muster Privacy Policy
This is an English translation provided for convenience. The Korean version is the official version, and if there is any conflict or inconsistency between the two, the Korean version prevails.
Effective date: October 5, 2026
Hatch Collectibles Co., Ltd. (the "Company") establishes and discloses this Privacy Policy as follows, in accordance with the Personal Information Protection Act and other applicable laws, to protect the personal information of muster Users and to promptly handle related grievances.
Article 1 (Personal Information Collected and Methods of Collection)
| Category | Items collected | Required/Optional | Legal basis |
|---|---|---|---|
| Membership registration (Social Login) | Unique identifier of the social account, email address (for Apple, this may be a relay email), name or nickname, confirmation of being 14 years of age or older | Required | Performance of contract / Age 14 confirmation is required by law |
| Membership registration (Social Login) | Profile photo | Optional (if consented to be provided by the social account) | Consent |
| Profile | Service nickname (@ID), profile photo | Nickname required | Performance of contract |
| Card collection | Card photos (front and back), card information (player, year, set, grade, certification number, etc.), notes | Optional | Performance of contract |
| Community and Chat | Posts and comments, story photos and videos, Chat messages (including images) | Optional | Performance of contract |
| Area settings | Device location (GPS coordinates — used only for conversion to an administrative district and not stored), province/metropolitan city and city/county/district, whether the area is public | Optional | Consent (Location Information Act — separate consent to the Location-Based Services Terms of Use) |
| Ticket purchase | Booker's name (nickname), email (for sending payment receipts), payment approval information | Required | Performance of contract / Retention of transaction records is required by law |
| Grading submission request | Information and images of the requested card, selected store | Required | Performance of contract |
| Customer inquiries | Content of the inquiry, device and app information | Required | Performance of contract |
| Marketing communications | Whether consent to receive app push notifications has been given | Optional | Consent |
| Product purchase and delivery (when such service is provided) | Name of orderer and recipient, mobile phone number, delivery address | Required | Performance of contract |
| Sales settlement (when such service is provided) | Account holder name, bank name, account number | Required | Performance of contract |
| Payment | Type of payment method, payment approval information (card numbers and the like are processed by the payment service provider and not stored by the Company) | Required | Performance of contract |
| Automatically collected | Device information, app version, access logs, IP address, push token, service usage records (screen views, button taps, etc.), areas of interest based on usage records | Required | Performance of contract / Access logs are required by law |
Personal information is collected through app membership registration, purchase and sale procedures, customer center inquiries, and automatic generation in the course of using the Service. Location information (EXIF) contained in photos uploaded by Members is removed at the time of upload.
Article 2 (Purposes of Processing Personal Information)
- Member management: identifying Members, confirming intent to register, preventing fraudulent use, restricting registration by persons under 14 years of age, and giving notices and notifications
- Provision of the Service: providing card information and market prices, operating the community, issuing Tickets and confirming admission, Chat, displaying stores and Posts based on area, and connecting Members to stores offering grading submission services
- Performance of transactions: order processing, payment, delivery, withdrawal of offers and refunds, and settlement of sales proceeds
- Customer support: handling inquiries and complaints, and retaining records of dispute mediation
- Marketing (only with consent): sending advertising information such as promotions, coupons, and new products
- Service improvement: analyzing usage statistics and improving the card recognition feature
- Safe operation of the Service: automated review of Posts and images for harmful content, review of reported Posts and Chats, and restrictions on use
- Personalized services: identifying areas of interest and recommending content based on usage records (not used for personalized advertising)
For card recognition, card photos are sent to an external recognition service, and information that can identify the Member is not sent with them.
Article 3 (Retention and Use Period of Personal Information)
When a Member withdraws, account identification information (social identifier, email, nickname, and profile photo) is destroyed immediately, and other personal information is destroyed within 30 days after withdrawal. Posts, comments, Chat messages, and cards registered as public that remain after withdrawal are retained after being processed so that the Member cannot be identified. For records stored in the service usage analytics tool (PostHog), deletion is requested upon withdrawal, and they are deleted according to that tool's processing cycle. However, information that must be retained under applicable laws is kept for the periods below.
| Item retained | Governing law | Retention period |
|---|---|---|
| Records of contracts or withdrawal of offers, etc. | Act on Consumer Protection in Electronic Commerce | 5 years |
| Records of payment and supply of goods, etc. | Act on Consumer Protection in Electronic Commerce | 5 years |
| Records of consumer complaints or dispute resolution | Act on Consumer Protection in Electronic Commerce | 3 years |
| Records of labeling and advertising | Act on Consumer Protection in Electronic Commerce | 6 months |
| Access logs (IP address, access date and time, request path) | Protection of Communications Secrets Act (3 months or more), Company internal policy (responding to security incidents and fraudulent use) | 1 year |
| Records of fraudulent use | Company internal policy | 1 year |
| Chat messages | Company internal policy | While the chat room exists (destroyed when all participants have withdrawn or the room is deleted). Reported messages: 1 year from the date of the report |
| Records of reports and sanctions (including the underlying messages) | Company internal policy (responding to disputes) | 3 years after processing is completed |
| Database backups | Company internal policy | Up to 7 days (deleted on a rolling basis) |
| Records confirming the use and provision of location information | Location Information Act (6 months or more) | 1 year (destroyed immediately upon withdrawal of consent or membership withdrawal) |
Article 4 (Provision of Personal Information to Third Parties)
The Company processes Users' personal information only within the scope of the purposes in Article 2 and provides it to third parties only with the User's consent or where there is a legal basis.
| Recipient | Purpose of provision | Items provided | Retention period |
|---|---|---|---|
| Event Organizer | Confirming Ticket admission | Booker's name (nickname), admission status | Until the event ends (displayed only at admission confirmation) |
| Store offering grading submission services (the store selected by the Member) | Consultation on and processing of the submission | Nickname, information and images of the requested card | Until the submission is completed |
| Seller in transactions between Members (when such service is provided) | Product delivery and performance of the transaction | Recipient's name, delivery address, mobile phone number | 3 months after the transaction is completed (purchase confirmed) |
Nickname, profile photo, cards and Posts registered as public, and area (if the Member has chosen to make it public) are displayed to other Members.
Article 5 (Outsourcing of Personal Information Processing)
The Company outsources personal information processing tasks as follows to provide the Service smoothly. When entering into outsourcing contracts, the Company specifies the matters necessary to ensure that personal information is managed safely and manages and supervises the contractors.
| Contractor | Outsourced tasks |
|---|---|
| Google LLC (Google Cloud, Seoul region) | Server, database, and file storage, and system operation |
| Toss Payments Co., Ltd. | Payment processing and prevention of payment fraud |
| Google LLC (Firebase Cloud Messaging), Apple Inc. | Sending app push notifications |
| Kakao Corp. | Conversion of location coordinates to administrative districts, map display |
| OpenAI, L.L.C. | Review of posted images and text for harmful content |
| PostHog, Inc. | Identifying service errors and analyzing usage flows |
| Korea Post (Post Office Parcel Service) (when such service is provided) | Product delivery |
Article 5-2 (Overseas Transfer of Personal Information)
In outsourcing processing necessary to provide the Service, the Company transfers personal information overseas as follows.
| Recipient (contact) | Country | Timing and method | Items | Purpose | Retention period |
|---|---|---|---|---|---|
| PostHog, Inc. (privacy@posthog.com) | United States | Transmitted over the network from time to time while the app is used | Member identifier, usage records, device information (email and nickname are not sent; session recording is turned off) | Identifying service errors and maintaining quality | 1 year from the date of collection. Deletion requested 30 days after membership withdrawal |
| OpenAI, L.L.C. | United States | Transmitted over the network when posting or uploading | Uploaded images and text | Review for harmful content | Up to 30 days (abuse monitoring records; deleted afterward) |
| Google LLC (Cloud Vision) | United States | Transmitted during fallback review | Uploaded images | Review for harmful content (fallback) | Not stored (discarded immediately after processing) |
| Google LLC (FCM), Apple Inc. (APNs) | United States | When sending notifications | Push token, notification content | Sending push notifications | Until sending is completed |
The overseas transfers above are processing necessary to provide the Service, and if a User does not wish such transfer, it may be difficult to use the Service (or, for push and posting features, the relevant feature). In this case, the User may stop the transfer by withdrawing membership or turning off notification settings.
Article 6 (Procedures and Methods for Destroying Personal Information)
The Company destroys personal information without delay when the retention period ends or the purpose of processing has been achieved. Electronic files are permanently deleted by a method that makes them unrecoverable, and paper documents are shredded or incinerated. Information retained under applicable laws is stored separately in a separate database. Upon destruction, the Member's profile photo and story image and video files are also deleted, and backup data is deleted on a rolling basis within up to 7 days. Information that is difficult to delete permanently due to technical characteristics is anonymized so that individuals cannot be identified.
Article 7 (Rights of Users and How to Exercise Them)
Users may at any time request access to, correction of, deletion of, or suspension of processing of their personal information, or withdraw consent. Users may do so directly in the app under Settings > Withdraw Membership and Settings > Notifications > Benefits and Marketing Notifications, or by request to the customer center (contact@muster.zone / 010-2968-2609). Users may also exercise their rights through a legal representative or an authorized agent.
Article 8 (Personal Information of Children Under 14 Years of Age)
The Company does not accept membership registration by children under 14 years of age and does not collect their personal information.
Article 9 (Measures to Ensure the Security of Personal Information)
- Administrative measures: establishing an internal management plan, minimizing the number of personal information handlers, and providing regular training
- Technical measures: one-way encryption of passwords, encryption in transit (HTTPS), encrypted storage of important information such as account numbers, access rights management, and retention of access logs
- Physical measures: processing in data centers of cloud service providers that have obtained security certifications, and on dedicated, access-controlled equipment managed by the Company
Article 10 (Installation, Operation, and Refusal of Automatic Collection Tools)
The Company uses PostHog to automatically collect app usage records (screen views, button taps, etc.) and device information in order to identify service errors and maintain quality. The Company does not collect advertising identifiers (IDFA/ADID) and does not use the collected information for personalized advertising. This collection is processing necessary to provide the Service, and matters regarding refusal follow Article 5-2.
Article 10-2 (Location Information)
With the User's consent, the Company receives the device's location coordinates and uses them only to convert them into an administrative district (city/county/district), and does not store the coordinates. Matters concerning the processing of location information are governed by the Location-Based Services Terms of Use.
Article 11 (Chief Privacy Officer)
| Category | Details |
|---|---|
| Chief Privacy Officer | Ahn Junhyung (안준형) (CEO) |
| Contact | contact@muster.zone / 010-2968-2609 |
Inquiries, complaints, and requests for remedies regarding personal information may be made to the contact above.
Article 12 (Remedies for Infringement of Rights)
Users may request consultation or dispute resolution regarding infringement of personal information from the organizations below.
- Personal Information Dispute Mediation Committee: 1833-6972 (www.kopico.go.kr)
- Personal Information Infringement Report Center: 118 (privacy.kisa.or.kr)
- Supreme Prosecutors' Office: 1301 (www.spo.go.kr)
- Korean National Police Agency: 182 (ecrm.police.go.kr)
Article 13 (Changes to the Privacy Policy)
This Privacy Policy applies from October 5, 2026. If its contents change, the Company gives notice through in-app notifications and the like starting 7 days before the effective date (30 days before for changes material to Users' rights), and Users can check the changes and the full text in the notification. Previous versions can be viewed in the revision history in the app.