Y
Yumebana

Privacy Policy

Last updated: May 2026

Yumebana (“we”, “us”) operates a B2B wholesale marketplace connecting Korean indie cosmetic brands with verified spa, aesthetician, and beauty boutique buyers in Southeast Asia. This policy explains what information we collect from buyers, sellers, and visitors, why we collect it, and what we do with it.

1. Information we collect

Waitlist signups. When you join one of our waitlists (buyer access on / or /vi, brand listing on /sell), we store the email address you provide, the page you submitted from, your referrer, and the context fields you filled in (business name, country, business type, monthly K-beauty spend, where you currently buy — for buyers; brand name in Korean and English, Korean business registration number if provided, KakaoTalk ID, MOQ, primary category — for sellers). We also store a hashed version of your IP and your browser user-agent.

Account data. If you sign in with Google, we receive your name, email, and profile picture via Supabase Auth.

Business verification documents. Once buyer verification is enabled, we collect your business registration document (Vietnam ĐKKD, Indonesia NIB, Thailand บริษัท, Philippines DTI, or equivalent). We use it only to confirm your business is real and matches the registry record. Documents are stored encrypted and retained for the life of your account; deletion on request closes the account.

Order and escrow data. Once checkout is enabled, your purchase records (order line items, ship-to address, invoice totals) and your Stripe Connect transaction metadata are processed to operate escrow, customs, and settlement. Card data never touches Yumebana servers — Stripe handles it directly.

Public catalog data. We process publicly available data from Korean cosmetic-industry sources — brand registry data from the Korean tax-office (국세청), product and review data from Hwahae (화해), and product-listing data from Olive Young Global — to build the brand catalog. This data is published by those sources and contains no personal information about you.

Basic analytics. Page views via Google Analytics (GA4) so we can see which pages, languages, and source channels actually convert.

2. How we use your information

  • To contact you when buyer or seller access opens for the cohort you signed up for
  • To verify your business against the relevant local registry (so the marketplace stays free of counterfeit-resellers and scrapers)
  • To operate escrow checkout, customs declarations, and settlement once these features are live
  • To mediate disputes and process refunds where Yumebana's mediation finds a buyer claim valid
  • To prevent abuse (the IP hash lets us rate-limit without storing raw IPs)
  • To operate and improve the Service

3. How we share data

We do not sell your data. We share information only with:

  • Supabase — hosted Postgres + Auth (waitlist records, account data, verification documents)
  • Vercel — application hosting and CDN
  • Stripe — payments processing and Connect escrow (order, payout, and card-tokenization data)
  • Wise — KRW settlement to Korean seller accounts (payee bank info, payout amounts)
  • DHL eCommerce / FedEx International — shipping and customs declarations (ship-to and ship-from address, declared value, HS code)
  • Resend — transactional email when we reply to waitlist signups or send verification confirmations
  • Google Analytics — aggregate, non-identifying usage data
  • Law enforcement or regulators when legally required

4. Cross-border transfers

Yumebana operates between Korea and Southeast Asia, so personal data necessarily crosses borders. By using the Service you consent to your data being processed in Korea, the United States (where Supabase, Vercel, Stripe, and Resend operate), and the destination country of any shipment. We rely on the lawful-transfer mechanisms available in each jurisdiction.

5. Your rights

You can request a copy of your data, ask us to correct it, or ask us to delete it at any time. Email us at the address below.

  • Vietnam (PDPD). You may request access, correction, or deletion of your personal data.
  • Indonesia (UU PDP). You may withdraw consent and request data deletion subject to legal retention obligations.
  • Thailand (PDPA). You may exercise the rights of access, rectification, erasure, restriction, and portability.
  • Philippines (Data Privacy Act). You may exercise your data subject rights including access, correction, and erasure.
  • Korea (PIPA). You may exercise rights of access, correction, deletion, and restriction of processing.
  • EU/UK (GDPR/UK GDPR). Applicable rights including access, portability, and erasure are honored.
  • California (CCPA). Right to know, delete, and opt out of sale (we do not sell).

6. Retention

Waitlist signups are retained until you ask us to delete them or for up to 24 months, whichever is sooner. Verified-account data (including business registration documents) is retained for the life of your account; deletion requests close the account. Order and tax records are retained for the period required by Korean and destination-country tax law, typically 5–10 years. Analytics data follows Google Analytics' default retention (currently 14 months).

7. Cookies

We use cookies for session authentication (Supabase) and aggregate analytics (GA4). We do not use third-party advertising cookies.

8. Contact

Questions, deletion requests, or concerns: steven@yumebana.com