Privacy Policy

Version: 2026-09-15

Who operates this service

esangdan is operated by 이상단주식회사. For privacy questions, access or correction requests, account closure, or deletion requests, use [Help & Support](/en/support). If you cannot access your account, use the contact channel on our [corporate website](https://www.esangdan.com/en/).

Information we use

- Account information: your email, verification status, member identifier and account status. Passwords are stored as password hashes, not readable passwords.

- Google sign-in: Google's account identifier and verified email; basic profile information only where supplied for sign-in. We do not request Gmail, Drive, Calendar or other Google account content.

- Service information: saved products, cart selections, inquiry messages and uploaded images, and product or option references you include.

- Security and consent records: sign-in sessions, verification challenges, rate-limit identifiers, policy versions and the time and language of your agreement. Hosting services may process technical request logs.

- Optional analytics: when you allow analytics, Google Analytics receives limited website usage and device/browser information and a pseudonymous browser identifier. We do not intentionally send email, names, messages, attachments, passwords, verification tokens or other private account content to Analytics.

Why we process information

We use account and service information to provide the features you request, verify ownership, manage your account and answer inquiries. We use technical data to protect the service and investigate abuse. We retain policy agreement records to document account registration. Analytics is optional and is used to understand and improve the storefront.

The applicable basis depends on your location and the processing purpose, including providing the requested service, applicable security interests, legal obligations and consent where required. Declining optional analytics does not prevent shopping or account use.

Providers and international processing

The storefront/API is hosted on Render in Singapore. Member and service records are stored in our configured MSSQL service in Korea. Resend provides transactional email delivery. Google provides Google sign-in and, if you allow it, Google Analytics. These providers may process information outside your country, including through their international infrastructure and support operations.

We disclose only information needed for the relevant service, subject to applicable provider agreements and safeguards. No payment or shipment is processed in this MVP. The policy will be updated before introducing PayPal, carriers or other new recipients for ordering.

Cookies and browser storage

Essential cookies support authentication and cart continuity. Short-lived browser storage can retain navigation intentions and inquiry drafts; these do not contain passwords. Your analytics preference is stored separately. Analytics scripts are blocked until you choose to allow them, and advertising features are not enabled by this storefront.

Use the site's Cookie settings to change your analytics choice. Withdrawing consent stops future analytics collection from the site; it does not automatically remove records already held by Google. You may also clear browser cookies and storage.

Retention

We keep active account records and the saved items and inquiries needed to provide the service. On a verified closure or deletion request, we review and remove information that is no longer needed, except records that must be retained to meet legal obligations, address security issues or resolve disputes. Retained records are restricted to those purposes.

Verification links expire after 30 minutes and sign-in sessions after seven days unless revoked earlier. Expiry stops their use; it does not imply immediate deletion of the underlying audit record. No automatic deletion schedule is represented as active where one has not been implemented. Contact us for a retention or deletion review.

Your choices and rights

Depending on applicable law, you may request access, correction, deletion, restriction or portability of your information, object to certain processing, withdraw consent, or complain to a competent data-protection authority. We may need to verify ownership before acting. Necessary account processing is separate from optional analytics consent.

Security and changes

We use encrypted connections, password hashing, session controls and member-specific access checks. No system can guarantee absolute security. Please avoid sending unnecessary sensitive information in support inquiries.

We publish policy updates here with a version date and record the version acknowledged during registration. Material changes will be communicated as required by applicable law.