DUBU Market - Privacy Policy

Last Modified: 10 March 2026

1. Introduction

1.1. Purpose This Privacy Policy (hereinafter the "Policy") aims to clearly explain how H Lab Korea Co., Ltd. (hereinafter "Company", "we", or "us") collects, uses, stores, shares, and protects the personal information of users (hereinafter "User", "Member", or "you") in providing the used goods trading platform 'DUBU Market' and related services (hereinafter "Services"). We consider the protection of your personal information and privacy as our top priority and comply with applicable privacy regulations in the regions where the Services are provided, including the Personal Information Protection Act (PIPA) of the Republic of Korea.

1.2. Scope This Policy applies when you access and use DUBU branded mobile applications (App), websites (Web), location-based used goods trading and community features, communications, and all other services of ours that reference this Policy. However, this Policy does not apply to third-party websites, platforms, or services (e.g., linked external websites, etc.) that are not owned or controlled by us.

1.3. Consent By signing up for an account on the Service, clicking the "Agree" button, or accessing and using our Services, you give your legally binding consent to the collection, use, processing, sharing, and transfer of your personal information as specified in this Policy. If you do not agree to the terms of this Policy, you may not use our Services and must immediately cease using the Service and terminate your account.

1.4. Modifications We may amend this Policy and the Cookies Policy from time to time in response to changes in laws, addition of service features, or changes in operational policies. In the event of material changes, such as the items of personal information collected or the purpose of use, we will provide advance notice through means such as in-service announcements, banner notifications, or emails so that you can review the changes before they take effect. Your continued use of our Services after the notice of the updated Policy has been posted or sent shall be deemed your consent to the updated Policy.

2. Information We Collect

The Company collects the following personal information from you to smoothly provide the Service, maintain your account, support customers, and foster a Trust & Safety environment.

2.1. Information Provided at Registration

• (a) Mandatory Information: A mobile phone number (WhatsApp-verified), email address, password, and nickname are collected for identity verification, unique account identification, and security.
• (b) Optional Information: Profile image, region of residence, nationality, and date of birth may be collected to personalize your profile and provide location-based services.
• (c) Social Login Information: If you register or log in by linking a Google or Apple account, the Company receives a unique identifier for social login authentication (Google ID, Apple ID, Kakao ID), email, and name (upon the first Apple login) from the respective platform.

2.2. Information Collected During Service Use

• (a) Post and Community Data: The title, description, price, photos, category, status information, reference links of the posts (sell, looking to buy, free giveaway) you register, and the transaction location coordinates (latitude and longitude) optionally entered by you are collected.
• (b) Communication Data: Message contents, transmitted images, and appointment and location information exchanged in 1:1 chat rooms between users are collected. However, all chat messages are encrypted and stored on the server using the AES-256-GCM algorithm.
• (c) Transaction and Activity History: Wishlist (favorites) history, Offer creation and acceptance/rejection history, transaction status change records, review and tag data for Manner Score calculation, in-app search keywords, followers/following lists, and notification receipt setting history are collected.
• (d) Customer Support and Moderation Data: Detailed reasons, explanations, and evidence (such as image URLs) submitted by you during reports of fraudulent use, blocking, transaction disputes, and mobile phone number ownership disputes are collected.

2.3. Automatically Collected Information & Analytics

• (a) Device and Log Information: When you access our Services, device identifiers (Device ID), platform (iOS or Android), access IP address, login method, and the time of last activity are automatically collected for multi-device session management and security.
• (b) Push Notification Tokens: Firebase Cloud Messaging (FCM) tokens are collected for sending and managing push notifications per device.
• (c) App Analytics and Usage Statistics: To improve service quality, track crashes, and analyze marketing performance, the Company may automatically collect behavioral data in an anonymized form, such as your screen visit history, feature click frequency, and app force-close logs, using third-party analytics tools.

2.4. Methods of Collection The Company collects personal information when you directly enter or submit information through in-app screens, when the system automatically generates logs during your use of the Services, when you submit a customer support inquiry or dispute application, and by receiving information from external social platforms that you have authorized to link.

3. How We Use Your Information

The Company uses the collected personal information for the following purposes. The personal information processed by us will not be used for purposes other than those specified, and if the purpose of use changes, we will take necessary measures such as notifying the user in advance and obtaining separate consent in accordance with relevant laws.

3.1. Service Provision and Account Management

• (a) User Identification and Authentication: Confirming intent to sign up, verifying fulfillment of age requirements (19 years or older), verifying identity via a mobile phone number (WhatsApp verification) during registration and service use, and managing multi-device login sessions.
• (b) Core Service Provision: Registering and displaying posts for selling, looking to buy, and free giveaways; providing 1:1 real-time chat services between users; and synchronizing Offers and completed transaction statuses.
• (c) Customer Support: Securing a smooth communication channel for customer consultation, complaint handling, report reception, and transaction dispute resolution arising during service use, and guiding the processing results.
• (d) Notification Delivery: Sending push notifications (FCM) for receiving chat messages, price drops on wishlisted items, keyword alerts, review receipts, and major service announcements.

3.2. Fostering and Protecting a Safe Trading Environment (Trust & Safety)

• (a) Prevention of Fraudulent Use: Detecting, preventing, and sanctioning (e.g., account suspension) fraudulent activities that violate laws and the Terms of Service (e.g., fraud, no-shows, account theft, abnormal repeated sign-ups and withdrawals, etc.).
• (b) Automated Filtering and Monitoring: Data processing to automatically detect and issue warnings through systems and AI regarding the exposure of personal contact information (phone numbers, emails, etc.) in chats, keywords related to prohibited items, and acts of inducing external messengers and payments to maintain a safe trading environment.
• (c) Reliability Evaluation: Writing mutual reviews (evaluation tags and comments) between users after a transaction is completed, granting badges, and automatically calculating Manner Scores based on these.
• (d) Chat Reading for Dispute Resolution and Report Handling: When a report regarding violations of the Service operation policy—such as fraud, profanity, no-shows, or trading prohibited items between users—is received or a dispute occurs, dedicated administrators (Admins) authorized by the Company may restrictively read the chat history between the parties involved in the transaction for prompt problem resolution, damage prevention, and accurate investigation of the violation.

3.3. Service Improvement and Analysis

• (a) Enhancing User Experience: Developing new features and improving usability by analyzing users' service access frequency, feature usage statistics, and in-app behavioral patterns in an anonymized form using third-party analytics tools.
• (b) Securing System Stability: Providing a stable service environment by tracking and fixing the causes of app errors, bugs, and system performance degradation.
• (c) Advancement of AI Models: Improving the accuracy and performance of AI assistance features that automatically suggest titles, categories, descriptions, etc., through photo analysis when creating a post, and comparing prices of similar items.

3.4. Marketing and Tailored Advertising

• (a) Provision of Tailored Advertising: Displaying appropriate and meaningful targeted advertisements within the app based on service usage records such as the user's Emirate of residence, categories of interest, wishlist history, and search keywords.
• (b) Promotion Notifications: Sending messages for marketing purposes, such as events of the Company or its partners, and announcements of new services (provided that you have explicitly consented to receive marketing information).

4. Data Sharing and International Transfers

As a general rule, the Company does not provide your personal information to external parties without your consent. However, for the smooth provision of services and compliance with legal obligations, we may share personal information with third parties or transfer it overseas as follows.

4.1. Data Processors We entrust the processing of, or share, personal information with trusted third-party service providers to provide core functions of the Service (authentication, notifications, cloud storage, AI features, etc.).

• (a) Cloud Server and Storage: Amazon Web Services (AWS)
• (b) Authentication Service: Meta (WhatsApp)
• (c) Push Notifications and Analytics: Google Firebase
• (d) Social Login: Google, Apple, Kakao

4.2. Cross-border Data Transfers The Company is a corporation headquartered in the Republic of Korea, and we utilize global cloud infrastructure (e.g., AWS) overseas, including the Middle East region, to provide stable global services. By using the Services, your personal information may be transferred, stored, and processed outside of your country of residence. The Company complies with appropriate security and protection measures required by relevant personal information protection laws when transferring data overseas.

4.3. Law Enforcement As specified in the Terms of Service, we may provide your information to relevant law enforcement agencies, regulatory authorities, or courts without prior notice to you in order to respond to subpoenas, court orders, or lawful legal processes from law enforcement agencies; to investigate and prevent fraud and criminal activities; and to protect the rights and safety of the Company or third parties.

5. Cookies and Tracking Technologies

5.1. Definition of Cookies and Identifiers

The Company uses automated tracking technologies such as cookies, mobile device identifiers (IDFA/AAID), and SDKs for device identification when you use the app and website.

5.2. Purpose of Use

They are used to maintain essential login sessions, analyze app performance, and provide customized targeted advertisements (Ads) based on the user's activity history.

5.3. Third-party Analytics

We utilize third-party analytics tools like Firebase Analytics, which collect anonymized data in accordance with their own policies.

5.4. User Controls

You can restrict customized ad tracking or reset identifiers through your device's OS settings. However, restricting essential session cookies may limit your use of the Service.

6. Data Retention

6.1. Principle of Deletion

In principle, a user's personal information is destroyed without delay when the purpose of collection and use has been achieved or when you terminate this Contract (withdraw membership). Upon account deletion, sensitive personal information that can directly identify you, such as your nickname, profile image, password, and device information, is immediately deleted in an irrecoverable state (Soft-delete and immediate removal of sensitive information).

6.2. Retention under Applicable Laws

In accordance with the standards of the Korean corporation providing the service and relevant laws (Act on the Consumer Protection in Electronic Commerce, Protection of Communications Secrets Act, etc.), the Company safely stores the following information for the specified periods for the confirmation of rights and obligations and dispute resolution, before destroying it:

• (a) Records on contracts or withdrawal of subscription, etc.: 5 years
• (b) Records on payment and supply of goods, etc.: 5 years
• (c) Records on consumer complaints or dispute resolution: 3 years
• (d) Service visit and access log records: 3 months

6.3. Exceptions for Internal Policy

In addition to statutory retention periods, the following information is exceptionally retained to maintain a safe trading environment and optimize the system:

• (a) Withdrawn Account Records (Fraud Prevention): To restrict re-registration (7-day cooling-off period) and prevent malicious users with a history of fraud from laundering their identities, WhatsApp-verified mobile phone numbers and social identifiers are separated from the original account and stored for up to 5 years after one-way encryption, after which they are automatically and permanently deleted by the system.
• (b) Time-to-Live (TTL) Data: System notifications and push notification data are stored for 90 days, and authentication codes (WhatsApp verification codes, etc.) and login session tokens are automatically and permanently deleted by the system (TTL index) when their expiration date passes.

7. User Rights and Choices

7.1. Access and Correction

You can view or modify your personal information (nickname, profile image, etc.) at any time through the "Settings" menu within the App.

7.2. Account Deletion (Right to be Forgotten) & Data Anonymization

You may request the deletion of your account (membership withdrawal) at any time through the in-app settings. Upon account deletion, your personal information will be processed in accordance with the "Data Retention" section of this Policy. However, to protect the transaction records of counterparties and the integrity of the platform, contents you have already shared with others or registered in public areas (e.g., sent chat messages, transaction reviews, community comments) will not be deleted; instead, they will be strictly anonymized (e.g., displaying the author as "Unknown User") and maintained.

7.3. Managing Permissions

You can withdraw your consent for optional access rights (camera, photo album, location, push notifications, etc.) at any time through your mobile device's OS settings. Refusing optional permissions will not prevent you from using the core Service, but may restrict your use of certain features that require those permissions.

8. Data Security

The Company implements the following technical and administrative measures to protect your personal information from loss, theft, leakage, alteration, or damage:

• (a) Data Encryption: All data transmitted over the network is protected via encrypted communication (HTTPS), and passwords and sensitive data are securely stored using strong encryption algorithms. In particular, chat messages are encrypted using AES-256-GCM.
• (b) Access Control: Access to the database and servers containing personal information is strictly controlled and limited to a minimum number of authorized personnel.
• (c) Security Systems: We utilize modern security infrastructure, including firewalls and intrusion detection systems provided by global cloud services, to prevent unauthorized access and cyberattacks.

9. Contact Us

If you have any questions, concerns, or complaints regarding this Privacy Policy or our data processing practices, please contact our privacy support team. We will respond to your inquiries promptly and faithfully.

• Corporate Entity: H Lab Korea Co., Ltd.
• Email: support@iflab.fun