Privacy Policy

JMBCORP Ltd. (주식회사 제이엠비코퍼레이션) (“Matchum”, “we”) operates trymatchum.com and decides how and why your personal information is used (we are the “controller” or “personal information controller”). Business details are in the site footer.

This policy applies to the website, consultations, orders, emails and customer service. It is also our Consumer Health Data Privacy Policy (section 4).

*Legal bases under the GDPR and UK GDPR, where they apply. Under the Korean Personal Information Protection Act (PIPA), we collect only what each purpose needs, with your consent or where the law allows (for example, to perform a contract).

Information marked optional can be left out; you can still order. If you don't agree to store your skin profile, the consultation still works for that visit and nothing about your skin is kept. We get information from you, from PayPal (payment status), from Google or Apple (if you sign in with them) and from carriers (delivery status).

• To provide the Service: consultations, routines, orders, delivery, returns, points and customer service.
• To communicate: order and shipping emails, and marketing emails only if you opt in. You can unsubscribe in every marketing email.
• To keep the Service safe: prevent fraud and abuse, and secure accounts.
• To improve the Service: aggregate analytics (only with your cookie consent), with health-related properties removed in your browser before anything is sent.
• To meet legal duties: tax, accounting, consumer protection and responding to lawful requests.

We don't use your skin information for advertising, we don't build advertising profiles, and we don't make decisions about you with legal or similarly significant effects by automated means. Routines are generated by our rules and an AI model; you can always ask a person instead by contacting us.

This section is our Consumer Health Data Privacy Policy under the Washington My Health My Data Act, Nevada SB 370, Connecticut and similar laws, and covers “sensitive information” under PIPA and other laws.

• What: skin type and sensitivity, skin concerns and symptoms, pregnancy or breastfeeding, prescription skin treatments, products you use, check-in results, and anything about your skin you write in a consultation or message.
• Why: only to recommend, explain and adjust your skincare routine and to answer you.
• Consent: we ask before storing it (“Can I remember your skin?”). You can withdraw consent anytime in Your Privacy Choices; we then delete your stored skin profile and consultations.
• Sharing: only with our AI model provider, to run the consultation you started (see section 5). We never sell it, never share it for advertising, and never send it to analytics, email or CRM providers, or to embedding providers.
• Your rights: confirm whether we hold it, get a copy, delete it, withdraw consent, and get a list of the processors it went to (section 8).
• We don't use geofencing around health care locations.

We don't sell personal information and don't “share” it for cross-context behavioral advertising (as those terms are used in California law). We use these service providers (processors), under contracts that limit them to our instructions and require security:

We also disclose information when the law requires (for example, to customs and tax authorities or in response to a valid court order), to protect rights and safety, or to a buyer if our business is sold (with this policy continuing to apply). We don't otherwise provide personal information to third parties without your consent.

We are a Korean company serving customers in the United States, so your information moves between countries. Under PIPA, here is what is transferred abroad. It happens over encrypted connections when you use each feature, and you can refuse by not using that feature (for example, declining analytics cookies or not storing your skin profile); some, like payment and delivery, are needed to complete an order.

For people in the EU or UK, transfers rely on adequacy decisions or standard contractual clauses.

When a period ends or the purpose is met, we delete the data permanently from our database so it can't be restored, and printed records (we keep none by default) would be shredded. Backups are overwritten on a rolling schedule. Where the law requires us to keep records, we keep them separately and use them only for that legal purpose.

Wherever you live, you can:

• Access and get a copy of your information (download it in Your Privacy Choices).
• Correct it, delete it, or close your account.
• Withdraw any consent (skin profile, marketing, analytics) without affecting what was done before.
• Ask us to stop or restrict processing, or object to it.
• Opt out of marketing emails (link in every email) and of analytics cookies (cookie banner, or Global Privacy Control).

US residents (California, Colorado, Connecticut, Virginia, Washington, Nevada, Texas, Oregon and other states): you also have the right to know what we collect and disclose, to correct and delete, to data portability, to opt out of sale, sharing, targeted advertising and profiling (we do none of these), and to limit the use of sensitive information (we use it only to provide the Service). We won't treat you differently for using your rights. You can use an authorized agent; we may ask them for proof. If we decline a request, you can appeal by replying to our answer, and if you remain unhappy you can contact your state attorney general.

EU and UK residents: you also have the right to data portability and to complain to your data protection authority.

Korea: you may request access, correction, deletion or suspension of processing, and withdraw consent (PIPA Articles 35 to 37). We answer within 10 days.

To make a request, use Your Privacy Choices if you have an account, or Contact us and choose “My data or privacy rights”. We verify requests by confirming access to your email address, and we answer within the time the law sets (10 days in Korea, 45 days under most US state laws).

• Necessary: sign-in session, security and your cookie choice. These can't be turned off.
• In your browser only: this visit's consultation, cart and filters (session storage, cleared when you close the tab), and saved or recently viewed products (local storage, product codes only).
• Analytics (optional): PostHog, only after you accept. We turn off autocapture and session recordings, mask page text and strip health-related properties.

We don't use advertising cookies. We honor Global Privacy Control as an opt-out. Change your choice anytime in Your Privacy Choices.

• Encryption in transit (HTTPS) and passwords stored only as strong one-way hashes.
• Access limited to staff who need it, with admin sign-in and an audit log of admin changes.
• Consumer health data kept out of analytics, email, logs and links by design, and checked in our tests.
• Signed, expiring links for order lookups; rate limits against abuse.
• Security reviews before payment, account and consent changes, and staff training on handling personal information.

No system is perfectly secure. If a breach affects you, we'll tell you and the authorities as the law requires.

Matchum is for adults (18+). We don't knowingly collect information from anyone under 18, and never from children under 14 (Korea) or 13 (US) without a parent's consent. If you think a child gave us information, Contact us and we'll delete it.

We post changes here with a new date at least 7 days before they take effect, or at least 30 days before for important changes (such as new purposes or recipients), and we email account holders about important changes. Where the law requires, we ask for your consent again.

Privacy Officer, JMBCORP Ltd. (주식회사 제이엠비코퍼레이션). Contact us (choose “My data or privacy rights”) or email help@trymatchum.com.

If you are in Korea and need help beyond us, you can contact:

• Personal Information Infringement Report Center (KISA): privacy.kisa.or.kr, call 118
• Personal Information Dispute Mediation Committee: kopico.go.kr, call 1833-6972
• Supreme Prosecutors' Office cybercrime: spo.go.kr, call 1301
• Korean National Police Agency cyber bureau: ecrm.police.go.kr, call 182