Previous version (1.2). This policy applied from 13 October 2026 to 27 October 2026. See the current privacy policy.
GY International (“we”) publishes this policy to protect the personal information handled on the LUCE website (yourluce.com) under the Korean Personal Information Protection Act and to deal with related enquiries promptly.
At present the site collects personal information in three places: the Private Access email list, MY LUCE member accounts, and the enquiries and requests you send to the email address published on the site. Online ordering is not open; we will update this policy and announce the change on this site before it opens.
| Data controller | Details |
|---|---|
| Company | GY International |
| Representative | Heebum Choi |
| Business registration no. | 422-05-03482 |
| Address | 29 Aeryeonjeong-ro, Icheon-si, Gyeonggi-do 17372 |
| support@yourluce.com |
01What we collect and why
We process only the personal information needed for the purposes below. If a purpose changes, we will tell you in advance and ask for consent again where the law requires it.
| Service | Purpose | Information | Legal basis |
|---|---|---|---|
| Private Access email list | Sending news of launches, new pieces, limited releases and events (advertising); telling you the result of your consent or unsubscribe; handling unsubscribe and resubscribe requests; confirming the overseas-transfer consent of subscribers who joined before 28 September 2026; detecting duplicate sign-ups; issuing a personal discount code when we run a discount | Required: email address Recorded automatically: sign-up (consent) time, time of your overseas-transfer consent, page language, where you signed up (the home page section or the sign-up window), subscription status and history, a log of the emails we send you, discount code (only during a discount) | Your consent (PIPA Art. 15(1)1); consent to receive advertising (Network Act Art. 50(1)) |
| Unsubscribe record | Not sending advertising again to an address that opted out, and, if the address is entered in the sign-up form again, sending a resubscribe confirmation so that its owner confirms it; sending the result notice when you opt out by email or with your mail app’s unsubscribe button | Email address, sign-up and unsubscribe dates, how you unsubscribed (link, admin, bounce or spam complaint), the date you asked, subscription history, the log of the result notice | Compliance with a legal obligation (PIPA Art. 15(1)2; Network Act Art. 50(2) and 50(7)) |
| MY LUCE member service | Creating, signing in to and managing your account; email verification and password recovery; checking registration requests for products you own and managing authenticity; running member benefits and tiers (points are not running at present); preventing fraudulent sign-ins | Required when you sign up: name, email address, password (the server stores only a one-way encrypted value) Optional, entered by you on the account page: phone number, country code, state or province, city, postal code, street address, address line 2. If you change your email, the new email address When you ask to register a product: the product, serial number, purchase date, and order number and note (if you give them) Recorded automatically: time of your sign-up consent, page language (Korean or English), time the account was created, changed and verified, sign-in session records, email-verification and password-recovery link records, the log of verification and recovery emails, points and tier records, account activity log (member ID, type of action, time) Added by our operator: account status, assigned tier, the result of a product-registration check and the reason | Your consent (PIPA Art. 15(1)1); performance of the contract to provide the member service (Art. 15(1)4) |
| Enquiries and requests | Answering enquiries; handling requests to see, correct or delete information, and confirming who sent them | Sender’s email address, name (if given), content of the enquiry or request, attachments (if any) | Requests about your rights: legal obligation (PIPA Art. 15(1)2). Purchase enquiries: steps you ask for before a contract (Art. 15(1)4). Other enquiries: our legitimate interest in answering them (Art. 15(1)6) |
| Security and operation | Blocking repeated sign-up and order requests; blocking repeated failed admin logins; blocking repeated MY LUCE sign-up, sign-in, verification and recovery attempts; investigating faults | A transformed value of your IP address (to detect repeated requests and login attempts); a transformed value of the email address entered in a MY LUCE request (the member ID, for a signed-in member) to detect repeated attempts; hosting access logs (IP address, request time, requested URL, browser information) | Our legitimate interest in keeping the service secure (PIPA Art. 15(1)6) |
- We do not process resident registration numbers or other unique identifiers, sensitive information or pseudonymised information.
- The email that tells our operator about a new sign-up contains no information about the subscriber; the list can be seen only in the admin console.
- Creating a MY LUCE account does not sign you up to the email list (advertising). We ask for that consent separately, on the sign-up form for news.
- The phone number and delivery address on the account page are optional; you can use the account without them. We will add the handling of order information to this policy when online ordering opens.
- Your age-check answer, language choice and cart are stored only in your browser; we do not receive them. The cookie that keeps you signed in to MY LUCE is sent to our server (section 9).
02How long we keep it
We destroy personal information without delay once its retention period ends or its purpose has been achieved.
| Information | Retention |
|---|---|
| Email list sign-up | Until you unsubscribe. When you unsubscribe we delete your page language, sign-up place and discount code and the log of emails sent to your address without delay, and keep only the unsubscribe record below. |
| Unsubscribe record | Until you ask us to delete it. We use it only so that we do not email you again and, if your address is entered in the sign-up form again, to send a resubscribe confirmation (at most once a day) so that you can confirm it yourself. If you ask us to delete it, we delete it without delay. |
| Sign-ups from before 28 September 2026 | Records whose overseas-transfer consent we have not confirmed are not used to send news and are kept until 31 October 2026. Unless the person signs up again on the form and confirms by email before then, they are destroyed without delay from 1 November 2026, including records of people who have unsubscribed. |
| MY LUCE account information | Until you ask us to close (delete) your account. This covers your name, email address, the encrypted password value, the phone number and delivery address you chose to enter, page language, consent and verification times, product-registration requests, and points and tier records. When you ask us to delete the account, we destroy this information without delay after confirming who you are, within 10 days of receiving your request. No MY LUCE information is currently subject to a legal retention duty; if one arises, we will state it in this policy. |
| MY LUCE sign-in session records | 7 days from sign-in (up to 10 per account). Deleted at once when you sign out; all sessions of the account are deleted when you change or reset the password or verify your email. Expired records are deleted at the next sign-in. |
| Email-verification and password-recovery link records | 30 minutes from issue (single use). Expired records are deleted when the next link is issued; when you finish a verification or reset, or change your password, all link records of the account are deleted. |
| MY LUCE account activity log | Member ID (no email or name), type of action and time, with the reason where our operator handled it. Once the operating log exceeds 2,000 entries, the oldest are deleted automatically. After we process an account-deletion request, only the member ID remains in this log until it is deleted automatically. |
| Enquiry and request emails | One year from the day we finish answering or handling them |
| Resend’s record of received enquiry emails | Emails received at any yourluce.com address (sender’s email address, name, message and attachments) are kept by Resend for 30 days from the day they arrive and then deleted (Resend’s retention period). Only email sent to support@yourluce.com is forwarded to our company mailbox (Gmail). |
| The site’s email log | Records of emails that were sent are deleted automatically 30 days after they were last handled. When you unsubscribe, the log of emails sent to your address is deleted at once, except the notice confirming your unsubscribe. Records of emails that failed or need checking are kept as long as the related sign-up record and deleted with it. Records of MY LUCE verification and password-recovery emails (including the recipient address and the encrypted link value) follow the same rule, and when we process an account-deletion request, the records and copies of emails sent to that address are deleted at once. |
| Copies of sent emails stored by the site | Deleted as soon as the email service accepts the message. A copy of an email that failed is kept, so that it can be resent unchanged, as long as its log record. |
| Transformed IP values for repeated-request and login checks | Sign-up and order requests: held in server memory and deleted at the next request after 10 minutes (1 minute for orders), or when the server stops. Failed admin logins: held in our operating data store (Vercel Blob) and deleted at the next login attempt after 15 minutes. MY LUCE sign-up, sign-in, verification and recovery requests (transformed IP and email values): held in our operating data store (Vercel Blob) and deleted at the next MY LUCE request after 15 minutes have passed since the first request. |
| Hosting access logs | Deleted automatically after the period Vercel sets for its plan (up to 30 days). |
| Resend’s sending log | As long as needed to send the email and confirm the result; deleted when Resend’s retention period ends. |
03How we destroy it
- We identify personal information whose retention period has ended or whose purpose has been achieved and destroy it without delay.
- Electronic files: we delete the records from our operating data store (Vercel Blob) and from the mailbox that received the enquiry or request. Any subscriber list the operator downloads is deleted once the task is finished.
- When you ask us to delete your information, we delete your sign-up record, unsubscribe record, email log and stored copies together.
- When you ask us to close your MY LUCE account, we confirm who you are and then delete, from our operating data store, your account information, sign-in sessions, verification and recovery link records, product-registration requests, points and tier records, and the records and copies of verification and recovery emails sent to your address.
- Printed copies: shredded or incinerated.
04Disclosure to third parties
We do not provide email list information or MY LUCE member information to third parties, except where you have separately agreed or where a law makes special provision for it, and then only to that extent.
05Service providers
We entrust the following processing to service providers. If a provider or its task changes, we will update this policy and announce the change on this site.
| Provider | Task |
|---|---|
| Vercel Inc. | Hosting the website, running the sign-up and MY LUCE account server, storing sign-up records, MY LUCE member information and the email log (through the hosting account run by JI Lab), and passing enquiry emails on (the content of the emails is not stored) |
| Plus Five Five, Inc. (Resend) | Sending LUCE emails such as consent and unsubscribe notices, resubscribe and consent confirmations, MY LUCE email verification and password recovery, and operator notifications, and reporting delivery, bounces and spam complaints; receiving enquiry and request emails sent to support@yourluce.com and forwarding them to our company email (Gmail) |
| JI Lab | Developing and maintaining the site and its admin tools, fixing faults, running the hosting account |
| Google LLC | Keeping the enquiry and request emails received at our email address (Gmail); emails sent to support@yourluce.com reach this mailbox forwarded through Resend |
The companies Vercel and Resend in turn rely on (sub-processors) are listed on their sites: Vercel, Resend. Resend sends our email, and receives mail sent to support@yourluce.com, in Japan through its sub-processor Amazon Web Services, Inc. (Amazon SES, Tokyo region). JI Lab in turn entrusts the site’s hosting to Vercel Inc. (sub-processing).
06Transfer outside Korea
The LUCE website’s servers and storage are in the United States, our emails are sent and received in Japan, and enquiries sent to our email address pass through Resend and are kept in a Google mailbox. We therefore transfer personal information abroad as follows.
Legal basis for the transfer
Email list records (Vercel, Resend): the separate consent to overseas transfer you give on the sign-up form (PIPA Art. 28-8(1)1). The unsubscribe record kept after you unsubscribe (Vercel): kept for the period stated in that consent (after unsubscribing, until you ask us to delete it). Hosting access logs and transformed IP values for repeated-request and login checks (Vercel), and enquiry and request emails (Resend, Google): processing and storage entrusted to providers so that we can run the site and answer you, with the details in Art. 28-8(2) disclosed in this policy (Art. 28-8(1)3(a)). MY LUCE member information (Vercel, Resend): processing and storage entrusted to providers so that we can perform the contract to provide the member service, with the details in Art. 28-8(2) disclosed in this policy (Art. 28-8(1)3(a)).
Records of people who joined before 28 September 2026 are kept by Vercel (United States) without this consent, so they are not used to send news until the consent is recorded. The consent is recorded only when the person signs up again on the form and confirms with the button in our email. If it has not been recorded by 31 October 2026, those records, including records of people who have unsubscribed, are destroyed without delay from 1 November 2026.
Vercel Inc.
- Recipient and contact
- Vercel Inc., privacy@vercel.com, 440 N Barranca Avenue #4133, Covina, CA 91723, United States
- Country
- United States (server and storage region iad1, US East)
- Information
- The email list and unsubscribe records, MY LUCE member information (account, sign-in sessions, verification and recovery link records, product-registration requests, points and tier records), the security/operation information in section 1, the email log and sent-message copies
- When and how
- Each time you sign up, or sign in and enter or change account information, and each time you visit the site, over an encrypted connection (HTTPS)
- Purpose
- Hosting the website, processing sign-ups and MY LUCE accounts, storing operating data
- Retention
- As set out in section 2
Plus Five Five, Inc. (Resend)
- Recipient and contact
- Plus Five Five, Inc. (Resend), privacy@resend.com, 2261 Market Street #5039, San Francisco, CA 94114, United States
- Country
- Japan (sending and receiving enquiry emails, Tokyo ap-northeast-1, through Amazon Web Services, Inc.) and the United States (account data and sending log; handling and storing the enquiry emails received)
- Information
- Recipient email address and the email subject and body. Consent and unsubscribe notices and resubscribe and consent confirmations are sent to the subscriber’s address; MY LUCE verification and password-recovery emails are sent to the member’s address and contain a link that works once within 30 minutes; operator notifications contain no subscriber information. Resend also receives the enquiry and request emails sent to support@yourluce.com (sender’s email address, name, message and attachments).
- When and how
- Each time an email is sent, over an encrypted connection (HTTPS). Enquiry emails: sent over the network when they arrive
- Purpose
- Sending email and reporting delivery, bounces and spam complaints. Receiving enquiry emails and forwarding them to our company email
- Retention
- As long as needed to send the email and confirm the result; deleted when Resend’s retention period ends. Enquiry emails: 30 days from the day they are received
Google LLC
- Recipient and contact
- Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, United States, privacy contact form
- Country
- The United States and other countries where Google operates data centres
- Information
- Enquiry and request emails received at our email address (Gmail): sender’s email address, name, message and attachments
- When and how
- By email through Resend, when an enquiry arrives
- Purpose
- Receiving and answering enquiries, handling requests about your rights
- Retention
- As set out in section 2
How to refuse, and what happens
Email list: if you leave the overseas-transfer box on the sign-up form unticked, you will not be signed up and will not receive our news. After joining you can stop our news with the unsubscribe link in our emails, and ask us by email (section 11) to delete the remaining address and unsubscribe record, which withdraws your overseas-transfer consent. MY LUCE: the transfers above are needed to provide the account service, so if you do not want them, you cannot create an account. After joining, you can stop them by asking us by email (section 11) to close (delete) your account. Enquiries: enquiries sent to our email address pass through Resend (United States) and are kept in a Google mailbox; if you do not want this, you may choose not to send one. Access logs: because the site’s servers are in the United States, access logs are sent there whenever you use the site; if you do not want this, please stop using the site.
07Your rights
- You may at any time ask to see, correct or delete your personal information, ask us to stop processing it, or withdraw your consent.
- MY LUCE members can view and correct their name, phone number and delivery address, email and password themselves on the account page after signing in, and can see the products they asked to register and the status. Closing (deleting) an account cannot be done on the account page, so please ask us by email (section 11). We confirm that the request comes from the email address you signed up with and act on it within 10 days of receiving it.
- To leave the email list, use the “Unsubscribe” link at the bottom of our news emails or ask us by email (section 11). We tell you the result of a consent or unsubscribe (our name, the date and the outcome): by email when you join, on the page itself when you use the unsubscribe link (by email if you use your mail app’s unsubscribe button), and by email when you ask us by email.
- Send any other request to the privacy officer in section 11. We act on it once we have confirmed it comes from the email address you signed up with.
- We act on your request and reply within 10 days of receiving it. If there is a legitimate reason we cannot do so in time, we will tell you the reason and when we expect to finish.
- If we refuse or only partly fulfil a request, we will tell you why and how to object. If you disagree, you may object by email (section 11), and we will review it and reply within 10 days of receiving it.
- A legal representative or a person you authorise may also make a request; please include a letter of authorisation.
08How we protect it
- Sign-up records are kept in private storage that cannot be reached through a public address.
- The whole site uses encrypted connections (HTTPS).
- The admin console requires a password, and the server stores only a one-way hash of it. Admin sessions end automatically after 4 hours, and five failed logins from the same address within 15 minutes block further attempts.
- Change requests sent from other websites are blocked by checking their origin and a security token.
- MY LUCE passwords must be at least 12 characters, and the server stores only a one-way encrypted value. A sign-in ends after 7 days, and changing or resetting the password or verifying your email signs you out on every device.
- Email-verification and password-recovery links work once, within 30 minutes. MY LUCE sign-up, sign-in, verification and recovery requests are blocked after more than 10 within 15 minutes from the same connection or for the same email address.
- Member information can be seen in the admin console only by the people who need it. Verification and recovery links are never shown there, and admin actions such as changing member information and checking product registrations are logged.
- Admin access is limited to the people who need it. The subscriber list can be downloaded only in the admin console, and admin actions such as downloading the list or unsubscribing someone are logged.
09Browser storage and cookies
We use no visitor analytics, advertising cookies or behavioural tracking for targeted advertising. The site keeps the three values below only in your browser’s storage (localStorage) and does not send them to us.
| Name | Contents | Purpose | Kept until |
|---|---|---|---|
| luce.age | That you answered “Yes” on the age check | Not asking again | You clear your browser data |
| luce.lang | Your language choice (Korean or English) | Keeping your language | You clear your browser data |
| luce.cart | Product identifiers and quantities in your cart | Keeping your cart | You empty the cart or clear your browser data |
- When you sign in to MY LUCE, one cookie (luce_member) that keeps you signed in is stored in your browser and sent to our server with each request. It holds only a signed value that confirms your sign-in and a security token, and is not used for advertising or analytics. It lasts 7 days and is removed when you sign out or change your password.
- The site’s typeface is loaded from jsDelivr (cdn.jsdelivr.net), so your IP address and browser information may reach jsDelivr. We do not receive this information.
- To refuse: block or clear site data in your browser settings. The age check will then appear again, your language choice and cart will not be kept, and if you block the MY LUCE cookie you cannot sign in.
10Age check and children
- The LUCE website is intended for adults of legal age and asks for confirmation on your first visit. We do not ask for your date of birth, and your answer stays in your browser.
- We do not collect personal information from children under 14. If we learn that we have, we delete it without delay.
11Privacy officer
For questions, complaints or requests about your personal information, please contact our privacy officer.
| Role | Details |
|---|---|
| Privacy officer | Heebum Choi (Representative) |
| support@yourluce.com |
12Getting help
For advice or redress about a privacy infringement, you can contact the following Korean public bodies.
| Organisation | Contact |
|---|---|
| Personal Information Dispute Mediation Committee | 1833-6972 (in Korea), www.kopico.go.kr |
| Personal Information Infringement Report Center (KISA) | 118 (in Korea), privacy.kisa.or.kr |
| Supreme Prosecutors’ Office | 1301 (in Korea), www.spo.go.kr |
| Korean National Police Agency | 182 (in Korea), ecrm.police.go.kr |
13Changes to this policy
- This policy applies from 13 October 2026.
- Before a change takes effect, we will announce what is changing and why on this site and keep the previous version available.
| Version | Effective | Change |
|---|---|---|
| 1.0 | 28 September 2026 | First version (see previous version) |
| 1.1 | 12 October 2026 | MY LUCE member service opens: added the handling of member information (what, why, how long, service providers, transfer abroad, how to exercise your rights) and the sign-in cookie (see previous version) |
| 1.2 | 13 October 2026 | Changed the contact email to support@yourluce.com, and added how emails sent to that address are received by Resend and forwarded to our company email (Gmail): service providers, transfer abroad and retention |