Korena

Privacy Policy

Last updated: August 2, 2026

1. Introduction

KORENA (also stylized “KORĒNA”) is a United States-based online marketplace for musical instruments and related gear (“KORENA,” “we,” “us,” or “our”). We combine a traditional e-commerce storefront with a conversational AI shopping assistant that helps customers find guitars, basses, amplifiers, effects pedals, and accessories. This Privacy Policy explains what personal information we collect when you visit our site, create an account, place an order, or interact with our AI shopping assistant; how we use that information; who we share it with; and the rights you have over it. It applies to all visitors and customers of the KORENA website and related services (collectively, the “Service”).

By using the Service, you acknowledge that you have read and understood this Privacy Policy. If you do not agree with our practices, please do not use the Service.

2. Information we collect

We collect information that you provide directly, information collected automatically when you use the Service, and information we receive from third-party providers that help us operate the Service.

Account information

When you create an account, authentication is handled by our identity provider, Clerk. We receive from Clerk your name, email address, and (if you choose to provide it) your phone number, along with authentication identifiers used to keep you signed in across sessions. If you sign in with a social identity provider through Clerk, we may also receive a display name and profile image.

Order and transaction information

When you place an order, we collect your billing address, shipping address, the items you purchased, order total, and order history. Payment is processed by Stripe. Stripe tokenizes your card and returns to us only a payment reference and non-sensitive details such as the last four digits of the card and the card brand. We never see or store full payment card numbers, CVVs, or bank account numbers. We also retain records of returns, refunds, and exchanges for the applicable order.

Cart and browsing state

We store the contents of your shopping cart (including guest carts) so that your selections persist between visits. We also record page navigation and search activity through the analytics and operational logging described below.

Chat conversation transcripts

Our AI shopping assistant processes the messages you type. Your messages are sent to OpenAI’s API and used to power product recommendations and checkout actions. We may retain transcripts of your conversations to operate session-level memory features, improve product recommendations, support customer service, and monitor service quality.

Device, browser, and usage data

When you visit the Service, we automatically collect IP address, approximate geolocation derived from IP, browser type and version, operating system, device type, referring URL, pages viewed, time spent on pages, and timestamps.

Cookies and similar technologies

We use strictly necessary cookies for sign-in and browser storage to maintain your cart and remember preferences. Google Analytics 4 may set analytics cookies to measure site performance in aggregate. You can control cookies and browser storage through your browser settings. Disabling necessary storage may prevent parts of the Service from working.

3. How we use your information

  • Fulfilling orders: to process payments, ship products, calculate sales tax, handle returns and refunds, and communicate with you about specific orders.
  • Order updates:to send transactional emails and, where you have provided a phone number, transactional SMS messages — order confirmations, shipment notifications with tracking, delivery confirmations, refund receipts, and verification codes. KORENA does not operate a marketing email list or send promotional newsletters; all order-related messages are transactional only.
  • Customer support: to respond to your questions, investigate issues with orders, and provide the assistance you request.
  • Account and identity:to create, authenticate, and protect your account, including guest checkout and the “claim to account” flow that links guest orders to a new or existing account after sign-in.
  • Improving the AI shopping assistant: to evaluate how well the assistant interprets requests, recommends products, and completes checkout tasks. Transcripts used for evaluation are reviewed under restricted internal access.
  • Fraud prevention and security: to detect and prevent fraudulent orders, abuse, credential stuffing, payment disputes, and security incidents.
  • Analytics: we use Google Analytics 4 (GA4) to understand in aggregate how visitors navigate our site, which product categories are viewed, and where users drop off. GA4 data is aggregated and not keyed to personally identifiable information; we have enabled IP anonymization and have not enabled Google advertising or remarketing features.
  • Legal compliance: to comply with tax, accounting, sanctions, consumer protection, and other legal obligations, and to respond to lawful requests from authorities.

4. Third parties we share information with

We share personal information with the following categories of service providers, each only as needed to operate the Service. We do not sell personal information.

  • Stripe— payment processing. Card details are submitted directly to Stripe and tokenized. Stripe is a PCI-DSS Level 1 certified payment provider.
  • Clerk— authentication, session management, and account lifecycle. Clerk is SOC 2 Type II audited.
  • AWS Simple Email Service (SES)— transactional email delivery (order confirmations, shipment updates, refund notifications, verification codes).
  • Twilio— transactional SMS delivery for order and verification messages when you have provided a phone number.
  • Order Management System (OMS)— order fulfillment, inventory reservation, shipment creation, and carrier handoff. OMS is an affiliated internal system rather than an unrelated third party.
  • Google Analytics 4— aggregated website analytics. IP anonymization is enabled and advertising features are disabled.
  • OpenAI— our AI shopping assistant sends prompts and your typed input to OpenAI’s API to generate responses. Per OpenAI’s API terms, data submitted via the API is not used to train OpenAI’s models.
  • Shipping carriers(USPS, UPS, FedEx) — recipient name, shipping address, package contents descriptor, and contact details required to deliver your order.
  • Cloud infrastructure providers that host the Service and its databases, under written confidentiality and data processing obligations.
  • Law enforcement or regulators when legally required, such as in response to a valid subpoena, court order, or governmental request.
  • Successors in interest in connection with a merger, acquisition, financing, or sale of assets, subject to this Privacy Policy.

5. Your rights under the GDPR (EU, UK, and Switzerland)

If you are located in the European Economic Area, the United Kingdom, or Switzerland, the General Data Protection Regulation (and its UK equivalent) grants you the following rights over your personal data:

  • Right of access— request a copy of the personal data we hold about you and information about how we process it.
  • Right to rectification— request correction of inaccurate or incomplete information.
  • Right to erasure (“right to be forgotten”)— request deletion of your personal data, subject to exceptions such as legal retention obligations.
  • Right to restrict processing— ask us to pause or limit how we use your data while a request is being investigated.
  • Right to data portability— request an export of your personal data in a common, machine-readable format.
  • Right to object— object to processing that relies on our legitimate interests.
  • Right to withdraw consent— where we rely on consent, withdraw it at any time.
  • Right to lodge a complaint with your local data protection supervisory authority.

To exercise any of these rights, email support@korena.com from the email address on file. We will respond within the timeframes required by applicable law (generally 30 days, with possible extensions). For identity verification, we may ask you to confirm information already associated with your account.

6. Your rights under the CCPA/CPRA (California residents)

If you are a California resident, the California Consumer Privacy Act, as amended by the California Privacy Rights Act (collectively, “CCPA/CPRA”), grants you the following rights:

  • Right to know— request disclosure of the categories and specific pieces of personal information we have collected about you, the sources of that information, the business or commercial purpose for collecting it, and the categories of third parties with whom we share it.
  • Right to delete— request deletion of personal information we have collected from you, subject to exceptions (for example, completing a transaction or complying with a legal obligation).
  • Right to correct— request correction of inaccurate personal information.
  • Right to opt out of sale or sharing— opt out of the sale of personal information or its sharing for cross-context behavioral advertising. KORENA does not sell personal information for money. We do disclose aggregated, non-identifying analytics data to Google Analytics as described in this Policy; to the extent any of that disclosure is considered “sharing” under the CPRA, California residents may opt out by disabling analytics cookies in their browser or using an accepted Global Privacy Control signal.
  • Right to limit use of sensitive personal information— direct us to limit our use of sensitive personal information to what is necessary to provide the Service.
  • Right to non-discrimination— we will not deny service, charge different prices, or provide a lower-quality experience because you exercised a CCPA/CPRA right.

To exercise any of these rights, email support@korena.com. You may also authorize an agent to submit a request on your behalf, provided you give written permission and we can verify your identity.

7. Data retention

  • Order records (order history, invoices, shipment records, refund records) are retained for a minimum of seven (7) years after the order date to satisfy U.S. federal and state tax, accounting, and consumer-protection recordkeeping requirements. Deletion requests for active order records are honored only to the extent consistent with those obligations.
  • Account data (name, email, phone, saved addresses, preferences) is retained for as long as your account is active. When you request deletion, we remove account data except for records we are legally required to keep.
  • Chat conversation transcripts are retained only as long as needed to power in-session memory, evaluate service quality, and investigate support issues.
  • Analytics datacollected by Google Analytics 4 follows GA4’s default retention period of fourteen (14) months, after which user-level records are automatically deleted.
  • Logs and security data are retained for up to twelve (12) months for operational, debugging, and security purposes, and longer where legally required.

8. Children under 16

The Service is intended for adults (see our Terms of Service for age eligibility) and is not directed to children under 16. We do not knowingly collect personal information from anyone under 16. If you believe a child under 16 has provided personal information through the Service, contact support@korena.com and we will take appropriate steps to delete that information.

9. Security

We implement administrative, technical, and physical safeguards designed to protect your personal information. All traffic to and from the Service is encrypted in transit using TLS. Data at rest in our databases is encrypted with industry-standard algorithms. Access to production systems is limited to authorized personnel and logged. Payment processing is handled entirely by Stripe, which is PCI-DSS Level 1 certified. Authentication is handled by Clerk, which is SOC 2 Type II audited. Despite these safeguards, no method of transmission or storage is perfectly secure, so we cannot guarantee absolute security of any information you submit.

10. Changes to this Privacy Policy

We may update this Privacy Policy from time to time to reflect changes to our practices, the Service, or applicable law. If we make material changes, we will notify you by email (where we have an email address on file) or through a prominent in-app banner before the changes take effect. The “Last updated” date at the top of this page indicates when this version became effective. Your continued use of the Service after the effective date constitutes acceptance of the updated policy.

11. Contact us

For privacy questions, rights requests, or concerns about how we handle your personal information, contact:

Email: support@korena.com
Mailing address:
KORENA c/o Guitar Center
5795 Lindero Canyon Rd
Westlake Village, CA 91362
United States