Privacy notice

MadRose Privacy Notice Effective date: 30 September 2026 Rose, trading as MadRose and represented by Jinyu Kim, processes personal information for this member and guest checkout store as described below. 1. Purposes We process information to accept and confirm orders and payments, make and ship products, handle cancellations, returns, refunds and inquiries, resolve disputes, secure the site and prevent misuse. We also process information for registration, email verification, login, password reset and member order and delivery history. We measure page views and performance in aggregate without identifying visitors or linking visits. We do not track visits for personalized advertising. We keep a visit record so the shop owner can see where customers leave checkout, improve the ordering process and answer enquiries. 2. Information and collection At registration we collect your name and email and store your password as a hash. We create email-verification and password-reset information and login sessions. At checkout we collect the buyer's name and email, the recipient's name, phone number and delivery address (including country and postal code), and the selected items, options and quantities. We create order numbers, amounts and payment and shipment statuses. If you contact us, we process your email address and message. IP address, browser and access records, and an order-session cookie may be created when you visit. We do not send product or order contents or customer identifiers for aggregate page-view and performance measurement. We do not directly collect payment card numbers or PayPal passwords. We do not target children under 14 or intentionally collect their information. Pages opened, products viewed, items added to or removed from the bag, checkout steps reached and the input step where a notice appeared (not the notice text), payment window opening and outcome, device type and referral source are recorded with a visit cookie (mr_vid). We link this record to the bag or order if there is one. We do not store what you type or your IP address in the visit record, and do not share it with advertisers or other third parties. 3. Retention Korean e-commerce law requires us to keep contract and withdrawal records and payment and supply records for five years, consumer complaint and dispute records for three years, and advertising records for six months. These periods apply to the relevant transaction records, not automatically to all access data. We delete other information without undue delay when its purpose ends or a valid deletion request is confirmed. Order and login session cookies last up to 30 days. Records retained by law are managed separately for that purpose and deleted when the applicable period ends. Visit records are deleted automatically 90 days after collection. 4. Payment and other recipients Domestic payments are routed through Korea PortOne and processed by KG Inicis or NHN KCP. The order reference, amount and payment-related buyer name, contact and email are transmitted as needed. For international payments, PayPal, Inc. receives the order reference, amount, currency, recipient name and shipping address; you then proceed to PayPal's checkout. PayPal processes payment information as an independent controller. When we arrange delivery, the actual carrier (currently including Korea Post) receives the recipient's name, address, phone and necessary order details. We do not disclose this information for unrelated purposes except as required by law. 5. Service providers Cloudflare, Inc. delivers and protects the site and measures page views and performance without identifying individual visitors. This measurement uses no analytics cookies or browser storage. NHN Dooray Corporation receives and stores messages sent to [email protected]. Opening the Korean address search may send search text and connection information to Kakao's postcode service; only the selected address is copied into the checkout. When order and shipment notices are enabled, we send them from [email protected] through Plus Five Five, Inc. (Resend). The buyer's email, order reference, products and amount, recipient name and shipping address, and tracking number are included in the email sent through Resend. We do not create a separate customer list there, but Resend temporarily retains sent message content and delivery records. For email verification and password reset, Resend also receives your email and verification or reset link. We will update this notice when a provider or its work changes. When staff alerts are enabled, our bot uses Telegram Messenger Inc.'s Bot API to send the order reference, products, quantities, amount, destination country, and order, refund or shipment status to designated staff chats. Group chats receive summaries only. The detail button sends item and tracking information only to authorized staff in a private chat. We do not send buyer or recipient names, email addresses, phone numbers or full delivery addresses to Telegram; staff access those in the authenticated admin dashboard. 6. Transfers outside Korea When you access the site, IP, browser and request information and information transmitted through the site pass over the network to Cloudflare, Inc. (United States; [email protected]) for delivery and security. Processing may occur on Cloudflare's global network; current locations and retention practices are described at www.cloudflare.com/privacypolicy/. If you choose international payment, the order reference, amount, currency, recipient name and shipping address are transmitted to PayPal, Inc. (United States; www.paypal.com/kr/smarthelp/contact-us) when the payment request is created. PayPal retains the data for payment, fraud prevention and legal obligations under its own statement at www.paypal.com/kr/legalhub/paypal/privacy-full. We do not send this information to PayPal if you do not choose PayPal payment. Refusing this transfer means PayPal payment is unavailable. On order or shipment completion, email verification or password reset, your email and the relevant order, shipment, verification or reset message are transferred by API to Plus Five Five, Inc. (United States; [email protected]) to deliver the message and manage delivery records. Resend says email and logs are kept for 30 days on Free, Pro and Scale plans and backups for seven days (resend.com/security/gdpr). Contact us using section 9 to object to or ask about an overseas transfer; the relevant payment or email service, or access to the site, may then be unavailable. When staff alerts are enabled, the order summary described in section 5 is sent through Telegram Messenger Inc.'s Bot API to Telegram's services outside Korea as the order, refund or shipment status changes. Cloud chat messages may be processed in data centers in multiple jurisdictions and remain subject to deletion by the operating chat and Telegram's policy (telegram.org/privacy). Contact us using section 9 if you object to this transfer; we will explain whether the order can be processed through another workflow. 7. Deletion At the end of an applicable retention period or purpose, we check legal retention requirements before deleting data. Electronic files are deleted so that recovery is difficult, and paper records are shredded. Recovery backups are access-restricted and separate from operating data, and are deleted once their retention need ends. 8. Your rights and cookies You and your legal representative may ask to access, correct or delete information, restrict processing, or exercise an applicable statutory data-transfer right by using the email or phone number in section 9. We check identity or representation using the order reference and purchase email, then respond under applicable law; statutory retention may limit deletion. We will explain eligible data, the transfer method and the status of a request when asked. You may block or delete order and login session cookies in your browser, though login, cart and checkout may then stop working. We do not use a separate analytics cookie for aggregate page-view and performance measurement. We do not make automated decisions with significant legal effects. You can block or delete the visit cookie (mr_vid, 90 days) in your browser settings; browsing and ordering remain available without it. 9. Security and privacy officer We restrict access to staff who need it and use HTTPS, administrator authentication and restricted backup access. Privacy officer and access-request contact: Jinyu Kim, representative of Rose. Send requests to [email protected] or +82 507-1377-5230. For remedies, contact Korea's Personal Information Infringement Report Center (118, privacy.kisa.or.kr) or Personal Information Dispute Mediation Committee (+82 1833-6972, www.kopico.go.kr). 10. Changes We will publish changes and their effective date on this page.