THÉONÉ Co., Ltd. ("Company") operates TROPS (trops.kr and app.trops.kr, the "Service"), an export management service. In accordance with the Personal Information Protection Act of Korea and related laws, the Company sets out this Privacy Policy to protect users' personal information and to handle related complaints promptly.
Article 1 Purposes of processing
The Company processes personal information for the following purposes. If a purpose changes, the Company will notify users in advance and obtain any consent required by law.
- Membership: identity verification, email verification, registering companies (per business) and managing their members, and preventing misuse
- Pilot program applications: receiving applications and contacting applicants, selecting participating companies, pre-filling company basic information (name, industry, size, address) and contact person details after an invitation, and preparing the tasks described in the application
- Launch news: announcements about the Service launch and pilot program recruitment
- Advertising information (only where optional consent is given): the TROPS newsletter and information on government export support programs. Consent is obtained separately for each purpose and can be withdrawn at any time
- Export work support: export transaction records, preparing quotations and shipping documents, freight quote requests and forwarder matching, guidance on trade insurance and payment deadlines, and guidance on support programs
- Automatic document reading and work requests: reading document types, field values and deadlines from documents users upload to link them to transactions and assist input; reading company information from business registration certificates to assist company information entry and company verification; preparing work drafts at the user's request; and confirming ownership of company bank accounts
- Contacting counterparties: sending emails such as quotations and shipping notices to buyer contacts at the user's request
- Notifications: providing work notifications such as deadlines, document arrivals, document changes, quote arrivals and shipments by email and through calendars connected by the user
- Customer support and operations: responding to inquiries, entering information on the user's behalf where the user has consented, and improving the Service
- Payment and settlement for paid services
- Statistics: where the user has separately consented, compiling statistics on export terms processed so that individuals cannot be identified
- Payment account checks and email address checks: comparing the payment account written on documents users upload with the registered account and alerting users when they differ, keeping a record of account changes confirmed by phone, and checking the public settings of company and counterparty email domains and look-alike domains, to reduce payment incidents caused by impersonation emails
Article 2 Personal information processed
| Category | Items | How collected |
|---|---|---|
| Members (shipper contacts and representatives) | Name, email, password (encrypted), phone number, company, title or role | Entered on sign-up and settings screens; name and email of the Google account when signing in with Google |
| Pilot program applications | Required: company name, industry, company size, contact name, email, phone number · Optional: job title, company address (including postal code), requested tasks (free text), referral code · Automatic: referral channel · Items received through earlier application forms: region, business registration number | Entered on the application screen (address via address search) |
| Launch news | Company name, name, email | Entered on the application screen |
| Consent to advertising information (optional) | Whether consent was given and when, and the purposes consented to (newsletter, government support program information) | Application, sign-up and My info screens |
| Company information | Trade name (Korean and English), business registration number, representative name, address (Korean and English) and postal code, company size, company logo, copy of the business registration certificate (file) | Company information entry; uploading the business registration certificate (AI reads field values such as the trade name, business registration number, representative name and address to assist input, and the user confirms them); National Tax Service business status lookup |
| Company receiving account | Bank, account number, account holder, SWIFT code, branch and bank address (English), account certificate file | Company information entry, file upload |
| Transaction documents | Information in export declarations, quotations, purchase orders, invoices, bills of lading, certificates of origin, trade insurance policies and similar documents | File upload, direct input, work request conversations |
| Buyer contacts (third parties) | Name, job title, email, phone number | Entered by the user (shipper) |
| Buyer accounts | Bank name, account holder, account number, IBAN, SWIFT/BIC, branch, bank address and country | Entered by the user (shipper) |
| Account records (payment account checks) | For accounts of the company and its counterparties (buyers, forwarders and others): bank, country, currency, SWIFT/BIC, account holder, the last four characters of the account number and a comparison value (the full account number is not kept); the name of the document showing the account and any phone number written on it; the name and phone number of the counterparty contact who confirmed an account change, the time of the call and the answer; and the users who recorded and approved it | Read from documents users upload, company information entry, partner information, entered in work request conversations |
| Email security checks | Domains (the part after @) of company and counterparty email addresses, the public settings of those domains (email authentication and receiving settings), look-alike domains with their registration dates and receiving settings, and the sender domain of emails users paste in (the email body is not kept) | Email addresses in company, partner and buyer contact information, public lookups (domain name system and domain registration data), entered in work request conversations |
| Forwarder contacts | Name, email, phone number, company | Forwarder sign-up and settings |
| Collected automatically | Access logs, IP address, browser information, cookies, service usage records | While the Service is used |
Document files and work request conversations may contain information about third parties (buyers, carriers and others) to the extent users upload or write it.
Article 3 Processing and retention periods
The Company keeps personal information until the purpose is achieved and destroys it without delay once the following periods have passed.
| Item | Retention period |
|---|---|
| Member information | 30 days after withdrawal (destroyed after checking for misuse) |
| Pilot program applications | Until the pilot program ends or consent is withdrawn, up to 1 year (on sign-up, the information moves into member and company information and follows those periods) |
| Launch news | 1 year (365 days) from the application, or until consent is withdrawn |
| Records of consent to advertising information | Until consent is withdrawn or membership ends (consent is reconfirmed every two years) |
| Company transaction records, documents (including originals of received documents, values read from documents, differences from earlier versions and deadline records) and work request conversations | Until the company requests deletion |
| Trade insurance policy files and account certificates | Until the company or the account is deleted |
| Copy of the business registration certificate (file) | 30 days from the date company verification is completed (until then it is kept for verification). Company information read from the document follows the retention period for company records |
| Records of emails sent to buyers (excluding the body) | 3 years |
| Account records (registered accounts; comparison, phone confirmation and approval records) | Until deletion of the company is requested (comparison and confirmation records are kept without being edited or deleted until then) |
| Email security check records (domain check results, look-alike domains) | Until deletion of the company is requested |
| Freight quotes (not contracted) | 90 days after the user deletes them |
| Operator access logs | 3 years |
| Calendar subscription URLs (per company and per user) | Until the user cancels or regenerates them |
| Anonymous statistics | Kept after processing so that individuals cannot be identified |
| Access logs | 3 months (Protection of Communications Secrets Act) |
| Contract and payment records for paid services | 5 years (Act on the Consumer Protection in Electronic Commerce, etc.) |
Article 4 Provision to third parties
The Company processes users' personal information only within the scope of Article 1 and provides it to third parties only in the following cases.
| Recipient | Items provided | Purpose | Timing and period |
|---|---|---|---|
| The one forwarder whose quote the user accepts | Company name, contact name and phone number, detailed origin and destination addresses, documents chosen by the user (issued or draft) | Concluding and performing the freight contract | When the user accepts · 12 months from acceptance; the user can withdraw the disclosure |
| Tax accountants, lawyers and others to whom the user sends materials | Materials chosen by the user | Tax and legal work | When the user sends them · until the link expires |
| Buyer contacts to whom the user sends email | Email subject, body and attached documents | Transaction communication | When the user sends the email |
| Requests under law | Items prescribed by law | Legal compliance | Upon request |
Before a quote is accepted, forwarders cannot see the company name, contact details, buyer or amounts. They see only the country and city, shipment timing, cargo category and total volume, and freight terms.
Article 5 Entrustment of processing
| Trustee | Entrusted work |
|---|---|
| Supabase, Inc. | Database and file storage, member authentication (storage location: Seoul region, Republic of Korea) |
| Vercel Inc. | Service operation (web hosting) |
| Resend, Inc. | Sending email (verification codes, notifications, buyer emails) |
| 주식회사 렛서 (Korea) | Relaying AI calls |
| Anthropic, PBC | AI document reading and work request processing |
| Toss Payments Co., Ltd. | Payment processing for paid services |
In its entrustment contracts the Company sets out personal information protection obligations, restrictions on re-entrustment and security measures, and manages and supervises the trustees. If the Company starts sending KakaoTalk notification messages or text messages, it will add the sending agency to this table and notify users.
Article 6 Transfer abroad
| Recipient | Country | Items transferred | When and how | Purpose | Retention |
|---|---|---|---|---|---|
| Anthropic, PBC (privacy@anthropic.com) | United States | Contents of documents uploaded by users, work request conversations | Sent over the network each time an AI feature is used | Reading document fields, processing work requests | As set out in the provider's policy |
| Resend, Inc. (privacy@resend.com) | United States | Recipient email address, email subject and body, attachments | Sent over the network when an email is sent | Sending email | As set out in the provider's policy |
| Vercel Inc. (privacy@vercel.com) | United States and other countries | Access logs, request information | While the Service is used | Service operation | As set out in the provider's policy |
If you do not want your information transferred abroad, you can enter information directly instead of using AI document reading or work requests, or download documents and send them yourself instead of using email sending. In that case those features cannot be used. AI features are explained separately and your consent is obtained the first time you use them.
Article 7 Personal information collected from sources other than the data subject
Buyer contact details, buyer accounts, account information of counterparties (forwarders and others) and the name and phone number of the contact who confirmed an account change, and third-party information in documents and work request conversations are entered or uploaded by the user (shipper). The Company processes this information only to support the user's export work and to check payment accounts (Article 1, items 5, 7 and 12). The data subjects may request notice of the source and purpose of processing, and suspension of processing, in the manner described in Article 9.
Article 8 Destruction of personal information
- Personal information is destroyed without delay when the retention period expires or the purpose has been achieved.
- Electronic files are deleted so that they cannot be recovered, together with the original files in storage.
- Where the law requires retention, the information is kept separately from other information.
Article 9 Rights of data subjects and legal representatives
- Data subjects may at any time request access to, correction, deletion or suspension of processing of their personal information, or withdraw consent.
- Requests can be made on the Service's settings screens or through the contact in Article 13, and the Company will act without delay.
- The sharing and disclosure scope of company information and the consent records can be checked and withdrawn directly under "Company › Settings".
- Advertising information is sent with «(광고)» (advertisement) in the subject and instructions for opting out in the body. You can opt out at any time through the unsubscribe link at the bottom of the email, the My info screen, or the contact in Article 13.
Article 10 Security measures
- Administrative measures: an internal management plan, minimal access rights, operator access logs
- Technical measures: encrypted storage of passwords and account numbers, showing only the last 4 digits of account numbers on screen, keeping files in private storage and using short-lived viewing links, row-level access control in the database, encryption in transit
- Every time an operator views a company's transaction records, accounts, files or email records, the access is logged.
- Deadline and document notifications and calendar subscription URLs include the transaction name (the name set by the user, or the buyer name if there is none), the document type, the deadline type and date, and payment status (completed or not), but not amounts. If a transaction name looks like an amount, the transaction number is shown instead. Calendar subscription URLs are created separately per company and per user, and users can close or regenerate them at any time.
Article 11 Cookies and similar automatic collection
The Company uses cookies and browser storage to keep you signed in and to remember screen settings. You can refuse storage in your browser settings, in which case some features such as signing in cannot be used.
Article 12 Automated decisions
AI is used only to read document types, field values and deadlines and to prepare work drafts. Deadlines and transaction links read from documents uploaded by users are recorded immediately with a «read from document» label and may be sent as notifications to members of that company. Users can correct the document type and transaction link, and can confirm deadlines or mark them as done. Export transaction values and emails sent to third parties such as buyers are saved or sent only after the user reviews and approves them. The Company does not make decisions that significantly affect data subjects' rights or obligations in a fully automated way.
Article 13 Privacy officer
| Item | Details |
|---|---|
| Privacy officer | Hana Beom (CEO) |
| Contact | contact@theo-ne.com |
| Company | THÉONÉ Co., Ltd. · Business registration number 625-81-04032 · B269-11, 524 Bongeunsa-ro, Gangnam-gu, Seoul, Republic of Korea |
Article 14 Remedies for infringement
You may report or seek advice from the Personal Information Infringement Report Center (privacy.kisa.or.kr, call 118), the Personal Information Dispute Mediation Committee (kopico.go.kr, 1833-6972), the Supreme Prosecutors' Office (spo.go.kr, call 1301) and the Korean National Police Agency (ecrm.police.go.kr, call 182).
Article 15 Changes to this Privacy Policy
This Policy applies from October 15, 2026. When it changes, the Company notifies users on the Service at least 7 days before the change takes effect (30 days for significant changes). The changes from the previous policy (effective October 14, 2026) are in Article 1 (new item 12), Article 2, Article 3 and Article 7.