Legal notice and privacy policy
Version 1.0 · Effective 2026-10-01
Legal notice (Impressum)
- Business
- HB Crossborder (허니뱃저), sole proprietorship, Republic of Korea
- Owner
- Uihyun Moon
- Business registration no. (Korea)
- 249-71-00696
- VAT ID (EU)
- Not applicable
- moonshowstar@gmail.com
- Customers
- Business clients only. We do not sell to consumers.
Privacy policy
HB Crossborder ("we") publishes this policy under Article 30 of Korea's Personal Information Protection Act (PIPA) and, where it applies, Articles 13 and 14 of the EU GDPR.
1. Why we process your data
(1) To receive your free check request, prepare and send your report, and answer your questions
(2) To conclude and perform contracts, invoice and settle payments, and meet tax obligations
(3) To send updates, only if you separately agree
2. What we collect
Free check (required): your name, business name, one contact detail (email, KakaoTalk ID or WhatsApp number), website or map URL, and your message
If you came from a campaign link: its campaign tags (utm values)
When we sign a contract: contact person's name, title, email and phone, billing details, PayPal transaction ID
Collected automatically: nothing. We use no cookies or analytics. Security logs kept by our hosting provider follow the provider's policy (see section 6).
3. How long we keep it
Requests that don't lead to a contract: 12 months after we reply
Contract records: 5 years after the relationship ends, 7 years for cross-border transactions (Korean Framework Act on National Taxes, Art. 85-3)
Update subscriptions: until you withdraw consent
4. Deletion
When the retention period ends, we delete the data without delay in a way that can't be recovered. Data we must keep by law is stored separately.
5. Sharing with third parties
We do not share your personal data with third parties, except where the law requires it.
6. Processors and international transfers
We use the processors below. Transfers to those outside Korea are necessary to answer your request and perform our contract, and are disclosed here under PIPA Art. 28-8(1)(iii).
| Processor (contact) | Country / storage | Data | When and how | Purpose / retention |
|---|---|---|---|---|
| Supabase, Inc. (privacy@supabase.io) | US company; data stored in the Republic of Korea (AWS Seoul region) | All free check form fields | On submission, over encrypted HTTPS | Storing requests; retention as in section 3 |
| Google LLC (https://support.google.com/policies) | USA and other Google data centre locations | Form fields and email content | When emails are sent and received | Email storage; retention as in section 3 |
| Vercel Inc. (privacy@vercel.com) | US company; the form function runs in the Republic of Korea (Seoul region) | Access logs (IP address etc.) and form fields | When you visit the site or submit the form, over encrypted HTTPS | Hosting, passing on your request, security; Vercel's policy applies |
| NAVER Corp. (NAVER Mail) | Republic of Korea | Name, business name, email address, URL | Right after you submit, if you chose email for your report | Sending and storing the confirmation email with our deck; retention as in section 3 |
| Telegram Messenger Inc. (https://telegram.org/privacy) | British Virgin Islands company; Telegram data centres (e.g. the Netherlands, Singapore) | All form fields | Right after you submit, as an encrypted notification to the founder | Alerting the founder to new requests; retention as in section 3 |
| PayPal Pte. Ltd. (5 Temasek Boulevard #09-01, Suntec Tower Five, Singapore 038985) | Singapore (and PayPal processing locations) | Payer name, email, transaction data | When we invoice and you pay | Payment and settlement; PayPal's policy applies |
| Meta Platforms Ireland Ltd. / Meta Platforms, Inc. (WhatsApp) | Ireland / USA | WhatsApp number, message content | When you choose WhatsApp for your report | Sending the report and replies; WhatsApp's policy applies |
| Kakao Corp. (KakaoTalk) | Republic of Korea | KakaoTalk ID, message content | When you choose KakaoTalk for your report | Sending the report and replies; Kakao's policy applies |
If you prefer, you can pay by bank transfer instead of PayPal. Without storing your request and emailing you, we can't send your report.
7. Your rights
You can ask to access, correct or delete your data, restrict or object to processing, receive a portable copy, or withdraw consent at any time. Email the contact below; we respond within 10 days (and never later than one month). You can also act through a representative.
8. Security
Two-factor authentication on admin accounts, least-privilege access, encryption in transit (HTTPS), database row-level security (the website can only save requests, never read them), and regular deletion of data we no longer need.
9. Cookies
This site uses no cookies, analytics or ad trackers, and serves its own fonts. The website examples under /work/web/ load example photos and fonts from third parties (Pexels, Naver).
10. Automated decisions
We do not make automated decisions about you.
11. Data protection contact
Uihyun Moon, owner · moonshowstar@gmail.com
As a small business, the owner acts as privacy officer under PIPA Art. 31(2).
12. Complaints (Korea)
Personal Information Dispute Mediation Committee +82-1833-6972 (www.kopico.go.kr), Personal Information Infringement Report Center 118 (privacy.kisa.or.kr).
13. Additional information for the EEA
Controller: Uihyun Moon, trading as HB Crossborder (허니뱃저), sole proprietorship, Republic of Korea, business registration no. 249-71-00696, moonshowstar@gmail.com.
Legal basis: steps prior to a contract at your request (GDPR Art. 6(1)(b)) where you are the prospective contracting party; otherwise our legitimate interest in answering business enquiries (Art. 6(1)(f)). Updates only with your consent (Art. 6(1)(a)).
Recipients and transfers: the processors in section 6. Google LLC is certified under the EU-U.S. Data Privacy Framework (Decision (EU) 2023/1795). We are located in the Republic of Korea, which benefits from an EU adequacy decision (Decision (EU) 2022/254).
You have the right to access, rectification, erasure, restriction, objection and data portability, to withdraw consent, and to complain to your supervisory authority. Giving us your contact details is voluntary, but we can't reply without them. No automated decision-making.
EU representative (GDPR Art. 27): we will appoint one before we begin serving EU clients on a regular basis. Until then, please contact us directly at the email above.
14. Additional information for mainland China
For users in mainland China we process personal information only after consent and a separate consent to cross-border provision, as required by the PIPL. The overseas recipient is HB Crossborder (Republic of Korea). Requests are stored with Supabase (Seoul region), confirmation emails are sent through NAVER Mail (Korea), new requests reach the founder via Telegram, and emails are kept with Google LLC (USA). You can request access, copies, correction or deletion, or withdraw consent, at the email above; withdrawal does not affect processing before it.
15. Children
This is a business-only service. We do not collect data from children under 14.
16. Changes
This policy applies from 2026-10-01. We announce changes on this page at least 7 days before they take effect.