Patory Privacy Policy

FADTORY (hereinafter referred to as “Fatory”) | Effective Date: August 1, 2026

Gurapa Lab Co., Ltd. considers users' personal information important in providing the FADTORY (hereinafter referred to as “FADTORY”) service and processes personal information safely in accordance with relevant laws and regulations, including the Personal Information Protection Act.

Purpose of processing personal information

Purposeand Content

Purpose:Membership registration and member management

Content:Member identification, account management, contact verification, prevention of fraudulent use, delivery of notices, and response to customer inquiries. If separate identity verification procedures, such as mobile phone authentication, are operated, the personal information items required for such procedures and the purpose of use will be notified separately.

Purpose:Product ordering and delivery

Contents:Order Confirmation, Payment, Product Delivery, Delivery Tracking, Exchange, Return, Refund, Customer Support, Dispute Resolution

Purpose:Curation, Limited Sales, and Pre-order Operation

Content:Limited quantity sale, pre-order, notification of minimum purchase quantity or number of participants met, restocking and shipping schedule notification, delay notification, cancellation and refund processing

Purpose:Operation of brand direct delivery service

Content:Product shipment, delivery, exchange, return, refund, and customer inquiry processing through brands or partners.

Purpose:Curator collaboration, sales operation

contentcurator, aggregation of sales performance, management of collaborative sales pages, and handling of customer inquiries. In principle, the Company does not provide curators with personally identifiable information, such as customers' names, contact details, or shipping addresses.

Purpose:AI curation and personalized services

Contentassists in product exploration and recommendation based on customer searches, clicks, shopping carts, purchase history, preferred categories, input, etc.

Purpose:Customer consultation and dispute resolution

inquiries, handling complaints, verifying shipping issues, processing refunds and exchanges, and responding to disputes.

Purpose:Marketing and Notifications

Content includesnew curation, curation limited sales, pre-orders, live schedules, member priority notifications, season curation, and brand content announcements. Marketing information is sent only if the user has opted in to it.

Items of personal information processed

Purpose of using classification processing items

Category:Membership Registration and Member Management

Processing itemsName, Email, Password, Mobile Phone Number

Purpose of use:Member identification, account management, contact verification, delivery of notices, response to customer inquiries

CategoryOrder · Payment · Delivery

Processing ItemsName, Mobile Phone Number, Email, Shipping Address, Order Number, Product Name, Payment Amount, Shipping Information, Exchange/Return/Refund Request Information

Purpose of use:Order confirmation, payment processing, product delivery, delivery information, cancellation, exchange, return, and refund processing

ClassificationPayment-related Information

Processing items:Order number, payment approval number, payment method, payment amount, cancellation/refund information

Purpose of use:Transaction verification, payment approval, cancellation, and refund processing. In principle, the Company does not directly store sensitive payment authentication information, such as full card numbers or account passwords.

Category:Curation, Limited Sale, and Pre-order

Processing ItemName, Mobile Phone Number, Email, Order Information, Shipping Information, Sales Status, Refund Processing Information

Purpose of use:Proceeding with sales, notifying of whether minimum requirements have been met, shipping and refund processing

CategoryBrand Direct Delivery Service

Processing Items:Name, Mobile Phone Number, Email, Shipping Address, Ordered Product Information, Exchange/Return/Refund Request Information

Purpose of Use:Shipment, delivery, and processing of exchanges, returns, and refunds through brands or partners

Category:Curator Collaboration Sales

Processed Items:Traffic sources by curator, purchase conversion information, order aggregation information, cancellation and refund aggregation information

Purpose of use:Performance aggregation and settlement. In principle, customer personally identifiable information is not provided to curators.

ClassificationAI Curation

Processed items:search terms, click history, shopping cart information, purchase history, interest categories, preferred brands, input sentences, feature usage history

Purpose of use:Assisting with product search, recommendations, and improving service quality

Distinction:AI fitting room or image-based function

Processing items:User-uploaded images, image creation request information, creation result information

the purpose of useand a consent process. If this feature is not used, image information will not be collected or processed.

Categoryselection item

Items processed:Date of birth, gender, interest categories, preferred brands, style preference information, profile image, reviews or customer testimonials (images and text)

Purpose of Use:Processed only when there is separate consent for the use of the relevant function.

ClassificationAutomatically Collected Items

Processed items:Service usage records, access logs, IP addresses, cookies or similar identifiers, device information, browser information, and access date and time.

Purpose of use:Service operation, security management, statistics, customized service improvement

Retention and Usage Period of Personal Information

The Company destroys personal information without delay once the purpose of processing the personal information has been achieved. However, information that must be retained for a certain period in accordance with relevant laws and regulations will be retained for that period.

Retention period of stored items

Records regarding contracts or withdrawal of subscription, etc., in storage

Retention period:5 years

Records regarding payment for stored items and the supply of goods, etc

Retention period:5 years

Retained items:Records regarding the handling of consumer complaints or disputes

Retention period:3 years

Records regarding the display and advertising of stored items

Retention period:6 months

Archived Items:Access records related to service usage

Retention period:3 months

Transaction-related informational guide

The Company may send transaction-related informational notices, such as orders, payments, shipping, cancellations, returns, exchanges, refunds, results of curated limited sales, and pre-order shipping schedules, to the mobile phone number or email address provided by the member.

This notice is an informational guide necessary for ordering and contract fulfillment, and is distinct from consent to receive advertising information. However, if you are unable to receive this notice, the use of services such as ordering, delivery, and refunds may be restricted.

For KakaoTalk users, transaction-related notifications, such as orders and deliveries, may be sent via KakaoTalk Notification. If the Notification fails to be sent, it may be sent via text message instead.

Receive and withdraw marketing information

The Company may send promotional information via email, text message, KakaoTalk, app notifications, etc., only if the user has given optional consent.

·Today's Curation Guide
·Curation Limited Sale Information
·Pre-order Information
·Live Schedule Information
·Member Priority Guide
·New Brands and Curator Content
·Season Curation Guide
·Brand Content and Benefits Guide

Users can withdraw their consent to receive marketing communications at any time through My Page, Customer Center, the unsubscribe link, or the unsubscribe number.

When the Company sends promotional information, it indicates that the information is promotional in accordance with relevant laws and regulations, and provides the sender's name and instructions on how to opt out or withdraw consent to receive. When sending promotional information via text message or long text message, the Company provides a free means to opt out.

Nighttime advertising information

When transmitting promotional information between 21:00 and 08:00 the following day, the Company sends it only if it has obtained separate consent from the user to receive nighttime promotional information. In principle, during initial operation, nighttime promotional information is not sent, and in this case, a separate consent item for receiving nighttime promotional information may not be provided.

Provision of personal information to third parties

In principle, the Company does not provide users' personal information to external parties. However, in the following cases, personal information may be provided to the extent necessary.

1If the user has given prior consent
2Where provision is required in accordance with laws and regulations
3When necessary information is provided to the brand or partner company for the processing of shipment, delivery, exchange, return, or refund of products from the brand's direct delivery service

RecipientPurpose of ProvisionItems ProvidedRetention and Usage Period

Recipient: Domestic orinternational brands or partners

Purpose of Service:Processing of shipment, delivery, exchange, return, and refund of brand direct delivery service products

Items provided:Name, mobile phone number, email, shipping address, ordered product information

Retention and Usage Period:Until delivery and follow-up processing are completed, or until the retention period stipulated by relevant laws.

If a brand or partner independently ships, delivers, or handles after-sales processing of goods rather than acting merely as a trustee, the Company shall notify such provision as a provision to a third party.

Outsourcing of personal information processing tasks

The company entrusts personal information processing tasks as follows to ensure smooth processing of personal information.

Details of entrusted tasks to the trustee, items of personal information entrusted, and retention and usage period

Consignment companySolapy Co., Ltd.

Entrusted Work Details:Sending of text messages, long text messages, and KakaoTalk notifications

Items of personal information entrusted:Name, mobile phone number, order number, product name, order status, shipping information

Retention and Usage Period:Until the termination of the consignment contract or the achievement of the purpose of the consigned work.

Consignee:Kakao Corporation

Details of entrusted work:Processing and provision of sending infrastructure for Kakao AlimTalk and Brand Messages, and support for handling customer inquiries via KakaoTalk Channels.

Items of personal information entrusted:Name, mobile phone number, order number, product name, order status, shipping information, KakaoTalk Channel consultation details

Retention and Usage Period:Until the termination of the consignment contract or the achievement of the purpose of the consigned work.

Consignee:Korea Port One Co., Ltd.

Details of entrusted work:Payment processing agency and payment information relay

Items of personal information entrusted:Name, mobile phone number, email, order information, payment information

Retention and Usage Period:Until the termination of the consignment contract or until the retention period stipulated by relevant laws.

Consignee:KG Inicis Co., Ltd.

Entrusted tasks:Payment approval, payment cancellation, refund processing, and payment-related customer service

Items of personal information entrusted:order information, payment information, refund information

Retention and Usage Period:Until the termination of the consignment contract or until the retention period stipulated by relevant laws.

Consignment companyOrderLogis Co., Ltd.

Entrusted tasks includeproduct storage, dispatch, delivery processing, return collection, and delivery tracking.

Items of personal information entrusted:Name, mobile phone number, shipping address, and ordered product information

Retention and Usage Period: Until delivery and follow-up processing are completed

ContractorVercel Inc.

Outsourced Work Details:Cloud hosting, service deployment, server operation, log processing, security management

Items of personal information entrusted:service usage information, access logs, IP addresses, and information processed during the course of service operation among member information and order information.

Retention and Usage Period: Until the termination of the consignment contract or until the purpose of providing the service is achieved.

ContractorSupabase, Inc.

Details of entrusted work:Database operation, file storage operation, authentication, and data storage

Items of personal information entrusted:Member information, order information, shipping information, information related to products, reviews, and consultations, access and usage records, and other information stored during the course of service operation.

Retention and Usage Period: Until the termination of the consignment contract or withdrawal of membership

ContractorAmazon Web Services, Inc.

regarding entrusted tasks, sending password reset emails and service notification emails

Personal information items entrusted:Name, email address

Retention and Usage Period:Until the termination of the consignment contract or the achievement of the purpose of the consigned work.

ContractorMux, Inc.

Details of entrusted work:Live streaming transmission and playback

Items of personal information entrusted:access IP, viewing history

Retention and Usage Period:Until the termination of the consignment contract or the achievement of the purpose of the consigned work.

ContractorFal AI, Inc.

Outsourced Work Details:AI fitting room image generation and processing

Items of personal information entrusted:Images uploaded by the user, image creation request information, and creation result information

Retention and Usage Period:Until the purpose of providing the relevant function and processing is achieved.

TrusteeGoogle LLC

Details of entrusted work:Providing Google account-based social login

Items of personal information entrusted:Google account identification information, email address, name, or profile information

Retention and Usage Period: Until membership withdrawal or social login linkage is disconnected

When entering into a consignment contract, the Company specifies in documents such as contracts, in accordance with the Personal Information Protection Act, matters concerning the prohibition of processing personal information for purposes other than the performance of entrusted tasks, technical and administrative protective measures, restrictions on sub-consignment, management and supervision of the trustee, and liability such as compensation for damages, and supervises whether the trustee safely processes personal information.

If the details of the entrusted work or the trustee changes, the Company will disclose this without delay through this Privacy Policy.

Overseas transfer of personal information

The company may transfer personal information overseas during the process of providing services such as direct overseas brand delivery services, cloud hosting, database operation, email sending, live streaming, and AI image generation.

In the event of an international transfer, the Company will notify the recipient, the country of transfer, the date and method of transfer, the items of personal information being transferred, the purpose of transfer, the retention and usage period, the method for refusing the transfer, and the disadvantages of refusal through the Privacy Policy, product detail page, or payment stage.

1. Direct shipping service for overseas brands

Overseas brands or partner companies that directly ship the goods to the recipient

Country of origin or country of shipment displayed on the product detail page of the country being transferred

Previous items:Name, mobile phone number, email, shipping address, ordered product information

Previous purpose:Product shipment, international shipping, exchange, return, and refund processing

Previous Date and Method:Transferred electronically for shipping processing after customer order completion

Retention and Usage Period:Until delivery and follow-up processing are completed, or until the retention period stipulated by relevant laws.

Users may refuse the transfer of personal information overseas. However, if you refuse the transfer, the processing of orders, deliveries, exchanges, returns, and refunds for products shipped directly from overseas brands may be restricted.

2. Cloud and Service Infrastructure

Transfer recipientsVercel Inc., Supabase, Inc., Amazon Web Services, Inc., Mux, Inc., Fal AI, Inc., Google LLC

UnitedStates and the countries where each operator or their sub-processor provides services.

Previous Items:Service usage information, access logs, IP addresses, information processed during service operation among member and order information, email addresses, social login account information, AI fitting room uploaded images

Previous purpose:cloud hosting, database and file storage operation, email sending, social login authentication, live streaming broadcasting, AI image generation

Previous Date and Method:Electronic transfer via network when using the service

Retention and Usage Period: Until the termination of the consignment contract or until the purpose of providing the service is achieved.

Users may refuse the overseas transfer of personal information through the aforementioned business operator. However, in this case, the use of all or part of the Factory service may be restricted.

Processing of personal information related to AI curation

Factory's AI curation feature is designed to assist customers in product browsing, and may process search terms, click history, shopping cart information, purchase history, interest categories, preferred brands, sentences related to style, situation, or usage entered by the customer, and images uploaded when using the AI Fitting Room.

AI recommendation results are information intended to assist customers in their purchasing decisions, and the final decision on whether to purchase is made by the customer themselves.

AI fitting room image

When using the AI Fitting Room feature, images uploaded by the user may be transferred to Fal AI, Inc. for image generation processing. This feature may be used after obtaining separate consent, and use will be restricted if consent is not given.

In accordance with the terms of use and settings of Fal AI, Inc., Patori takes necessary measures to ensure that images uploaded by users are not used for purposes other than providing the relevant function, and separately provides information on the storage period, deletion method, and whether AI training is used for original images on the function screen.

Users must not upload photos of others, images of minors' faces, images containing sensitive body information, or images for which they do not have permission to use.

Installation, operation, and refusal of automatic personal information collection devices

The Company may use cookies or similar identifiers during the use of the Service. Cookies may be used to record the user's service usage, access environment, products of interest, shopping cart, maintain login status, improve services, and manage security.

Users can refuse or delete cookie storage through their browser settings. However, if you refuse cookie storage, the use of some services, such as staying logged in, the shopping cart, and personalized recommendations, may be restricted.

Destruction of personal information

The Company destroys personal information without delay once the retention period has expired or the purpose of processing has been achieved. Personal information in the form of electronic files is deleted using methods that make recovery and reproduction impossible, while personal information recorded in paper documents is shredded or incinerated.

User Rights

Users may request access to, correction of, deletion of, suspension of processing of, or withdrawal of consent regarding their personal information at any time. Requests may be submitted via the Factory Customer Center or the email address of the Chief Privacy Officer. The Company takes action without delay upon receiving a user's request, and in the case of a request for correction or deletion, it will not use or provide the relevant personal information until processing is completed.

Processing of personal information of children under the age of 14

In principle, the Company does not provide services to children under the age of 14 and does not intentionally collect personal information from children under the age of 14. If the processing of personal information of children under the age of 14 is necessary, the Company follows the procedures stipulated by relevant laws and regulations, such as obtaining the consent of a legal representative.

Measures to ensure the safety of personal information

1Minimization of personal information handlers and access control management
2Encrypted storage of authentication information such as passwords
3Encryption applied to communication channels
4Storage of access records to personal information processing systems and prevention of forgery and tampering
5Access control to systems where personal information is stored
6Management and supervision of entrusted companies
7Operation of internal management standards regarding personal information processing

Chief Privacy Officer

Chief Privacy OfficerBang Tae-yoon

Position:Chief Technology Officer

Emailprivacy@fadtory.com

Inquiries regarding personal information, complaints, and requests for damage relief can be submitted through the contact information above.

Remedies for Infringement of Rights

OrganizationContact Information and Address

InstitutionalPersonal Information Dispute Mediation Committee

Contact Information and Address1833-6972 / www.kopico.go.kr

AgencyPersonal Information Infringement Reporting Center

Contact Information and Address: 118 (no area code required) / privacy.kisa.or.kr

Agency:Supreme Prosecutors' Office Cyber Investigation Division

Contact Information and Address: 1301 (no area code required) / www.spo.go.kr

Agency:National Police Agency Cyber Investigation

Contact Information and Address: 182 (no area code required) / ecrm.cyber.go.kr

Changes to the Privacy Policy

In the event of changes to the Privacy Policy, the Company provides advance notice of the changes, the reasons for the changes, and the effective date through announcements on the Factory website or via a linked screen. In the event of significant changes, the Company provides notification by comparing the content before and after the revision so that users can easily verify the changes.

This Privacy Policy is effective from August 1, 2026.