Privacy policy
Last updated: November 5, 2026
1. Who We Are and Our Roles
This Privacy Policy explains how KZONE Co., Ltd. ("KZONE", "we"), a company organized under the laws of the Republic of Korea and doing business as BuyerCrew, handles information through the BuyerCrew website, application and AI sales-agent service. Our address is 151, Bundangnaegok-ro, KZONE (1004), Bundang-gu, Seongnam-si, Gyeonggi-do, Republic of Korea.
We act in two roles:
- On behalf of a customer. When we process connected email, WhatsApp, contact, inventory or sales information only to do sales work a business customer commissioned, that customer decides why and how the data is used, and we process it on its behalf under our agreement with it. If you are a buyer or contact of that customer, please direct requests to the customer first.
- For ourselves. We decide the purpose for account administration, billing, website, security, legal compliance, support, and any lead data we collect ourselves, as described below.
2. Information We Collect
- Account and billing information: names, work email, company, role, login and billing details.
- Connected-channel data (customer-authorized): Gmail and WhatsApp messages, sender and recipient details, timestamps, message metadata and attachments. We use only the access scopes needed for the features the customer enables.
- Customer sales information: contacts, inventory, products, prices, orders and notes, plus buyer-interest indicators we derive for that customer.
- Lead and prospect data we collect ourselves: business contact details of potential buyers and sellers (name, company, work email, phone, role) from business-information providers, public business websites and similar sources. We process this data based on our legitimate interest in business-to-business sales and, where the law requires, on consent. We tell individuals where we obtained their data when they ask, and we honor opt-out requests.
- Website and usage data: device and browser details, pages viewed, and logs. The marketing website currently loads Microsoft Clarity, Google Analytics 4 and Google Ads tags. We use these tools to understand how visitors use the site and to measure our advertising.
- Consent and opt-out records and support communications.
We do not knowingly collect information from children, and the Service is for businesses only.
3. How We Use Information and AI
We use customer data to do the sales research and sales-agent work the customer requested: analyzing buyer communications, matching buyer interest to the customer's goods, preparing recommendations and follow-up messages, and sending authorized messages through connected channels. We use account, billing, security, support and usage data to run and protect BuyerCrew and to meet legal duties.
We use AI models, including models from third-party providers, to produce these outputs. Our AI providers are contractually barred from training on customer data, but they may keep inputs and outputs for a limited period for security purposes. Providers and retention periods are listed in our subprocessor list.
Our own research, product improvement or model training is a separate purpose. We do it only where the law and the source provider's terms allow and any required separate consent has been given. We do not use data from Google APIs, or WhatsApp data, including anything derived from it, for our independent research or for general AI-model training.
Gmail data is used only to provide the user-facing features the customer requested. Our use of information received from Google APIs follows the Google API Services User Data Policy, including its Limited Use requirements. Our staff do not read connected messages unless the customer asks for support, security requires it, or the law demands it.
4. Sharing and Subprocessors
We do not sell, rent or disclose identifiable customer data or customer-specific conversation content to another BuyerCrew customer, a competitor, a buyer, a supplier or any other transaction counterparty. This includes KZONE's own affiliates when they are customers.
We share information only with:
- the channel provider the customer chose (for example Google or WhatsApp);
- service providers and subprocessors for hosting, messaging connectivity, AI processing, analytics, payments and security, bound by written confidentiality and data-protection terms;
- affiliates in the KZONE group that support the Service, under intra-group terms;
- authorities or advisers where the law requires, or in a merger or sale of the business, with notice where required.
Our current subprocessor list, with each provider's purpose, data processed, location and change-notice process, is available on request at hello@kzoneseller.com.
5. International Transfers
KZONE is based in Korea, so information from customers and contacts in other countries is transferred to and processed in Korea, and in the countries where our subprocessors host data (currently the United States and South Korea). Where Korean law requires, we tell individuals who receives their data, in which country, what is sent, for what purpose, and for how long. For customers and contacts in the US, EU/UK and elsewhere, we rely on the transfer tools the customer's law requires, such as standard contractual clauses, set out in the DPA. We give a copy of the safeguards on request.
6. Retention
We keep customer data for up to three (3) years from collection to provide the commissioned services, unless the law, the customer's instruction or a connected platform's terms require earlier deletion. A shorter legal or platform limit always controls. The table shows the planned periods by data type.
| Data type | Planned retention | Start point |
|---|---|---|
| Original messages and attachments | Up to 3 years | Date the message was collected |
| Customer-specific analysis and recommendations | Up to 3 years, or until the customer contract ends if earlier | Date the analysis was created |
| Consent, opt-out and suppression records | As long as needed to honor the opt-out, and up to 5 years after the account ends | Date of consent or opt-out |
| System logs | 12 months | Log date |
| Backups | Removed within 90 days after deletion from live systems | Deletion date from live systems |
| Account and billing records | As tax and commercial law require | Account end |
After termination we delete or return customer data within 30 days of the customer's written request, as the DPA provides.
BuyerCrew does not offer a general export or download of the full original email or WhatsApp history or original attachments. This does not limit a verified request for access, correction or deletion where the law gives that right, or a return-or-deletion duty under a customer contract.
7. Your Rights and Requests
Depending on where you live, you may have the right to access, correct, delete or restrict the use of your personal information, to withdraw consent, to object to certain uses, to receive a copy of your data, and to opt out of sale or sharing, and not to be treated worse for using these rights. We do not sell personal information.
Send requests to the privacy contact in Section 10. We verify identity before acting and answer within the time the applicable law sets (Korea: within 10 days; California: within 45 days; EU/UK: within one month). For data we hold on a customer's behalf, we may refer your request to that customer or help the customer answer it, as our agreement provides. You can also complain to your local data-protection authority; in Korea, that is the Personal Information Protection Commission.
You can unsubscribe from marketing emails using the link in each email, and opt out of WhatsApp or other channel messages by replying as the message instructs. Opt-outs are recorded and checked before any later message is sent. We honor opt-outs within 10 business days at the latest.
8. Security and Breach Notice
We use access controls, encryption in transit and at rest, logging, vendor reviews and staff confidentiality duties to protect information in line with industry standards. If a breach affects personal information, we notify affected customers and, where required, individuals and regulators without undue delay: within 72 hours of becoming aware for Korean personal information, and within the deadline each US state or other country sets. Customers can reach us for security reports at the contact below.
9. Cookies and Website Analytics
Our marketing website uses cookies and tags from analytics and advertising providers to measure visits and the performance of our ads. These include Google Analytics, Google Ads and Microsoft Clarity, which records page interactions such as clicks and scrolling. Where the law requires consent, we ask for it before these tools load. You can control cookies in your browser settings and through the cookie banner on our website. Website analytics tools do not receive the content of connected Gmail or WhatsApp messages. We configure analytics so that it does not collect the content of connected messages.
10. Contact and Changes
Privacy officer: Sungsu Kim, CEO
Privacy requests and questions: hello@kzoneseller.com
Postal address: KZONE Co., Ltd., 151, Bundangnaegok-ro, KZONE (1004), Bundang-gu, Seongnam-si, Gyeonggi-do, Republic of Korea
We may update this policy. We post the new version with its date and, for material changes, tell customers by email or in the app at least 30 days before they take effect.