Privacy notice

Launch preparation draft · 2026-10-02-v1

This notice describes the current account and test-order service. Live card payment is not available. Provider arrangements, international transfer disclosures and retention procedures must be finalized before live orders. This draft does not ask you to consent to unspecified processing.

Who is responsible and how to contact us

Naneun Yeppuda is operated by FASHION DULA (패션둘라), representative 배정숙, business registration 566-11-01301. Address: Room 401, 32, Jayang-ro 6-gil, Gwangjin-gu, Seoul, Republic of Korea.

For privacy questions or requests, email support@naneunyeppuda.com. Do not send passwords, verification codes, full card details or identity documents with your initial request.

Information we process and why

• Account and verification: name, email, password hash and salt, preferred currency, signup date, account role, verification records and invitation-code use. A phone-verified signup also records the verified phone number and its country. These support registration, sign-in, account recovery and access control.
• Quotation, cart and order: product names, seller URLs, prices, options, quantities, uploaded product screenshots, quotation amounts, recipient name, email, phone and delivery address, destination, consent records, order events, carrier and AWB. These support quotations, purchasing, delivery, customer support and dispute records.
• Member activity and coupons: cumulative sign-ins, cart additions and amounts, order and test-payment totals, and coupon issuance, reservation and use. These support account administration, order management and review rewards.
• Reviews: the nickname you choose, rating, review text, posting date and administrator reply appear publicly on the review page. Your account email and phone are not published as review fields. Do not include private contact details in the nickname or review.
• Security: session records, verification attempts and rate-limit records help prevent unauthorized access and abuse. Application rate limiting hashes the account or network identifier; hosting infrastructure may also process request metadata.

Service providers and operational sharing

• Cloudflare: hosts the application and its D1 database, including saved product screenshots and account/order records.
• Brevo: delivers account verification and password-reset emails.
• Google Firebase: processes phone authentication when you use the SMS verification route, including the phone number and authentication verification data.
• Google Sheets: receives administrative copies of submitted order information and member records. These include member names, emails, recorded phone numbers and country, activity and coupon history, and order recipients, amounts, payment state, carrier and AWB. The current order export does not include delivery addresses or product screenshots. Sheets changes do not update your order in the app.
• OpenAI, when configured: may receive the question, selected destination and language for AI chatbot answers, or product images for AI product analysis. The chatbot does not attach your account name, email or order history to its AI request. Some FAQs are answered directly without an AI request. Avoid uploading screenshots containing personal information or entering personal, payment or identity details into chat. The application requests that AI responses not be stored; this is not a promise that the provider has no operational retention.

For the proposed live purchasing and delivery service, relevant order details may need to be supplied to sellers, air carriers and customs parties to fulfill your instructions. The contracted parties, information supplied and applicable transfer arrangements must be confirmed before live service. EXIMBAY is currently a test integration; its future live-payment data flows and terms are not yet finalized.

International processing

The service is operated from Korea for customers including those in the UAE and Saudi Arabia. Cloud and authentication services may process information outside your country. The legal provider identities, processing destinations, transfer basis, safeguards and provider retention periods still require confirmation. This draft is not a completed international-transfer disclosure or consent.

Cookies and browser settings

We use the essential nyp_session cookie for sign-in, configured to expire after seven days. Signing out removes that browser session. Blocking the cookie prevents authenticated features from working. Phone authentication may also use Google verification mechanisms. The cookie expiry is not an account or order-data deletion deadline.

Retention and deletion requests

Account, quotation, order, review and coupon records currently remain in the service database unless handled through an authorized process. There is no self-service account deletion or complete automated retention schedule yet. Expired session, verification and rate-limit records are cleaned during relevant service requests; expiration does not mean immediate deletion from every system or backup.

Email us to request access, correction, account closure, deletion or another privacy right available under applicable law. We will verify the request proportionately and explain any legally required record retention or restriction. We must finalize retention periods, deletion handling and backup procedures before live service. A database change alone does not remove existing administrative exports or provider copies; these need to be included in the handling of a request.

Updates and remaining launch work

The final notice must specify the applicable purposes and legal bases, mandatory and optional fields, retention periods, processor and transfer arrangements, rights procedures and any required destination-language disclosures. We will publish the updated notice and explain material changes. This page alone does not establish legal compliance or enable live payment.