Announced :2026-09-07
Munch Factory Inc. ("Company," "we," "us," or "our"), a corporation incorporated under the laws of the Republic of Korea, operates the hourplace platform accessible at hourplace.co (the "Service"). The Service connects guests with photography studio and creative space hosts across Korea, enabling time-based reservations and payments.
This Privacy Policy explains how we collect, use, store, share, and protect personal information when you use hourplace.co. It also describes the rights available to you depending on your location.
This policy applies exclusively to users of hourplace.co (global site). Users of hourplace.co.kr (Korean-language domestic site) are subject to a separate privacy policy published on that site.
By registering for or using the Service, you acknowledge that you have read and understood this Privacy Policy. If you do not agree, please do not use the Service.
Data Controller
Controller Information
Munch Factory Inc. (주식회사 먼치팩토리) 4, Gangnam-daero 128-gil, Gangnam-gu, Seoul 06114, Republic of Korea Email: privacy@hourplace.co Business Registration No.: 494-81-00558
2-A. Information You Provide Directly
Fields marked "Required" are necessary to create an account and complete bookings; if you do not provide them, we may be unable to provide those services. Fields marked "Optional" can be withheld without affecting your core use of the Service.
2-B. Information Collected Automatically
2-C. Information Received from Third Parties
CCPA / CPRA — Categories of Personal Information
For California residents, the categories of personal information we collect include: Identifiers (name, email, IP address); Commercial information (booking history, payment records); Internet or network activity (usage logs, cookies); Geolocation data (approximate location derived from IP address); Inferences drawn from the above to create a profile about your preferences. We do not collect sensitive personal information as defined under CPRA beyond what is strictly necessary for payment processing, and we do not use or disclose it for inferencing.
We do not sell your personal information for monetary consideration. Where marketing cookies are active, we "share" online identifiers with advertising partners (e.g., Meta, Google) for cross-context behavioral advertising; you can opt out as described in Section 8-C. We do not use your personal information to make fully automated decisions that produce legal or similarly significant effects without human review.
Korea — PIPA
We process personal information in accordance with the Personal Information Protection Act of Korea (PIPA). Our legal grounds include: (a) consent of the data subject; (b) necessity for the performance of a contract to which the data subject is a party; (c) necessity for compliance with a legal obligation; and (d) necessity for the pursuit of the legitimate interests of the Company, provided that such interests are not overridden by the interests or fundamental rights of the data subject.
EU / EEA — GDPR Article 6
For users located in the European Economic Area (EEA), our processing is based on the following legal grounds under Article 6 of the GDPR:
California — CCPA / CPRA
We collect and use personal information for the business purposes described in Section 3. We do not "sell" personal information for monetary consideration. Where marketing cookies are active, we "share" online identifiers with advertising partners (Meta, Google) for cross-context behavioral advertising as defined under the CCPA/CPRA. You may opt out of this sharing at any time — see Section 8-C. We honor Global Privacy Control (GPC) browser signals as a valid opt-out request. Your rights under CCPA/CPRA are described in Section 8-C.
We retain personal information only for as long as necessary for the purposes described in this Policy, unless a longer retention period is required or permitted by law.
Following expiry of the applicable retention period, personal information is securely deleted or anonymized using methods that prevent recovery. Reviews (text, rating, photos) are retained for as long as the associated Space remains listed on the Service. Upon account deletion, your account and identifying information are deleted and your reviews are anonymized; the anonymized review text and rating remain published. Even after your name is removed, a photo may still identify you; you may request removal of any review photo that identifies you (for example, one showing your face) through the Help Center (Contact us) or at privacy@hourplace.co.
We engage the following third-party service providers to process personal information on our behalf. Each provider is bound by a data processing agreement and may only process personal information for the specified purpose.
Advertising partners
Where marketing cookies are active, we share online identifiers and usage data with Meta Platforms, Inc. and Google LLC to deliver and measure advertising on their platforms (cross-context behavioral advertising). These partners act as independent third parties, not as our processors. You can opt out via "Cookie settings" or, if you are a California resident, as described in Section 8-C; in the EEA/UK/Switzerland these cookies are set only with your consent.
Disclosure to Hosts
When a booking is confirmed, we share the following information with the relevant host to enable fulfillment of the reservation: guest name, contact phone number, booking details (date, time, headcount), and the guest message submitted at the time of booking (if provided). This disclosure is limited to information necessary for the specific booking and is made under the host's obligation to handle personal information in accordance with applicable law.
Disclosure to Authorities
We may disclose personal information to government authorities, law enforcement agencies, or courts where required by applicable law, valid legal process, or to protect the rights, safety, or property of the Company, our users, or the public.
Our primary data infrastructure is located in the Republic of Korea (AWS Seoul Region). When you access the Service from outside Korea, your personal information is transferred to and processed in Korea.
Some of our service providers operate in countries other than Korea (see Section 6). When we transfer personal information internationally, we ensure appropriate safeguards are in place as required by applicable law. Our advertising partners (Meta, Google) process data in the United States; such transfers rely on Standard Contractual Clauses or equivalent safeguards.
EU / EEA — International Transfer Safeguards
For transfers of personal information from the EEA to third countries (including Korea and the United States), we rely on the following safeguards:
You may request a copy of the relevant transfer mechanism by contacting us at privacy@hourplace.co.
AWS stores all platform data within the AWS Seoul Region (ap-northeast-2). Data may be replicated to backup locations within the same region for disaster recovery purposes.
8-A. General Rights (all users)
Regardless of your location, you have the right to:
To exercise these rights, contact us at privacy@hourplace.co or use the account management functions available in your Settings.
8-B. EU / EEA Residents — GDPR Rights
If you are located in the EEA, you have the following additional rights under the GDPR:
We will respond to verifiable requests within 30 days. In complex cases, this period may be extended by a further 60 days with notice. If you are not satisfied with our response, you have the right to lodge a complaint with your local data protection supervisory authority. A list of EU supervisory authorities is available at edpb.europa.eu.
8-C. California Residents — CCPA / CPRA Rights
If you are a California resident, you have the following rights under the CCPA/CPRA:
To submit a CCPA/CPRA request, contact us at privacy@hourplace.co with the subject line "California Privacy Request." We will respond within 45 days. If additional time is required, we will notify you within the initial 45-day period. You may designate an authorized agent to submit requests on your behalf. Authorized agents must provide written authorization signed by you, and we may require you to verify your identity directly.
8-D. Identity Verification
To protect your information, we will verify your identity before fulfilling privacy rights requests. Verification may require you to confirm your email address or provide additional information that matches our records. We will not fulfill requests where we cannot reasonably verify the requester's identity.
We use cookies and similar tracking technologies to operate the Service and improve your experience. Cookies are small text files stored on your device by your browser.
Cookie consent banner
If you access hourplace.co from the European Economic Area, the United Kingdom, or Switzerland, a cookie consent banner is displayed on your first visit, and non-essential cookies (functional, analytics, marketing) are set only following your affirmative consent ("Accept all"). Elsewhere, we rely on this notice instead of a banner, and you may opt out at any time via "Cookie settings" in the website footer or Settings page — your choice is honored in every region. We also honor the Global Privacy Control (GPC) signal sent by your browser.
Implementation note: The banner is shown based on the country of your IP address, determined at our CDN edge. Where the banner is not shown, analytics identifiers are withheld until your region has been determined, after which they are collected under this notice; an explicit "Only necessary" choice suppresses them for as long as that choice stands. Your choice is stored in a client-side cookie (cookie_consent) for 12 months. For full details on cookies used, see our Cookie policy.
You may also control cookies through your browser settings. Note that disabling certain cookies may affect the functionality of the Service, including the ability to log in and complete bookings.
Third-Party Analytics
We use Google Analytics to analyze usage of the Service. Google Analytics sets cookies that collect information about your use of the Service in an anonymized form, which is transmitted to and stored by Google. You can opt out of Google Analytics by installing the Google Analytics Opt-out Browser Add-on at tools.google.com/dlpage/gaoptout.
The Service is not directed to individuals under the age of 16 (or the applicable minimum age in your jurisdiction under applicable law, including 16 for GDPR purposes). We do not knowingly collect personal information from children under 16. If you are a parent or guardian and believe your child (under 16) has provided us with personal information, please contact us at privacy@hourplace.co and we will promptly delete such information.
Users between the ages of 16 and 17 (or the applicable minimum age of legal capacity in their jurisdiction) must obtain consent from their legal guardian before using the Service. Where a booking is made by a minor, the legal guardian may cancel the booking on behalf of the minor.
Privacy Enquiries (General)
Privacy Contact
Munch Factory Inc. — Privacy Team Email: privacy@hourplace.co Operating hours: Monday–Friday, 10:00–17:00 KST (excluding Korean public holidays) Response time: Within 7 business days for general enquiries; within 30 days for formal rights requests
Data Protection Officer (PIPA)
DPO/CPO — Korea (PIPA)
Chief Executive Officer: Young Seok Seo (서영석) Email: privacy@hourplace.co
Supervisory Authorities
If you are not satisfied with our response to a privacy concern, you may contact the following authorities:
We may update this Privacy Policy from time to time to reflect changes in our practices, legal requirements, or operational needs. When we make changes, we will revise the "Effective" date at the top of this Policy and publish the updated version at hourplace.co/privacy.
For material changes that significantly affect how we collect, use, or share your personal information, we will provide at least 30 days' advance notice by:
If you continue to use the Service after the updated Policy takes effect, you will be deemed to have accepted the changes. If you do not agree to the updated Policy, you may terminate your account before the effective date
We encourage you to review this Policy periodically to stay informed about how we protect your information.
This Privacy Policy takes effect from 2026-09-07 Announced: 2026-09-07 Effective: 2026-09-07 Version: 1.4