locogeeksOperator: 주식회사 로코긱스
Effective date: August 26, 2026 (Wednesday)
1. General
주식회사 로코긱스 (the “Company”) processes and protects the personal information of LocoGeeks users in accordance with applicable law. This Policy applies to the website, mobile app, customer support, and Host operations tools.
2. Categories of Personal Information Processed
① Account and identity verification: email address, mobile phone number, login identifier, encrypted password information, birth year or age verification information, social login provider, and provider identifier.
② Profile: display name, photo, nationality, city of residence, languages, gender, introduction, areas of interest, and voluntarily provided occupation and affiliation information.
③ Host application and settlement: type of identity document, a copy with the latter digits of the resident registration number fully masked or the identity verification result, identity verification metadata, activity region, experience and introduction, settlement account, account holder's name, and information needed for tax processing. The Company does not collect an original resident registration card or a copy with an unmasked resident registration number.
④ Listings, bookings, and transactions: listing content, schedule, options, participant count, price and fee snapshots, booking status, and cancellation, refund, settlement, and chargeback records.
⑤ Payment: type of payment method, payment processor transaction number, amounts and times of approval, cancellation, and refund. As a general rule, the Company does not directly store full card numbers or security codes.
⑥ Service use: messages, reviews and photos, reports, customer inquiries, notification settings, push tokens, device and app versions, IP address, and access and error logs.
⑦ Location-related: exact meeting place supplied by the Host when registering a listing, and its approximate public location. The initial service does not collect the Traveler device's current GPS location.
⑧ Optional marketing consent: whether consent was given, when it was given or withdrawn, and the permitted channels and scope of content.
⑨ Host Category Discovery Wizard: selected response IDs, optional idea text, recommendation results, anonymous session identifiers, source, language, permitted attribution data, and feature-use and analytics event metadata. Before sign-in, the anonymous session is not linked to a Member account.
Social Login and External Authentication Services
When a user chooses Google or LINE Login, the Company receives account identifiers and profile information within the scope authorized by the user from that external authentication provider and uses them for login and account linking. The information provided by Google depends on the permissions actually granted. LINE Login currently requests the openid profile scopes and does not request permission to receive the user's email address from LINE. Google and LINE are external authentication providers, not companies to which the Company entrusts the processing of personal information.
3. Purposes of Processing
The Company processes personal information for account registration and authentication, Host screening, publication of listings, booking, payment, refunds and settlement, messaging and notifications, reviews, reports and dispute handling, safety and fraud prevention, compliance with legal obligations, improving service quality, and marketing subject to separate consent. Host Category Discovery Wizard information is processed to restore progress, provide experience-category recommendations, analyze the completion flow, and improve the service. Optional idea text is not used for AI analysis or recommendation scoring and is not included in analytics events.
4. Legal Bases for Processing
The Company relies on entering into and performing service contracts, compliance with legal obligations, legitimate interests of the Company and users, protection of life and physical safety, and the data subject's consent as lawful bases for processing. Refusal of optional consent does not restrict use of the basic service.
5. Retention and Use Period
① In principle, personal information is destroyed without delay when its processing purpose is fulfilled or a Member withdraws.
② Under applicable law, records of contracts and withdrawal of offers, and records of payment and supply, may be retained for five years; consumer complaint and dispute records for three years; and display and advertising records for six months.
③ An allowed masked copy of an identity document or identity verification result is stored privately only for the minimum period needed for screening and legal verification and is destroyed when that purpose is fulfilled. The specific destruction schedule follows the internal retention policy and applicable law.
④ Minimum information needed to prevent misuse or resolve an ongoing dispute may be stored separately until that purpose ends.
⑤ An anonymous Host Category Discovery Wizard session that is not linked to an account is retained for up to 30 days from creation and then automatically deleted. If a session is lawfully linked to an account after sign-in, the account and service retention policy applies instead of the anonymous-session deletion rule.
6. Provision to Third Parties
① To fulfill a booking, the Company provides the Traveler and Host with the other party's booking information, display name, necessary contact details, and Experience requirements. The exact scope and timing are explained at the booking stage.
② The Company may provide necessary information to investigative or supervisory authorities for legally required reporting or incident response.
③ Other provision to third parties occurs only with separate consent or where there is a legal basis.
7. Entrusted Processing
The Company entrusts personal information processing necessary to operate the service as follows.
| Processor | Entrusted task and information processed | Retention and processing criteria |
|---|---|---|
| Supabase, Inc. | Account authentication, service database and file storage, and server functions. Account, profile, Host application, and service-use information stored for those functions | The Company's retention period in Section 5 and the service's and agreement's deletion and backup policies |
| Vercel Inc. | Hosting the operations Admin web service and processing server requests. Admin login information and Member and Host information accessed or processed in Admin operations | Request processing and the service's and agreement's log and deletion policies |
| Plus Five Five, Inc. (Resend) | Sending authentication emails. Recipient email address, message content, and sending and delivery information | The email and log retention policy for the applicable service plan; remaining customer data is deleted within 90 days after termination of the service agreement under the provider's DPA |
| 650 Industries, Inc. (Expo Push Service) | Delivering notifications using push tokens. Push tokens and, when a notification is sent, its content | Tokens are processed for the period needed to provide the notification service; notification content is processed only for the period needed to deliver it. Android notification delivery uses Google LLC's Firebase Cloud Messaging as a downstream processing path |
8. Cross-Border Transfer of Personal Information
The Company processes personal information abroad as necessary in the course of operating the following services. Users may object to a cross-border transfer by emailing the address in Section 15. The Company will review the request, explain whether the transfer can be stopped and how this would affect the relevant function, and reply with the outcome. Information that must be retained by law remains subject to statutory retention duties.
| Recipient, contact, and confirmed processing country | Information transferred and purpose | Time and method of transfer | Retention and processing criteria | Effect of refusal |
|---|---|---|---|---|
Supabase, Inc. — privacy@supabase.com; Singapore (Production primary data region ap-southeast-1) | Account, profile, Host application, and service-use information stored for authentication, storage, and service provision | Transmitted over encrypted connections from the app and Admin service when a Member uses the service | The Company's retention period in Section 5 and the service's and agreement's deletion and backup policies | Use of the service may be restricted because authentication and storage are core infrastructure |
| Vercel Inc. — privacy@vercel.com; United States (the provider's stated primary processing facilities) | Admin login information and Member and Host information needed for Admin operations, to provide the operations web service and process requests | Transmitted over encrypted connections when an Admin logs in or makes an operational request | Request processing and the service's and agreement's log and deletion policies | Some service functions requiring Admin or server request processing may be restricted |
| Plus Five Five, Inc. (Resend) — privacy@resend.com; United States | Recipient email address, authentication email content, and sending and delivery information, to send authentication emails | Transmitted by SMTP from Supabase when an authentication email is sent | The email and log retention policy for the applicable service plan; remaining customer data is deleted within 90 days after termination under the provider's DPA | Authentication and notification emails may be restricted |
| 650 Industries, Inc. (Expo Push Service) — privacy contact form; United States. Google LLC (Firebase Cloud Messaging) in the Android delivery path — Firebase privacy inquiries; Google's global processing facilities (no single country designated) | Push tokens and, when a notification is sent, its content, to deliver notifications. On Android, delivery passes through Google LLC's Firebase Cloud Messaging | Transmitted over encrypted connections when a device is registered or a notification is sent | Tokens are processed for the period needed to provide the notification service; notification content is processed only for the period needed to deliver it | Push notifications may be restricted |
9. Location Information and Meeting Places
The initial service does not collect the Traveler device's current GPS location. The exact meeting place for a Host's listing is stored privately with restricted access; only an approximate location within about 500 meters is shown publicly. Before introducing current-location features, the Company will complete the separate notice and consent and location-information procedures.
10. Data Subject Rights and How to Exercise Them
Users may request access, correction or deletion, suspension of processing, withdrawal of consent, transfer of their personal information, and account withdrawal. If a request is restricted due to a statutory retention obligation or to protect another person's rights, the Company explains the reason.
11. Information Concerning Minors
Only persons aged 18 or older may create a Platform account. A Member who is a minor under applicable law may use non-transactional functions such as search, profile management, and bookmarks, but may not independently book or pay or act as a Host. A minor may accompany an adult booker or guardian on a booked Experience; the guardian must lawfully provide the participant information needed during booking.
12. Destruction Procedures and Methods
Electronic files are securely deleted so they are difficult to restore, and paper documents are shredded or incinerated. Information retained by law is separated from operational information and access to it is restricted.
13. Security Measures
The Company implements reasonable safeguards, including minimized access rights, authentication and authorization management, encryption in transit and at rest, private storage, access logs, security updates, backups, incident response procedures, and employee training.
14. Cookies, SDKs, and Similar Automatic Collection Technologies
The website and app may use cookies, SDKs, or similar technologies to maintain login sessions, ensure security, diagnose errors, and improve the user environment. Before sign-in, the Host Category Discovery Wizard uses the essential __Host-locogeeks-host-wizard cookie to restore progress and protect the session. Its randomly generated session credential is stored as a hash on the server and is not linked to a Member account before sign-in. If optional analytics or advertising technologies are introduced, their purposes and opt-out methods will be disclosed separately.
15. Privacy Protection and Complaints Department
Department responsible for personal information protection and related complaints: Privacy Protection and Complaints Department.
Email: coreteam@locogeeks.com
Users may contact this department to request the exercise of their privacy rights or seek advice about a suspected privacy infringement.
16. Changes to This Policy
The Company gives notice on the Platform before changes to this Policy take effect. For material changes to data categories, purposes of use, third-party provision, or cross-border transfer, it gives further notice or obtains consent as required by applicable law.
Supplementary Provision
This Policy takes effect on August 26, 2026 (Wednesday).