1. Overview

WeBuyK ("we") processes personal data to provide shopping assistance, purchase requests, payments, warehousing, and international shipping. This policy aligns with our security design (GDPR / CCPA principles).

2. Data we collect

Depending on how you use the Service, we may collect:

• Account: email, display name, Firebase UID, WBK-* customer code, role
• Profile: preferred language and currency
• Commerce: cart items, purchase requests, quotes, order history, consent records (including the policy version you agreed to)
• Shipping: recipient name, address, phone (when you provide them at checkout)
• Chat: messages you exchange with the AI assistant, including product URLs you paste
• Technical: session cookies, device/browser data, audit logs

3. How we use data

We use personal data to:

• Authenticate you and protect your account
• Parse product URLs and generate quotes
• Match inbound packages to your WBK-* code
• Process payments and arrange shipping
• Send transactional notifications (quote ready, warehouse received, shipped)
• Comply with law and prevent fraud

4. Sharing and processors (international transfers)

We do not sell your personal data. We share data with the following processors under contract, only as needed to operate the Service. These providers may process data outside your country of residence, including in the Republic of Korea and the United States, with appropriate safeguards:

• Firebase Authentication (Google LLC, US): account credentials and authentication state
• Stripe (Stripe, Inc., US): payment processing; WeBuyK does not store your card details
• SendGrid (Twilio Inc., US): transactional email delivery
• Google Gemini API (Google LLC, US): powers the AI shopping assistant — the content of your chat conversations (including pasted URLs and free-text messages) is transmitted to and processed by this large language model service to generate responses
• International carriers and customs brokers: recipient name, address, phone, and shipment contents as required for delivery and customs clearance

5. Retention

We retain data while your account is active and as required for legal, tax, and dispute purposes. Specific retention periods:

• Audit logs: 5 years (kept in separated storage, including after account deletion or service wind-down)
• Parsed source URLs (raw parsing inputs): 1 year
• Warehouse inspection media (photos/video): archived 90 days after delivery completion
• Payment and tax records: as required by applicable commercial and tax law

6. Your rights (GDPR / CCPA)

Where applicable, you may:

• Access and receive a copy of your data
• Correct inaccurate profile or address information
• Request deletion or anonymization of your account
• Export your data in a portable format (JSON)
• Withdraw marketing consent (transactional messages may still be sent)

7. Deletion requests

Deletion requests are completed within 30 days of verification. We delete or anonymize personal data across production systems and backups within that window, except for records we must retain by law (e.g. audit logs for 5 years, payment/tax records), which are kept in separated storage and excluded from further processing.

8. Cookies

We use essential session cookies for authentication and route protection. Analytics and marketing cookies, if introduced, will require separate consent.

9. Children

The Service is not directed to children under 16. We do not knowingly collect data from children.

10. Contact

Privacy inquiries and data subject requests: contact channels will be published here before commercial launch (TBD).