Privacy Policy

Effective Date: January 30, 2026

Article 1 (Purpose)

Tinker Inc. (the "Company") complies with the Personal Information Protection Act, the Act on Promotion of Information and Communications Network Utilization and Information Protection (the "Network Act"), and other relevant laws to protect the personal information ("Personal Data") of individuals ("Users") who use the services provided by the Company (the "Services"). The Company establishes this Privacy Policy (the "Policy") to process user complaints related to privacy quickly and smoothly.

Article 2 (Principles of Personal Data Processing)

The Company may collect Users' Personal Data in accordance with applicable laws and this Policy. Collected Personal Data may be provided to third parties only with the User's consent. However, when compelled to do so by applicable law, the Company may provide Personal Data to third parties without prior consent.

Article 3 (Disclosure of This Policy)

  1. The Company discloses this Policy on the first page of its website or on a linked page so Users can easily review it at any time.
  2. When disclosing this Policy under paragraph 1, the Company uses readable font sizes, colors, and other formatting so Users can readily identify the content.

Article 4 (Amendments)

  1. This Policy may be amended to reflect changes in privacy laws, guidelines, notifications, or adjustments to government or Company policies or Services.
  2. When the Policy is amended under paragraph 1, the Company notifies Users through one or more of the following means:
    1. Posting a notice on the main page of the Company's website or in a separate pop-up window.
    2. Providing notice via letter, fax, email, or a similar communication method.
  3. Notices described in paragraph 2 are provided at least seven days before the effective date of the amendment, or at least 30 days in advance if User rights are materially affected.

Article 5 (Information Collected for Membership)

The Company collects the following information for Services membership registration:

  1. Required: email address, password, name, and mobile phone number.
  2. Optional: operating company name, business registration number, and brand name.

Article 6 (Information Collected for Payments)

  1. Required Information: Payment authorization information (card company name, payment authorization number, email, etc.)
  2. Optional Information: Expense verification information (company name, business registration number), refund account information

Article 7 (Information Required to Provide Services)

The Company collects the following information to provide Services to Users:

Required: email address, name, and contact information.

Article 8 (Information for Service Use and Fraud Prevention)

To analyze Service usage statistics and detect fraudulent activity (e.g., repeated sign-ups after withdrawal, repeated purchase cancellations, or other improper acts prohibited by the Terms of Service), the Company collects:

  1. Required: member ID, email address, and contact information.
  2. Optional: operating company name, business registration number, and brand name.

Article 9 (Collection Methods)

The Company collects Personal Data through the following methods:

  1. User entry of Personal Data on the Company's website.
  2. User entry of Personal Data via websites or Services.
  3. Information provided while using Services such as customer support or board activities.

Article 10 (Use of Personal Data)

The Company uses Personal Data for the following purposes:

  1. Communicating notices necessary for Company operations.
  2. Responding to inquiries and resolving complaints to improve Services.
  3. Providing the Company's Services.
  4. Enforcing restrictions against members who violate laws or Company Terms, preventing and sanctioning activities that hinder smooth Service operation, including fraudulent use.
  5. Developing new Services.
  6. Marketing, including events and promotional announcements.
  7. Conducting demographic analyses and analyzing visit and usage data.
  8. Understanding customer usage status, including Service reviews.

Article 11 (Retention and Use Period)

  1. The Company retains and uses Personal Data for the duration necessary to fulfill the collection and use purposes.
  2. Notwithstanding the preceding paragraph, the Company retains Personal Data after account deletion until the User requests deletion to prevent fraudulent sign-ups and usage under internal policies.

Article 12 (Statutory Retention)

Personal Data is retained and used in accordance with applicable laws as follows:

  1. Act on the Consumer Protection in Electronic Commerce:
    1. Records of contracts or withdrawals of offer: 5 years.
    2. Records of payments and supply of goods: 5 years.
    3. Records of consumer complaints or dispute resolutions: 3 years.
    4. Records of advertisements: 6 months.
  2. Protection of Communications Secrets Act:
    1. Website login history: 3 months.
  3. Electronic Financial Transactions Act:
    1. Records of electronic financial transactions: 5 years.
  4. Act on the Protection and Use of Location Information:
    1. Records of personal location information: 6 months.

Article 13 (Principle of Destruction)

The Company promptly destroys Personal Data when it is no longer necessary, such as after fulfilling the processing purpose or upon expiration of the retention period.

Article 14 (Destruction Procedures)

  1. Information entered during membership registration is transferred to a separate database (or filing cabinet for paper documents) after the purpose is met, stored for a set period under internal policy and legal requirements, then destroyed.
  2. Personal Data subject to destruction is deleted after approval from the privacy protection officer.

Article 15 (Destruction Methods)

Electronic files are deleted using technical methods that prevent recovery, and paper documents are shredded or incinerated.

Article 16 (Transmission of Promotional Information)

  1. The Company obtains explicit prior consent before sending commercial promotional information via electronic means, except in the following cases:
    1. When contact information is collected directly during a transaction and the Company sends promotional information about similar goods or services within six months after the transaction ends.
    2. When a telephone salesperson under the Door-to-Door Sales Act orally notifies the recipient of the source of Personal Data during a call.
  2. Even in the above cases, the Company ceases to send commercial information if the recipient withdraws consent or requests to opt out and informs the recipient of the outcome.
  3. If the Company sends commercial messages between 9:00 p.m. and 8:00 a.m. the next day, it obtains separate prior consent from the recipient regardless of paragraph 1.
  4. When sending commercial messages electronically, the Company clearly indicates the following:
    1. Company name and contact information.
    2. Instructions on how to refuse or withdraw consent.
  5. The Company does not take any of the following actions when sending commercial information electronically:
    1. Evading or obstructing opt-out or withdrawal of consent.
    2. Automatically generating contact information (phone numbers or email addresses).
    3. Automatically registering phone numbers or email addresses for the purpose of sending commercial messages.
    4. Concealing the sender's identity or origin of the advertisement.
    5. Deceiving recipients to induce replies for commercial purposes.

Article 17 (Protection of Children's Personal Data)

  1. The Company allows membership only for Users aged 14 or older to protect minors' Personal Data.
  2. If a User is under 14, the Company obtains consent from the child's legal guardian for the collection, use, and provision of the child's Personal Data.
  3. In such cases, the Company additionally collects the guardian's name, date of birth, gender, duplicate registration confirmation information (DI), and mobile phone number.

Article 18 (User Obligations)

  1. Users must keep their Personal Data up to date and are responsible for issues caused by inaccurate information.
  2. Users who register using another person's Personal Data may lose their membership or face penalties under applicable privacy laws.
  3. Users are responsible for safeguarding their email addresses, passwords, and similar credentials and may not transfer or lend them to third parties.

Article 19 (Management of Personal Data)

The Company implements necessary technical and administrative safeguards to prevent the loss, theft, leakage, alteration, or damage of Personal Data during processing and to ensure security.

Article 20 (Handling Deleted Data)

Personal Data deleted or terminated at the request of a User or legal representative is processed according to the retention period described in "Retention and Use Period" and is not used or accessed for any other purpose.

Article 21 (Password Encryption)

User passwords are stored and managed using one-way encryption, and only the User who knows the password can verify or change Personal Data.

Article 22 (Measures Against Hacking)

  1. The Company strives to prevent Personal Data from being leaked or damaged due to hacking, computer viruses, or other intrusions.
  2. Up-to-date antivirus programs are used to prevent User data from being leaked or damaged.
  3. The Company operates intrusion prevention systems to maximize security.
  4. Sensitive Personal Data, where collected and stored, is transmitted securely over networks through encrypted communication.

Article 23 (Minimization and Training)

The Company limits the number of personnel authorized to process Personal Data and emphasizes compliance with laws and internal policies through training and administrative measures.

Article 24 (Measures for Personal Data Breach)

Upon learning of any loss, theft, or leakage of Personal Data ("Breach"), the Company promptly notifies affected Users of all relevant details and reports the incident to the Korea Communications Commission or the Korea Internet & Security Agency.

  1. Items of Personal Data subject to the Breach.
  2. Time of the Breach.
  3. Measures Users can take.
  4. Actions taken by the information and communications service provider.
  5. Contact information for the department handling inquiries.

Article 25 (Exceptions to Breach Notification)

If the Company cannot obtain a User's contact information for legitimate reasons, it may substitute notification with a posting on the Company website for at least 30 days.

Article 26 (Cookies and Automated Data Collection)

  1. To provide personalized services, the Company uses cookies, small pieces of data sent from the Service server (PC or mobile) to the User's web browser that may be stored on the User's device.
  2. Users can choose whether to allow cookies by adjusting browser settings to accept all cookies, confirm each time, or refuse all cookies.
  3. Rejecting cookies may limit access to certain Services that require login.

Article 27 (Cookie Configuration)

Cookie preferences can be configured via browser settings:

  1. Edge: Settings (top right) > Cookies and site permissions > Manage and delete cookies and site data
  2. Chrome: Settings (top right) > Privacy and security > Cookies and other site data
  3. Whale: Settings (top right) > Privacy protection > Cookies and other site data

Article 28 (Data Protection Officer)

  1. To safeguard Personal Data and handle related complaints, the Company designates the following department and Data Protection Officer (DPO):
    1. Data Protection Officer
      1. Name: Tae-Eok Kim
      2. Title: CEO
      3. Phone: 070-5100-0344
      4. Email: wkjeong@tinker.style

Article 29 (Delegation of Personal Data Processing)

  1. To improve operational efficiency, enhance Service quality, and fulfill contractual obligations, the Company may outsource certain tasks to specialist vendors and delegate the collection, storage, processing, use, provision, management, and destruction of Personal Data and customer information.
  2. Among the entrusted companies, 'Polar' and 'Google Cloud' may transfer and store personal information on servers located overseas, including the United States, for service fulfillment.
  3. The Company shares Personal Data with third parties only with the data subject's consent or when permitted under Article 17 of the Personal Information Protection Act or other applicable laws, as described below.
  4. The Company may also provide Personal Data without consent when required by law, including:
    1. When a lawfully authorized investigative or governmental body requests information through due process.
    2. When disclosure is reasonably necessary to take legal action against individuals who cause mental, material, or property damage to others by using the Services.
  5. The delegated processors and their duties are as follows.
RecipientWebsiteScope of Work
PortOne Korea Co., Ltd.https://portone.ioPayment processing (Country: South Korea)
Polar (Polar.sh)https://polar.shInternational payment processing and settlement (Country: United States)
Google Cloudhttps://cloud.google.comServer operations and data storage (Country: United States, etc.)

Article 30 (Remedies for Infringement)

  1. Data subjects may request dispute resolution or consultation from the Personal Information Dispute Mediation Committee, the Korea Internet & Security Agency (KISA) Privacy Infringement Center, and the agencies below. Additional inquiries may be directed to:
    1. Personal Information Dispute Mediation Committee: 1833-6972 (www.kopico.go.kr)
    2. KISA Privacy Infringement Center: 118 (privacy.kisa.or.kr)
    3. Supreme Prosecutors' Office: 1301 (www.spo.go.kr)
    4. National Police Agency: 182 (ecrm.cyber.go.kr)
  2. The Company endeavors to protect the data subject's right to self-determination and to offer consultation and remedies for privacy infringements. Please contact the department listed in paragraph 1 if you need assistance.
  3. Individuals whose rights or interests are harmed by a public institution's disposition or omission regarding requests under Articles 35 (Access), 36 (Rectification/Deletion), or 37 (Suspension of Processing) of the Personal Information Protection Act may file an administrative appeal pursuant to the Administrative Appeals Act.
    1. Central Administrative Appeals Commission: 110 (www.simpan.go.kr)
  4. Rights of European Union (EU) Residents: Users residing in the EU may exercise their rights under the GDPR (General Data Protection Regulation), including the right to access, rectification, erasure, restriction of processing, data portability, and the right to object. To exercise these rights, please contact the Company via email (wkjeong@tinker.style), and the Company will take action without delay.

[Appendix] Additional Privacy Policy for Users Residing Overseas

Gentone respects the privacy of users worldwide. This additional section applies to users residing outside of the Republic of Korea, including the European Economic Area (EEA), the United Kingdom, Switzerland, and the State of California, USA. In case of any conflict between the main text and this appendix, the provisions of this appendix that better comply with the laws of the user's place of residence shall prevail.

1. Provisions for Residents of the European Union (EU) and the United Kingdom (GDPR)

A. Lawful Basis for Processing Personal Information: The Company processes users' personal information based on the following lawful bases under Article 6 of the GDPR.

  1. Performance of a Contract: Service registration, provision of lookbook creation features, payment processing and settlement.
  2. Legitimate Interests: Maintaining service security, fraud prevention, improving service performance, and statistical analysis.
  3. Compliance with Legal Obligations: Record retention under applicable laws (e.g., tax laws), responding to lawful requests from courts or investigative authorities.
  4. Consent: When the user has given explicit consent, such as for receiving marketing information. (Consent may be withdrawn at any time.)

B. Rights of Data Subjects: EU resident users may exercise the following rights under Articles 15-22 of the GDPR.

  1. Right to Access: The right to request a copy of your personal information held by the Company.
  2. Right to Rectification: The right to request correction of inaccurate or incomplete information.
  3. Right to Erasure ('Right to be Forgotten'): The right to request deletion of information that is no longer necessary.
  4. Right to Restriction: The right to request restriction of processing in certain circumstances.
  5. Right to Portability: The right to receive your information in a machine-readable format or request its transfer to another controller.
  6. Right to Object: The right to object to processing based on the Company's legitimate interests.

C. International Data Transfers: User data is transferred outside the European Union (EU) to the Republic of Korea and the United States (Polar, Google Cloud, etc.) for service provision. The Company applies protective measures equivalent to the European Commission's Standard Contractual Clauses (SCC) or adequacy decisions when transferring data.

D. DPO and Supervisory Authority Contact

2. Provisions for California Residents (CCPA/CPRA)

A. Categories of Personal Information Collected (Past 12 Months)

B. Do Not Sell My Personal Information

The Company does not sell users' personal information to third parties. Therefore, no separate 'Opt-out' action under the California Consumer Privacy Act (CCPA) is required.

C. California Consumer Rights

  1. Right to Know: The right to request disclosure of personal information collected, used, and disclosed over the past 12 months.
  2. Right to Delete: The right to request deletion of personal information collected by the Company. (Except where legal obligations or other exceptions apply)
  3. Right to Non-Discrimination: The right not to be discriminated against in service pricing or quality for exercising your rights.

D. How to Exercise Your Rights: California residents may exercise the above rights by contacting us via email (wkjeong@tinker.style), and the Company will respond within 45 days of receiving the request.