Privacy Policy

Effective date 25 October 2026

How SOYOSEOJAE handles personal information for Google sign-in, saved configurations and customer enquiries.

Purpose and current services

주식회사 소요서재 uses personal information to identify you through Google sign-in and let you save, edit, delete and revisit your product configurations.

Sign-in and configuration storage are processed to provide the service you request under Article 15(1)(4) of Korea’s Personal Information Protection Act. Essential security and abuse prevention use the minimum information necessary for legitimate interests under Article 15(1)(6), taking your rights and interests into account.

The website does not currently accept quote submissions, send automated emails or take online payments. We will explain the information and handling involved before introducing these features.

Information used for Google sign-in

Google sign-in is optional. You can browse products and change 3D configurations without signing in. We request only basic profile, email and account verification permissions (openid, email and profile).

We receive your Google account identifier and name, and store an internal customer ID, Google account identifier, display name and creation/update times. Your verified email is processed temporarily during sign-in and is not stored in our customer account database. We do not store your Google password, profile photo or raw authentication tokens, or request access to Gmail messages or Google Drive files.

For One Tap sign-in, the Google ID token (JWT) is sent from your browser to our server and processed temporarily for verification, without being stored.

Saved configurations and email enquiries

When you save a configuration, we link its name, product, model, design revision, wood choices for each component and creation/update times to your customer ID. We use this information to let you reopen, edit and delete your configurations.

For enquiries sent to our support email, we process the sender’s email address, name and message to reply and resolve the enquiry. Please send only the information needed and avoid including sensitive information.

Retention and deletion

We retain account information until an account deletion request is processed, and saved configurations until you delete them or account deletion is processed. You can delete configurations in your collection and request account deletion by support email. We verify your identity before processing deletion requests. Email enquiries are deleted without undue delay once their purpose has been fulfilled.

Electronic information is removed from the active service in a manner that makes recovery difficult. AWS Seoul operational logs are retained for 7 days, and database backups expire after no more than 7 days. Deleted information may remain in existing database backups until expiry; if a database backup is restored, completed deletions are reapplied. The separate details below apply to deletion and retention in the Google enquiry mailbox.

If a legal retention duty arises, we will identify the information, legal basis and period separately. Retention periods for purchases and payments do not apply indiscriminately to accounts or saved configurations when these transaction services are not provided.

Access, correction, deletion and withdrawal

You can view, edit and delete saved configurations in your collection. To request access, correction, deletion, suspension of processing or withdrawal of consent for account information, use the customer support email in the page footer. We verify you or your authorised representative and explain the outcome.

You can also revoke access through your Google account settings. Disconnecting Google and deleting the account or configurations held by SOYOSEOJAE are separate actions; please request deletion as well if desired. Matching email addresses alone do not authorise us to link or delete another account’s information.

Manage third-party connections in your Google account

Cookies and browser storage

We use essential cookies for sign-in, security and duplicate-request prevention. Sign-in authentication cookies issued by our server are sent over HTTPS only in production and use HttpOnly to prevent browser scripts from reading them. We do not use advertising, analytics or behavioural tracking cookies.

The periods below are cookie validity periods. Expired server-side authentication records are removed through a separate operational cleanup process, so cookie expiry does not mean immediate deletion of server records.

soyo_session: keeps you signed in, 24 hours.
soyo_oauth: links a Google sign-in request to its callback, 10 minutes.
soyo_one_tap: binds a One Tap sign-in request to the browser, 10 minutes (HttpOnly, SameSite=Lax, path /auth).
soyo_guest: identifies a guest browser and prevents duplicate requests, 30 days.
g_state: Google Identity Services may set this cookie to manage sign-out and automatic sign-in state. Its lifetime follows Google’s settings.
Before redirecting to Google, only your product, model and wood choices may be held temporarily in the tab’s sessionStorage, with restoration allowed for up to 10 minutes. This draft contains no personal information or session tokens and is cleared after sign-in, cancellation or sign-out.
You can reject or remove cookies in your browser settings. Blocking essential cookies may prevent sign-in and configuration saving.

Service providers and disclosure

We use the Seoul region of Amazon Web Services, Inc. (AWS) for website hosting, databases, static assets, logs and backups. We also use Google LLC’s Google sign-in and Google Asia Pacific Pte. Ltd.’s Google Workspace enquiry mailbox. Processing by Google services is not guaranteed to be confined to Korea.

We do not sell personal information, use it for marketing or disclose it to third parties for purposes beyond those described here. Exceptions may apply where legal requirements are met, such as a lawful request under applicable legislation.

Overseas processing of email enquiries

We entrust email transmission and storage to Google Workspace to receive and answer the enquiries you send to support. Under Article 28-8(1)(3)(a) of Korea’s Personal Information Protection Act, this policy discloses overseas processing and storage needed to handle the enquiry you request.

Authentication of a personal Google account is separate from this enquiry-mailbox processing and is also governed by Google’s Privacy Policy. We do not back up our customer account database or your saved configurations to Google.

Recipient: Google Asia Pacific Pte. Ltd. (Singapore) and the affiliates and subprocessors in the official list below. Contact SOYOSEOJAE support or Google’s data protection contact for related enquiries.
Information: the sender’s name and email address, message content and attachments you provide.
Timing and method: when sending or receiving mail and as needed during retention, through email transmission and storage on Google Workspace servers.
Purpose: receiving and replying to enquiries and retaining mail needed to handle them.
Retention: once the enquiry’s purpose has been fulfilled, we instruct deletion without undue delay, including emptying recoverable Trash. Under Google’s Cloud Data Processing Addendum, complete deletion from Google systems may take up to 180 days from the instruction that makes the information no longer recoverable by us.
How to refuse and consequences: do not send email, or contact support to request suspension or deletion. This limits email support but does not affect browsing products, Google sign-in or saved configurations.

Possible overseas processing countries and territories in the official list

Argentina, Australia, Belgium, Brazil, Bulgaria, Canada, Chile, Colombia, Denmark, El Salvador, Finland, France, Germany, Hong Kong, India, Ireland, Israel, Italy, Japan, Malaysia, Mexico, the Netherlands, New Zealand, the Philippines, Poland, Romania, Singapore, Spain, Sri Lanka, Sweden, Switzerland, Taiwan, the United Kingdom and the United States.

These are possible Core Service processing locations in the official Google Workspace list updated on 19 October 2026. This does not mean every email is stored in every country. See the official list below for current providers and locations.

Security measures

We use HTTPS, server-verified login sessions, customer-specific access controls, restricted operational access and separately stored secrets. Ordinary operational logs do not contain request bodies, email enquiry content, authentication tokens or cookies.

Changes and contact

If the information, purposes or retention periods change, we will update this page and its effective date, and provide advance notice or obtain consent where required. SOYOSEOJAE operations handles privacy enquiries and rights requests through the customer support email in the page footer.