1. General
Chingu is a marketplace where sellers from the Republic of Korea sell to shoppers in Kyrgyzstan, Russia and other CIS countries. Orders are delivered to a pickup point in Bishkek. The operator that decides why and how the data is processed is [확인 필요: 상호] (details under "Contact").
This policy covers shoppers on the website and in the app. Sellers and warehouse staff are covered by the separate rules of the Seller Center and the staff apps.
By using the service you also accept the Terms of Use.
2. Data we collect
- Account: e-mail, name, password and your chosen language (Russian, English or Korean). The password is stored only as a one-way hash (bcrypt); we never see or keep the password itself.
- Profile phone number, optional: you can save a number so that it is filled in when you place an order. You can change or remove it at any time under Profile, Personal info.
- Customs details: surname and given name in Latin letters (as in the passport), passport number, passport issue and expiry dates, city, home address and postal code. We do not ask for a tax ID / personal number (INN / PIN) or date of birth. We ask for them only at checkout and in your profile (Profile, Delivery and customs details) for customs clearance and delivery of the parcel. If you tick "Save my details for next orders", they are kept in your profile and filled in for your next orders; you can edit or delete them there.
- Orders: items, quantities, amounts, statuses, recipient name and phone number, pickup point, order and parcel numbers, pickup code, delivery history, the international shipping fee and whether it was paid.
- Shopping and interests: cart, wishlist, followed shops and recently viewed products (up to the last 200, for at most 90 days).
- Reviews: rating, text and the photos you add to a review.
- Notifications: in-account notifications, notification settings and the device token for push notifications in the app.
- Security: sign-in sessions and refresh tokens (stored as hashes) and sign-in attempt counters per e-mail and IP address. The IP address is stored only as a hash and deleted after about 30 minutes.
- Links in e-mails: one-time links to reset your password and to confirm a new e-mail address. We store only a hash of the link (and, for an e-mail change, the new address until it is confirmed). A password reset link is valid for 30 minutes, an e-mail confirmation link for 24 hours.
- AI assistant: anonymous statistics only, without the text of your questions (see section 6).
We ask for passport data only for customs clearance, in the order form and in your profile as described above; there is no need to share it with the AI assistant (section 6). We do not ask for precise location, phone contacts or bank card data. We do not use advertising trackers or third-party web analytics.
3. Why we use the data
- To create your account, sign you in and keep you signed in (performing our agreement with you).
- To send service e-mails: password reset links, confirmation of a new e-mail address and account security notices (performing our agreement with you). We do not send marketing e-mails.
- To place and fulfil orders: pass them to sellers, pack them, ship them to Bishkek and hand them over against your pickup code.
- To transport the parcel and clear it through customs: pass the recipient name, phone number, pickup point and customs details (surname and given name as in the passport, passport number, passport issue and expiry dates, address and postal code) to our logistics and customs partners (performing our agreement with you and customs law requirements).
- To keep you informed about orders: in-account notifications and push notifications if you allowed them (your consent, which you can withdraw in settings).
- To show your wishlist, recently viewed products and recommendations.
- To fill in your name and phone at checkout, if you saved a phone number in your profile.
- To protect accounts and the service: limit sign-in attempts and requests and detect abuse (legitimate interest).
- To publish your reviews on product pages.
- To keep order and seller settlement records as required by law (legal obligation).
4. Payments
Order payments currently run in test mode: no real money is charged. We do not receive or store card numbers or other payment details.
International shipping is paid when you collect the order at the pickup point; we only store the amount and the fact that it was paid.
5. Pickup point and pickup code
Orders are handed over at the pickup point in Bishkek. Each order gets a pickup code shown under "My orders". Pickup staff check the code and the parcel numbers so the order goes to you.
Warehouse staff in Korea and pickup staff in Bishkek see only the order data they need for packing and handover. Sellers see the items and amounts of an order, but not your name, phone or e-mail.
6. AI shopping assistant
Questions to the AI assistant are processed by a language model running on our own server. The text is not sent to third-party AI services.
Conversations are not stored on the server: the history stays in your browser tab and is cleared when you close it. If you are signed in, the assistant may look up the status of your orders to answer; your name, phone, address and pickup code are never passed to the model.
For 90 days we keep only anonymous request statistics (request type, outcome, language, response time) — no text, no user ID and no IP address. Request rate limiting uses a hash of the IP address that is kept only in server memory.
Please do not share personal data such as passport details, passwords or card numbers with the assistant.
7. Push notifications
If you allow notifications in the app, we store your device token and link it to your account. Notifications are sent through the Expo Push service, which delivers them through Firebase Cloud Messaging (Google) and, on Apple devices, the Apple Push Notification service. These services receive the device token and the notification text (for example an order status).
You can turn notifications off in your account settings or in the phone settings. After you sign out, no notifications are sent to that device; deleting your account deletes the tokens of all devices.
10. Where data is stored and cross-border transfer
The server, the database and uploaded photos are hosted on Google Cloud in the Seoul region (Republic of Korea). Database backups are also kept in the Tokyo region (Japan).
Service e-mails are sent through Resend, Inc., so the recipient's address and the text of the e-mail are transferred to the USA.
To transport the parcel and clear it through customs, the recipient name, phone number, pickup point and customs details are transferred to our logistics and customs partners, including in Kyrgyzstan, the parcel's destination country.
Our shoppers live in Kyrgyzstan, Russia and other CIS countries, so their data is transferred to and stored outside their country of residence — in the Republic of Korea and Japan. The transfer is needed to fulfil orders and run your account. By creating an account and placing orders you agree to this transfer.
11. How long we keep data
- Account data — as long as the account exists.
- Recently viewed products — up to 90 days.
- Sign-in attempt counters — about 30 minutes; sign-in sessions — up to 7 days after they expire.
- Links in e-mails — deleted 7 days after they are used or expire, and at once when the account is deleted.
- Anonymous AI assistant statistics — 90 days.
- Orders and seller settlements — in anonymised form for as long as accounting and tax rules require [확인 필요: 법정 보관 기간].
- Customs details: in your profile until you change or delete them (or delete your account); on an order for as long as customs law requires, then deleted [확인 필요: 통관 자료 법정 보관 기간].
- Database backups — up to 8 weeks on the server and 30 days in Tokyo; after an account is deleted its data disappears from backups as they are replaced.
12. Deleting your account
You can delete your account yourself: Profile → Delete account (your password and a confirmation word are required). Deletion is immediate. Orders in progress must first be collected or cancelled; unpaid orders are cancelled automatically.
Deleted: name, e-mail, profile phone number, saved customs details, password, cart, wishlist, followed shops, viewing history, notifications, device tokens and all sign-in sessions. Kept in anonymised form: order history (without recipient name, phone number and customs details) for accounting, and reviews, signed "Deleted user".
More on the Delete account page.
13. Your rights
- Find out what data we hold about you and get a copy.
- Correct inaccurate data. You can change or remove your name, phone number and customs details yourself in your profile.
- Delete your account and data (section 12).
- Withdraw consent — for example turn off push notifications — and object to processing.
- Complain to the data protection authority of your country or of the Republic of Korea.
To use these rights, write to the e-mail under "Contact". We may ask you to confirm that the account is yours.
14. Children
The service is not directed to children under 14 [확인 필요: 연령 기준 확인], and we do not knowingly collect their data. If you believe a child has registered without parental consent, contact us and we will delete the account.
15. Security
Connections to the service use HTTPS. Passwords and tokens are stored as hashes, sign-in attempts are limited, staff access to data is limited to their tasks, and internal panels are reachable only from allowed addresses.
16. Changes to this policy
We may update this policy when the service or the law changes. The date of the last update is shown at the top. We will announce significant changes on the site or in a notification.
17. Contact
Send questions about personal data and requests about your rights to the address below.
- Company name
- [확인 필요: 상호]
- Business registration number (Korea)
- [확인 필요: 사업자등록번호]
- Mail-order business report number
- [확인 필요: 통신판매업 신고번호]
- Address
- [확인 필요: 사업장 주소]
- Representative
- [확인 필요: 대표자]
- Privacy officer
- [확인 필요: 개인정보 보호책임자]
- Contact e-mail
- [확인 필요: 연락처 이메일]