Privacy Policy

The data controller responsible for personal information processed through localiseoul.com is COMMONKUNST Co., Ltd. (주식회사 커먼쿤스트), represented by SIMUN YANG.

• Address: 304-2301, 47 Ungcheonjungang-ro, Yeosu-si, Jeollanam-do, South Korea
• Business Registration: 807-86-02271
• Privacy contact: commonkunst@gmail.com (Simun Yang, founder)

2.1 You provide directly

• Name, email address, country of residence, preferred language and currency.
• Booking details: desired check-in / check-out dates, length of stay, number of guests, special requests.
• Match quiz answers: persona type, budget range, work or school location, lifestyle preferences.
• Payment metadata (last four digits, brand, country) — full card numbers are never seen or stored by Locali; they are handled by PayPal or Toss Payments.
• Any message you send through email, KakaoTalk, WhatsApp, or in-product chat.

2.2 Collected automatically

• IP address, device type, browser type, and language headers for security and basic analytics.
• Authentication cookies issued by Supabase when you sign in.
• Locale / currency preference cookies set when you change the language or currency selector.

2.3 Received from third parties

• Listing metadata sourced from upstream Korean platforms (33m2 and direct partner hosts) and stored after English translation and curation.
• Payment status events from PayPal and Toss Payments webhooks.

• Operating bookings: confirming availability with the Host, processing payment, sending check-in instructions, and supporting your stay.
• Personalising recommendations: matching you to neighborhoods and listings based on Match quiz answers.
• Account features: sign-in, favorites, notifications, profile management.
• Communication: responding to booking questions, sending transactional emails (booking confirmation, refund updates), and one-off service announcements.
• Security and abuse prevention: detecting fraud, abuse, and policy violations.
• Legal compliance: tax records, e-commerce reporting, and dispute resolution as required by Korean law.

We do not use personal information to train AI models, and we do not sell or rent your information to advertisers.

We process personal information on the following bases:

• Performance of contract — to process your booking and provide the Service (PIPA § 15, GDPR Art. 6(1)(b)).
• Legitimate interest — basic analytics, security, and fraud prevention (GDPR Art. 6(1)(f)).
• Consent — marketing communications or any processing not strictly required to operate the Service. You may withdraw consent at any time without affecting prior processing.
• Legal obligation — tax, accounting, and consumer-protection record-keeping under Korean law.

We share the minimum information necessary with the following service providers, each bound by a data-processing agreement or equivalent:

• Supabase (database, authentication, storage). Hosted in the region selected for the localiseoul.com project.
• Vercel (web hosting and edge functions).
• PayPal and Toss Payments (payment processing).
• Resend (transactional email delivery from hello@localiseoul.com).
• Naver Cloud Platform (Maps and Places API for in-app neighborhood discovery).
• Hosts and upstream platforms (33m2 and direct partners) — we share only the guest name, check-in/check-out dates, party size, and contact details required to confirm the reservation.

We do not transfer personal information to any other third party except where required by law, court order, or to protect the safety of users.

• Booking records: 5 years from the completion of the stay, as required by Korean consumer-protection and e-commerce regulations.
• Payment and refund records: 5 years (Commercial Act and tax law).
• Account and profile data: until you delete your account, then 30 days for backup recovery.
• Match quiz answers: until you delete the entry from your profile, or up to 2 years if you have no account.
• Marketing consent records: until withdrawn.
• Server logs: up to 90 days.

Under PIPA (and the EU GDPR for EU-resident Guests), you have the right to:

• Access the personal information we hold about you.
• Correct inaccurate or incomplete information.
• Request deletion or restriction of processing, subject to the retention obligations in Section 6.
• Receive a copy of the data in a portable format (GDPR residents).
• Withdraw consent and object to processing based on legitimate interest.
• File a complaint with the Korean Personal Information Protection Commission or your local supervisory authority.

To exercise any of these rights, email commonkunst@gmail.com. We respond within 10 business days.

We use cookies for three purposes only:

• Strictly necessary — Supabase authentication session, CSRF protection, locale and currency preference.
• Functional — remembering UI choices such as favorites (when not signed in).
• Anonymous analytics — aggregated page-view counts that do not identify you personally.

We do not use advertising or cross-site tracking cookies.

We protect personal information with TLS in transit, encrypted storage at rest through Supabase, role-based access for operator staff, and audit logging on sensitive admin actions. No system is perfectly secure, but we promise to notify affected Guests and the Korean PIPC within 72 hours of any confirmed breach that puts their data at risk.

Some service providers (Vercel, Resend) operate from outside South Korea. Where data is transferred internationally, we rely on the provider’s standard contractual clauses and equivalent safeguards under PIPA and the GDPR.

Locali is not intended for users under the age of 18 and we do not knowingly collect personal information from anyone under 18. If you believe a minor has provided us information, please contact us and we will delete it.

We may update this Privacy Policy as the Service evolves. Material changes are posted on this page and notified by email where we have a current address on file. Continued use of the Service after a change indicates acceptance of the updated policy.