Privacy Policy

Effective Date: April 1, 2026

Saturday Block (hereinafter “Company”) establishes and discloses this Privacy Policy in accordance with Article 30 of the Personal Information Protection Act of the Republic of Korea to protect the personal information of data subjects and to handle related complaints promptly and effectively.

Article 1 (Personal Information Collected and Methods of Collection)

① The Company collects only the minimum personal information necessary for each purpose, such as service provision, order/payment processing, delivery and delivery-related contact, and identity verification, and does not use it beyond the scope of those purposes. The Company collects the following personal information:

1. Upon Account Registration

• Required: Email address, password
• Optional: Name, phone number

2. Upon Placing an Order (Members and Non-Members)

• Required: Orderer's name, phone number, email
• For delivery orders: Recipient's name, phone number, shipping address (including postal code)
• Shipping address is not collected for pickup orders.

3. Upon Meetup Reservation

• Required: Name, email, phone number

4. Upon Lightning Authentication (LNURL-auth) Login

• Lightning Public Key

5. Information Automatically Collected During Service Use

• IP address, browser type (User-Agent), access time
• Page visit and event data through an analytics tool (PostHog)

② Methods of Collection: Through website registration, order forms, meetup reservations, and automatic collection devices (cookies).

Article 2 (Use of Cookies)

1. The Company uses cookies for user convenience.
2. Cookies are used to maintain login status, store language preferences, and save shopping cart information.
3. Users may refuse to store cookies through browser settings. In such cases, some services may be restricted.

Article 3 (Purpose of Processing Personal Information)

The Company processes personal information for the following purposes only:

1. Member management: Registration, identity verification, prevention of fraudulent use
2. Order processing and delivery: Order fulfillment, delivery information transfer, payment confirmation
3. Meetup operations: Reservation confirmation, attendance management
4. Customer support: Handling inquiries and complaints, delivering notices
5. Service improvement: Usage statistics analysis (de-identified processing)
6. Partner Brand transactions: Transferring order and reservation information to Partner Brands for fulfillment

Article 4 (Retention and Use Period of Personal Information)

① The Company destroys personal information without delay once the purpose of collection and use has been fulfilled.

② However, the following information is retained in accordance with applicable laws:

1. Records of contracts or withdrawal of offers: 5 years
2. Records of payment and supply of goods: 5 years
3. Records of consumer complaints or dispute resolution: 3 years
4. Access log records: 3 months

③ Upon membership withdrawal, personal information is destroyed immediately. Information subject to the above legal retention obligations is stored separately for the required period and then destroyed.

Article 5 (Provision of Personal Information to Third Parties)

The Company does not provide personal information to third parties as a general rule. Exceptions are made in the following cases:

1. When the data subject has given prior consent
2. When required by law or when requested by investigative agencies in accordance with legally prescribed procedures

The Company provides the following personal information to Partner Brands (actual sellers) for the purpose of order fulfillment and meetup operations:

The Company supervises Partner Brands to ensure they handle personal information in compliance with applicable laws. If a Partner Brand violates its data protection obligations, the Company may terminate the partnership agreement and restrict the Brand's access to the platform.

Article 6 (Entrustment of Personal Information Processing)

The Company entrusts personal information processing to the following entities for service provision:

Article 7 (Overseas Transfer of Personal Information)

The Company transfers personal information overseas for service provision as follows:

1. Recipients: Vercel Inc., PostHog, Sentry, Supabase Inc., payment processors (Blink, Zaprite, etc.)
2. Countries of transfer: United States, Singapore, and the respective countries where each provider is located (Supabase data is hosted in Seoul, South Korea)
3. Items transferred: Respective information as described in Articles 6 and 8
4. Purpose of transfer: Respective tasks as described in Articles 6 and 8
5. Timing/method: Transferred as needed via encrypted communication (HTTPS/API) upon service use, payment, or error events
6. Retention period: Until each processing purpose is fulfilled or the outsourcing/integration relationship ends

Users may refuse consent to the above overseas transfers. However, service use may be restricted in such cases.

Article 8 (External Payment Services and Provision of Information)

The Company may integrate with the following external payment services for Bitcoin/Lightning payment processing and payment-status verification. The information provided varies by payment method and integration, and the Company provides only the minimum information necessary for payment processing.

• BTCPay Server: payment amount, currency, order reference, transaction identifiers, and Bitcoin/Lightning technical payment and status information
• Blink (Galoy): payment amount, currency, order reference, transaction identifiers, and Lightning payment/status information
• Zaprite: order number, payment amount, currency, order/payment identifiers, and customer name and email address may be transmitted for payment processing.

Accordingly, the Company does not state categorically that no personal information is transmitted to any payment service; the actual items transferred vary by service. Information independently collected and processed by the operators of the above services is subject to their respective privacy policies, and the Company assumes no responsibility for such information.

Article 8-2 (Minimization and Masked Transmission for Administrative Alerts)

The Company may use external messaging services (e.g., Telegram, Discord) for administrative operational alerts regarding orders, payments, and operational status. In such cases, the Company applies the data-minimization principle as follows.

1. Only the minimum information necessary for operations is transmitted to external messaging services.
2. Full email addresses, full phone numbers, and detailed shipping addresses are not transmitted; email and phone data are transmitted only in masked form.
3. Detailed personal information is accessible only within the Company's authenticated administrative system.
4. Where transmitted data may still permit identification of an individual, the Company discloses such processing under the outsourcing and overseas-transfer sections of this Policy.

Article 9 (Procedures and Methods for Destroying Personal Information)

1. Destruction procedure: Personal information is destroyed without delay when the retention period expires or the processing purpose is fulfilled.
2. Destruction methods: Electronic files are permanently deleted using methods that prevent recovery. Paper documents are shredded or incinerated.

Article 10 (Measures to Ensure Security of Personal Information)

The Company takes the following security measures in accordance with Article 29 of the Personal Information Protection Act:

1. Administrative measures: Minimizing personnel with access to personal information, conducting regular training
2. Technical measures: Encrypted storage of passwords, encrypted transmission and storage of sensitive information, HTTPS (TLS) implementation, administrator two-factor authentication (2FA), CSRF protection, access permission management and activity log recording
3. Physical measures: Data center physical security through cloud infrastructure (provided by Vercel and Supabase)

However, the Company shall not be liable for issues arising from the user's own negligence (password disclosure, device loss, failure to log out on shared devices, etc.) or inherent risks of the internet, unless the Company is found to have acted with intent or gross negligence.

Article 11 (Rights and Obligations of Data Subjects and Methods of Exercise)

① Data subjects may exercise the following rights at any time:

1. Request to access personal information
2. Request for correction of errors
3. Request for deletion
4. Request for suspension of processing

② Method of exercise: Request via contact@saturdayblock.com or directly through the My Page section of the website

③ Processing deadline: Within 10 days of the request

④ Information that is required to be retained by law (Article 4, Paragraph ②) may be excluded from deletion or suspension of processing. In such cases, the data subject will be notified of the reasons.

⑤ Data subjects are responsible for maintaining their personal information in an up-to-date state. The Company shall not be liable for issues arising from the provision of inaccurate information.

Article 12 (Personal Information of Children Under 14)

The Company prohibits the use of its services by children under the age of 14 and does not implement separate identity verification procedures for this purpose. Users are responsible for confirming that they are 14 years of age or older when using the service. If a user is found to be under 14, their account and information will be destroyed without delay.

Article 13 (Personal Information Protection Officer)

Name

Gidong Kim

Title

CEO

Contact

contact@saturdayblock.com, +82 10-7787-7268

Inquiries regarding personal information, complaints, and damage relief may be directed to the above Personal Information Protection Officer.

Article 14 (Changes to the Privacy Policy)

1. This Privacy Policy is effective from the effective date stated above.
2. It may be amended to reflect changes in laws, policies, or services. Changes will be announced through the website at least 7 days prior to the effective date.
3. Previous versions of the Privacy Policy may be viewed on the website.

Article 15 (Disclaimer)

1. The Company shall not be liable for issues arising from information provided by the user that is inaccurate or not up to date.
2. The Company shall not be liable for damages arising from the user's disclosure of passwords or other personal information to third parties.
3. Unless the Company is found to have acted with intent or gross negligence, the Company's liability for personal information breaches caused by external intrusions such as hacking shall be limited to the extent prescribed by applicable laws.

Article 16 (Remedies for Infringement of Rights)

Data subjects may contact the following organizations for relief from personal information infringement:

• Personal Information Dispute Mediation Committee: 1833-6972 (www.kopico.go.kr)
• Personal Information Infringement Report Center: 118 (privacy.kisa.or.kr)
• Supreme Prosecutors' Office Cyber Investigation Division: 1301 (www.spo.go.kr)
• National Police Agency Cyber Bureau: 182 (ecrm.cyber.go.kr)