Privacy policy

1. Purpose and scope

Room Lab publishes this policy under Article 30 of the Republic of Korea’s Personal Information Protection Act (PIPA). Data is processed to provide the service, answer inquiries, protect the site, analyze visits and operate advertising. Additional consent is obtained before a change that requires it. There are no accounts, payments or file uploads. We do not request sensitive data, national identity numbers or precise location.

2. Data, collection and legal grounds

• Room dimensions, furniture types, sizes, positions and language choices stay in your browser (localStorage and a cookie) and are never sent to the operator’s server. The operator does not collect them. Opening a link made with “Copy link” does send that URL to the hosting provider (see section 9).
• Your email address, display name, message and voluntary attachments are processed to answer your request (Article 15(1)(4)). Do not send unnecessary personal information.
• IP address, request time and URL, and browser/device information reach the hosting provider (Cloudflare) automatically; Cloudflare works out an approximate country from the IP address. Transmission needed to provide the service falls under Article 15(1)(4). Separate security processing relies on legitimate interests only where Article 15(1)(6) requirements are met.
• Google Analytics and AdSense may process cookie/online identifiers, page visits, referrals, device/browser data, usage and ad impressions/clicks. Collection, disclosure and overseas transfers requiring consent occur only after the relevant consent is obtained.

3. Retention

• Layout localStorage (gonggan-lab-layout-v1) and language localStorage remain until you clear site data or your browser removes them.
• The roomlab_lang cookie lasts up to one year after setting/resetting, unless deleted earlier.
• Inquiry emails are deleted within three months after resolution. Where a dispute or legal retention duty requires longer storage, we identify the basis, period and items and keep only what is needed separately.
• Cloudflare request/security records follow the relevant contract and feature policies. The operator has no separate layout database or access-log store.
• Google Analytics user- and event-level data is deleted automatically after two months, the GA4 default. Aggregate reports follow Google’s separate rules.
• AdSense cookie and record retention varies by cookie, user settings and Google’s advertising/security retention policies linked below.

4. Disclosure and processing providers

We do not sell personal data or disclose it outside the stated purposes without a legal basis or separate consent. Cloudflare, Inc. provides Pages hosting, content delivery, security and initial language routing. Google LLC provides Analytics statistics and AdSense ad delivery/measurement. Inquiry emails arrive in the operator’s personal Gmail account, which is governed by Google’s terms of service and privacy policy rather than a separate entrustment contract. Work done by Cloudflare is covered by Cloudflare’s customer data processing addendum (DPA), including safeguards, access restrictions, subprocessor control and deletion duties. Processing by Google or advertising partners for their own purposes follows their policies; this does not remove our duty to establish any required legal basis.

5. Cloudflare Pages

Room Lab uses Cloudflare Pages to host and deliver this website. IP addresses and request information are processed for delivery and security. Cloudflare estimates the country from the IP address, and that estimate is used only to choose the first language; no GPS is used and the operator does not separately retain country data. Fonts are served by this site.

See Cloudflare’s privacy policy and contact options and its data processing addendum.

6. Google Analytics

Google Analytics is the service’s tool for visit statistics and usability improvement. Cookie identifiers and visit/event information are transmitted to Google. We do not include names, emails or raw room layouts in analytics events.

Shared addresses containing layout data are excluded from visit statistics.

See Google’s partner-site data practices, retention settings and the Analytics opt-out browser add-on.

7. Google AdSense and behavioral data

Room Lab uses Google AdSense as its advertising service to help fund operations.

Google and third-party vendors may use cookies or similar technologies to serve ads based on visits to this and other websites. Cookie identifiers, IP address, browser/device information, visits, impressions and clicks may be processed for ad delivery, personalization, measurement and fraud prevention.

Manage or refuse personalization in My Ad Center and participating third-party cookies through industry opt-out choices. Refusing personalization does not remove all ads. See Google ad technology providers, Google advertising technologies and Google’s privacy policy. Consent required by law or Google policy must be obtained before ads operate in affected regions.

8. International transfers

Because Room Lab relies on the overseas providers below, some data is processed and stored outside Korea. Visiting the site or the publication of this policy does not count as consent to a transfer.

Hosting through Cloudflare is entrusted processing and storage needed to provide the service, notified through this policy under PIPA Article 28-8(1)(3). Transfers for Analytics and AdSense happen only with consent under Article 28-8(1)(1). Inquiry emails are transferred only when you choose to email the operator’s Gmail address; if you don’t email, nothing is transferred.

You can block the Analytics and AdSense transfers by refusing or withdrawing consent and keep using the planner. Refusing the transfers needed for hosting means the site can’t be shown; you can ask the operator to stop processing or delete your data.

9. Cookies, local storage and controls

Language cookies and localStorage retain preferences and restore layouts. Use Chrome/Edge Settings → Privacy and security → Cookies/site data, or Safari Settings → Privacy → Manage Website Data to block or delete them; menus vary by version. Clearing site data removes saved layouts and preferences. Blocking cookies may prevent settings from persisting.

Editing happens in your browser. “Copy link” embeds the layout in the URL. Opening that link sends the URL to the host; it may also remain in browser history or the services used to share it. Do not include names or addresses in shared layouts.

10. Deletion

Data no longer needed is deleted without delay. Operator-held electronic files are deleted to prevent recovery; emails are removed from trash and paper copies, if any, are shredded. Legally required records are stored separately and destroyed after their retention period. Browser-held data can be removed using site-data controls.

11. Your rights and children

You or an authorized legal representative may request access, correction, deletion, processing suspension or withdrawal of consent at [email protected]. After minimal identity/authority checks, we act within statutory periods and report the result. Restrictions are explained with their legal grounds. Withdrawal does not affect prior lawful processing.

We do not intentionally collect children’s personal data on the basis of consent without the legal representative’s consent required for children under 14. Any future collection requiring that consent will include a prior verification process. Improperly collected children’s information will be investigated and deleted as required. We do not make fully automated decisions with significant effects or combine pseudonymized datasets.

12. Security

Measures include limiting personal-data access, protecting accounts, applying security updates, HTTPS transport and deleting unnecessary information. If a breach is discovered, we follow applicable notification, reporting and harm-reduction duties.

13. Privacy officer and remedies

Operator and privacy officer: 호두. Responsible for privacy protection and complaints. Contact: [email protected].

External assistance: KISA Privacy Infringement Report Center and the Personal Information Dispute Mediation Committee.

14. Changes and related documents

Effective November 6, 2026. Material changes and effective dates will be published on this site; processing requiring additional consent starts after that consent. Previous versions, where applicable, will be made available with the change history. See the Terms of use for service conditions.