1. What we collect, why, and for how long
Newsletter subscription
- Items collected
- Email address, name
- Purpose
- Sending the newsletter and the subscription confirmation email, handling unsubscribe requests
- Retention
- Until you unsubscribe. After you unsubscribe we keep your email address, your name and the unsubscribe record for as long as needed to avoid sending to you again. Requests that are never confirmed are deleted after 30 days.
Preventing abuse of the signup form
- Items collected
- The visitor's IP address and email address converted with a secret key (the original values are not stored)
- Purpose
- Preventing repeated requests and spam
- Retention
- 30 days
Website access records
- Items collected
- Access records such as the IP address, browser information and requested address (generated automatically)
- Purpose
- Operating and securing the website
- Retention
- Kept for 1 day and then deleted (based on our current Vercel plan)
2. Your right to refuse consent
You may refuse to consent to the collection and use of your personal information and to receiving promotional information. If you refuse, we cannot send you the newsletter.
3. Processors
- Processor
- Stibee Inc.
- Service
- Newsletter delivery and subscriber management
- Transfer abroad
- Yes (see “Transfer of personal information abroad” below)
- Processor
- Vercel Inc.
- Service
- Website operation (server functions run in the Seoul region)
- Transfer abroad
- Yes (see “Transfer of personal information abroad” below)
- Processor
- Supabase Pte. Ltd.
- Service
- Values converted with a secret key (hashes) stored to prevent abuse of the signup form (Seoul region)
- Transfer abroad
- Yes (see “Transfer of personal information abroad” below)
We supervise how the processors handle personal information.
4. Transfer of personal information abroad
To provide the service, we transfer personal information abroad as set out below, and we disclose this in this policy under Article 28-8(1)3 of the Personal Information Protection Act.
- Recipient (contact)
- Amazon Web Services, Inc. (Stibee’s cloud processor; contact: https://aws.amazon.com/compliance/contact/)
- Country
- United States
- When and how
- Sent over the information and communications network when you use the newsletter service
- Items transferred
- Email address, name, unsubscribe record, records of opens and clicks of the newsletter
- Purpose
- Operating Stibee’s servers for sending the newsletter and managing subscribers
- Retention
- Same as the retention period of section 1 (newsletter subscription).
- Recipient (contact)
- Vercel Inc. (privacy@vercel.com)
- Country
- United States and other countries where Vercel operates (server functions run in the Seoul region)
- When and how
- Sent over the information and communications network when you use the website
- Items transferred
- Access records such as the IP address, browser information and requested address; the email address and name entered when subscribing (processed in transit)
- Purpose
- Operating the website
- Retention
- Access records are kept for 1 day and then deleted (based on the plan currently in use), and other information is not stored separately at Vercel.
- Recipient (contact)
- Supabase Pte. Ltd. (Singapore, privacy@supabase.io)
- Country
- Stored in the Republic of Korea (Seoul region); where needed to provide the service, it may be processed in the United States and other countries where Supabase and its processors operate.
- When and how
- Sent over the information and communications network when you sign up
- Items transferred
- Hash values for preventing abuse of the signup form
- Purpose
- Operating the database
- Retention
- 30 days
If you do not want your personal information transferred abroad, you can decide not to subscribe, or unsubscribe at any time. However, if you refuse the transfer, you cannot receive the newsletter. The transfer of access records that comes with visiting the website takes place when you use the site.
5. Provision to third parties
We do not provide personal information to third parties without the consent of the person concerned, except where the law requires it.
6. How personal information is destroyed
We destroy personal information without delay once the retention period ends or the purpose of processing has been achieved. As an exception to destruction without delay, we keep the email address, name and unsubscribe record of a person who has unsubscribed for as long as needed so that we do not send the newsletter to them again. The values stored to prevent abuse of the signup form and the subscription requests that were never confirmed are deleted automatically after 30 days. Personal information in electronic files is deleted in a way that cannot be recovered.
7. Security measures
We take the following measures to keep personal information safe.
- Access control
- We limit access to the staff in charge and manage the scope of access by role.
- Encryption in transit
- Information exchanged with this site is encrypted with HTTPS.
- Access logs of the processing system
- We keep logs of staff access to the systems that process personal information.
- Hashing
- The IP address and email address kept to prevent abuse of the signup form are stored only as values converted with a secret key (hashes), not as the original values.
8. Your rights and how to exercise them
You may at any time ask to access, correct or delete your personal information, ask us to stop processing it, or withdraw your consent. Use the unsubscribe link at the bottom of the newsletter or email the privacy officer below, and we will act without delay.
We do not collect personal information from children under 14. Only people aged 14 or over may subscribe.
9. Cookies and logs
The signup process on this site does not use cookies to track visitors. When you open the newsletter or select a link in it, the delivery service (Stibee) records the open and the click, and we use these records to see how each issue performed.
When you use the website, access records such as your IP address, browser information and requested address are generated automatically and sent to our website processor (Vercel Inc.); they are kept for 1 day and then deleted (based on the plan currently in use; see section 4).
10. Privacy officer
- Name
- Wan Song
- Title
- Chief Technology Officer
- wan@bionutrion.kr
- Company
- 주식회사 바이오뉴트리온
- Phone
- 02-6326-0825
11. Remedies for infringement
If your personal information has been infringed, you may ask for help or file a report with the organizations below.
- Personal Information Infringement Report Center
- privacy.kisa.or.kr · dial 118 without an area code
- Personal Information Dispute Mediation Committee
- www.kopico.go.kr · 1833-6972
- Supreme Prosecutors' Office
- www.spo.go.kr · dial 1301 without an area code
- Korean National Police Agency
- ecrm.police.go.kr · dial 182 without an area code
12. Effective date
This policy applies from October 10, 2026. If it changes, we will say so on this page first.