Privacy Policy

Article 1 (Purposes of Processing Personal Information)

The Company processes personal information for the following purposes. Personal information processed is not used for any purpose other than the following, and if a purpose changes, we will seek prior consent.

1. Responding to and handling inquiries — responding to inquiries, partnership requests and personal information requests received through the inquiry form and email on the Site, sending replies and follow-up
2. Handling customer inquiries from mobile apps — identifying the causes of inquiries and error reports received from mobile apps distributed by the Company, and replying to them
3. Service operation and security — keeping access logs of the Site and detecting and blocking abnormal access (automated attacks, session floods, etc.)
4. Analysis of service usage statistics and improvement — statistical analysis of visits and usage flows using Google Analytics, and improvement of content and screen layout based on it
5. Management of Site operator accounts — authentication and permission management of operator accounts created directly by the Company's administrators
6. Compliance with legal obligations — providing materials and responding to disputes in accordance with applicable laws and requests from government agencies

Article 2 (Personal Information Processed)

The Company processes the following items of personal information. Items marked "automatically generated" in the table below are generated and collected automatically in the course of using the service, without the user entering them.

Inquiries received from mobile apps

Inquiries and error reports sent from mobile apps distributed by the Company are stored on an inquiry server operated by the Company in the Republic of Korea. The information that an app sends with an inquiry (the content of the inquiry, app and device environment information, contact details and login method for replies, files attached by the user, etc.) and its retention period are set out in each app's privacy policy. The items collected differ from app to app and new apps continue to be added, so please check the privacy policy of the app you use. Each app's privacy policy can be found on the settings or information screen within the app, on the app's detail page in the app market (App Store and Google Play), and on that app's page on this Site.

However, the IP address and browser information (User-Agent) automatically recorded by the receiving server at the time an inquiry is received are not sent by the app but recorded by the Company's server, so their processing and retention period follow this Privacy Policy.

Information the Company does not collect

The Company does not collect any of the following information on this Site.

• Behavioral information for personalized advertising — no advertising SDK or script that collects advertising identifiers (ADID or IDFA) is installed on this Site. The Company uses Google Analytics only to analyze usage statistics for service improvement, and does not use the information collected through it for personalized advertising or provide it to third parties for advertising purposes.
• Unique identification information — we do not collect resident registration numbers, passport numbers, driver's license numbers or alien registration numbers.
• Location information — we do not collect personal location information under the Act on the Protection, Use, etc. of Location Information of Korea.
• Sensitive information — we do not collect sensitive information such as ideology or beliefs, health, sex life, genetic information or criminal records.

Article 3 (Processing and Retention Periods)

1. The Company processes and retains personal information within the retention and use period prescribed by law or the retention and use period agreed to by the data subject when the personal information was collected.

2. The retention periods for each purpose of processing are as follows.

   Category	Retention period	Basis
   Site access logs and abnormal access blocking logs	3 months	Operated in line with the retention standard for communication confirmation data under Article 15-2 of the Protection of Communications Secrets Act of Korea and Article 41 of its Enforcement Decree
   Inquiry records (including attachments) and emails sent and received in connection with the inquiry	3 years after the reply is completed	Records of consumer complaints or dispute handling under Article 6 of the Act on the Consumer Protection in Electronic Commerce, etc. of Korea
   Records of customer inquiries from mobile apps (including the receiving IP and browser information)	3 years after handling is completed	Same as above. The retention period of information sent by an app is also set out in each app's privacy policy
   Web usage analytics information (Google Analytics)	Up to 14 months	The retention setting for user- and event-level data in Google Analytics. Aggregated statistical report data that cannot identify individuals may be kept after that
   Records of other notice emails sent	3 years after sending	Confirmation of sending and response to disputes
   Site operator account information	Until the account is deleted	Destroyed without delay when the account is deleted

3. Personal information whose retention period has expired is destroyed without delay. However, where other laws require it to be kept, it is kept for that period and then destroyed.

Article 4 (Provision of Personal Information to Third Parties)

1. The Company processes data subjects' personal information only within the scope specified in Article 1 (Purposes of Processing Personal Information), and provides personal information to third parties only in cases falling under Articles 17 and 18 of the Personal Information Protection Act of Korea, such as with the consent of the data subject or under special provisions of law.
2. The Company currently does not provide data subjects' personal information to any third party. If provision becomes necessary in the future, we will notify data subjects in advance and obtain their consent.

Article 5 (Entrustment of Processing and Overseas Transfer)

1. Entrustment of Personal Information Processing

To operate the Site smoothly, the Company entrusts the processing of personal information as follows.

When concluding an entrustment contract, the Company specifies in the contract, in accordance with Article 26 of the Personal Information Protection Act of Korea, matters such as the prohibition of processing personal information for purposes other than the entrusted work, technical and managerial safeguards, restrictions on re-entrustment, and management and supervision of the trustee.

2. Overseas Transfer of Personal Information

In accordance with Article 28-8 of the Personal Information Protection Act of Korea, the Company transfers personal information overseas as follows.

A. Sending and receiving inquiry replies and notice emails

B. Collection and analysis of Site usage statistics

The cloud storage used by the Site (Amazon S3) stores data in the Seoul region of the Republic of Korea (ap-northeast-2), so attachments and content files are not transferred overseas.

Data subjects may refuse an overseas transfer under Article 28-8(1)(1) of the Personal Information Protection Act of Korea. If you refuse the transfer for sending and receiving emails, receiving and replying to inquiries by email may be restricted; in that case you can be guided to other methods through the contact details in Article 10 below. You can refuse the transfer for the collection and analysis of Site usage statistics yourself at any time by the method in Article 9(4), and refusing it does not restrict your use of the Site.

Article 6 (Rights and Obligations of Data Subjects and How to Exercise Them)

1. Data subjects may exercise the following rights against the Company at any time.
   • Request access to personal information
   • Request correction of errors, etc.
   • Request deletion
   • Request suspension of processing
2. These rights may be exercised in writing, by email or by other means in accordance with Article 41(1) of the Enforcement Decree of the Personal Information Protection Act of Korea. The Company will take action without delay. The channels are as follows.
   • Email — privacy@reply.codesand.co.kr
   • Inquiry form on the Site — choose the "Privacy & Terms" category on Contact us
3. If a data subject requests correction or deletion of errors in personal information, the Company does not use or provide the personal information concerned until the correction or deletion is completed.
4. Rights may also be exercised through an agent, such as the data subject's legal representative or a person delegated by the data subject. In this case, a power of attorney in the form of Annex Form No. 11 of the Notice on Methods of Processing Personal Information must be submitted.
5. The Company verifies whether the person who submitted a request to exercise rights is the data subject or a legitimate agent. In this process we may request minimum verification information, which is used only for verification and destroyed without delay.
6. Users can set their refusal of the collection for Site usage analytics (Google Analytics) themselves by the method in Article 9(4), without making a separate request to the Company.

Article 7 (Procedure and Method of Destroying Personal Information)

1. When personal information is no longer needed, for example because its retention period has expired or the purpose of processing has been achieved, the Company destroys it without delay.
2. Destruction procedure — unnecessary personal information and personal information files are destroyed safely in accordance with internal policies and applicable laws under the responsibility of the privacy officer.
3. Automatic destruction — the Company operates a database scheduler so that information whose retention period under Article 3 has passed can be deleted without human judgment. Access logs and abnormal access blocking logs are automatically deleted at a fixed time every day once their retention period (3 months) has passed.
   • Records that must be kept under law and inquiries still being handled are excluded from automatic destruction.
   • Records with attachments are handled by a separate destruction procedure, because the files in storage must be deleted together with them.
4. Destruction method
   • Electronic files: permanently deleted in a way that cannot be restored
   • Personal information printed on paper: shredded or incinerated

Article 8 (Measures to Ensure the Security of Personal Information)

The Company takes the following measures to ensure the security of personal information.

1. Encrypted storage of passwords — passwords of operator accounts are stored using one-way encryption that cannot be decrypted, and are not kept in plain text.
2. Minimization of access rights — accounts that can access personal information are limited to administrators who need them for their work, and permission levels are divided so that only the necessary functions can be used.
3. Retention of access logs — access logs of the personal information processing system are kept so that unauthorized access or anomalies can be checked afterwards.
4. Encryption in transit — HTTPS is applied to the entire Site, so information exchanged between users and the server is encrypted with TLS.
5. Automatic blocking of abnormal access — abnormal requests repeated in a short time are detected and blocked automatically, and the blocking is recorded.
6. Automatic destruction of information past its retention period — an automatic destruction procedure is operated under Article 7 so that information whose retention period has passed does not remain in the system.

Article 9 (Installation, Operation and Refusal of Automatic Collection Devices)

1. The Company uses the minimum "cookies" necessary for the basic operation of the Site. A cookie is a small amount of information that the server used to operate a website sends to the user's browser, and it may be stored on the user's device.

2. The cookies used by this Site are as follows.

   Cookie name	Purpose	Retention period
   SESSID	Session identification required for the Site to work, such as keeping you logged in	Deleted when the browser is closed
   siteLocale	Remembers the display language chosen by the user	1 year
   _ga	Identifier used by Google Analytics to distinguish visitors	2 years
   _ga_	Identifier used by Google Analytics to maintain the state of a visit session	2 years

3. Installation, operation and refusal of cookies — you can refuse to store cookies in your web browser settings. However, if you refuse session cookies, some features such as logging in may not work properly.

4. Use of web analytics tools and refusal of collection — this Site uses Google Analytics to analyze usage statistics for service improvement. Users can refuse the collection of analytics information in the following ways, and refusing it does not restrict your use of the Site.

   • Block the storage of cookies or delete stored cookies in your web browser settings
   • Install the Google Analytics Opt-out Browser Add-on provided by Google

5. No personalized advertising — the Company does not use information collected through Google Analytics for personalized advertising, and does not install advertising SDKs or scripts that collect advertising identifiers on this Site.

Article 10 (Privacy Officer)

The Company designates a privacy officer as follows to take overall responsibility for the processing of personal information and to handle data subjects' complaints and remedies for damage related to the processing of personal information.

Please send requests to exercise rights such as access, correction, deletion or suspension of processing of personal information to the privacy@ address. For other inquiries, such as how to use the service, please use the support@ address or Contact us on the Site.

Article 11 (Remedies for Infringement of Rights)

To obtain remedies for infringement of personal information, data subjects may apply for dispute resolution or consultation to the Personal Information Dispute Mediation Committee, the Personal Information Infringement Report Center of the Korea Internet & Security Agency and others.

Article 12 (Changes to This Privacy Policy)

1. The Company may add to, delete from or amend this Privacy Policy in accordance with changes in laws, policies or the service, and when it does so, it posts the change in the Site's notices stating the reasons and the effective date.
2. So that users can easily check the changes, we also post a comparison of the versions before and after the change.

Addendum

This Privacy Policy takes effect on August 29, 2026.