KOSURAN — Privacy Policy

Effective: 21 July 2026

Plain-language summary (not a substitute for the Policy below). To buy Korean products for you and ship them to you, we collect the information you give us (account, delivery address, order details) and some information collected automatically (device and usage data, cookies). We share it only with the partners needed to run the Service — our payment provider, cloud hosting, email, analytics, shipping carriers, and the Korean sellers and affiliate we buy through — and, for advertising measurement, with an advertising provider. We do not sell your personal information for money, though our advertising tools may count as "sharing" under U.S. state law, and you can opt out. You can access, correct, delete, and port your data, opt out of marketing, and appeal if we say no. Contact us any time at support@kosuran.com.

This Privacy Policy explains how KOSURAN Inc., a United States corporation based in Los Angeles, California ("KOSURAN," "we," "us," or "our"), collects, uses, shares, and protects personal information in connection with the KOSURAN website, applications, and services (the "Service"). KOSURAN is the business (controller) responsible for that personal information. Terms not defined here have the meaning given in our Terms of Service.

This Policy also serves as our Notice at Collection under California law: the categories of personal information we collect, the purposes for collecting them, whether they are sold or shared, and how long we keep them are set out in §2, §3, §7, and §9.

---

1. Scope

This Policy applies to personal information we process about visitors, account holders, and customers of the Service. It does not apply to third-party sites, sellers, or services that we link to or that process your payment, each of which has its own privacy practices.

We serve customers in the United States, Japan, and other countries. Where a law that applies to you gives you rights beyond those described here, those rights apply.

2. Information we collect

2.1 Information you provide.

• Account information — name, email address, password (stored in hashed form), and language/market preference. If you sign in with Google or Apple, we receive your name and email address from that provider (we never receive your password).
• Order and delivery information — recipient name, shipping address, phone number, the Products you order, order and settlement details, and (for group orders) the handle or identifier you use with an Organizer.
• Communications — messages you send us (e.g., customer-service emails), and photos or details you submit for a claim (e.g., a damaged-item report).
• Marketing preferences — your consent choices and subscription status.

2.2 Payment information. When you pay, your card or payment details are collected and processed directly by our third-party payment provider (currently Stripe; we may add or change providers). We do not receive or store your full card number. We receive limited information such as a payment confirmation, a token, and the last four digits or card type.

2.3 Information collected automatically. When you use the Service we collect, through cookies and similar technologies (see §5): device and browser type, IP address (from which we may infer approximate, city- or region-level location — we do not collect precise geolocation), pages viewed, referring/exit pages, search queries within the Service, interaction and usage data, email open and click events for messages we send you, and diagnostic data when something goes wrong.

2.4 Information from third parties. We may receive information from: Sellers, our Korean affiliate, and shipping carriers/forwarders (to fulfill and track your Order); our payment provider (payment status, fraud signals); sign-in providers (§2.1); and analytics and advertising providers (see §5 and §6).

2.5 Sensitive personal information. The only "sensitive personal information" we handle is your account log-in credentials, and we use it solely to provide the Service. We do not collect government identifiers, precise geolocation, health, biometric, racial or ethnic origin, religious belief, union membership, sexual orientation, or the contents of your private communications, and we do not use or disclose sensitive personal information for purposes that would require us to offer a "limit the use" right. We do not knowingly collect information from children (see §12).

3. How we use your information

We use personal information to:

• provide the Service — create and manage your account; purchase Products for you as your buying agent; consolidate, ship, and provide customs information; clear customs and pay import duties on your behalf; and process settlements and refunds;
• communicate — send transactional messages (order confirmations, shipping and customs updates, refund and Store Credit notices) and respond to your inquiries, and measure whether those messages were delivered, opened, and acted on;
• process payments and prevent, detect, and investigate fraud, abuse, and chargebacks;
• operate, secure, and improve the Service, including analytics, error monitoring, and product development;
• market — with your consent where required, send you promotional messages, show you relevant advertising, and measure the performance of our marketing (see §5–§6);
• comply with law — meet customs, tax, accounting, and record-keeping obligations, and respond to lawful requests.

We do not use personal information for automated decision-making that produces legal or similarly significant effects about you, and we do not use it to train third-party artificial-intelligence models.

Legal bases (where applicable, e.g., for EEA/UK visitors). We rely on: performance of a contract (to provide the Service you request); your consent (for marketing and non-essential cookies); our legitimate interests (to secure, operate, and improve the Service and prevent fraud); and compliance with legal obligations.

4. How we share your information

We share personal information only as needed to run the Service. As of the effective date, our principal recipients are:

We also disclose personal information: for legal and safety reasons, where required by law, legal process, or to protect the rights, safety, or property of KOSURAN, our users, or others; and in a business transfer, in connection with a merger, acquisition, financing, or sale of assets, subject to this Policy.

Service providers are bound by contract to use personal information only to perform services for us. This list may change; we will keep this section current.

We do not sell your personal information for money. For advertising, we may "share" certain information for cross-context behavioral advertising as described in §6; you can opt out (§11).

5. Cookies and similar technologies

We use cookies, pixels, SDKs, and similar technologies for the following purposes:

• Strictly necessary — sign-in, security, cart and checkout, and load balancing. These are required for the Service to work.
• Analytics — to understand how the Service is used and to improve it (PostHog), and to detect and diagnose errors (Sentry).
• Advertising and measurement — to deliver and measure marketing, including the Reddit Ads pixel and Conversions API and the Google Ads site tag (gtag). These may set identifiers used to build audiences and measure conversions.

Your choices. You can manage cookies through your browser settings and, where offered, through our cookie/consent controls. You can opt out of advertising as described in §6 and §11. Where required, non-essential cookies are set only with your consent.

Opt-out preference signals. We honor recognized universal opt-out mechanisms, including Global Privacy Control (GPC), as an opt-out of "sale"/"sharing" and of targeted advertising, for the browser or device on which the signal is sent. Do Not Track: browsers also offer a "Do Not Track" setting, but there is no common industry standard for how to respond to it; we do not currently respond to DNT signals, and we honor GPC instead. This paragraph is provided in part under California Business & Professions Code §22575(b).

6. Advertising and analytics

As part of our marketing, we use advertising and analytics services (currently Reddit Ads and Google Ads, via the technologies in §5, including the Reddit pixel and Conversions API and the Google Ads site tag) that may collect identifiers and usage information so that we can measure campaigns and show relevant ads. This activity may constitute "sharing" for cross-context behavioral advertising, or "targeted advertising," under U.S. state privacy laws even though no money is exchanged for your information.

You can opt out at any time using our cookie controls, by sending a GPC signal, by contacting us at support@kosuran.com, and by adjusting ad settings with the relevant provider. We do not use your information for targeted advertising if we know you are under 16 without the consent required by law.

7. Notice of financial incentive

We may offer a first-order discount to customers who create an account and, where offered, subscribe to our emails. The material terms are:

• What you get — the discount amount stated in the offer at the time it is presented to you (a fixed U.S. dollar amount off your first order), applied automatically at checkout on a qualifying first order.
• What we collect — the account information in §2.1 (name, email) and your marketing consent.
• How to join — create an account and, where applicable, opt in to marketing email. How to withdraw — unsubscribe at any time using the link in any marketing email, or email support@kosuran.com; withdrawing does not take away a discount already applied to a completed order.
• Why the offer is permitted and how we value it — the discount is reasonably related to the value your data provides to us. We make a good-faith estimate of that value using the discount amount itself as the measure — that is, the value we assign to your participation is no more than the face value of the discount you receive — calculated from the expected margin contribution of a first order net of the discount. We do not otherwise place a monetary value on your personal information, and we do not sell it.

You are never required to participate, and declining does not change the price of any Product or the Service Fee.

8. International data transfers

KOSURAN Inc. is based in the United States. Our application infrastructure and customer database are hosted in Japan (Tokyo); our purchasing, warehouse, and export operations are performed by our affiliate and sub-agents in the Republic of Korea, who access order and delivery information to fulfill your Order; and several of our providers are located in the United States (see §4). Our customers are located worldwide.

As a result, your personal information may be transferred to, stored in, and processed in countries other than your own, which may have different data-protection laws and may be accessible to authorities there. Where required, we use appropriate safeguards for such transfers, including contractual protections with our providers and affiliate.

9. Data retention

We keep personal information for as long as your account is active and as needed to provide the Service, and then for the periods below. Where several periods apply, the longest governs.

We may retain information longer where required by law, or where needed to establish, exercise, or defend legal claims; when the period ends we delete or anonymize it.

10. Security

We take reasonable technical and organizational measures to protect personal information, including encryption in transit, hashed passwords, access controls, and use of reputable infrastructure providers. No method of transmission or storage is completely secure; we cannot guarantee absolute security, and you are responsible for keeping your account credentials confidential.

11. Your privacy rights

11.1 Rights available to residents of U.S. states with comprehensive privacy laws. Depending on where you live — including California, Colorado, Connecticut, Delaware, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah, Virginia, and other states as their laws take effect — you may have the right to:

• know and access the personal information we hold about you, and obtain a copy in a portable format;
• correct inaccurate personal information;
• delete personal information we hold about you;
• opt out of targeted advertising, of the "sale" of personal information (we do not sell for money), and of profiling with legal or similarly significant effects (we do not do this);
• limit the use of sensitive personal information (we already use it only to provide the Service — see §2.5); and
• be free from discrimination for exercising your rights.

11.2 California residents (CCPA/CPRA). In the past 12 months we have collected the categories below (sources: you, your device, and our providers; purposes: those in §3; retention: §9). Each category is disclosed to service providers as described in §4.

We do not knowingly sell or share the personal information of consumers under 16. You may use an authorized agent to submit requests on your behalf, with proof of authorization.

California "Shine the Light" (Civil Code §1798.83). We do not disclose personal information to third parties for those third parties' own direct-marketing purposes. You may request confirmation of this once per year at support@kosuran.com.

11.3 How to exercise your rights. Email support@kosuran.com with your request and the email address on your account. We will:

• acknowledge your request within 10 business days, and respond within 45 days, extendable once by a further 45 days where reasonably necessary (we will tell you if we need the extension);
• take reasonable steps to verify your identity — usually by confirming control of the account email; we may ask for additional information for high-risk requests, and we use that information only for verification; and
• not discriminate against you for making a request.

Appeal. If we decline your request, you may appeal by replying to our decision or emailing support@kosuran.com with the subject line "Privacy Appeal." We will respond to an appeal within 45 days with a written explanation. If we deny the appeal, we will provide a method to contact your state attorney general.

11.4 Japan (APPI). You may request disclosure, correction, addition, deletion, and cessation of use or provision of your retained personal data, in accordance with the Act on the Protection of Personal Information. Contact us at support@kosuran.com.

11.5 Republic of Korea (PIPA). Our Korean affiliate and sub-agents process personal information on our behalf in Korea (§4, §8). If you are in Korea, you may request access, correction, deletion, and suspension of processing, and may lodge a complaint with the Personal Information Protection Commission (PIPC) or the Korea Internet & Security Agency (KISA).

12. Children's privacy

The Service is intended for users who are at least 18 years old (or the age of majority where they live). We do not knowingly collect personal information from children under 13, consistent with the Children's Online Privacy Protection Act (COPPA), and we do not knowingly sell or share the personal information of anyone under 16. If you believe a child has provided us information, contact support@kosuran.com and we will delete it promptly.

13. Third-party links

The Service links to third-party sites and sellers. We are not responsible for their privacy practices. Please review the privacy policy of any third-party site you visit.

14. Changes to this Policy

We may update this Policy from time to time. We will post the updated Policy with a new effective date and, for material changes, provide additional notice (e.g., by email or in-Service notice) where required. Your continued use after the effective date of changes constitutes acceptance.

15. Contact us

KOSURAN Inc. — a United States corporation based in Los Angeles, California, operating the "KOSURAN" service.

• Privacy and support contact: support@kosuran.com
• Website: kosuran.com

---

This Policy reflects KOSURAN's actual data practices as of the effective date, based on the providers deployed in the Service. It is not legal advice. KOSURAN should have this Policy reviewed by qualified United States privacy counsel (CCPA/CPRA and the other state comprehensive privacy laws, COPPA, and the financial-incentive notice in §7), and by Japanese counsel for APPI, before launch, and should re-confirm the provider and cookie inventory in §4–§6 at go-live.