Privacy Policy

01What we collect and why

We process only the personal information needed for the purposes below. If a purpose changes, we will tell you in advance and ask for consent again where the law requires it.

• We do not process resident registration numbers or other unique identifiers, sensitive information or pseudonymised information.
• The email that tells our operator about a new sign-up contains no information about the subscriber; the list can be seen only in the admin console.
• Your age-check answer, language choice and cart are stored only in your browser; we do not receive them (section 9).

02How long we keep it

We destroy personal information without delay once its retention period ends or its purpose has been achieved.

03How we destroy it

• We identify personal information whose retention period has ended or whose purpose has been achieved and destroy it without delay.
• Electronic files: we delete the records from our operating data store (Vercel Blob) and from the mailbox that received the enquiry or request. Any subscriber list the operator downloads is deleted once the task is finished.
• When you ask us to delete your information, we delete your sign-up record, unsubscribe record, email log and stored copies together.
• Printed copies: shredded or incinerated.

04Disclosure to third parties

We do not provide email list information to third parties, except where you have separately agreed or where a law makes special provision for it, and then only to that extent.

05Service providers

We entrust the following processing to service providers. If a provider or its task changes, we will update this policy and announce the change on this site.

The companies Vercel and Resend in turn rely on (sub-processors) are listed on their sites: Vercel, Resend. Resend sends our email from Japan through its sub-processor Amazon Web Services, Inc. (Amazon SES, Tokyo region). JI Lab in turn entrusts the site’s hosting to Vercel Inc. (sub-processing).

06Transfer outside Korea

The LUCE website’s servers and storage are in the United States, our emails are sent from Japan, and enquiries sent to our email address are kept in a Google mailbox. We therefore transfer personal information abroad as follows.

Legal basis for the transfer

Email list records (Vercel, Resend): the separate consent to overseas transfer you give on the sign-up form (PIPA Art. 28-8(1)1). The unsubscribe record kept after you unsubscribe (Vercel): kept for the period stated in that consent (after unsubscribing, until you ask us to delete it). Hosting access logs and transformed IP values for repeated-request and login checks (Vercel), and enquiry and request emails (Google): processing and storage entrusted to providers so that we can run the site and answer you, with the details in Art. 28-8(2) disclosed in this policy (Art. 28-8(1)3(a)).

Records of people who joined before 28 September 2026 are kept by Vercel (United States) without this consent, so they are not used to send news until the consent is recorded. The consent is recorded only when the person signs up again on the form and confirms with the button in our email. If it has not been recorded by 31 October 2026, those records, including records of people who have unsubscribed, are destroyed without delay from 1 November 2026.

Vercel Inc.

Recipient and contact

Vercel Inc., privacy@vercel.com, 440 N Barranca Avenue #4133, Covina, CA 91723, United States

Country

United States (server and storage region iad1, US East)

Information

The email list and unsubscribe records and the security/operation information in section 1, the email log and sent-message copies

When and how

Each time you sign up or visit the site, over an encrypted connection (HTTPS)

Purpose

Hosting the website, processing sign-ups, storing operating data

Retention

As set out in section 2

Plus Five Five, Inc. (Resend)

Recipient and contact

Plus Five Five, Inc. (Resend), privacy@resend.com, 2261 Market Street #5039, San Francisco, CA 94114, United States

Country

Japan (sending, Tokyo ap-northeast-1, through Amazon Web Services, Inc.) and the United States (account data and sending log)

Information

Recipient email address and the email subject and body. Consent and unsubscribe notices and resubscribe and consent confirmations are sent to the subscriber’s address; operator notifications contain no subscriber information.

When and how

Each time an email is sent, over an encrypted connection (HTTPS)

Purpose

Sending email and reporting delivery, bounces and spam complaints

Retention

As long as needed to send the email and confirm the result; deleted when Resend’s retention period ends

Google LLC

Recipient and contact

Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, United States, privacy contact form

Country

The United States and other countries where Google operates data centres

Information

Enquiry and request emails received at our email address (Gmail): sender’s email address, name and message

When and how

By email, when an enquiry arrives

Purpose

Receiving and answering enquiries, handling requests about your rights

Retention

As set out in section 2

How to refuse, and what happens

Email list: if you leave the overseas-transfer box on the sign-up form unticked, you will not be signed up and will not receive our news. After joining you can stop our news with the unsubscribe link in our emails, and ask us by email (section 11) to delete the remaining address and unsubscribe record, which withdraws your overseas-transfer consent. Enquiries: enquiries sent to our email address are kept in a Google mailbox; if you do not want this, you may choose not to send one. Access logs: because the site’s servers are in the United States, access logs are sent there whenever you use the site; if you do not want this, please stop using the site.

07Your rights

• You may at any time ask to see, correct or delete your personal information, ask us to stop processing it, or withdraw your consent.
• To leave the email list, use the “Unsubscribe” link at the bottom of our news emails or ask us by email (section 11). We tell you the result of a consent or unsubscribe (our name, the date and the outcome): by email when you join, on the page itself when you use the unsubscribe link (by email if you use your mail app’s unsubscribe button), and by email when you ask us by email.
• Send any other request to the privacy officer in section 11. We act on it once we have confirmed it comes from the email address you signed up with.
• We act on your request and reply within 10 days of receiving it. If there is a legitimate reason we cannot do so in time, we will tell you the reason and when we expect to finish.
• If we refuse or only partly fulfil a request, we will tell you why and how to object. If you disagree, you may object by email (section 11), and we will review it and reply within 10 days of receiving it.
• A legal representative or a person you authorise may also make a request; please include a letter of authorisation.

08How we protect it

• Sign-up records are kept in private storage that cannot be reached through a public address.
• The whole site uses encrypted connections (HTTPS).
• The admin console requires a password, and the server stores only a one-way hash of it. Admin sessions end automatically after 4 hours, and five failed logins from the same address within 15 minutes block further attempts.
• Change requests sent from other websites are blocked by checking their origin and a security token.
• Admin access is limited to the people who need it. The subscriber list can be downloaded only in the admin console, and admin actions such as downloading the list or unsubscribing someone are logged.

09Browser storage

We use no visitor analytics, advertising cookies or behavioural tracking for targeted advertising. The site keeps the values below only in your browser’s storage (localStorage) and does not send them to us.

• The site’s typeface is loaded from jsDelivr (cdn.jsdelivr.net), so your IP address and browser information may reach jsDelivr. We do not receive this information.
• To refuse: block or clear site data in your browser settings. The age check will then appear again, and your language choice and cart will not be kept.

10Age check and children

• The LUCE website is intended for adults of legal age and asks for confirmation on your first visit. We do not ask for your date of birth, and your answer stays in your browser.
• We do not collect personal information from children under 14. If we learn that we have, we delete it without delay.

11Privacy officer

For questions, complaints or requests about your personal information, please contact our privacy officer.

12Getting help

For advice or redress about a privacy infringement, you can contact the following Korean public bodies.

13Changes to this policy

• This policy applies from 28 September 2026.
• Before a change takes effect, we will announce what is changing and why on this site and keep the previous version available.