CLERIVY — Privacy Policy

Notice at Collection (summary)

This Section is our notice at collection. It appears at the top of this Policy so that the Privacy Policy links on our Site, cart, checkout, account sign-in, and Subscribe form lead directly to it. It lists the personal information we collect, why we collect it, whether it is sold or shared, and how long we keep it. Details are in the sections that follow.

To opt out of the sale or sharing of your personal information, use our Do Not Sell or Share My Personal Information page, Cookie Settings, or a Global Privacy Control signal (Section 3). Card details you enter at checkout are collected only by our payment processors, to complete and secure your payment (Section 1). We do not sell or share sensitive personal information, and we do not use it to infer characteristics about you. Washington and Nevada residents: see also our Consumer Health Data Privacy Policy.

This Privacy Policy explains how GUHADA Co., Ltd., operator of the Clerivy brand ("Clerivy," "we," "us," or "our"), handles personal information in connection with clerivy.com, its pages and forms, our checkout and customer-account pages, and related communications that we operate (collectively, the "Site").

Clerivy is a beauty and skincare brand based in the Republic of Korea. The Site introduces Clerivy products, lets customers in the United States purchase them directly through our online store, and also links to Clerivy product listings on Amazon.com. Visitors in other countries may browse the Site or subscribe to marketing emails.

When you place an order on the Site, checkout and customer accounts are hosted by Shopify. We collect the information needed to process and deliver your order, such as your name, email address, shipping address, phone number, and order details. Payment-card details are entered in a secure payment form provided by Shopify or our payment processor and are never received or stored by Clerivy. Our Subscribe form asks only for an email address. Purchases made on Amazon are completed directly on Amazon under Amazon's terms and privacy notice.

1. Information We Collect

We may receive aggregated or campaign-level reports from analytics, advertising, hosting, and Amazon Attribution providers. Amazon does not provide us with your payment-card details, shipping address, password, or Amazon account credentials through these reports. Our payment processor and PayPal do not provide us with your full card number or account credentials.

Apart from the payment details you enter in our payment processors' secure forms, which are used only to complete and secure your payment, we do not request government identifiers, financial account credentials, precise geolocation, biometric data, or other sensitive personal information through the Site. The only other sensitive personal information we expect to receive is health information you choose to share when you tell us about a reaction to a product. We use it only to respond to you, review product safety, and meet legal reporting obligations. We do not sell or share it, use it for advertising, or use it to infer characteristics about you. Please do not include other sensitive information in a message to us.

2. How and Why We Use Information

• Orders and customer service: to process payment, prepare and ship your order, send order and shipping confirmations, handle returns, refunds, and cancellations, respond to inquiries, and prevent fraud.
• Marketing: to send newsletters, product updates, promotions, and related emails you requested.
• Site operation: to publish, deliver, maintain, troubleshoot, and secure the Site and its forms.
• Analytics and improvement: to understand traffic, content performance, navigation, and product interest.
• Advertising and attribution: to connect visits and Amazon outbound clicks with campaigns, measure performance, and, where permitted, build or refine advertising audiences.
• Communications: to respond to inquiries and privacy requests.
• Reviews: to display the reviews, ratings, display names, and photos you submit on the Site and in our marketing, and to moderate them under our Terms of Service.
• Product safety: to respond to reports of reactions to our products, review product safety, and make reports required by law.
• Compliance and protection: to maintain consent, opt-out, and transaction records, prevent misuse, protect rights and safety, comply with law, and establish or defend legal claims.

Where applicable law requires a legal basis, we rely on: performance of a contract for processing and delivering your order and operating your account; consent for marketing and for non-essential analytics or advertising technologies where required; our legitimate interests in operating, securing, measuring, and improving the Site and promoting our products, where those interests are not overridden by your rights; steps taken at your request; and legal obligations or legal claims. You may withdraw consent at any time without affecting processing that occurred before withdrawal.

3. Cookies, Analytics, and Advertising Choices

We use cookies, pixels, tags, local storage, server logs, and similar technologies. The technologies shown below may be used when enabled. The Site's Cookie Settings interface should reflect the non-essential categories currently active.

How we use non-essential analytics and advertising technologies depends on where you visit from. If you visit from the European Economic Area, the United Kingdom, or Switzerland, we do not load them until you accept them in our consent banner. If you visit from elsewhere, including the United States, they are active when you visit, and you can opt out at any time. In either case, once you reject or opt out of a category, the technologies in that category stop setting or reading cookies and similar identifiers on your device and are no longer used to measure or personalize advertising for you; Google tags may continue to send limited, cookieless signals that do not identify you. You can accept, reject, or manage categories through the consent banner where it is shown, and at any time through Cookie Settings in the Site footer. We remember your choice for at least 12 months. Rejecting or opting out will not prevent you from browsing the core Site, placing an order, or following a product link to Amazon.

You can also opt out of the sale and sharing of your personal information and of targeted advertising through our Do Not Sell or Share My Personal Information page or Cookie Settings. We treat a Global Privacy Control (GPC) signal as such an opt-out request. The signal applies to the browser or device that sends it and to any profile we associate with that browser or device; if you are signed in to your account or we otherwise know who you are, we also apply it to your account and to information linked to your email address. To use GPC, turn it on in a browser or browser extension that supports it.

Our checkout and account pages are hosted by Shopify on separate subdomains (checkout.clerivy.com and account.clerivy.com). The choices you make through Cookie Settings or our Do Not Sell or Share My Personal Information page on clerivy.com, and any GPC signal from your browser, also apply on those pages, which may show their own cookie or privacy controls as well. You may also restrict cookies through your browser settings.

4. How We Disclose Information

We disclose personal information to providers that help us operate the Site and conduct the activities described in this Policy:

If we start using another provider for these purposes, such as a product-review or email-marketing service, we will add it to this Policy before we share personal information with it.

We may also disclose information to professional advisers, security or infrastructure vendors, and affiliated entities when reasonably necessary for their services; to authorities or others to comply with law, respond to lawful requests, meet product-safety reporting obligations, investigate misuse, or protect rights and safety; and in connection with a merger, financing, reorganization, asset transfer, or similar transaction. We may disclose information at your direction or with your consent.

Some advertising, analytics, social-media, and commerce providers may handle information for their own purposes under their own terms. Please review the Shopify Privacy Policy, PayPal Privacy Statement, Google Privacy Policy, Meta Privacy Policy, Amazon Privacy Notice, and Framer Privacy Statement.

5. Targeted Advertising and U.S. State Privacy Notice

We do not sell personal information for money. Some U.S. state laws, however, may treat the use of advertising and analytics technologies as a "sale," "sharing," or targeted advertising because online identifiers and Site activity are made available to advertising or analytics providers for cross-context behavioral advertising.

If those laws apply, the categories involved may include online identifiers; device and Internet or electronic-network activity; product-interest or commercial information; approximate location; and inferences about interests. Recipients may include advertising networks, analytics providers, and social-media platforms. We do not disclose your name, email address, phone number, postal address, or account information, including in hashed form, to advertising or social-media companies for advertising. We do not knowingly sell or share personal information of anyone under 16.

You may opt out through our Do Not Sell or Share My Personal Information page, Cookie Settings, GPC, or by emailing info@clerivy.com with the subject "Privacy Opt-Out." Our notice at collection is the "Notice at Collection (summary)" at the top of this Policy.

California and other U.S. state disclosures. In the preceding 12 months, we collected the following categories of personal information, as named in California Civil Code Section 1798.140. Our business and commercial purposes are described in Section 2.

We sell or share personal information only for advertising and campaign measurement, and only until you opt out as described in Section 3. We do not use or disclose sensitive personal information for purposes other than those permitted by California Code of Regulations, Title 11, Section 7027(m). We do not collect characteristics of protected classifications, biometric information, professional or employment-related information, or education information.

6. Purchases on the Site and on Amazon

Purchases on the Site. When you order on clerivy.com, you check out on pages hosted by Shopify (checkout.clerivy.com) and may create an account (account.clerivy.com). We use your order information to process payment through our payment processor or PayPal, to ship your order through our fulfillment center in the United States, and to handle returns and refunds under our Refund & Return Policy and Shipping Policy. Shopify, our payment processor, and PayPal may also process your information under their own privacy notices for purposes such as fraud prevention and, where you have a Shopify or PayPal account, the operation of that account.

Purchases on Amazon. The Site's "Buy on Amazon" buttons direct you to Clerivy-branded product listings on Amazon. Amazon handles Amazon-account login, orders, payment, billing, shipping, returns, and customer service for those purchases under its own terms and privacy notice.

We may use product-specific Amazon Attribution links and measure the outbound click to understand which page, campaign, ad group, or creative led to an Amazon visit. Do not put personal information in a URL or send it to us for this purpose. Information that Amazon collects after you leave the Site is governed by Amazon's policies and choices.

7. Marketing and Retention

We send marketing emails only where permitted by law. You can unsubscribe at any time through the link in an email or by contacting info@clerivy.com. Unsubscribing does not affect order confirmations, shipping notices, a response to a request you made, or another non-marketing communication permitted by law.

We may delete or de-identify information sooner when it is no longer needed. We may retain it longer when required by law, a valid legal hold, fraud prevention, or the establishment, exercise, or defense of legal claims.

How we delete information. When a retention period in this Section ends or the purpose of processing has been achieved, we delete the information without delay. Electronic records are deleted using technical methods that prevent them from being restored, or are irreversibly de-identified, and we instruct our service providers to do the same. Paper records are shredded. Information we must keep under the laws listed above is stored separately from other information, with access limited to the staff who need it, and is used only for the purpose for which it must be kept.

8. Your Privacy Rights

Depending on where you live and subject to legal exceptions, you may have the right to:

• know whether and how we process your personal information and obtain access or a copy, including the categories of personal information we collected, its sources, our purposes, the categories of third parties to which we disclosed it, and the specific pieces of personal information we hold;
• correct inaccurate information;
• request deletion, restriction, suspension, or objection to certain processing;
• receive certain information in a portable format;
• withdraw consent and opt out of marketing, targeted advertising, profiling, sale, or sharing;
• appeal a refusal of a request where applicable; and
• complain to the privacy or data-protection authority where you live or work.

You can view and update your account details and saved addresses at any time by signing in to your account at account.clerivy.com. To close your account or ask us to delete your information, email info@clerivy.com.

To make a request, email info@clerivy.com with the subject "Privacy Request," or write to us at the postal address in Section 12, and tell us which right you wish to exercise. You do not need an account to make a request. For requests to access, correct, or delete personal information, we verify your identity by asking you to confirm a one-time link or code sent to the email address associated with your order, account, or subscription, and we may ask for your order number; for requests for specific pieces of information, deletion, or correction, we may ask for additional details. We do not require identity verification for a request to opt out of sale, sharing, or targeted advertising; we ask only for the information needed to apply your choice, such as the email address you used with us. We use information provided for verification only for that purpose. An authorized agent may submit a request where permitted by law, but we may require proof of authorization and, for requests to access, correct, or delete, direct verification with you. We apply an opt-out of sale, sharing, or targeted advertising as soon as feasibly possible and no later than 15 business days after we receive it, and the response periods below do not delay an opt-out or a withdrawal of consent. For other requests, we confirm receipt within 10 business days and respond within 45 days; we may extend that period by up to 45 more days where the law allows, in which case we will tell you why within the first 45 days. If a law that applies to your request sets a shorter deadline, we meet it. For example, where Korea's Personal Information Protection Act applies, we respond to a request to access, correct, delete, or suspend processing within 10 days or, where the law permits, tell you within that period why we are postponing or declining it. We will not unlawfully discriminate or retaliate against you for exercising a right. If we decline your request, we will explain why. You may appeal our decision by replying to it with the subject "Privacy Appeal." We will respond to your appeal in writing within 45 days, and if we deny it, we will tell you how to contact the Attorney General of your state.

EEA, UK, and Switzerland. You may object to processing based on legitimate interests, withdraw consent, and lodge a complaint with your local supervisory authority. We do not use Site information to make decisions that produce legal or similarly significant effects through solely automated processing.

Republic of Korea. You may request access, correction, deletion, suspension of processing, or withdrawal of consent under applicable law. If you need help with a privacy concern, you may also contact the Personal Information Dispute Mediation Committee (www.kopico.go.kr, 1833-6972 from within Korea) or the Personal Information Infringement Report Center of the Korea Internet & Security Agency (privacy.kisa.or.kr, 118 from within Korea).

9. International Transfers

GUHADA Co., Ltd. is located in the Republic of Korea. The Site is global and our providers operate in multiple countries. As a result, personal information may be processed outside the country where you live, including in Korea, the United States, Canada, Singapore, the Netherlands or other parts of the European Economic Area, and locations used by provider subprocessors.

Legal basis for transfers under Korean law. Each transfer in the table below shows its basis under Article 28-8(1) of Korea's Personal Information Protection Act. "Contract" means the provider stores or processes the information on our behalf because this is necessary to conclude and perform our contract with you, and we rely on disclosure in this Policy. "Consent" means the information is transferred only after you agree: for PayPal, by choosing PayPal at checkout after the notice shown there; for analytics and advertising when you visit from the European Economic Area, the United Kingdom, or Switzerland, by accepting the relevant category in our consent banner, which links to this Policy. "Notice and opt-out" means that, when you visit from elsewhere, including the United States, the transfer takes place after the notice given in this Policy unless and until you opt out, as described in Section 3. If we change the information, country, recipient, purpose, or retention period of a consent-based transfer, we will ask for your consent again before the change applies to you. You can refuse or withdraw analytics or advertising consent, or opt out, at any time in Cookie Settings; refusing does not prevent you from browsing the Site, placing an order, or following a product link to Amazon, but we will not be able to measure or personalize our advertising for you. You can refuse the PayPal transfer by paying by card instead; this does not prevent you from placing an order.

Card payments. Card payments are processed on our behalf by Eximbay Co., Ltd. (Rm. 1707, R-dong, Daeryung Post Tower 8, 43, Digital-ro 26-gil, Guro-gu, Seoul 08389, Republic of Korea). If you are outside Korea, your card information is transferred to Eximbay in Korea over encrypted connections when you pay by card. When you pay by card, Eximbay transfers your card number, name, email address, and IP address in real time over encrypted connections to its subprocessor CyberSource Corporation (a Visa company, United States; privacy@visa.com) for card authentication and fraud screening. This transfer is necessary to perform our contract with you (basis: Contract). CyberSource keeps this information for as long as needed for these purposes and to meet legal and card-network record-keeping requirements, as described in Visa's Global Privacy Notice.

Amazon. When you select a "Buy on Amazon" link, you leave the Site, and Amazon collects information directly under the Amazon.com Privacy Notice. The link contains only campaign codes; we do not send Amazon your name, email address, or other contact details. Amazon provides us with aggregated attribution reports.

Where required, we use recognized transfer safeguards such as adequacy decisions, contractual protections, or standard contractual clauses and take supplementary measures appropriate to the risk. Provider locations may change; their current subprocessors and privacy notices provide additional information. You may avoid optional analytics or advertising transfers through Cookie Settings. You may avoid the subscription transfer by not submitting the form. Order-related transfers marked "Contract" are necessary to fulfill a purchase you make on the Site. You may refuse them by not placing an order, but we will then be unable to sell or ship products to you. Essential hosting transfers are necessary to deliver the Site.

10. Security

We use reasonable administrative, technical, and organizational measures designed to protect personal information, including access controls, restricted provider permissions, encrypted transmission where supported, account security, and review of collection and retention. Checkout pages are served over HTTPS, and payment-card data is handled by PCI DSS–compliant payment providers rather than by Clerivy. No Internet transmission or storage system is completely secure, so we cannot guarantee absolute security.

11. Children and Third-Party Services

The Site is intended for a general audience and is not directed to children under 13 or the higher minimum age required by local law. You must be at least 18, or the age of majority where you live, to place an order. We do not knowingly collect personal information from children through the Site. If you believe a child provided personal information, contact us so we can investigate and delete it where required.

The Site may link to or embed Amazon, social-media, video, or other third-party services. Their privacy practices are governed by their own notices, not this Policy. Review their notices before providing information or using their services.

12. Changes and Contact

We may update this Policy to reflect changes in the Site, our providers, or applicable law. We will revise the "Last Updated" date and provide additional notice when required. Material changes apply from the effective date stated in the updated Policy.

For privacy questions, complaints, or requests, contact: