that right; and - contact us with a privacy complaint.

Your name and date of birth are not directly editable in the account because they are used to identify you for a booking. Contact [CONTACT_EMAIL] if either is incorrect.

If you withdraw provider-sharing consent while a request is active, the request with that provider may no longer be able to continue.

We may ask for reasonable information to verify your identity before acting on a privacy request.

10. How we protect information

NUVI uses technical and organisational measures designed to protect personal information.

Current measures include:

- HTTPS encryption in transit; - private storage for customer photos; - database row-level access controls so customers can access only their own data; - staff access limited to active staff accounts; - audit logs for staff actions; - logging of staff access to customer photos; - secrets kept outside the application codebase; and - daily backups provided by the database service.

No online system can remove every security risk. If an incident occurs, NUVI will investigate and make required notifications under applicable law.

11. Adults only

NUVI is for people aged 18 or older.

We collect your date of birth and a separate confirmation that you are at least 18.

If we learn that an account belongs to a person under 18, we may restrict the account and delete the information as required.

12. If you are outside Korea

NUVI is based in Korea and is designed for foreign visitors who are often outside Korea when using the service.

Core service data is stored in Korea as described above. Your own device may access that data from another country.

For users in the European Economic Area or the United Kingdom, NUVI intends to rely on contract performance for information needed to provide the service, consent for provider/photo sharing where consent is the appropriate basis, and legal obligation for records that must be retained.

We offer access, correction, deletion, and consent-withdrawal options to users regardless of nationality where reasonably applicable.

If GDPR requires NUVI to appoint an EU representative, the final details will be: [EU_REPRESENTATIVE_IF_REQUIRED].

If UK GDPR requires a UK representative, the final details will be: [UK_REPRESENTATIVE_IF_REQUIRED].

You may also have the right to complain to the data-protection authority where you live. In Korea, complaints may be made to the Personal Information Protection Commission.

Mandatory rights under the law where you live are not removed by this Policy.

13. Changes to this Policy

We may update this Policy when the service, processors, law, or our privacy practices change.

We will show the version and effective date at the top.

Where a change requires notice or renewed consent, we will provide it before the change applies as required by law.

14. Contact and privacy officer

Operator: [COMPANY_LEGAL_NAME] Address: [COMPANY_ADDRESS] Business registration number: [BIZ_REG_NO] General/privacy contact: [CONTACT_EMAIL] Privacy Officer: [PRIVACY_OFFICER_NAME_AND_TITLE]

For questions, access/correction requests, deletion requests, consent withdrawal, or privacy complaints, contact [CONTACT_EMAIL].