PRIVACY POLICY
Homes in Korea Privacy Policy
Homes in Korea ("Company") complies with the Personal Information Protection Act ("PIPA") and related laws of the Republic of Korea, and establishes this Privacy Policy to protect the personal information of users.
Article 1 (Personal Information Collected)
The Company collects the following personal information to provide the Service.
1) Membership Registration & Management (Mandatory)
| Applies to | Items |
|---|---|
| Guest | Email, password, name, nationality, phone number, identification document image (passport or Alien Registration Card) |
| Host | Email, password, name, nationality, phone number, profile picture, host name, host introduction, host type |
2) Reservation & Payment (Mandatory)
- Reservation information (accommodation, check-in/check-out dates, occupancy, requests)
- Payment information (payment cards are stored as billing keys via Toss Payments; actual card numbers and expiration dates are not retained by the Company)
- Payment and refund history, settlement history
3) Service Usage Logs (Automatically Collected)
- Access logs, IP address, cookies, device information, browser information
- Service usage records (search history, view history)
4) Optional Items
- With consent to receive marketing communications: email, phone number, KakaoTalk ID
- With consent to use location-based services: device location information
- Upon posting reviews or content: posts, photos, ratings, comments
- Upon registering a profile photo: profile image (for accounts created via a social login, the profile photo from that account is saved as the initial value)
- Upon submitting inquiries: content of inquiries, attachments
Article 2 (Purpose of Processing)
| Purpose | Details |
|---|---|
| Member management | Identity verification, provision of member-only services, prevention of fraudulent use |
| Reservation & payment fulfillment | Reservation formation, payment processing, settlement, refund, contract performance |
| Identity confirmation | Verification of Guest's real name and residency status (passport, Alien Registration Card) |
| Notifications | Reservation, payment, and contract announcements (via email, SMS, app push, KakaoTalk AlimTalk) |
| Inquiry response | Reception and processing of customer inquiries |
| Marketing (optional) | Promotions, events, and recommended accommodation announcements (for consenting members only) |
| Service improvement | Statistical analysis, feature development, error response |
| Legal compliance | Retention per e-Commerce Consumer Protection Act, Electronic Financial Transactions Act, tax laws, etc. |
Article 3 (Retention & Use Period)
In principle, personal information is destroyed without delay after the purpose of collection and use has been achieved. However, information may be retained for the periods below if required by law.
| Legal Basis | Item | Retention Period |
|---|---|---|
| e-Commerce Consumer Protection Act | Records of contracts or withdrawal of subscription | 5 years |
| e-Commerce Consumer Protection Act | Records of payment and supply of goods | 5 years |
| e-Commerce Consumer Protection Act | Records of consumer complaints or dispute handling | 3 years |
| Electronic Financial Transactions Act | Records of electronic financial transactions | 5 years |
| Protection of Communications Secrets Act | Access logs | 3 months |
- Upon membership withdrawal (grace period): To support account recovery and prevent misuse (e.g., re-registration by malicious users), member information (account and profile data) is retained for 30 days after the withdrawal request, and is completely destroyed without delay once the 30 days have passed. You can restore your account by logging in again within 30 days of the withdrawal request.
- During the grace period, access to the retained information is strictly restricted; it is not used for member lookups, service exposure, marketing, or any other purpose. All marketing communications (email, KakaoTalk, WhatsApp, app push) stop immediately upon the withdrawal request. However, content the member posted to the Service before the withdrawal request (reviews, chat messages, posts, etc.) remains available during the grace period, and the author information is anonymized at the time of destruction.
- Information required to be retained under the laws above is stored separately for the applicable period before destruction, regardless of the 30-day grace period.
Article 4 (Provision to Third Parties)
The Company does not provide personal information to external parties without user consent. However, subject to separate consent, the following information is provided to Hosts for reservation fulfillment.
| Recipient | Items Provided | Purpose | Retention/Use Period |
|---|---|---|---|
| The Host of the confirmed accommodation | Guest's name, contact information, reservation information | Reservation fulfillment, check-in support, inquiry handling | 3 years after termination of the contract |
- For details, see the separate consent form in
third-party-en.md. - Personal information may be disclosed pursuant to law or legitimate demands from investigative authorities.
Article 4-2 (Information Displayed Publicly within the Service)
Reviews, posts, and comments that a user publishes on the Service can be viewed by anyone, including visitors who are not logged in. The following information is displayed on screen together with the published content.
| Screen | Information Displayed |
|---|---|
| Accommodation reviews (Home, accommodation detail) | Author's display name, rating, review text, photos attached to the review |
| Housing request board (posts and comments) | Author's display name, post content |
| Host information on the accommodation detail page | Host's display name, host introduction |
- The display name is a name entered by the user. It does not need to be a legal name and can be changed at any time from My Page.
- A profile photo may be shown alongside the display name on some screens. It appears only if the user has registered one, and it can be changed or deleted at any time from My Page. For accounts created via a social login (Google, Kakao, Apple), the profile photo from that account is set as the initial value.
- Other personal information — such as email address, phone number, identity document details, and reservation or payment history — is not displayed on public screens.
- Users may delete their own posted content at any time. Handling of posted content upon membership withdrawal follows Article 3.
Article 5 (Entrustment of Personal Information Processing)
The Company entrusts the following operations to external service providers, and specifies safe-management requirements in the entrustment contracts pursuant to applicable law.
| Processor | Entrusted Operations | Items Processed |
|---|---|---|
| Toss Payments | Payment/refund processing, billing key management | Payment information, payment history |
| Supabase Inc. | Database, authentication, and server operations | Member, reservation, payment, and inquiry information |
| Cloudflare, Inc. | Storage of identification documents and profile images (R2) | Uploaded image files |
| SOLAPI | Delivery of SMS and KakaoTalk notifications | Name, phone number, notification content |
| Channel Corporation (Channel.io) | Customer inquiry support | Inquiry content, access information |
| NAVER Cloud Platform | Map and address search services | Location information (only for consenting users) |
| Vercel Inc. | Web application hosting | Service usage logs |
- Changes to processors will be announced through this Privacy Policy.
Article 6 (Rights of Data Subjects)
Users may exercise the following rights at any time:
- Right to request access to their personal information;
- Right to request correction of errors;
- Right to request deletion (except where retention is legally required);
- Right to request suspension of processing;
- Right to withdraw consent (via My Page or customer support).
- Requests may be submitted to
help@homesinkor.com, and the Company will act without undue delay. - The Company does not collect personal information of children under the age of 14 without the consent of a legal guardian.
Article 7 (Destruction of Personal Information)
The Company destroys personal information without delay once the retention period has expired or the purpose of processing has been achieved.
- Electronic files are securely deleted so they cannot be recovered; paper documents are shredded or incinerated.
- Upon membership withdrawal: The account is suspended immediately upon the withdrawal request, and member information is retained for 30 days (with restricted access) for account recovery and misuse prevention. After 30 days, it is automatically and permanently destroyed by irreversible means (data deletion/overwriting and deletion of stored files). Logging in again within 30 days restores the account and cancels the destruction.
- Information subject to statutory retention under Article 3 (payment records, etc.) is kept separately in a form that cannot identify an individual even after withdrawal, and is destroyed after each statutory period expires.
Article 8 (Security Measures)
The Company implements the following measures to ensure the security of personal information:
- Administrative measures: Establishment and implementation of an internal management plan, access permission management, regular training.
- Technical measures: Access control for personal information processing systems, installation of access control systems, encryption in transit (HTTPS/TLS), encryption at rest, backup and recovery procedures.
- Physical measures: Access control to servers and storage media.
Article 9 (Use of Cookies)
The Company may use cookies for user convenience and statistical analysis.
- Users may refuse the storage of cookies through browser settings, in which case some Service functions may be limited.
Article 10 (Data Protection Officer and Contact)
The Company designates the following Data Protection Officer to be responsible for overseeing personal information processing and handling user inquiries, complaints, and remedies.
- Data Protection Officer: Park Hae-Joong
- Email: help@homesinkor.com
- Inquiry Handling: The Company does not operate a separate customer support phone line; inquiries are received and processed by email.
For reports or consultations related to personal information infringement, users may contact:
- Personal Information Dispute Mediation Committee (privacy.go.kr / +82-1833-6972)
- Personal Information Infringement Report Center (privacy.kisa.or.kr / +82-118)
- Cyber Investigation Division of Supreme Prosecutors' Office (spo.go.kr / +82-1301)
- Cyber Investigation Bureau of Korean National Police Agency (ecrm.police.go.kr / +82-182)
Article 11 (Amendments)
The Company will announce amendments to this Privacy Policy at least seven (7) days before their effective date, or at least thirty (30) days in advance if the amendments are materially disadvantageous to users.
- Notice Date: 2026-07-09
- Effective Date: (To be determined after legal review prior to publication)