Privacy Policy

The Company collects the following personal information.

· When issuing or using coupon books: registered account email and identifier, hotel, booking reference, stay dates and local time zone, coupon issuance, use and cancellation records and reasons, and administrator/partner staff access and action records. Operators register information provided by the member to verify the booking. We also collect party size and confirmation records made on the member’s device.

· When requesting a product sample: recipient name, phone number and shipping address, SNS/channel details at the time of the request, required consents and their time, shipping, receipt, post link and deadlines, sample fulfilment and non-fulfilment records, and reasons for not running a group-buy (optional)

· Contact persons at sample-sponsorship brands (sellers): contact name and email, shipping contact email (optional), and on accepting terms the consenting email, a transformed value of the access IP (the original IP is not stored) and the time of consent, and records of sending and verifying codes and links

· Social login (Google; Kakao login is currently unavailable and any resumption will be announced) or email authentication link login: name (nickname), email address when provided, unique social account identifier and profile information

· When joining through a creator page: signup referral information (the creator page and deal through which the member joined)

· Creator membership review: type and URL of social media or channels such as blogs, Instagram and YouTube; follower, subscriber or neighbor counts entered by the member; review submission date and time

· Required at the first creator review submission: how you first heard about the service, the web search engine or AI service used, and any other source entered by you

· Sponsorship applications: available content, preferred visit period or check-in/out dates, region, adult/child counts, content types and quantities, application message, final proposals and acceptance/rejection records, consent and its timestamp

· When submitting creator materials: files and links such as media kits, channel introductions, performance and analytics screenshots; representative content links; phone number (optional); and consent to use the materials and its timestamp

· Sponsorship completion verification: links to posts (content) submitted by the member and submission date and time

· If the member consents to a public roster listing: handle, display name, category, primary channel, follower count, profile photo URL, featured content links and public-listing consent date and time

· Creator-page/deal usage: records of page/deal views, promotion-code views and visits to hotel booking pages; referral source (referring domain only); and a session identifier valid only within the same day. These records do not store raw IP addresses. Stay dates and guest counts selected on creator pages are passed to the hotel booking page and are not stored by the Company.

· Information automatically generated or collected during use: access logs, service usage records, pass grants and usage, tier changes, cookies for authentication and returning to the original page after login, and advertising measurement cookies and online identifiers (see Section 10)

· When you receive a notification email from us: whether the email was opened, whether a link in it was clicked, and when (see Section 10)

· Member identification and login authentication

· Booking verification, coupon benefits, prevention of duplicate use, and related support and understanding the reported party size per coupon

· Creator membership review and notification of results

· Sponsorship campaign matching, review and selection notices

· Verification of sponsorship performance and management of creator tiers and passes

· Receiving sample requests, brand selection review and sample shipping, confirming posts and managing request restrictions

· Verifying brand contacts, keeping evidence of consent to sample-sponsorship terms and sending progress notices

· Publishing and proposing creator rosters to hotels, only for consenting members

· Providing creator pages and hotel promotion codes, measuring booking performance, and settling accounts with hotels and creators

· Providing, operating and improving the service and responding to inquiries

· Analyze signup referral sources and improve how people discover the service. Answers are not used for review decisions or shared with hotels.

· Fulfilling obligations under applicable laws and the Terms

In principle, the Company destroys personal information without delay when a member withdraws or the collection and use purpose is fulfilled. Information that must be retained under applicable laws is kept for the required period.

· Usage records (creator page and deal views, promotion code views and visits to hotel booking pages): retained for 6 months, then deleted with only non-identifying aggregate figures retained — purpose: performance measurement and settlement

· Signup referral information (creator page referral): until membership withdrawal

· Coupon book booking, issuance, use and cancellation records: until membership withdrawal. Booking cancellation preserves usage history, but membership withdrawal deletes that member’s bookings, coupons and associated action records. Account links for staff and administrators who withdraw are also removed.

· Sample shipping address: deleted 30 days after the request closes and no later than 120 days after the request. Sample request and fulfilment records: until membership withdrawal

· Brand contact information and records of consent to terms: kept for 3 years after the partnership with the brand ends (in case of disputes over the agreed terms), then deleted

· Duplicate prevention after withdrawal: we retain only a keyed fingerprint derived from the hotel and booking reference while the coupon book service operates. The fingerprint stores neither the original reference nor an account link and is used only to prevent another issuance for the same booking.

On the website, introductory materials are visible only to the member and Company operators and are not automatically published to the public roster. Replacing or removing materials from the profile does not remove materials included in previously submitted applications; they are retained for the relevant negotiations and fulfillment checks. The retention and destruction principles in Section 3 also apply to files and application records. Requests for access, correction or deletion can be sent to the contact below.

If a member requesting a product sample consents, we provide the brand (seller) with the member’s SNS/channel details at the time of the request and counts of fulfilled and unfulfilled samples for selection, and, if approved, the recipient’s name, phone number and shipping address for delivery. The brand can view the address only after entering a code sent to its registered contact email, may not use it for any purpose other than shipping, and must delete it after shipping. The member’s email is not provided to the brand.

The brand may use selection information only to decide on approval and shipping details only for shipping, and if it keeps its own copy it must delete it without delay once the decision or shipping is complete or the request ends. The brand can view this information on OTi only while the link OTi sent remains valid. Members may refuse this provision, but without consent they cannot request a product sample.

Partner staff receive only the presented coupon’s identifier, benefit and terms, validity dates and local time zone, reported party size, and use status and time. They do not receive the guest’s name, email or booking reference.

The Company does not in principle disclose personal information externally. For sponsorship matching, with the member’s consent, it may provide hotels reviewing the application with information needed for review and matching, including nickname, social/channel information, introductory and performance materials, representative content, dates and guest counts, and proposed content.

Information shared with hotels and creators about creator page performance consists only of aggregate figures by creator, deal and period; individual user identifiers and usage records are not shared. Booking information entered on a hotel's booking page is collected and processed directly by the hotel under its own privacy policy.

Only with the member's separate consent, the Company publishes the following information on its public /partners page and in proposals to hotels.

· Public fields: handle, display name, category, primary channel, follower count, profile photo, featured content links and creator tier

· Audience: the general public (public webpage) and hotels considering a partnership

· Contact details, including email addresses, are not published.

· Consent can be withdrawn at any time in My Profile in the service, immediately making the listing private. Refusing consent does not restrict sponsorship applications or other service use.

· If a published page has been cached by search engines or other external services, the Company cannot guarantee when those caches will be removed.

The Company outsources personal information processing as follows to operate the service.

The Company transfers personal information overseas for outsourced processing as follows to provide the service.

Transfer timing: when the service is used. Users can refuse international transfers by not using social login or the service, but this may restrict service use.

Electronic information is deleted using technical methods that prevent recovery or reproduction. Paper documents are shredded or incinerated.

Users may at any time request access, correction, deletion, suspension of processing or withdrawal of consent for their personal information. Social media and channel information can be edited directly on the creator review screen. Other requests can be sent to the contact below.

The Company implements technical and organizational safeguards, including access permission management, transport encryption (HTTPS) and database access control (Row Level Security).

The Company uses cookies to maintain login sessions and short-lived temporary cookies (15 minutes) to return users to their previous screen after login. Users may reject cookies in browser settings, but some features, including login, may then be restricted.

The Company also uses Meta Platforms, Inc.'s analytics tool (Meta Pixel) to measure advertising performance. Page views, completed signups, completed sponsorship applications, device and browser information and online identifiers are sent to Meta, which may use them for advertising measurement and personalized advertising. The Company does not send directly identifying information such as names or email addresses through this channel.

Meta Pixel is not used on the code confirmation screen immediately before leaving for a hotel's booking page, or on login and authentication pages.

To avoid collection through Meta Pixel, use your browser's tracking protection or opt out of personalized advertising in your Meta account's ad settings.

Emails we send, such as receipt and result notifications, include an open-confirmation image and tracked link addresses, so whether the email was opened, whether a link in it was clicked, and when are recorded by our email delivery processor (Resend). We use this only to confirm that notifications actually reach you and to improve how we notify you (email, messaging channels, etc.); it is not used for advertising. Keeping remote images blocked in your email program prevents open records (if you unblock and load the images, the open is recorded at that point). Clicks on links in the email are recorded regardless of image blocking.

For inquiries, complaints or remedies relating to personal information processing, please contact:

· Privacy officer: PermissionLabs privacy team

· Email: privacy@permissionlabs.com

This Policy may be revised as laws or the service change. Revisions, their effective date and the changes will be announced in the service.