Privacy & Data Use

The data controller for Loop& Skin is Loop& (루프앤드), a sole proprietorship registered in the Republic of Korea under business registration number 350-09-03190.

A dedicated Loop& address for data-protection questions and requests is being set up and will be published here and in the site footer as soon as it is live.

We collect the info you give us and what you do on the site, use it to run the service and build your personalized plan, and produce aggregated, de-identified analytics about demand that we may share or sell to clinics and partners. We track your activity only after you consent at sign-in, and you can withdraw at any time.

• Account: email; and, if you use Google, your name and profile picture.
• Profile: budget range (가격대), nationality, trip length, and treatment goals you choose.
• Activity: procedures you view, searches you run, treatments you save, plans you build, and timestamps.
• Technical: your IP address, and the country we derive from it, at the moment of each request. We store the derived country with your activity; the IP itself is kept only with sign-in link requests, to limit abuse.
• Consent record: the version and time you agreed to these terms.

• To operate the service — save your treatments and generate clinic matches and plans.
• To produce aggregate analytics (e.g., which treatments a budget or nationality segment is interested in). Reports shared or sold externally are aggregated and do not identify you.
• User-level data is used only to provide the service to you; it is not sold.

We ask for your consent to collect and use your activity when you sign in. Providing profile details is optional. You may withdraw consent by logging out or asking us to delete your account; after withdrawal we stop tracking new activity.

Clinics and partners receive aggregated demand insights. Your individual identity or contact details are shared only when you take an action that requires it (for example, asking us to connect you to a clinic or coordinator).

Some things stay on your device: your saved treatments and your session are kept in your browser's local storage. Everything else is held on managed services, which means your data leaves Korea:

• Neon (PostgreSQL, hosted on AWS in us-east-1, United States) — activity events, the country derived from your IP, waitlist entries, and sign-in link records.
• Resend (United States) — delivery of sign-in and confirmation emails. Receives your email address.
• Vercel (United States) — site hosting. Handles requests and standard server logs.
• Google — only if you choose Google sign-in, to verify who you are.

Each is used only to run the service, for as long as section 8 describes. We do not transfer your personal data to anyone else for their own purposes.

We keep your data while your account is active and for as long as needed to provide the service and meet legal obligations. You can clear it by deleting your account.

You may request access to, correction of, or deletion of your data, and you may withdraw consent, using the contact in section 1.

This policy works together with our Terms of Service. Questions? Email us any time.