Privacy Policy

Article 1 (Purposes of Processing Personal Information)

The Company processes personal information for the following purposes. Personal information being processed will not be used for purposes other than the following, and if the purpose of use changes, the Company will take necessary measures such as obtaining separate consent under Article 18 of the Personal Information Protection Act.

1. Website membership registration and management Confirming intent to register, identifying and authenticating members for membership services, maintaining and managing membership qualifications, preventing improper use, verifying consent of a legal representative when processing personal information of children under 14, notices and communications, and handling grievances. 2. Provision of goods or services Providing services (AI knowledge search, AI chat), payment and settlement of fees, processing promotion/event payouts operated by the Company, and identity verification (KYC) and bank transfers required therefor. 3. Account security and unusual login review Recording login time and access environment (including country-level location estimates) so that members can review login history in service settings, check unexpected access, and for security purposes such as preventing abuse and account takeover. Such history is not used for advertising, marketing, or profiling.

Article 2 (Items of Personal Information Processed and Collection Methods)

The Company collects and processes the following personal information to provide the Platform.

1. Membership registration and management - Required: email, nickname - Optional: profile photo, bio 2. During service use - Knowledge material upload information, AI chat prompts and session information, token purchase and usage history - Promotion participation, progress, and payout-related information (where applicable); identity verification (KYC) and payout account information (when requesting payout) 3. Login activity records (for account security; collected automatically) - Login date and time - Access IP address - Country-level access location (network-based estimate at ISO country-code level; detailed city-level or GPS location is not collected) - Platform type (web, iOS, Android, etc.) and User-Pack information needed to identify browser/device - Whether access is from a country different from prior login countries (flag for security history display) ※ Members may view a summary of this history in service settings (login history). The list may show country, platform, and time; access IP may not be shown on the member-facing screen. 4. Other automatically collected information (for essential purposes) - Device information, operating system, service usage records, improper-use records, push notification tokens (when notification consent/registration is given)

[Collection methods] The Company collects personal information entered directly by users during registration and service use, and information generated and collected automatically during login and service use (including access IP and country code via network infrastructure).

Article 3 (Processing and Retention Periods)

① The Company processes and retains personal information within the retention and use periods under applicable law or the periods consented to when collecting personal information from the data subject. ② Processing and retention periods are as follows: 1. Membership registration and management: retained up to 2 years after withdrawal, then destroyed; provided that if any of the following applies, until the relevant matter ends - Investigation or inquiry for violation of applicable law is ongoing: until that investigation or inquiry ends - Outstanding claims or debts from service use remain: until settlement of those claims or debts 2. Provision of goods or services: until supply of goods/services and fee payment/settlement are completed; provided that records subject to statutory retention are kept for the required period - Records of payment and supply of goods under the Act on the Consumer Protection in Electronic Commerce, etc.: 5 years - Records of consumer complaints or dispute handling under the same Act: 3 years - Website visit records under the Protection of Communications Secrets Act: 3 months 3. Login activity records: retained mainly as recent per-member records within the scope of account security; past records exceeding 50 per member are automatically deleted. Upon withdrawal, login activity records are deleted without delay; provided that access logs subject to statutory retention (e.g., Protection of Communications Secrets Act) may be retained for the required period. 4. Promotion payout and tax-related records: for periods required under tax law, commercial law, and similar obligations

Article 4 (Destruction Procedures and Methods)

① When personal information becomes unnecessary due to expiry of the retention period (2 years after withdrawal), achievement of the processing purpose, or similar reasons, the Company destroys the personal information without delay. ② If personal information must continue to be preserved under other laws even after the consented retention period has expired or the processing purpose has been achieved, the Company transfers that personal information to a separate database or stores it in a different location. ③ Procedures and methods of destruction are as follows: 1. Procedure: select personal information for which destruction grounds have arisen and destroy it with approval of the Chief Privacy Officer. 2. Method: personal information recorded/stored in electronic files is destroyed so that records cannot be reproduced; personal information in paper documents is shredded or incinerated.

Article 5 (Provision of Personal Information to Third Parties)

① The Company processes personal information of data subjects only within the scope stated in Article 1 (Purposes of Processing Personal Information), and provides personal information to third parties only with the data subject's consent, under special provisions of law, or in cases under Articles 17 and 18 of the Personal Information Protection Act. ② The Company does not currently provide personal information to third parties without the data subject's consent.

Article 6 (Outsourcing of Processing and Cross-Border Transfer)

① To process personal information smoothly, the Company outsources personal information processing to overseas and external specialist providers as follows.

[Cross-border transfer and outsourcing] 1. Processor: Google LLC (United States) - Work: cloud infrastructure operation and AI computation - Items transferred: service usage records, prompts and materials entered by users - Time/method: transmission over the network upon service use - Retention/use: up to 2 years after membership withdrawal, or until end of the outsourcing contract

2. Processor: Cloudflare, Inc. (United States) - Work: network security, traffic routing, and provision of access country codes - Items transferred: access IP, country-level location estimates (country code), User-Pack and other network traffic metadata - Time/method: automatic transmission upon service access/login - Retention/use: up to 2 years after membership withdrawal, or until end of the outsourcing contract (login history stored on Company servers follows Article 3)

3. Processor: Cream (cream.io) (overseas) - Work: service payment processing (including token purchases) - Items transferred: payment information and payment-related identifiers - Time/method: encrypted transmission upon payment processing - Retention/use: statutory retention periods or until end of the outsourcing contract

4. Processor: Airwallex (overseas) - Work: cash transfers for promotions and identity verification (KYC) - Items transferred: payout/transfer information, identity-related identifiers - Time/method: encrypted transmission upon payout processing - Retention/use: statutory retention periods or until end of the outsourcing contract

② When entering into outsourcing contracts, the Company specifies in writing, under Article 26 of the Personal Information Protection Act, prohibition of processing outside the purpose of the outsourced work, technical and organizational safeguards, restrictions on re-outsourcing, management and supervision of processors, and liability for damages, and supervises whether processors process personal information securely.

Article 7 (Installation, Operation, and Refusal of Automatic Collection Devices)

① The Company collects only the minimum automatically collected information (access logs, login activity records, essential cookies, etc.) needed for essential service provision, security, and session maintenance during Platform use. ② Login activity records (access IP, country-level location estimates, platform/User-Pack, login time) are essential processing for account security and unusual-access checks and are inseparably linked to providing login-based services. Members may view this history in settings. ③ The Company does not use third-party analytics tools (Google Analytics, Mixpanel, Amplitude, etc.), marketing cookies, or ADID/IDFA for tracking website visit history or providing personalized advertising. ④ Users may configure their web browser to allow all cookies, confirm each time a cookie is stored, or refuse all cookies. Refusing essential cookies may impair use of some login-required services. - Example (web browser): Tools > Internet Options > Privacy (browser-specific menus may vary)

Article 8 (Rights and Obligations of Data Subjects and Legal Representatives; Exercise Methods)

① Data subjects may exercise rights against the Company at any time, including access, rectification, deletion, and suspension of processing of personal information. (For children under 14, a legal representative may exercise the rights.) ② Rights may be exercised in writing, by email, etc.; the Company will act without delay. ③ If a data subject requests rectification or deletion of errors in personal information, the Company will not use or provide that personal information until rectification or deletion is completed. ④ Rights may be exercised through a legal representative or authorized pack. In such cases, a power of attorney in the form under the Public Notice on Methods of Processing Personal Information (No. 2020-7), attached Form 11, must be submitted.

Article 9 (Measures to Ensure Safety of Personal Information)

The Company takes the following measures to ensure the safety of personal information. 1. Administrative: establishment and implementation of internal management plans, regular employee training, etc. 2. Technical: access-rights management for personal information processing systems, access-control systems, encryption of unique identifiers, etc., installation of security programs 3. Physical: access control for server rooms, document storage rooms, etc.

Article 10 (Chief Privacy Officer and Responsible Department)

① The Company is overall responsible for personal information processing and designates a Chief Privacy Officer as follows to handle data subjects' complaints and remedies related to personal information processing.

[Chief Privacy Officer (CPO)] Name: Kim LJ Title: CPO Contact: 02-1234-5678, support@rabbitfree.com

[Domestic pack] Agent name: Rabbitfree Korea Co., Ltd. (Representative: Hong Gildong) Address: 123 Teheran-ro, Gangnam-gu, Seoul Phone: 02-987-6543 Email: local.pack@rabbitfree.com

② Data subjects may inquire with the Chief Privacy Officer and responsible department about all personal information protection matters arising while using the Company's services, including complaints and remedies.

Article 11 (Remedies for Infringement of Data Subject Rights)

Data subjects may apply for dispute resolution or consultation with the Personal Information Dispute Mediation Committee, the Personal Information Infringement Report Center of the Korea Internet & Security Agency (KISA), and similar bodies to obtain remedies for personal information infringement. For other reports or consultation regarding personal information infringement, contact:

1. Personal Information Dispute Mediation Committee: 1833-6972 (www.kopico.go.kr) 2. Personal Information Infringement Report Center: 118 (privacy.kisa.or.kr) 3. Supreme Prosecutors' Office: 1301 (www.spo.go.kr) 4. National Police Agency: 182 (ecrm.cyber.go.kr)

Article 12 (Changes to this Privacy Policy)

This Privacy Policy applies from July 31, 2026. Prior versions of the Privacy Policy may be confirmed through customer support.