Enkorwithus Inc. (operating the Enkostay service, 'https://stay.enko.kr/', hereinafter the "Company") establishes and discloses this Privacy Policy pursuant to Article 30 of the Personal Information Protection Act (PIPA) in order to protect the personal information of data subjects and to promptly and smoothly handle related grievances. This Policy applies to Tenant members.
Article 1 (Purposes of Processing Personal Information)
The Company processes personal information for the following purposes and does not use it for any purpose other than those stated. If the purpose of use changes, the Company will take necessary measures such as obtaining separate consent under Article 18 of PIPA.
- Membership registration and management: verifying intent to register, identifying and authenticating members, maintaining and managing membership, preventing fraudulent use, verifying consent of legal representatives, and notices.
- Provision of goods or services: service provision, delivery of contracts and invoices, provision of content and customized services, payment and settlement of fees, and management of overdue/unpaid amounts.
- Marketing and advertising: development of new services and provision of customized services, provision of event and promotional information, analysis of access frequency and usage statistics.
Article 2 (Processing and Retention Period)
The Company processes and retains personal information within the retention/use period required by law or consented to at the time of collection.
- Membership registration and management: until membership withdrawal (until the end of any investigation in case of legal violation; until settlement where credit/debt remains).
- Records of payment and settlement: 5 years (Act on Consumer Protection in Electronic Commerce, Article 6).
- Records of consumer complaints and dispute handling: 3 years (same Act, Article 6).
- Web/app service logs and access records (IP, etc.): 1 year (Protection of Communications Secrets Act, Article 15-2).
- Records of consultation and grievance handling: 3 years.
Article 3 (Items of Personal Information Processed and Collection Methods)
| Category | Required | Optional |
|---|---|---|
| Membership registration and management | Email, password, nationality, name, mobile phone number | Date of birth, gender |
| Provision of goods/services | Email, credit card information, payment records, name, contract information | Gender |
| Automatically generated/collected information | IP address, cookies, visit date/time, service usage records, records of improper use, device information, location information, information generated during payment/consultation | - |
| Marketing and advertising | - | Email, mobile phone number |
Collection Methods
- Direct entry by the data subject on the website/mobile app
- Automatic generation/collection during service use
- Collection via linkage from partner services (e.g., Bravo Korea) based on the data subject's consent to third-party provision (source disclosure under PIPA Article 20)
- Collection/use during the sending of verification messages for mobile phone number verification (see Article 5 for the processor)
Where copies of identification documents such as passports are collected, they are not subject to a separate retention period and are retained until the purpose of identity verification/contract performance is achieved or until membership withdrawal, and then destroyed without delay.
Article 4 (Provision of Personal Information to Third Parties)
The Company processes personal information only within the scope specified in Article 1 and provides it to third parties only to the minimum extent falling under Articles 17 and 18 of PIPA, such as with the data subject's consent or under specific legal provisions.
| Recipient | Purpose | Items Provided | Retention/Use Period |
|---|---|---|---|
| Host | Identity verification, contract preparation/performance, grievance/consultation, and other e-commerce contract performance | Name, email, purpose of visit, mobile phone number (optional), passport copy (if necessary) | 1 year after contract termination/completion of service |
| Livingco | Sale and delivery of bedding products | Name, contact, delivery address, purchase (order) details | Statutory period after delivery completion |
"Livingco" is a partner for selling and delivering bedding products for accommodations of hosts who do not provide bedding. Information is provided only where the data subject pays for bedding on the Company's site.
The data subject may refuse consent to third-party provision, in which case some services may be restricted.
Article 5 (Consignment of Personal Information Processing)
The Company consigns personal information processing as below and stipulates necessary matters to ensure personal information is managed safely under relevant laws.
| Consignee | Consigned Work |
|---|---|
| Stripe, Toss Payments | Payment processing |
| Amplitude, Google Analytics 4, Microsoft Clarity | Analysis of behavioral data automatically generated/collected during service use |
| Google LLC (Google Tag Manager) | Integrated management and deployment of analytics/advertising tags |
| Meta Platforms, Inc. (Meta Pixel) | Conversion tracking and customized (retargeting) advertising |
| Zendesk | Customer support (conversation content) |
| SendGrid, Mailchimp | Customer management and marketing (email delivery, account management) |
| Braze | Customer CRM and marketing message automation (app push, email, etc.) |
| Naver Cloud, Twilio | SMS notifications and mobile phone verification message delivery |
| Amazon Web Services | Infrastructure operation for service provision |
Article 6 (Overseas Transfer of Personal Information)
The Company transfers personal information overseas as below and takes measures necessary to ensure safety under PIPA Article 28-8.
| Transferee | Country | Items Transferred | Time/Method | Purpose / Retention |
|---|---|---|---|---|
| Amplitude, Inc. | USA | Behavioral data, device information | Transmitted over the network during service use | Behavioral analysis / up to 1 year from collection |
| Google LLC (GA4Β·GTM) | USA | Behavioral data, cookies | Transmitted during service use | Web usage analysis, tag management / up to 1 year |
| Microsoft Corp. (Clarity) | USA | Session and behavioral data | Transmitted during service use | UX analysis / up to 1 year |
| Meta Platforms, Inc. | USA | Behavioral data, advertising identifiers | Transmitted during service use | Customized (retargeting) advertising / until membership withdrawal |
| Stripe, Inc. | USA [/ Ireland] | Payment-related information | Transmitted at payment | Payment processing / period required by law |
| Twilio Inc. (SendGridΒ·SMS), Intuit Inc. (Mailchimp) | USA | Email, mobile phone number, contact | Transmitted at sending | Email/SMS delivery, customer management / until withdrawal |
| Braze, Inc. | USA | Name, date of birth, device information, service usage information | Transmitted during service use | Customer CRM / until membership withdrawal or termination of consignment |
Cloud infrastructure (Amazon Web Services) is stored in the Seoul Region (ap-northeast-2) and, so long as it remains in Korea, does not constitute an overseas transfer; it is therefore listed only under consignment in Article 5. It is added to the table above only where personal information is transferred to overseas regions for backup/disaster recovery replication.
The data subject may refuse consent to overseas transfer, in which case some services may be restricted.
Article 7 (Procedures and Methods of Destruction)
- Personal information is destroyed without delay once the retention period elapses or the purpose is achieved.
- Where retention is required by law, it is stored separately in a distinct database.
- Method: electronic files are deleted irrecoverably; paper is shredded or incinerated.
Article 8 (Rights and Obligations of Data Subjects and Legal Representatives, and Exercise Methods)
- The data subject may at any time request access, correction, deletion, or suspension of processing of personal information.
- Such rights may be exercised in writing, by email, or by fax, and the Company will act without delay.
- The data subject may directly view/edit/delete their information under 'My account' or request access via 'Contact us'.
- Rights may be exercised through a legal representative or a duly authorized agent, in which case a power of attorney must be submitted.
- Requests for access and suspension of processing may be restricted under PIPA Article 35(4) and Article 37(2).
Article 9 (Measures to Ensure Safety of Personal Information)
- Administrative measures: establishment/implementation of an internal management plan, operation of a dedicated organization, regular staff training.
- Technical measures: access rights management, installation of access control systems, encryption of personal information, installation/updating of security programs.
- Physical measures: access control to computer rooms, data storage rooms, etc.
Article 10 (Installation/Operation and Refusal of Cookies, etc.)
- Web browser cookies: collected/stored for visit records, login maintenance, and customized services; can be allowed/blocked in browser options.
- Mobile app: device identifiers (Device ID), advertising identifiers (IDFA/GAID), SDK usage records, etc. are collected; tracking can be limited in device settings.
- Settings guide: (iOS) Settings > Privacy > Tracking / (Android) Settings > Google > Ads / (Web) block/delete cookies per browser.
Article 11 (Collection/Use/Provision of Behavioral Data and Refusal)
- The Company collects and uses behavioral data to provide customized services and online customized advertising.
- Items collected: visit history, search history, click logs, page navigation/usage paths, funnel and event data, usage frequency, device information (browser/OS/device ID, etc.).
- Methods: automatic collection upon website visits, and via app SDKs and analytics tools (Amplitude, Google Analytics 4, Microsoft Clarity, Meta Pixel, etc.).
- Advertising/analytics recipients (shared with): Meta Platforms, Inc., Google LLC. The Company shares behavioral data with these providers for online customized advertising or allows them to collect it on the Company's services.
- Retention/use period: up to 1 year from collection, then destroyed (or the period required by law, if longer).
- The data subject may refuse the collection/use of behavioral data through browser/device settings and each provider's ad settings.
Article 12 (Matters Concerning Automated Decisions)
The Company does not use the data subject's personal information for decisions made entirely through automated systems (including profiling) that produce legal effects or similarly significant effects on the data subject.
Article 13 (Criteria for Additional Use/Provision)
Pursuant to PIPA Article 15(3) and Article 17(4), the Company may additionally use/provide personal information without the data subject's consent, taking into account relevance to the original purpose, foreseeability, whether it unfairly infringes the data subject's interests, and whether safety measures have been taken.
Article 14 (Personal Information Protection Officer)
- Chief Privacy Officer (CPO): Oh Jung Hoon (CEO) / 070-8803-1160 / stay_support@enko.kr
- Privacy department: Development Team / 070-8803-1160 / dev@enko.kr
- Access request reception/handling department: Operations Team / 070-8803-1160 / stay_support@enko.kr
Article 15 (Remedies for Infringement of Rights)
- Personal Information Dispute Mediation Committee: 1833-6972 (www.kopico.go.kr)
- Personal Information Infringement Report Center: 118 (privacy.kisa.or.kr)
- Supreme Prosecutors' Office: 1301 (www.spo.go.kr) / National Police Agency: 182 (ecrm.cyber.go.kr)
Article 16 (Changes to This Privacy Policy)
If this Policy is changed, the Company will announce the reason and content of the change via the website notice at least 7 days before the effective date (30 days before for changes unfavorable to data subjects).
Notice date: July 20, 2026
Effective date: This Privacy Policy applies from July 27, 2026.