Privacy Policy

We collect information you provide directly to us when you use our Contact form, apply for a buyer account, or sign in.

• Identification and contact details such as name, business email address, and company name.
• Inquiries and messages you submit through the Contact form or partnership channels.
• Buyer-application details such as company information, market territory, and intended use of products.
• Authentication identifiers from Google OAuth (your verified email and profile name) or magic-link email sign-in.

We also collect limited technical information automatically. Our Contact form stores a salted hash of the requester's IP address solely to enforce per-IP rate limits; we do not retain the raw IP address.

We use the information we collect to operate the platform, respond to inquiries, and meet legal obligations.

1. Respond to Contact form, partnership, and press inquiries you send to us.
2. Review buyer-account applications and communicate decisions to applicants.
3. Authenticate buyer-account holders and operate signed-in features.
4. Detect, prevent, and respond to abuse, fraud, and security incidents.
5. Comply with legal and regulatory obligations applicable to Cosmedi Global.

Where the General Data Protection Regulation (GDPR) applies, our lawful bases for processing include the performance of a contract with you, our legitimate interests in operating a B2B sourcing platform, your consent where required, and compliance with legal obligations.

Where the Republic of Korea Personal Information Protection Act (PIPA) applies, processing is carried out under the lawful bases recognized by PIPA, including performance of contract, consent, and legitimate business necessity.

We do not sell personal information. We share information with service providers acting on our behalf and only to the extent necessary for them to provide their services to us.

• Email delivery: Resend, for transactional and inquiry-related messages.
• Database hosting: Neon Postgres, for storage of application and inquiry records.
• Application hosting: Vercel, for compute and edge delivery of the platform.
• Authentication: Google, where buyers choose to sign in via Google OAuth.

We may disclose information when required by law, court order, or regulatory request, or to protect the rights, property, or safety of Cosmedi Global, our buyers, or others.

Cosmedi Global is established in the Republic of Korea, and our service providers operate infrastructure in jurisdictions outside Korea, including the European Economic Area and the United States. Where information is transferred internationally, we rely on appropriate transfer mechanisms recognized under applicable law, including standard contractual clauses and provider-level data processing agreements.

We retain personal information only for as long as necessary to fulfill the purposes described in this Policy, comply with our legal obligations, resolve disputes, and enforce agreements.

Specific retention periods will be confirmed and disclosed following completion of legal counsel review. Inquiry records may be retained while an active business relationship exists and for a reasonable period thereafter.

Subject to applicable law, you may have rights to access, correct, delete, restrict, or object to processing of your personal information, and to data portability.

To exercise any of these rights, contact us at privacy@cosmediglobal.com. We may need to verify your identity before responding. You also have the right to lodge a complaint with your local supervisory authority.

We maintain technical and organizational measures designed to protect personal information against accidental or unlawful destruction, loss, alteration, unauthorized disclosure, or access. Access to production systems is restricted to authorized personnel, and database tables enforce row-level security so that unauthenticated callers cannot read inquiry records.

Cosmedi Global is a business-to-business platform and is not directed to children. We do not knowingly collect personal information from children. If you believe a child has provided information to us, please contact us so we can take appropriate action.