This document is a draft pending legal review. Its contents may change; changes are announced in advance under Article 13.
Article 1. Information we process
[Booking] Name, email, phone number (with country code), gender (of the person booking), the salon, treatment and party size, preferred dates and time windows, requests (optional), and a record of the consents you gave (including the time and the browser you used).
We send notices by email. Your phone number is used when we need to reach you on the day of the treatment. Gender is used to prepare the treatment (some salons price services differently by gender).
[Enquiry] Email, the message you send, booking code (optional).
[Collected automatically] Your IP address (converted to a form that cannot be reversed), your language, and referral information (source and click identifiers).
[Account — optional] Your email address, name and language.
You do not have to create an account. You can book without one and reopen the booking with its code and your email. If you do create an account (by entering a code we email you), you can see all your bookings in one place. There is no password for you to set.
Article 2. Why we use it
· Taking bookings, arranging the schedule with the salon (including booking on your behalf through Naver Booking), and telling you when it is confirmed, changed or cancelled
· Contacting you on the day of the treatment and preparing the treatment
· Letting you reopen your own booking with its code and your email
· Answering enquiries
· Preventing abuse and enforcing usage limits
· Statistical analysis to improve the service, in a form that does not identify anyone
· (If you opt in) sending event and offer emails
Article 3. Transfer abroad
To send you notification emails we transfer information outside Korea:
· Recipient: Resend (Plus Five Five, Inc.)
· Country: United States
· Items: name, email, phone number, gender, and the booking details (code, salon, date and time, service, party size)
· Purpose: sending the received / confirmed / cancelled emails
· When and how: transmitted over HTTPS at the moment the email is sent
· Retention: as long as needed to deliver the message
· Resend's privacy policy: https://resend.com/legal/privacy-policy
Nothing else is transferred abroad. We do not collect photographs of any kind, including face photos.
Article 4. How long we keep it
· Booking information: one year from the booking date, after which identifying items are destroyed. A nightly job does this automatically; it does not wait for a request. The booking record itself (date, status, amount) remains as a basis for statistics and for handling disputes.
· Access logs (the converted IP address): three months, then destroyed automatically.
· Enquiries: one year after the enquiry is closed.
· Salon application documents already received (business registration certificate): one year from the review decision, after which the file is deleted automatically. We no longer take salon applications.
· Audit records kept to detect tampering: not deleted. These records are technically protected against modification and deletion, and they do not contain directly identifying items such as your name or email.
· Account details (email, name and language): until you ask us to delete them. We destroy them without delay on request (Article 7).
· Anything else is destroyed without delay once its retention period ends or its purpose is fulfilled.
Because we neither receive nor settle the price of the treatment, we keep nothing for settlement purposes, and we are not subject to the record-keeping duties that the E-Commerce Act imposes on payment and supply records.
Article 5. Processors
We use the following providers to operate the service.
· Supabase Inc. — database and file storage / Republic of Korea (Seoul) region
· Vercel Inc. — application hosting / Republic of Korea (Seoul) region
· Resend (Plus Five Five, Inc.) — sending notification emails / United States (the same transfer described in Article 3)
Our contracts require them to handle personal data securely. If a provider changes, this document is updated.
Article 6. Sharing with third parties
Once your booking is confirmed we share your name, gender, contact details, appointment time and requested service with the partner salon performing it. We always tell you which salon before anything is shared.
Otherwise we do not share your information without your consent, and we never sell it. Disclosure may occur only where lawfully required by an investigative authority.
Once information reaches the salon, the salon becomes a controller in its own right, and later use, storage and destruction are the salon’s responsibility.
Before confirmation neither name nor contact is provided. The screen the salon answers on shows only the requested time, treatment, party size and price.
Because we do not receive payment for treatments, we process no payment or card information at all.
Article 7. Your rights
You may at any time ask to access, correct, delete, or restrict the processing of your personal data.
· Write to mook@wadidu.com. We act without delay and tell you the outcome.
· If you have an account, you can delete it yourself under “My page → Delete account”.
· To confirm it is you, we may ask for your booking code and the email you gave when you booked.
A deletion request does not cancel an appointment already booked with a salon — that is a commitment made to them. Identifying items such as your name, contact details and requests are destroyed. If you need the booking cancelled, please tell us first.
Article 8. How we destroy data
Once a retention period ends or the purpose is fulfilled, we destroy the data without delay.
· Electronic files: deleted in a way that cannot be recovered. For attachments such as a business registration certificate, the file itself is deleted from storage first, then the record that pointed to it.
· Free-text fields — name, contact details, requests — are emptied rather than masked, because we cannot judge what you may have written where. Any machine translation of a request, and the note passed on to the salon, are emptied with it.
Article 9. Security measures
· Least-privilege access and access control (the database denies by default; access only through our servers)
· Encryption in transit (HTTPS)
· A separate identity check on the link that opens a booking and on lookup by booking code
· Access logging and tamper protection
· Usage limits to block automated abuse
There is no password for you to set. Signing in uses only a code we email you, valid for five minutes, so there is no password that can leak.
Article 10. Children under 14
MAKEDOL does not collect personal data from children under 14 without the consent of a legal guardian. We confirm at booking that you are 14 or older; if you are under 14, a separate guardian consent process is required.
Article 11. Data protection officer
· Officer: CHOI Inmook
· Position: Representative, WADIDU
· Contact: mook@wadidu.com
Please send any questions, complaints or remedy requests about our handling of personal data to the address above; we respond without delay.
· Operator: WADIDU (sole proprietorship) · Representative: Choi Inmook · Business registration no. 274-13-02856
· Address: 699 Gimpo-daero, 11F #1108, Gimpo-si, Gyeonggi-do, Republic of Korea
Article 12. Remedies
You may seek dispute resolution or advice from the following bodies.
· Personal Information Dispute Mediation Committee — +82-1833-6972 / www.kopico.go.kr
· Privacy Infringement Report Centre — +82-118 / privacy.kisa.or.kr
· Supreme Prosecutors' Office, Cybercrime Division — +82-1301 / www.spo.go.kr
· National Police Agency, Cyber Bureau — +82-182 / ecrm.police.go.kr
Article 13. Changes to this policy
We announce any change at least 7 days before it takes effect. Changes that materially affect your rights are announced 30 days in advance.
MAKEDOL is currently a pilot service. What you write when booking is read by the designer handling your appointment on the day.