The types of purchaser information we hold are as described in our privacy policy. The information we actually hold depends on the payment method the purchaser chose.
Types of information we hold
The items listed in our privacy policy for "customers using the services of our merchants" are as follows.
- Information items: name, phone number, credit card information (card number, cardholder name, expiration date, security code), email address, IP address, user agent, and transaction information
- Purposes of use: providing payment services; responding to and requesting inquiries, fraud reports, chargebacks, and attribute inquiries with payment institutions; detecting and preventing fraudulent use; updating account information; and responding to inquiries
Why do the items leaked from the CRM (such as address and date of birth) differ from those in the privacy policy?
Our inquiry records (CRM system) include information that purchasers wrote or sent themselves when contacting us. For this reason, they may include information not listed in the privacy policy, such as addresses and dates of birth.
Do you still hold data on purchasers who paid in the past (e.g., in 2024)?
We keep and manage data securely to the extent necessary, using the legal retention period under tax and other laws (in principle, seven years) as a minimum, in order to respond to past transaction inquiries, detect and prevent fraud, and prepare for audits and disputes. We are also continuously reviewing our company-wide policy on the data lifecycle and on appropriate deletion after the retention period ends.
Can you delete our purchasers' data?
Transaction data cannot be deleted. Inquiry records (inquiry history and submitted documents) can be deleted after identity verification. We are unable to tell you the retention period of inquiry records or the period covered by the leak at this time. If you have any questions or concerns, please contact our dedicated address, security-contact@komoju.com.