Privacy Policy

Last Updated: June 27, 2026

This Privacy Policy describes how Dermaskin ("we", "our", "us") collects, uses, stores, and protects your personal information when you use our mobile application and online services.

1. Information We Collect

When you use Dermaskin, we collect the following categories of information:

• Personal Credentials & Contact: Your full name, telephone number, email address, and operating region (UZB or KOR).
• Social & Authentication Identifiers: Google account identifier (sub) from Google Sign-In, Apple account identifier (sub) from Sign in with Apple, and Telegram user ID and username (where linked for order inquiries).
• Shipping & Delivery Addresses: Recipient name, contact phone number, province, city, street address lines, and postal code.
• Media & Payment Documentation: Profile avatar photographs and bank transfer deposit receipts uploaded to confirm order payments.
• AI Image Processing & OCR: Uploaded payment receipts and relevant product imagery are processed using artificial intelligence (OpenAI API) solely for optical character recognition (OCR) to verify bank transfer amounts, sender names, and transaction dates. No biometric templates or facial recognition models are trained or retained.
• Device & Diagnostic Telemetry: Device push tokens (Expo Push Token), client IP addresses, device operating system and model, and crash diagnostics (via Sentry) strictly to maintain security and ensure application stability.
• Application Activity: Order history, shopping cart items, wishlist selections, restock waitlist requests, and in-app notification preferences.

2. How We Use Your Information

We use the collected information for the following business purposes:

• Facilitating secure OAuth authentication via Google and Apple identity services.
• Processing e-commerce transactions, verifying bank transfer deposit slips, packaging shipments, and coordinating domestic and cross-border logistics.
• Automating receipt verification via optical character recognition (OCR) to accelerate order status confirmation.
• Sending critical transactional push notifications (order updates, shipping tracking, payment verification) via Expo Push Services.
• Delivering real-time administrative alerts and inventory notifications to our operations team via the Telegram Bot API.
• Complying with statutory accounting, tax reporting, and consumer protection mandates.

3. Third-Party Service Providers & Subprocessors

We partner with leading cloud infrastructure and API providers to deliver our services securely. Each provider processes personal data strictly according to our instructions under confidentiality obligations:

• Google LLC: Identity authentication (Google Sign-In API) and token verification.
• Apple Inc.: Identity authentication (Sign in with Apple), authorization verification, and server-to-server token revocation upon account deletion.
• Cloudflare, Inc. (Cloudflare R2): Encrypted S3-compatible cloud object storage for profile avatars, product banners, and payment deposit slips.
• OpenAI, LLC: Optical character recognition (OCR) and vision analysis of bank deposit slips to verify payments. Data sent to OpenAI is processed statelessly and not used for model training.
• Telegram FZ-LLC (Telegram Bot API): Real-time operational dispatch of urgent order notifications and internal database backup archives to authorized administrators.
• Expo (650 Industries, Inc.): Remote push notification delivery infrastructure to iOS and Android devices.
• Functional Software, Inc. (Sentry): Error monitoring and crash telemetry to diagnose and resolve software bugs. Authentication tokens and personal details are scrubbed prior to dispatch.

4. Data Retention Policy (Statutory Compliance)

Personal information is retained only as long as your account remains active and as required to deliver our services. When an account is deleted, personal profile data, addresses, and authorization credentials are permanently deleted or anonymized immediately.

However, pursuant to the Act on the Consumer Protection in Electronic Commerce (Article 6) of the Republic of Korea and applicable taxation laws, records related to consumer contracts and commercial transactions must be preserved for statutory periods:

• Records on contracts, orders, or withdrawal of subscription: Retained for 5 years.
• Records on payment settlement and supply of goods: Retained for 5 years.
• Records on consumer complaints or dispute settlement: Retained for 3 years.

These historical records are held in an isolated, pseudonymized state solely for regulatory inspection and legal audits.

5. Your Rights & Account Deletion

You have the right to access, inspect, modify, export, or permanently delete your personal information at any time.

In-App Deletion: You can permanently delete your account and personal data instantly inside the mobile app by navigating to "Profile > Delete Account" and confirming your request.

Alternative Request: You can also submit an account deletion request via email to our Data Protection team at support@dermaskinkorea.kr or visit our dedicated Account Deletion Page.

6. Children's Privacy

Dermaskin services are not intended for individuals under the age of 16. We do not knowingly collect personal information from children. If we become aware that personal data of a user under 16 has been collected, we will promptly remove it from our systems.

7. Contact Us

If you have any questions or concerns regarding this Privacy Policy or your personal data, please reach out to: