Privacy Policy

Last updated: August 26, 2026.

This policy describes what Korean Pharmacy collects, why, who else touches it, and what you can ask us to do about it. It is written for a United States store and it describes what this site actually runs, not what a template assumes a store runs.

The short version

• We collect what an order needs: who you are, where it goes, what you bought, and how to reach you about it.
• We do not show you advertisements and we do not run advertising trackers. There is no advertising pixel, no advertising network tag and no tag manager on this site.
• We do not sell your personal information, and we do not share it for cross context behavioural advertising.
• Your card details never reach us. Payment is handled by Shopify's checkout and its processors.

What we collect

• Contact and delivery details. Name, email address, shipping and billing address, and a phone number where a carrier needs one.
• Order details. What you bought, the amount, the order number and the date.
• Payment references. Not your card. The processor returns the last four digits, the card brand and a token so we can match a refund to a charge. The number itself is submitted to the processor and never passes through our systems.
• Account details, if you create an account: your email, saved addresses and order history.
• Email list membership, if you sign up for stock alerts or the newsletter: your email address, the page you signed up from, and for a back in stock alert the product you asked about.
• Site usage. Pages viewed, products viewed, cart and checkout events, IP address, browser and device type, and the page that referred you. This comes from Shopify's own analytics, which is the only analytics on this site.
• What you write to us. The content of your support messages, including any photograph you send with a damage or return claim.

We do not ask for sensitive personal information and we do not knowingly collect it. If you volunteer some, for example by describing a skin condition when you write to support, we use it only to answer you.

What we do with it

• Take your order, pick it, ship it, and handle the return if there is one.
• Email you about that order: confirmation, dispatch, tracking, and anything that goes wrong with it.
• Answer your questions and keep a record of what was said, so the next person who reads the thread has the context.
• Send marketing email only if you asked for it. Every one carries an unsubscribe link and it works on the first click.
• Understand which products people look at and buy, so the catalogue and the site get better. This is aggregate merchandising work, not profiling.
• Spot fraudulent orders and stop them.
• Meet our legal obligations: tax records, import records, product safety and adverse event duties, and lawful requests.

Advertising, tracking and cookies

This is the part most stores are vague about, so here is the specific answer.

This storefront is a Hydrogen application. The analytics it runs are Shopify's own storefront analytics and consent APIs, which is what powers order attribution and the sales reporting in our admin. There is no Google Analytics, no Google Tag Manager, no Meta pixel, no TikTok pixel and no advertising network tag anywhere on this site. Nothing on these pages is built to follow you to another website, and we do not buy or place behavioural advertising against your browsing here.

Cookies and similar storage are used for the things the shop cannot work without: keeping your cart, keeping your session, moving you through checkout, and remembering your preferences. Blocking non essential storage does not stop you shopping.

You can also use our Your Privacy Choices page. It is there because the law gives you the right to switch this off, and it works, but the honest position is that there is no advertising sharing here to switch off in the first place.

We do not make automated decisions about you that have a legal or similarly significant effect.

Who else handles your information

Only the companies it takes to run the shop, and only with what they need:

• Shopify Inc. Our ecommerce platform and hosting. Holds customer, order and product data, runs the checkout, and provides the storefront analytics described above.
• Payment processors, through Shopify's checkout. They process the payment and return us a reference. Which processor handles your payment depends on the method you choose at checkout.
• Our fulfilment partner in California. Receives your name, delivery address and the contents of the order so the parcel can be picked and packed.
• Delivery carriers. Receive the name, address and parcel details needed to deliver it, and return tracking events to us.
• Supabase. The database behind our newsletter and back in stock lists. It holds the email address you gave us for those lists and nothing else about you.
• Professional advisers and authorities, where the law requires it.

Because we import our stock in bulk and clear it through customs before it ever reaches a customer, your order does not generate a customs declaration and your details are not sent to a customs authority. That is a consequence of holding stock in California rather than shipping to you from Korea.

These companies act on our instructions. None of them is permitted to use your information for their own marketing. Service providers we use operate in the United States and in other countries, and your information may be processed where they operate.

We do not sell your information

We do not sell personal information as California law defines selling, and we do not share it for cross context behavioural advertising. We have never done either, and there is no part of this site built to.

How long we keep it

• Orders, payment references and shipping records: seven years, for tax, import and audit obligations.
• Account data: while the account exists, and for two years after the last sign in, unless you ask us to delete it sooner.
• Marketing list membership: while you are subscribed, and for three years after you unsubscribe, so we can evidence that you had asked to be on the list.
• Support conversations: three years from the last message in the thread.
• Site analytics: the retention Shopify applies to storefront analytics.

When a period ends we delete or anonymise the data, unless the law requires us to keep it longer.

Your rights

If you live in California, the CCPA as amended by the CPRA gives you the right to know what we hold about you and to get a copy, to have it corrected, to have it deleted subject to the records we must keep, to opt out of sale and sharing, to limit the use of sensitive personal information, and not to be treated worse for exercising any of them. As set out above, we do not sell or share your information and we do not use sensitive personal information beyond answering you, so the opt out and limit rights have nothing to act on here; you may still exercise them and we will confirm that in writing.

If you live in another United States state with a comprehensive privacy law, you have comparable rights and we will honour them on the same basis, within the time your state's law allows.

To exercise any of these, write to us through our contact page with the words "Privacy request" and the email address you used with the store. We verify who you are, normally by matching that address to an order, and we answer within 45 days. If we cannot verify you we will say so and tell you what else we need. You may use an authorised agent, with proof that you authorised them.

Children

This store is not aimed at children under 13 and we do not knowingly collect their information. If you believe a child has given us some, tell us and we will delete it.

Security

Traffic is encrypted in transit. Payment card data is segmented away from us entirely and never touches our systems. Access to admin systems is controlled and limited to people who need it. No system is perfectly secure; if a breach affects your personal information we will tell you, and the authorities where the law requires it.

Marketing incentives

From time to time we offer a discount for joining the email list. The discount is worth roughly what the subscription is worth to us. You can leave the list whenever you like and keep anything you already bought with the code.

Changes to this policy

We update this policy when our practices change. The revised version is posted here with a new date at the top. If a change is significant we tell subscribers by email.

Contact

Privacy questions and requests go through our contact page.