Privacy Policy

• Effective: 2026-10-20 (previous version: 2026-08-13 to 2026-10-19 — changes: added website inquiry handling, processors and overseas transfers, and retention of close-up print-check photos and capture details)
• Operator: Green Planet Pack Co., Ltd. (초록별팩 주식회사)
• Representative: Hyeonho Kim
• Business address: 75, Malgeunnae-gil, Uiwang-si, Gyeonggi-do, Republic of Korea
• Business registration number: 182-88-00936
• Data Protection Officer: Hyeonho Kim / cs@palettecorp.kr

We collect only what we need. Consumers can verify authenticity without creating an account or signing in; in that mode, we do not collect information that directly identifies you, such as your name or contact details. However, to prevent misuse and detect counterfeits, we store a hash of the visitor-identification cookie issued by our server together with scan records (the cookie value itself is not stored).

1-1. Guest users (no sign-in)

• Device OS / model / app version — compatibility and diagnostics (automatic)
• Service logs (scan request/response timing) — service operation (automatic)
• Location coordinates and accuracy — optional; collected only if you allow location access
• Hash of the visitor-identification cookie — fraud prevention and counterfeit detection (automatic; the cookie value itself is not stored)
• Live camera view for QR reading — not stored, decoded in memory only
• Close-up print-check photos (a close-up of the label’s deep security pattern) and capture details (device model, OS, app version, camera settings) — collected only when you run the detailed print check; GPS location data is removed from the photo before it is kept

Location is optional, and you can verify authenticity without it. Coordinates are not combined with information that directly identifies you, such as your name or contact details. They are stored together with a hash of the visitor-identification cookie issued by our server; the cookie value itself is not stored.

1-2. Signed-in users (distributors and store staff)

• Email, password (one-way hashed), store/affiliation — account identity
• Issuance, sale, store-location records — operator features
• Push notification token — only if notifications are enabled (optional)

1-3. Website inquiries (the inquiry form at https://genu.id)

• Required: name, company or affiliation, email address, inquiry content
• Optional: phone number, area of interest, attachments
• Referral information (search terms, ad media, etc. — see 6. Cookies and Similar Technologies)

Inquiries are received and handled in our work management system (GreenWork).

1-4. What we do not collect

We do not collect address-book contacts, photos/videos stored on your device (gallery), payment information, advertising identifiers (IDFA / GAID), or third-party advertising-tracking identifiers.

• Providing authenticity verification (QR validation, result delivery)
• Detecting and warning about suspected tampering/counterfeiting
• Detailed print check (reading the deep security pattern) and improving its accuracy — print-check photos and capture details
• Service operation, incident response, and performance improvement
• For signed-in users: account authentication and operator features (issuance, sale, store-location records)
• Optional: location data, used for (1) more accurate counterfeit detection (detecting suspected tampering or counterfeiting), (2) distribution analysis (regional authentication status and distribution routes for each brand), and (3) for signed-in users of the distributor app, recording the distribution route when scanning shipments, sales, and similar steps
• Optional: sending alerts about suspicious results
• Website inquiries: reviewing the inquiry, classifying its type and assigning the responsible staff, consulting and replying (including sending reply emails), providing quotations and proposals

We do not use collected information for any purpose beyond those above.

We do not sell, share, or otherwise transfer your personal information to third parties. The following processors are engaged solely to operate the service:

• Cloud infrastructure provider (e.g., AWS) — server and database hosting, domestic region preferred
• Apple Push / Google FCM — notification routing, only if notifications are enabled
• Amazon Web Services, Inc. — sending reply emails to website inquiries (Amazon SES) and storing inquiry attachments (Seoul region)
• Microsoft Corporation — delivering website inquiry notifications (Microsoft Teams)
• TypeSafe AI, Inc. — classifying the type of website inquiries
• Anthropic PBC — assisting in drafting reply emails to website inquiries (staff review and edit before sending)
• Google LLC — website usage analytics (Google Analytics · Google Tag Manager)

We may disclose information to law enforcement when required by a lawful legal request.

Pursuant to Article 28-8(1)3 of the Personal Information Protection Act of Korea, we entrust the processing and storage of personal information overseas as follows and disclose it through this policy.

TypeSafe AI, Inc.

• Country: United States
• Date and method: Transmitted over the network (API call) right after an inquiry is received
• Items: Inquiry content (the name, company, email and phone fields are not sent, and email addresses, phone numbers and links in the message are masked before sending)
• Purpose: Classifying the inquiry type
• Retention: As set out in the processor’s privacy policy (not used to train AI models)
• Contact: https://www.typesafe.ai/privacy-policy

Anthropic PBC

• Country: United States
• Date and method: Transmitted over the network (API call) when staff prepare a reply draft
• Items: Name, company or affiliation, inquiry content
• Purpose: Assisting in drafting reply emails (staff review and edit before sending)
• Retention: As set out in the processor’s data retention policy (not used to train AI models)
• Contact: https://www.anthropic.com/legal/privacy

Microsoft Corporation

• Country: United States and other countries where Microsoft operates data centres
• Date and method: Transmitted over the network when an inquiry is submitted
• Items: Name, company or affiliation, email address, phone number, area of interest, inquiry content
• Purpose: Delivering inquiry notifications to the responsible staff (Microsoft Teams)
• Retention: 3 years from the date the inquiry is received
• Contact: https://privacy.microsoft.com

Google LLC

• Country: United States
• Date and method: Transmitted over the network when the website is accessed
• Items: Cookies, access IP address, browser and device information, visit and usage records
• Purpose: Website usage analytics (Google Analytics · Google Tag Manager)
• Retention: The period set in Google Analytics data retention settings (up to 14 months)
• Contact: https://policies.google.com/privacy

You may refuse the overseas transfer of your personal information by contacting us (see 10. Contact). However, inquiry handling depends on the transfers above, so refusing may prevent use of the inquiry form; in that case you may contact us directly by email.

• Guest scan logs: up to 12 months from collection, then automatic deletion
• Print-check photos and capture details: up to 12 months from collection, then automatic deletion
• Signed-in account information: deleted on account closure (except items required by law)
• Issuance / sale / store records: the period required by applicable law (commerce, tax)
• Location coordinates (when allowed): same as scan logs (up to 12 months)
• Push tokens: discarded on notification opt-out or app uninstall
• Website inquiry records (content, contact details, attachments): 3 years from the date the inquiry is received

Electronic data is deleted using non-recoverable methods; printed materials are shredded or incinerated.

You may at any time:

• Request access to your personal information
• Request correction or deletion
• Request restriction of processing
• Withdraw consent (location and notification permissions can be revoked from your OS settings)

How to request: email cs@palettecorp.kr. After identity verification, we will respond within 10 business days. We hold no information that directly identifies guest users, such as a name or contact details. Their scan records and location coordinates are deleted automatically once the retention period in Section 4 ends, and we will delete them earlier on request.

The website (https://genu.id) uses:

• Essential cookies — required to deliver the service, such as maintaining a login session.
• Visit analytics — Google Tag Manager and Google Analytics 4 aggregate visit and usage records, used for statistics only and not to identify individuals.
• Referral source — to see how an inquiry reached us, referral details (search terms, ad source) are stored in browser localStorage (genuid_attr). You can clear it at any time from your browser settings.
• Visitor-identification cookie — a signed cookie issued by our server (HttpOnly, Secure, valid for 90 days). It tells repeat scans from the same device apart, which helps prevent misuse and detect counterfeits. The cookie holds only its issue time and a random value, with no personal information, and our server stores only a hash of it.
• Consent record — whether and when you agreed to the pre-scan notice is stored in browser localStorage (genu-id-consent-v1). You can clear it at any time from your browser settings.

The mobile app stores authentication material in the device's secure store (iOS Keychain / Android Keystore).

• Encrypted transport (TLS / HTTPS)
• One-way hashing of passwords
• Mobile credentials stored in the device secure store
• Least-privilege access control and operations log review
• Periodic vulnerability assessments

• Privacy / general inquiries / technical support: cs@palettecorp.kr
• Mail: 75, Malgeunnae-gil, Uiwang-si, Gyeonggi-do, Republic of Korea — Green Planet Pack Co., Ltd.

Regulatory remedies (Republic of Korea)

• Personal Information Dispute Mediation Committee — 1833-6972, www.kopico.go.kr
• Korea Internet & Security Agency Privacy Center — 118, privacy.kisa.or.kr
• Supreme Prosecutors' Office Cyber Investigation — 1301
• National Police Agency Cyber Bureau — 182