Privacy Policy

The data controller responsible for personal information processed through localiseoul.com is COMMONKUNST Co., Ltd. (주식회사 커먼쿤스트), represented by SIMUN YANG.

• Address: 304-2301, 47 Ungcheonjungang-ro, Yeosu-si, Jeollanam-do, South Korea
• Business Registration: 807-86-02271
• Privacy contact: hello@localiseoul.com (Simun Yang, founder)

2.1 You provide directly

• Name, email address, nationality, age, country of residence, preferred language and currency.
• Booking details: desired check-in / check-out dates, length of stay, number of guests, special requests.
• Expert Search brief and optional match answers: requested help, stay dates and duration, primary guest nationality and age, household composition, home type, budget and deposit preference, commute destinations, must-haves, deal-breakers, flexibility, requested Korean-language checks, and candidate-property links.
• Free Match Preview and concierge-service records: candidate profiles and fit reasons prepared for you, personalized setup guidance, preview delivery and first-view timestamps, accepted service scope, and verification status.
• Payment metadata (last four digits, brand, country) — full card numbers are never seen or stored by Locali; they are handled by PayPal or Toss Payments.
• Any message you send through email, KakaoTalk, WhatsApp, WeChat, LINE, or in-product chat.

2.2 Collected automatically

• IP address, device type, browser type, and language headers for security and basic analytics.
• Authentication cookies issued by Supabase when you sign in.
• Locale / currency preference cookies set when you change the language or currency selector.
• With your permission, Google Analytics measurement data and Microsoft Clarity interaction data used to understand site performance, usability, and advertising attribution. Form-field values are not intentionally sent to these services.

2.3 Received from third parties

• Listing metadata sourced from upstream Korean platforms (33m2 and direct partner hosts) and stored after English translation and curation.
• Payment status events from PayPal and Toss Payments webhooks.

• Operating bookings: confirming availability with the Host, processing payment, sending check-in instructions, and supporting your stay.
• Personalising recommendations: matching you to neighborhoods and listings based on Match quiz answers or your housing brief, and preparing your private Match Preview and Seoul setup guidance.
• Account features: sign-in, favorites, notifications, profile management.
• Communication: responding to booking questions, sending transactional emails (booking confirmation, refund updates), and one-off service announcements.
• Security and abuse prevention: detecting fraud, abuse, and policy violations.
• Legal compliance: tax records, e-commerce reporting, and dispute resolution as required by Korean law.

We do not use personal information to train AI models, and we do not sell or rent your information to advertisers.

We process personal information on the following bases:

• Performance of contract — to process your booking and provide the Service (PIPA § 15, GDPR Art. 6(1)(b)).
• Legitimate interest — basic analytics, security, and fraud prevention (GDPR Art. 6(1)(f)).
• Consent — marketing communications or any processing not strictly required to operate the Service. You may withdraw consent at any time without affecting prior processing.
• Legal obligation — tax, accounting, and consumer-protection record-keeping under Korean law.

We share the minimum information necessary with the following service providers, each bound by a data-processing agreement or equivalent:

• Supabase (database, authentication, storage). Hosted in the region selected for the localiseoul.com project.
• Vercel (web hosting and edge functions).
• PayPal and Toss Payments (payment processing).
• Resend (transactional email delivery from hello@localiseoul.com).
• Naver Cloud Platform (Maps and Places API for in-app neighborhood discovery).
• Google (and Apple, where offered) — social sign-in providers. If you choose to sign in with Google or Apple, we receive your name and email address from that provider to create or access your account.
• Hosts, upstream platforms, and licensed real-estate partners(33m2 and selected direct partners) — we share only the guest name, check-in/check-out dates, party size, and contact details required to confirm the reservation.

We do not transfer personal information to any other third party except where required by law, court order, or to protect the safety of users.

• Unqualified housing briefs: up to 1 year after the last contact, unless the guest asks for earlier deletion. Paid concierge proposals and contracts are retained with transaction records for 5 years.
• Booking records: 5 years from the completion of the stay, as required by Korean consumer-protection and e-commerce regulations.
• Payment and refund records: 5 years (Commercial Act and tax law).
• Account and profile data: until you delete your account, then 30 days for backup recovery.
• Match quiz answers: until you delete the entry from your profile, or up to 2 years if you have no account.
• Marketing consent records: until withdrawn.
• Server logs: up to 90 days.

Under PIPA (and the EU GDPR for EU-resident Guests), you have the right to:

• Access the personal information we hold about you.
• Correct inaccurate or incomplete information.
• Request deletion or restriction of processing, subject to the retention obligations in Section 6.
• Receive a copy of the data in a portable format (GDPR residents).
• Withdraw consent and object to processing based on legitimate interest.
• File a complaint with the Korean Personal Information Protection Commission or your local supervisory authority.

To exercise any of these rights, email hello@localiseoul.com. We respond within 10 business days.

We use cookies and similar storage for the following purposes:

• Strictly necessary — Supabase authentication session, CSRF protection, locale and currency preference.
• Functional — remembering UI choices such as favorites (when not signed in).
• Optional analytics — Google Analytics measures visits and conversion events, and Microsoft Clarity helps us understand navigation and usability. These services remain in denied/no-cookie mode unless you accept optional analytics cookies.
• Advertising measurement — when you accept optional cookies, Google Ads click identifiers and conversion signals help us measure campaign results. Locali currently keeps personalized advertising disabled.

You can accept or reject optional cookies when you first visit and change that choice later through Cookie settings in the footer. Rejecting optional cookies does not prevent you from browsing, sending a housing brief, or contacting Locali.

We protect personal information with TLS in transit, encrypted storage at rest through Supabase, role-based access for operator staff, and audit logging on sensitive admin actions. No system is perfectly secure, but we promise to notify affected Guests and the Korean PIPC within 72 hours of any confirmed breach that puts their data at risk.

Some service providers (Vercel, Resend) operate from outside South Korea. Where data is transferred internationally, we rely on the provider’s standard contractual clauses and equivalent safeguards under PIPA and the GDPR.

Locali is not intended for users under the age of 18 and we do not knowingly collect personal information from anyone under 18. If you believe a minor has provided us information, please contact us and we will delete it.

We may update this Privacy Policy as the Service evolves. Material changes are posted on this page and notified by email where we have a current address on file. Continued use of the Service after a change indicates acceptance of the updated policy.