Glowsight Privacy Policy
FORDYBN CO., LTD. ("we", "us") operates Glowsight, a brand-intelligence service for beauty brands. This policy explains what personal information we process and why.
1. Purposes
- Reviewing service applications and responding to inquiries.
- Creating accounts, login and access control.
- Service notices (weekly summaries, reports).
- Preventing fraud and keeping security logs.
- Marketing messages, only with separate consent.
- Improving answer quality of in-product Q&A, after removing company and brand names.
- Connecting a customer's own sales and advertising channels (for example Amazon Seller Central, Meta ad accounts, Shopee, TikTok Shop) at the customer's request, to show that customer its own aggregate performance.
2. Information we collect
| Category | Items | How |
|---|---|---|
| Service application | Business email, business registration number (required); contact name, company name (optional) | Application form |
| Account | Email, password (stored encrypted by our authentication provider), login history | Sign-up, login |
| Usage logs | IP address, browser, view/edit/download actions | Automatically |
| Consents | Marketing consent and time; terms consents with time and version | Sign-up |
| Customer requests and in-product Q&A | Request and question text, feedback | Customer input |
| Card payment | Payment method type, issuer, masked card number, personal/corporate flag, billing key (encrypted), random customer ID, amount, date, result, receipt link. Full card number, expiry and birth date are entered only in the payment provider's window; we never receive them. | Payment provider |
| Bank transfer | Company details for tax invoice, contact email, deposit confirmation | Customer input |
| Connected channel credentials | Access/refresh tokens issued by the channel when the customer authorizes us, the channel account or shop ID, granted scopes, connection status. We never ask for or store channel passwords. | Channel authorization (OAuth) |
We do not collect buyers' personal information from connected channels. We do not request channel permissions that give access to end-buyer names, addresses, phone numbers or emails (for example Amazon restricted roles, Meta lead forms, Shopee unmasked data). If a channel response nevertheless contains a buyer field, we discard it before storage and do not log raw responses.
3. Retention
- Unapproved applications: deleted after 1 year.
- Account information: anonymized 30 days after termination.
- Customer-entered data (sales, ad spend, memos, Q&A): kept 1 year after termination, then deleted (continued if the customer re-subscribes).
- Connected channel credentials: no longer used from termination and deleted 30 days after termination. When a customer disconnects a channel, we stop collection and delete the stored token.
- Payment and transaction records: 5 years (Korean tax law).
- Access logs: 1 year.
- Public market data: kept regardless of termination (not personal data of the customer).
- De-identified aggregate statistics: 1 year after termination.
- Marketing consent: until withdrawn.
4. Sharing with third parties
We do not provide personal information to third parties except where required by law. Data from a customer's connected channels is shown only to that customer's workspace.
5. Processors and international transfers
| Processor | Task | Location | Data |
|---|---|---|---|
| Supabase Inc. | Database, authentication, file storage, encrypted secret storage | Stored in Seoul region; operator in the US | Account information, logs, stored data, connected channel credentials |
| Vercel Inc. | Web hosting | Runs in Seoul region; operator in the US | IP and browser information during requests |
| Resend, Inc. | Email delivery | Japan (Tokyo), US | Recipient email, message content (logs up to 30 days) |
| Toss Payments Co., Ltd. | Card payment | Korea | Payment method information, amount, date, registrant email |
Business-data processors that receive no account personal data (public market data and customer business materials only): Vultr Holdings, LLC (servers, US) · Anthropic, PBC (AI analysis, US) · TypeSafe AI, Inc. (review classification, US) · Apify Technologies s.r.o. (public web collection, Czech Republic) · Zyte Group Limited (public page collection, Ireland) · Super Intent, Inc. (overseas shop collection, US).
6. Deletion
Personal information is deleted without delay when its retention period ends, using methods that cannot be restored.
7. Your rights
You may request access, correction, deletion or suspension of processing of your personal information, and withdraw marketing consent, by emailing hello@glowsight.kr. We respond within 10 days.
8. Security
HTTPS for all connections · encrypted password storage by our authentication provider · database row-level security with server-only access · workspace-level separation · access logs · rate limiting on public forms · channel tokens kept in an encrypted secret store accessible only to our server.
9. Cookies
We use login-session cookies only. No advertising or tracking cookies.
10. AI analysis and channel data
- Public market data and customer-provided business data may be analyzed by the AI processors above. Account personal information is never sent to AI processors.
- Customer data is used only inside that customer's workspace and is not used to train shared models; AI processors are used on terms that do not train on our data.
- Meta ad account data is read-only and used only for that brand's own screens and reports.
- Data from other connected channels (Amazon, Shopee, TikTok Shop) is read-only aggregate data, used only for that brand's own screens and reports, and is not shared with other customers.
- YouTube API data is refreshed or deleted within 30 days; YouTube Terms of Service and Google Privacy Policy apply.
11. Privacy officer
Email: hello@glowsight.kr Korean residents may also contact the KISA Privacy Center (118) or the Personal Information Dispute Mediation Committee (1833-6972).
12. Changes
We give at least 7 days' notice before changes take effect.