Revised: 29 October 2026
BRIGHTON AI HOLDINGS PTY LTD (the "Company") values the personal information of customers who use the FROMKO app, website and purchasing agency service (the "service").
This Privacy Policy explains what personal information the Company collects, who receives it, how long it is kept and what rights customers have.
1. Company information
Company name: BRIGHTON AI HOLDINGS PTY LTD
ABN: 67 692 023 135
ACN: 692 023 135
Registered address: Level 19, 144 Edward St, Brisbane City QLD 4000, Australia
Service name: FROMKO
Privacy enquiries: info@brightongroup.ai
2. Personal information we collect
The Company collects the following as necessary to provide the service.
(a) Account information
• email address and password (email sign-up); the authentication service stores passwords in irreversible form;
• for Google, Apple or Kakao sign-in, the account identifier, email address, name and profile image address from that service (Kakao: email address only);
• name, display language and time zone;
• an optional notification phone number with country code, collected only if phone messages are selected; it can be changed or removed in Settings > Notification settings; and
• records of terms, policies and optional consents accepted or withdrawn, with the wording version.
The Company does not currently collect gender or date of birth. Values entered previously are handled under sections 12 and 13.
(b) Order, delivery and customs information
• delivery address (recipient name, contact number, address, postcode, destination country), stored encrypted;
• ordered products, retailers, options, quantities, amounts, payment status and order history;
• recipient information needed for customs (the delivery address fields); the Company does not currently collect a separate customs identifier and will give notice before collecting one; and
• warehouse inspection records and photos, shipping country and tracking number.
(c) Payment information
Payments are processed on a Stripe payment page. Stripe receives card details directly; the Company does not store them and receives only payment status, amount, currency and transaction identifiers.
(d) Customer support and AI features
• customer support conversations, return and refund requests and handling records;
• questions to the original mall page assistant, with the address, title and on-screen text of the retailer page being viewed;
• photos and text entered in AI product search, and the results; and
• photos and product addresses shared to FROMKO from other apps.
(e) Collected automatically
• IP address, for security and abuse prevention (request rate limits);
• device type, operating system, app version and display language;
• access times and usage records (screens, features, cart and order steps, errors);
• search terms entered on the site;
• campaign values (utm_source, utm_medium, utm_campaign, utm_term, utm_content) and ad click identifiers (gclid, fbclid, ttclid); the Meta Pixel on the website's app introduction page also sends utm_id (section 7);
• cookie and on-device identifiers (section 7), the Google Analytics client ID and the Firebase app instance ID;
• the Google Play install referrer of the Android app;
• with advertising measurement consent in the Android or iOS app (on iOS, only if app tracking is also allowed), the advertising ID and device information collected by the Meta SDK (section 7A);
• push notification tokens and the device operating system type; and
• web page performance metrics.
The Company does not intentionally collect unnecessary sensitive information or precise location information.
3. How we collect personal information
The Company collects personal information directly from customers when they sign up, order or use support and AI features; automatically through cookies, SDKs and similar technologies; and from Stripe, warehouse providers and carriers.
Customers may decline to provide some information, but the related services cannot be used without information needed for ordering, payment, delivery or identity verification. Customers who decline optional consents can still use all basic purchasing services.
4. Purposes of use
• account creation, sign-in and identity verification (including verification emails);
• receiving orders, purchasing Korean products, payment confirmation and fraud prevention;
• warehouse inspection, packing, international shipping, customs, delivery tracking, cancellations, returns and refunds;
• customer enquiries and disputes (including AI support), the mall page assistant and AI product search;
• product safety information and recall notices;
• order and delivery notifications by app push, KakaoTalk AlimTalk or text message (order receipt, payment, purchase progress, inspection, shipping fee requests, shipment, delivery and refunds); advertising is not sent to phone numbers;
• usage statistics, service improvement, and measurement of traffic sources and advertising performance;
• with separate consent, advertising measurement, personalised advertising and retargeting in the Android and iOS apps (section 7A);
• marketing with the customer's consent;
• service operation, error fixing, security and abuse prevention; and
• legal, tax, accounting and regulatory obligations.
Where required by law, the Company relies on contract performance, legal obligations, consent or legitimate interests.
5. Disclosure of personal information and processors
The following recipients receive or process personal information as necessary for the service.
(a) Processors
• Supabase, Inc.: database, authentication and file storage for all service data, in the Republic of Korea (Seoul) region.
• Vercel, Inc.: website and server hosting in the Republic of Korea (Seoul) region, web performance measurement (Speed Insights) and AI request routing (AI Gateway), which routes AI customer support requests to OpenAI and other AI feature requests to Google; the AI Gateway processing region can vary by request (section 6A).
• Stripe: payment processing; amount, currency and internal order and member identifiers.
• Google LLC: verification emails (Gmail), usage statistics (Google Analytics 4, Firebase Analytics), Android push delivery (Firebase Cloud Messaging) and the Gemini language model for the mall page assistant, AI product search and product translation (section 6A).
• OpenAI, L.L.C. (United States): the language model and web search for AI customer support; receives the support information listed in section 6A through Vercel AI Gateway.
• 650 Industries, Inc. (Expo): push notification relay; push tokens and notification content.
• Apple Inc.: iOS push delivery (APNs).
• NHN Cloud Corp. (Republic of Korea): KakaoTalk AlimTalk and text messages; phone numbers and message content, delivered through Kakao Corp.'s KakaoTalk; held until the contract ends or the customer withdraws.
• Onestop (Republic of Korea): warehouse receiving, inspection, packing and dispatch; a pseudonymous customer code, ordered products, inspection photos, shipping country and tracking number.
• Onestop (Republic of Korea): international shipping labels and dispatch by Korea Post EMS; recipient name, address, contact number and delivery country.
(b) Other recipients
• Korean online retailers receive the Korean warehouse address and a pseudonymous customer code, not the customer's name or address.
• Carriers (Korea Post EMS), local delivery companies, customs authorities and brokers receive the recipient name, address, contact number, product information and, where required, a customs identifier.
• Korea Post's delivery tracking service receives the international tracking number when delivery status is checked.
• Google, Apple and Kakao receive sign-in requests when the customer chooses that sign-in.
• Meta Platforms receives the data in section 7A only from customers who consent in the Android or iOS app (on iOS, only if app tracking is also allowed), and the Meta Pixel data in section 7 only from visitors who accept the consent banner on the website's app introduction page, and uses it for advertising measurement, optimisation and ad delivery under its own privacy policy.
• card companies, banks and payment providers; the Company's accountants, auditors, lawyers and advisers; and courts, government agencies or regulators where required by law.
The Company discloses no more than is necessary for these purposes. In a merger, business transfer or restructure, relevant information may be disclosed to potential acquirers or advisers with reasonable safeguards. The Company does not sell personal information.
6. Overseas disclosure of personal information
The Company is an Australian company, and service data is stored in the Republic of Korea (Seoul). Personal information may be disclosed to or processed in:
• the Republic of Korea (data storage, servers, purchasing, warehouse operations, notifications);
• the United States, where Supabase, Vercel, Stripe, Google, OpenAI, Expo, Apple and Meta Platforms are headquartered and may access or process information;
• Australia and Ireland, where Stripe's contracting entity (Stripe Payments Australia Pty Ltd) and data processing party (Stripe Payments Europe, Limited) are located; Meta Platforms' contracting entity is Meta Platforms, Inc. in the United States;
• the delivery country (Canada, the United States, Japan, Australia or New Zealand); and
• other countries where these providers process data.
The Company applies contracts and reasonable safeguards before overseas disclosure. Overseas recipients may be subject to local law and government requests.
6A. Customs information and AI features
The Company does not currently collect a separate customs identifier. Customs identifiers or documents are requested only if actually required for the destination and order; a Korean personal customs code is not required in every country. Delivery addresses are stored encrypted and used only for delivery and customs.
The Company uses external language models through Vercel AI Gateway for the features below. AI customer support uses OpenAI's language model; the mall page assistant, AI product search and product translation use Google's Gemini language model. AI customer support requests are sent to OpenAI, L.L.C. through the AI Gateway of Vercel, Inc. (United States):
• AI customer support: support messages and the last 12 conversation turns, up to 3 summaries of earlier conversations, support notes, the default shipping country, the label, country and default flag of saved addresses, the number of orders, and for up to 20 recent orders (plus any order the customer selects in the conversation) the status, amount paid, products, retailers, delivery stage and whether a request can be handled, as well as requests the customer has submitted and self-service change records. Before sending, the Company masks card numbers, passport numbers, Korean personal customs codes, email addresses, phone-number-like strings, Korean road-name and English street address-like strings and address strings saved in the address book, and replaces strings that match the name, email address or phone number in the member profile. Values the customer enters in a task panel in the support screen, such as a delivery address change, are sent without masking so the request can be processed; a staff member takes over if the AI cannot answer or the customer asks;
• the original mall page assistant: the question, the retailer page address, title and on-screen text, and the product name, price and options read by the app;
• AI product search: photos and text entered by the customer; and
• product translation: retailer product information only, without customer personal information.
In AI customer support, the AI may use OpenAI's web search tool to find public information needed for an answer. Search queries the AI creates from the conversation are processed by OpenAI in the United States or Europe. Web search is not used while a task panel is open in the support screen.
OpenAI does not use inputs and outputs received through its API to train models, and keeps them for up to 30 days for abuse monitoring (longer where required by law). The Company turns off OpenAI's response storage for support requests. Vercel AI Gateway does not record prompts or responses and keeps only metadata such as request status, model and token usage for 30 days. The processing region of AI Gateway can vary by request and can be outside the Republic of Korea.
Customers may request information about AI processing and human review.
Customs identifiers, addresses and payment information are not used for statistics, advertising or unnecessary AI inputs.
7. Cookies, SDKs and analytics technologies
Strictly necessary
• sign-in (fromko-web-auth, fromko-web-auth-prev), guest cart (fromko-guest-cart), language and display mode (fromko_locale, fromko_color_scheme), recently viewed products and home display (fromko_recent_products, fromko_home_outline); and
• sign-in information, settings and advertising measurement consent status in the app's on-device storage.
Usage statistics
• Google Analytics 4 (website) and Firebase Analytics (Android app) measure screen views, feature use, search terms, cart and order steps and traffic sources for all visitors, distinguishing devices by cookies (such as _ga) or the app instance ID. They are not linked to the member account without consent.
• Page addresses keep only the path and the values listed in section 2(e); other values are removed. Analytics tools are not loaded on the payment page.
• For completed payments, shipping fee payments and refunds, the Company's server sends the order number, amount, product names, retailers, quantities and the browser identifier recorded at payment to Google Analytics 4.
• Firebase Analytics does not collect the advertising ID. The install referrer is used to measure install sources.
• Cookies holding the sign-in method (fromko_signup_method, fromko_login_method, fromko_reset_done) are kept for up to 5 minutes so that a sign-up, sign-in or completed password reset is recorded once in usage statistics.
Advertising measurement
• The Android and iOS apps contain the Meta SDK, which operates only with consent under section 7A. In the iOS app it operates only if app tracking is also allowed on the device (App Tracking Transparency).
• The website's app introduction page contains the Meta Pixel, which operates only if the visitor accepts the consent banner on that page. It then sends page views, clicks on app store links and the page address (including the campaign values utm_source, utm_medium, utm_campaign, utm_id, utm_term and utm_content and the ad click identifier fbclid) to Meta Platforms. Information Meta Platforms collects while the Meta Pixel operates is governed by the Meta Platforms privacy policy. The choice is stored in browser storage. The Meta Pixel does not operate on screens inside the app.
Customers can block cookies in their browser and reset the advertising ID in device settings; blocking necessary cookies may stop sign-in and the cart from working.
7A. Usage statistics and advertising measurement (optional consent)
With the "Usage statistics and advertising measurement consent (optional)", the Company carries out the following processing.
(a) Account-linked usage statistics
A per-member analytics identifier is attached to Google Analytics 4 and Firebase Analytics statistics. It is a random value created by the Company and contains no email address, name or phone number. It is used to analyse usage and order conversion across devices and visits.
(b) Advertising measurement, personalised advertising and retargeting in the apps
The Android and iOS apps send the following to Meta Platforms (Facebook and Instagram ads). The iOS app sends it only if app tracking is allowed on the device:
• events: sign-up, search (without the search term), product view, add to cart, checkout start, payment method entry and purchase;
• event details: FROMKO product number, quantity, unit price, amount, currency (USD) and order number (to prevent duplicate purchase events); and
• data the Meta SDK collects automatically: advertising ID (on iOS, the advertising identifier), device type, operating system, app version, language, IP address, and launches and installs of the Android app.
A purchase event is sent only for the customer's own paid order, within 7 days of payment, if payment was started on that device. The amount is the product amount, excluding the agency fee and shipping fees.
Meta Platforms uses this information to measure whether FROMKO ads led to installs, sign-ups and purchases, optimise FROMKO ad delivery, show ads based on the customer's interests (interest-based targeting), and show FROMKO ads again to people who used the FROMKO app (retargeting).
Search terms, customs identifiers, payment method information, delivery addresses, email addresses and phone numbers are not sent to Meta Platforms. The Company does not store the advertising ID in order records.
(c) Consent and withdrawal
• This consent is optional; all features remain available without it.
• Consent can be changed at any time in My > Settings. Withdrawal stops account linking and sending to Meta.
• Nothing is sent to Meta, and statistics are not linked to an account, on a signed-out device.
• The advertising ID can be deleted or reset in Android Settings > Privacy > Ads.
• On an iOS device, tracking permission for FROMKO can be turned off in Settings > Privacy & Security > Tracking. The iOS app then sends nothing to Meta.
• If the wording changes to add a new recipient or a new purpose, information is not sent to that recipient or used for that purpose for customers who agreed to earlier wording until they agree to the new wording. Sending to Meta from the iOS app has the same recipient and purpose as the existing consent and follows the existing consent (section 16).
Country-specific promotions use the selected shipping country and language, not precise location. Purchase or marketing consent is not consent to give contact details or order information to advertisers or retailers.
7B. Influencer referral links, codes and discounts
The Company uses influencer referral links and codes to apply referral discounts, identify the referral source of an order, and calculate and settle influencer commissions. It also uses the related records to prevent duplicate use or use above a code's limit, and to handle payment cancellations, refunds and settlement disputes.
When a referral link opens the app, the Company records the influencer identifier, link-entry identifier, entry time and entry route (link or install referrer). If the app supplies an installation identifier, that value is also recorded. On Android, the Company reads the referral source in the Google Play install referrer to process a link entry on the first launch.
The web screen inside the app stores a cookie (fromko-inf-entry) containing the link-entry identifier for up to 24 hours. This also applies when the customer follows the link before signing in. A later referral-link entry replaces the earlier one and starts a new validity period. Deleting or blocking the cookie may prevent the link discount from being applied.
When checkout is prepared with a referral code, the Company records the code, member identifier, checkout and order identifiers, the reservation, confirmation or release status of its use, and the corresponding times. Orders with a confirmed discount and referral source record the influencer and contract identifiers, whether the source was a link or a code, the discount rate, and the discounts for each product and the order. If both a link and a code are used, the code determines the referral source.
Before this approach was introduced, the Company linked an installation source to a member account to attribute orders to an influencer. Existing installation and member attribution records, and the order attributions already recorded from them, are retained for commission confirmation, settlement and disputes concerning those orders. New orders use the referral discount conditions for a valid link entry or referral code.
Influencers receive only aggregates for their own referrals, such as traffic, installs, orders, referral-code uses, product values, referral discounts and commissions. They do not receive customers' names, email addresses, phone numbers, delivery addresses, member identifiers or individual order details.
The cookie's 24 hours is the validity period of the link discount. It does not mean that all server records are deleted after 24 hours. Sections 9 and 12 govern the retention and deletion of order, discount, attribution and settlement records. This processing does not expand the scope of the optional consent in section 7A.
8. Marketing
With marketing consent, the Company sends new curation, promotion, coupon and featured collection information by app push notification. Notification phone numbers are not used for SMS or telephone marketing without separate lawful consent.
Customers can opt out at any time in My > Notification settings or device notification settings. Transaction notifications about orders, payment, delivery, security, refunds and product safety are sent regardless.
9. Retention of personal information
Personal information is kept as long as needed for its purposes and legal, tax, fraud prevention and dispute obligations:
• account information: until withdrawal, then deleted or anonymised under section 12;
• order, payment, customs, warehouse and dispatch records: 5 years from the transaction;
• customer support records: 3 years from the enquiry;
• original mall page assistant conversations: until withdrawal, then deleted;
• consent and terms acceptance records: as long as needed to prove consent, including after withdrawal;
• notification phone numbers: deleted on withdrawal; delivery records (time, channel, result) are kept without the number;
• AI product search photos, text and results: deleted after 30 days;
• request-rate records (member identifier or IP address): deleted when the limit window ends;
• usage statistics in Google Analytics 4 and Firebase Analytics: user-level data is deleted 14 months after the last activity; aggregate statistics remain in a form that does not identify individuals;
• advertising measurement records on the device: the Android app keeps the consent status, analytics identifier, up to 200 recently sent order numbers and order numbers whose payment was started (7 days); the iOS app keeps up to 200 irreversibly transformed values of recently sent order numbers and order numbers whose payment was started (7 days); deleted when the app is deleted (on Android, also when its data is cleared); and
• information received by Meta Platforms: under its privacy policy.
When the purpose ends, the Company securely deletes or anonymises the information.
10. Protection of personal information
The Company applies administrative, technical and physical safeguards, including encrypted connections (HTTPS) for all communications, separate-key encryption of delivery addresses and customs information, database access limited to the member and authorised operators, and warehouse partner access limited to the screens needed for their work.
No system is completely secure. If a breach occurs, the Company acts to reduce harm and notifies affected customers and regulators where required by law. Customers should keep passwords and devices secure and report suspected unauthorised use immediately.
11. Customers' rights
Subject to applicable law, customers may:
• request access to their personal information;
• request correction of inaccurate or out-of-date information;
• request deletion or restriction of processing;
• withdraw marketing consent and usage statistics and advertising measurement consent;
• object to processing;
• request a copy of information they provided; and
• make a complaint.
The Company may verify identity first. Some requests may be limited by legal obligations, ongoing transactions or legal claims; the Company explains why. Requests can be sent to info@brightongroup.ai.
12. Account deletion
Customers can withdraw in the account settings of the FROMKO app or website, or request deletion at info@brightongroup.ai. On withdrawal, the Company:
• deletes immediately: delivery addresses, cart, notifications and settings, push tokens, mall page assistant conversations, AI product search records and photos, and the sign-in authentication account;
• removes from the member record: name, email address, gender, date of birth, profile image and phone number; and
• keeps: an irreversibly transformed email value and the sign-in provider identifier to check re-registration, and the records kept under section 9.
On-device information in the Android and iOS apps is deleted when the app is deleted.
13. Children's personal information
FROMKO is intended for customers who can enter into legally valid purchase contracts. A minor may need parental or guardian consent and supervision under local law. If the Company learns that it collected a child's information without appropriate consent, it takes reasonable steps to delete it.
Gender and date of birth entered in earlier versions are used only for product demand statistics by gender and age group, not for personalised advertising.
14. Privacy complaints
Email: info@brightongroup.ai
Address: Level 19, 144 Edward St, Brisbane City QLD 4000, Australia
The Company endeavours to respond within a reasonable time. If not satisfied, customers may complain to the Office of the Australian Information Commissioner (www.oaic.gov.au) or the privacy authority in their region.
15. Third-party services
The FROMKO app can open Korean retailer web pages. Information entered on or collected by a retailer page is subject to that retailer's privacy policy. Information independently collected by Google, Apple, Kakao, Stripe and Meta Platforms is subject to their privacy policies (policies.google.com/privacy, www.facebook.com/privacy/policy, stripe.com/privacy). OpenAI's privacy policy is at openai.com/policies/privacy-policy.
16. Changes to this Privacy Policy
The Company may change this policy. Material changes are notified in advance through the app, website or contact details and apply after lawful notice and any required consent. When a new recipient or a new purpose is added to an optional consent, existing consents are not expanded retrospectively and the addition applies only to customers who agree to the new wording. Measurement through the Meta SDK in the iOS app and the Meta Pixel on the website's app introduction page, described in the revision of 29 October 2026, has the same recipient (Meta Platforms) and the same purposes (section 7A(b)) as the existing usage statistics and advertising measurement consent and is within the scope of that consent.
17. Contact
BRIGHTON AI HOLDINGS PTY LTD
Level 19, 144 Edward St, Brisbane City QLD 4000, Australia
Email: info@brightongroup.ai
