EXLAB · PRIVACY
Privacy Policy
EXLAB Corp. explains how personal information is handled on this website and in EXOS, including its purposes, retention periods and your rights. Effective 25 October 2026 · Version 1.0
1. Purposes and scope
EXLAB Corp. is the personal information controller. We process information needed to review and answer inquiries, prepare and notify you of quotations, manage contracts and projects, share files, authenticate members and provide support. Inquiry forms request consent; information required to perform a contract or meet a legal obligation is processed on the applicable basis.
A quick amount preview without contact details does not submit an inquiry. The calculation does not send a contact name, email or phone number. Any marketing use of inquiry information requires a separate applicable permission.
2. Information and collection methods
Required inquiry information includes company, contact name, email, phone and the project conditions required for the selected request, such as event, venue, dates and scale. Optional information includes role, budget, brief, references and attachments. Each field identifies whether it is required. Do not include national identification numbers, sensitive information or unnecessary third-party personal data in files.
EXOS member features process email and authentication information, company and contact details, linked inquiry, quotation, contract and project records, and signature or approval history. Access time, IP address, browser or device information, errors and usage logs may be processed to deliver and secure the service. Information is collected through website forms, attachments, member features and your email or phone inquiries.
3. Retention: one year for guest originals; two years for linked records
Original guest submissions: contact details, inquiry contents and attachments are retained for one year after the inquiry is marked closed, then automatically deleted. The period does not start on submission. An active inquiry's retention period begins when it is closed.
Member-linked consultation, quotation, contract and project records and attachments are automatically deleted after two years from the later of consultation closure and completion of the related transaction. Active projects and records placed on hold for legal retention or dispute handling are excluded. This process is separate from the one-year deletion of original guest submissions. Member accounts support the membership service; on withdrawal or deletion requests, we explain the treatment of the account and linked records.
Where law requires retention of contract, accounting or tax evidence, only the necessary information is retained separately for the statutory period. If legal retention or a dispute limits deletion, we explain the reason and scope. Information no longer needed is destroyed without undue delay when the applicable period ends.
4. Destruction and safeguards
An automated process removes expired guest attachments and submission records. Member and transaction records are checked hourly: linked storage files are deleted first, followed by consultation, quotation, contract and related records. If file deletion fails, records are retained for a retry. This applies to originals stored in EXOS and does not mean immediate deletion of previously received or downloaded copies or provider backups. Authorized staff shred paper documents where present.
HTTPS protects transmission. Inquiry attachments are held in private storage with access checks, and information is handled by staff with the permissions required for their work. Provider documentation below explains technical retention and deletion procedures for backups and security logs.
5. Service providers and third-party disclosure
Supabase (Supabase Pte. Ltd. and operational support affiliates): inquiry processing, member authentication, database and private attachment storage, and service operations. The production project's primary database, authentication and file-storage region is Seoul, Republic of Korea (ap-northeast-2).
Framer B.V.: website hosting, content delivery, operation and site statistics. Resend (Plus Five Five, Inc.): transactional emails about inquiries, quotations and contracts. Email processing includes sender and recipient addresses, message contents and links, and delivery status.
We do not sell personal information. If disclosure to another third party is needed beyond these service arrangements, we provide the recipient, purpose, data categories and retention period and obtain the required consent unless another legal basis applies. Processing outside the entrusted purpose is restricted, and protection, return and deletion arrangements are managed.
6. Overseas processing and transfers
Primary storage in Seoul does not mean all processing stays in Korea. Supabase support and operations may involve Singapore or the United States; operational logs and delivery may involve locations in its published subprocessor list. Encrypted communications are used as needed for service, support and security, limited to the information required for that task and service logs or metadata. Recipient contact: privacy@supabase.io.
Resend processes transactional email in the United States. Sender and recipient addresses, message contents, links and delivery records are transmitted over encrypted communications when an email is sent, to deliver the requested inquiry, quotation or contract notification. Email and log data is retained for 30 days on standard plans. Recipient: Plus Five Five, Inc. (Resend), privacy@resend.com.
Framer hosting and operation may involve provider locations including the Netherlands and the United States. On site access, IP addresses, access and device information may be processed over web connections for page delivery, security and statistics. Recipient: Framer B.V., legal@framer.com. Its current privacy and processing documentation below describes technical-log retention and subprocessor locations.
Overseas processing or storage needed to provide online inquiry, quotation and contract services is notified and handled under the applicable requirements of Article 28-8 of Korea's Personal Information Protection Act. Transfers requiring separate consent are subject to that consent in advance. Contact ex@exlab.co.kr with questions or objections; related online submission, email or membership features may be limited, and we will discuss available alternatives.
7. Access, correction, deletion and withdrawal
You or an authorized representative may request access, correction, deletion, restriction of processing or withdrawal of consent. Contact ex@exlab.co.kr or +82-2-515-8687, identifying the relevant records and request. We verify identity, take the required action and explain any legal limits. Do not send national identification numbers or other unnecessary information.
Without consent to the required inquiry information, online submission is unavailable. You can still view the public website and use the quick amount preview without contact details. A withdrawal or deletion request may not immediately remove records lawfully processed earlier or subject to statutory retention.
8. Cookies, browser storage and external links
Cookies or browser storage may support language settings, sign-in and other functions. Inquiry drafts keep project conditions in the same browser, up to 20 drafts for 30 days; contact details, the brief and attachments are not automatically saved. Drafts may not appear on another browser or device. You can remove or restrict cookies and site data in browser settings, which may limit some functions.
External destinations such as Naver, YouTube, Instagram and LinkedIn apply their own privacy policies. Clicking an external link does not itself disclose inquiry records held by EXLAB to that service.
9. Privacy requests and complaints
Contact: EXLAB Corp., Representative SHIN Yong Yun. Email ex@exlab.co.kr · Tel. +82-2-515-8687 · 3F, Building 405, 3 Seolleung-ro 134-gil, Gangnam-gu, Seoul, Republic of Korea. Use these details for access, correction, deletion and privacy complaints.
10. Changes and effective date
This policy takes effect on 25 October 2026. Material changes to purposes, information, retention periods or providers will be reflected in this page's date and version, with additional notice or consent where required.
Service provider documentation
EXLAB Corp. · Representative: SHIN Yong Yun · Business Registration No. 532-86-02848
3F, Building 405, 3 Seolleung-ro 134-gil (Cheongdam-dong), Gangnam-gu, Seoul, Republic of Korea
© 2026 EXLAB. All rights reserved.
Email: ex@exlab.co.kr
