Privacy Policy

1. What We Collect

When you create an account or use the Services, you give us:

• Names (English and Korean)
• Personal email address (used to sign in) and work or university email address
• Password, unless you sign in with Google
• Organisation, occupation, and job title
• Research specialties, and your highest degree with its field and awarding institution
• Interests, LinkedIn URL, and a profile photo — all optional

This information is needed to run a member account. You can browse public pages without it, but not register or book tickets.

If you sign in with Google, Google gives us your name and email address. We use them only as described here. We do not obtain personal information from data brokers, advertisers, or any other source.

Payments. Card details are handled entirely by Stripe and never reach us. We store only a payment reference.

Automatically. Our hosting provider records standard server logs — IP address, browser type, pages requested, and time — for security and diagnostics, and keeps them for a short period. We do not use analytics, advertising networks, tracking pixels, or behavioural profiling.

We do not process special category (‘sensitive’) personal information.

2. How We Use It, and Our Legal Basis

Our legitimate interests are keeping accounts and the platform secure, preventing fraud and misuse, running and improving a community service for our members, and responding to people who contact us. We have weighed these against your rights, and you can object at any time (section 8). Where we rely on consent, you can withdraw it at any time by emailing us.

3. Who We Share It With

Only these service providers, who process it on our instructions and under contract with us:

• Supabase — database hosting, servers in the EU/EEA (privacy policy)
• Stripe — payment processing (privacy policy)
• Google — sending our emails, and sign-in if you use it (privacy policy)
• Vercel — hosting; our site runs on their infrastructure, so requests and server logs pass through it (privacy policy)

International transfers. Our database is in the EU/EEA, which the UK recognises as providing adequate protection. Stripe, Google, and Vercel are US-based; those transfers rely on the UK International Data Transfer Agreement or the UK Addendum to the Standard Contractual Clauses. Contact us for details.

Their own use. We remain responsible to you for what we entrust to these providers. Some also use information for their own purposes as independent controllers — Stripe for fraud prevention and its own regulatory duties, Google for your Google account. That is governed by their policies, not ours; please read them using the links above.

We may transfer your information in connection with a merger, sale of assets, financing, or acquisition. We do not sell your personal data or share it with advertisers.

4. Cookies

We use only the cookies needed to sign you in and keep your account secure. These are strictly necessary and do not require consent under UK law. We use no advertising cookies, tracking pixels, or third-party analytics.

Your sign-in expires after 30 days and is not extended by continued use, so you will be asked to sign in again at least that often. If you block cookies you will not be able to sign in.

5. How Long We Keep It

• Account data — while your account is active.
• Profile data — erased immediately when you delete your account. Deletion is available directly from your profile page and takes effect the moment you confirm it: your names, both email addresses, organisation, occupation, education, specialties, interests, LinkedIn URL, profile photo, and password are removed, and you are signed out on every device.
• Order and payment records — at least 6 years from the transaction, as UK financial record-keeping requires. This includes a record of when each order was confirmed, cancelled, rejected, or refunded, so we can answer questions about a booking. After you delete your account these records remain, with no personal details attached.

Backups. Our database provider keeps routine encrypted backups for disaster recovery. Deleted information may persist there until they are overwritten in the normal cycle. Backups are used for nothing else.

Stripe. If you paid for a ticket, Stripe holds its own record of that transaction under its own obligations. Deleting your KULSA account does not remove it.

6. How We Keep It Safe

• Everything is encrypted in transit and at rest.
• We never store your password. We keep only a scrambled version that cannot be turned back into the original — not by us, and not by anyone who obtained a copy of our database. We can help you set a new one, but can never tell you the old one.
• Your browser never talks to our database directly. Every request passes through our servers, which check who you are and return only your own information.
• We never see your card details. Stripe handles payments, and its systems are certified to the payment industry’s security standard.

No system can be guaranteed completely secure, so please use the Services within a secure environment.

7. Children

The Services are for people aged 18 and over. We do not knowingly collect information from under-18s. If we learn that we have, we will deactivate the account and delete the data. Contact us at ask.kulsa@gmail.com if you believe this has happened.

8. Your Rights

Under UK GDPR you have the right to access your data, have it corrected or erased, restrict or object to how we use it, receive it in a portable format, and withdraw consent where we rely on it. We do not make automated decisions about you.

You can act on most of this yourself. Review and change your details on your profile page, or delete your account from Profile → Personal details → Delete my account — no request or waiting period. We keep order and payment records as the law requires, with no personal details attached.

For anything else, or if you have lost access to your account, email ask.kulsa@gmail.com and we will respond within 30 days. If you think we are handling your information unlawfully, you can complain to the UK Information Commissioner’s Office (ICO).

9. Changes to This Notice

We may update this notice. The date at the top shows when it last changed, and we will tell you directly if the changes are material.

10. Contact Us

Email ask.kulsa@gmail.com, or write to: