Privacy Policy

Canopy (sole proprietorship, representative Changmin Oh, Korean business registration no. 655-16-02997, 8-1 Jwadong 2-gil, Jangan-eup, Gijang-gun, Busan, Republic of Korea, the "Company") operates Canopy (canopy.travel) and is responsible for this policy. Data protection officer: Changmin Oh, welcome@canopy.travel.

The details a customer enters when booking are collected by the operator for its contract with that customer, and the Company stores and processes them on the operator's behalf. The Company also processes the same data for its own purposes set out in section 4.

Operators

• Account: email address, password (stored encrypted), country, the name, email and profile picture provided by a social login service, and the optional answer to "How did you hear about Canopy?" given at signup
• Business details: business name, representative, address, contact details, business registration number, date business started, confirmation that the operator is a registered business that runs its own products and when it was given, page address (handle), logo, cover image, introduction, social links
• Product information, photos, videos, portfolio and settings the operator uploads
• When a payment account is connected, the merchant ID and account email provided by the payment provider
• Supporting documents (such as a business registration certificate) the operator emails at the Company’s request
• Messages sent with "Contact us" on the operator screens (not stored in the service; sent only to the Company inbox)

Customers

• Name, email address, phone number, requests and preferred contact method entered when booking
• Booking details: product, date and time, number of people, options, amount, payment status, attendance, booking language
• The transaction ID, amount and payment status the payment provider gives the Company

People who send a report

• The email address and report sent with "Report" on a customer page

Generated automatically (operators and customers)

• Access logs: IP address, browser, device, language, time of access, pages viewed, referrer
• Cookies: a cookie that keeps you logged in

If new features add to what we collect, this section is updated and notice is given under section 12.

What operators and customers enter themselves, social login, the payment provider, and, when an operator imports its own product page from another platform, the product information publicly shown on that page.

To run the Service (performance of a contract or legitimate interest; no separate consent)

1. Creating accounts, logging in, resetting passwords
2. Listing products, automatic translation, automatic processing, importing from other platforms
3. Showing customer pages and booking pages
4. Receiving, confirming and cancelling bookings, recording attendance, passing information between operator and customer
5. Payments, fee settlement, plan charges, refunds, receipts
6. Emails and notifications about bookings and payments (needed to run the Service, so not subject to opt-out)
7. Answering enquiries, checking and replying to reports (the reporter’s email and report are used only for this)
8. Detecting and preventing fraud, fake bookings, money laundering and attacks on the Service, and checking business details before first publication (supporting documents are used only for this check)
9. Incident response, security, log analysis
10. Legal compliance, disputes, tax records
11. Providing features the Company adds in future. If the data collected or the purposes go beyond this policy, notice is given under section 12 and consent is obtained again where needed.

To build a better Service (legitimate interest; no separate consent)

12. Usage statistics and analysis: which products are booked when and how often, which countries and languages customers come from, where people leave the flow
13. Improving features, designing new ones, and providing price and demand references (for example average prices by area, peak seasons)
14. Improving and training automatic translation and automatic processing
15. Market reports, benchmarks and materials for investors and partners

Items 12 to 15 use data processed so that no individual can be identified (de-identified, aggregated data). Such data is not personal data, and the Company may keep, use and publish it without time limit.

Only with consent

16. Sending operators news about the Company's new features, updates and offers (optional checkbox at signup; unsubscribe at the bottom of any email)
17. Sending customers the Company's updates (optional checkbox when booking; unsubscribe at any time)
18. An operator who wants to send marketing to its own customers obtains their consent itself.

The Company does not sell personal data. It is shared only as follows.

1. The other party to the booking: customer details go to the operator that received the booking, and the operator's business details go to the customer.
2. Providers that run the Service (processors): hosting; database, login and file storage; payments; social login, maps and email delivery; automatic translation and processing; weather and map data. Their names and the data passed to them are listed in Appendix 1 below. If a provider changes, the appendix is updated and notice is given inside the Service. The Company binds these providers by contract, and they may not use the data for any other purpose.
3. When the law requires it: lawful requests from courts, investigating authorities and tax authorities.
4. On a transfer or merger of the Company, on condition that this policy continues to apply.

The database and servers are located in the Republic of Korea. Some providers in Appendix 1 process data abroad. The data, purposes and timing are as listed in Appendix 1, and each provider applies its own safeguards (such as standard contractual clauses). If you do not agree to these transfers, you may not be able to use the Service.

• Operator account data: deleted within 90 days after the account is closed
• Customer booking data: 3 years from the date of the tour
• Payment and settlement records: 5 years (Korean e-commerce and tax law)
• Access logs: 3 months (Korean communications privacy law)
• Marketing consent records: 1 year after consent is withdrawn
• The team’s admin screen access records: 1 year (Korean personal data protection safeguards)
• Supporting documents: deleted within 30 days after the check is finished (including the email they came in)
• Reporter email and report: 1 year after the report is closed
• Operator enquiry emails: 1 year after the enquiry is answered
• Business check result and time: kept with the account data (deleted within 90 days after the account is closed)
• Anything the law requires us to keep longer: for that period
• De-identified, aggregated data: no time limit

Operators and customers may ask to access, correct or delete their data, to stop processing, to withdraw consent, and to receive a copy. Send requests to welcome@canopy.travel; we answer within 10 days. Details a customer gave to an operator may also be requested from that operator. Residents of other countries also have the rights their own law gives them. Residents of Korea may contact the Personal Information Infringement Report Center (118) or the Personal Information Dispute Mediation Committee (1833-6972).

Encryption in transit (HTTPS), one-way password hashing, per-account data isolation, least-privilege access and access logging. If a breach occurs, we notify those affected and the authorities within the period the law sets.

Inside the Company, only the Canopy team (the representative and the co-founder, 2 people) can see personal data. The team looks at operator, booking and customer data only when needed to check operators, handle payment and refund problems, handle reports and answer enquiries.

We keep a record of when the team opens the admin screen and what data they view (who, when, what).

We do not accept signups or bookings from anyone under 14 (or a higher age if the law of your country says so). A booking made by a parent or guardian is recorded under the guardian's details.

We use a cookie that keeps you logged in. You can block it in your browser, but you will be logged out. If analytics or advertising tools are added, this section and Appendix 1 are updated.

The version and effective date are shown at the top. Changes are announced by email and inside the Service 7 days before they take effect. Changes that add to the data collected or widen the purposes are announced 30 days in advance, and consent is obtained again where needed. Provider changes in Appendix 1 are announced inside the Service. Previous versions remain available at canopy.travel/privacy.