TinyRolly Privacy Policy

The Company processes only information necessary for these purposes. If a purpose changes, the Company obtains separate consent or updates this Policy as required by PIPA.

• Registration, login, account security, consent records, and abuse prevention
• Orders, payment, delivery, cancellation, exchange, returns, refunds, and transaction evidence
• Membership tiers, coupons, points, review rewards, child-birthday benefits, and referrals
• Product Q&A, customer support, disputes, complaints, and necessary notifications
• Service security, access records, incident response, and legal duties
• Email or SMS marketing and analytics only after separate consent

• The Company does not directly store card numbers, CVCs, easy-payment passwords, or Korean resident registration numbers.
• The Company does not collect a child’s name, birth year, full date of birth, or resident registration number.
• Phone identity verification is not currently implemented. Birthday and referral benefits operate without it using account-level safeguards. Data and recipient relationships will be disclosed before any future introduction.

The Company destroys information when its purpose is achieved or the account is closed. Records required by law are separated from active account data and retained only for their statutory purpose.

A lawful preservation order may delay destruction for its duration. Information is destroyed promptly when the reason ends.

The Company uses personal information only within the disclosed purposes and provides it to a third party only with consent or another basis under Articles 17 and 18 of PIPA.

Where payment or delivery requires provision, the actual recipient, purpose, items, retention, and applicable consent are presented at checkout or in a separate notice.

The Company buys monthly best-review gifts itself and manually sends them to the phone registered to the winning account. It does not give the gift retailer customer information.

The Company uses the following service providers only to the extent needed to provide the relevant feature and transfers only the minimum information required when a user uses that feature.

A feature involving overseas processing or transfer may be unavailable if the user does not use it or withdraws an applicable consent. The Company keeps recipient, country, data, purpose, and retention details aligned with its contracts and service settings.

• A daily job removes information whose purpose or retention period has ended and records success, failure, and lawful exceptions.
• Statutory records are separated from active account data and access-restricted.
• Electronic files are deleted so recovery is impracticable; paper is shredded or incinerated.
• Backups expire under their lifecycle and deleted information is removed again if a backup is restored.

• A data subject may request access, correction, deletion, suspension, withdrawal of consent, and account closure.
• Requests may be submitted through available account controls, cscenter@maechorom.com, +82 70-7677-7997, or the postal address below.
• The Company verifies identity only as necessary and handles properly authorized representative requests under Korean law.
• A lawful restriction, extension, or refusal is explained together with an appeal route.
• Where the statutory right to data portability applies, the Company follows the required process and period and will announce formats and history checks when the applicable scope and standards are confirmed.

Registration includes confirmation that the user is at least 14. The Company does not register a child under 14 as an independent member.

A birthday benefit processes only the month and day of one child after an adult member declares legal guardianship and consents. It does not store the child’s name, birth year, or full date of birth. Deletion or withdrawal ends future benefits and triggers destruction.

Essential cookies and browser storage support login, security, consent choices, and carts. Analytics and marketing cookies are not requested, stored, or run before the corresponding optional consent. Choices can be changed through Cookie settings in the footer.

With analytics consent, Google Analytics 4 (GA4), provided by Google LLC, measures visits and page views. It processes browser identifier cookies (tinyrolly_ga and tinyrolly_ga_*), language, device and browser information, page routes with private identifiers removed, and the origin of external referring websites. Network requests are sent to Google servers. Cookies expire within 180 days of creation without renewal on repeat visits. GA4 user and event data retention is set to 14 months, with activity-based retention reset disabled. This period does not apply to aggregate reports.

Only with both analytics and marketing consent do we send permitted UTM campaign tags and Google ad click identifiers (gclid) to GA4 for campaign attribution. Ad personalization and Google Signals are disabled. Names, email addresses, phone numbers, order identifiers, login tokens and search text are excluded from our analytics fields. Withdrawal stops subsequent measurement and deletes this site’s GA4 identifier cookies.

Our own cookieless server statistics operate separately from these choices and count daily visitors and page views. An IP fingerprint and browser information are hashed with a daily random value to estimate visitors. The statistics tables do not store the original IP, browser information or page paths. A cleanup job removes identifying material and visitor tokens for dates more than 90 days old in Korea time, retaining daily totals.

Homepage YouTube videos use Privacy Enhanced Mode (youtube-nocookie.com) and remain visible and playable independently of analytics and marketing cookie choices. Loading the player and thumbnails sends requests to YouTube. Displaying or playing a video does not constitute consent to advertising campaign tracking.

Cookie choices last 180 days in this browser and are reviewed again after expiry or a policy or measurement-tool change. Withdrawal covers both Korean and English choices in this browser. If server recording fails, optional tools remain blocked and the withdrawal request is kept for retry. Withdrawal does not immediately delete historical consent evidence or records subject to retention obligations.

• Administrative: internal management plans, minimum staffing, access review, and training
• Technical: role-based least privilege, administrator MFA and reauthentication, encryption in transit and at rest, password hashing, access and audit logs, upload validation and malware scanning, backup and recovery, and vulnerability management
• Physical: access control for facilities and media containing personal information
• Log minimization: no card number, authentication token, password, or unnecessary raw phone/address data in application logs

The Data Protection Officer and customer-support contact receive and handle access and other privacy requests at cscenter@maechorom.com, +82 70-7677-7997, or Suite 920, 424 Yangcheon-ro, Gangseo-gu, Seoul, Republic of Korea.

These agencies are independent from Company support. A data subject may contact the Company first or separately seek consultation, reporting, or mediation.

• Personal Information Dispute Mediation Committee: 1833-6972, www.kopico.go.kr
• KISA Personal Information Infringement Report Center: 118, privacy.kisa.or.kr
• Supreme Prosecutors’ Office: 1301, www.spo.go.kr
• Korean National Police Agency: 182, ecrm.police.go.kr

Duplicate or abusive referral, review, or birthday benefits may be assessed by predefined rules using account, transaction, and benefit ledgers. This is rules-based processing, not an AI training model.

A user whose benefit is held or rejected may request the reason, an explanation, or human review through support. The Company does not determine a legal or similarly significant effect solely by automated processing.

The representative bears final responsibility for supporting privacy personnel, budget, and internal controls. If the Company becomes aware of loss, theft, leakage, forgery, alteration, damage, or a likely occurrence, it investigates and contains it without delay and gives notices and reports required by Korean law, including available remedies and dispute-mediation routes.

• Effective date: September 16, 2026
• Revision history: first effective version on August 30, 2026
• Revision history: customer service lunch hours corrected to 12:30–13:30 on September 7, 2026
• Revision history: customer service lunch hours changed to 13:00–14:30 on September 16, 2026
• General changes are announced 7 days in advance; materially unfavorable changes are announced 30 days in advance. Separate consent is obtained where required.
• If the English and Korean versions differ in meaning, the Korean version controls.