Privacy Policy

Chapter 1 General Provisions

Article 1 (Purpose)

① The purpose of this Policy is to set out for what purposes Impact Station Co., Ltd. (the "Company") processes Users' personal information in the Contentrip service it provides (the "Service"), how long it retains that information, and how it destroys it.

② The Company complies with the Personal Information Protection Act and other applicable laws and keeps this Policy posted within the Service at all times.

③ The personal information controller under this Policy is the Company (Representative: Song Sanghoon; Business Registration Number: 683-86-00599).

Article 2 (Definitions)

① Terms used in this Policy have the meanings given in Article 2 of the Terms of Service.

② "Creator" means a Member who is active in the Creator role under the Creator Member Terms, and "Client" means a Member who has commissioned content production from a Creator through business matching.

Article 3 (Relationship to Other Rules)

① Matters not provided for in this Policy are governed by the Terms of Service and applicable laws.

② Inquiries about this Policy, requests to exercise data subject rights, and objections are received through the contact channel set out in Article 25 of the Terms of Service. Processing deadlines and procedures not separately provided for in this Policy follow that Article.

③ Changes to this Policy follow Article 19, and notice to Members follows Article 33 of the Terms of Service.

Chapter 2 Processing of Personal Information

Article 4 (Personal Information Processed)

① The Company processes only the minimum personal information necessary to provide the Service.

② The items processed during sign-up and sign-in are as follows. You may sign up either by registering an email address and password directly or by signing in with a social account. Depending on the method chosen, either item 1 or item 2 is processed. Item 3 lists the items entered directly by the User. Of those items, nickname and date of birth, together with the name within the scope set out in item 3, must be entered in order to use the Service, while phone number and gender may be left blank and the Service may still be used. However, Members who sign in with a social account are not asked for the items in item 3. In that case the display name is the name passed under item 2, or, where no name is passed, the handle generated automatically at sign-up (paragraph ④, item 1); and whether the Member is at least 14 years old is established by the confirmation recorded on the consent screen. Notwithstanding item 3 and the other provisions of this paragraph, Members who wish to use the business matching service (Contentrip AI BIZ) are asked for their name, phone number, and date of birth regardless of how or when they signed up, and the business matching service cannot be used unless these are entered. Gender is optional in business matching as well. In that case, items already entered are not requested again.

1. 1.When signing up with an email address and password (entered directly by the User): email address (account identification and sign-in), password (the original is not stored; it is kept only in an irreversible form. See Article 13), email verification time (the time the sign-up confirmation email was opened)
2. 2.When signing in with a social account (passed to the Company by the relevant provider): email address (account identification), name (default for the initial display name), profile picture (a copy of the image provided by the provider is kept in the Company's storage; the original URL is not stored), email verification time (the value passed by the provider), social account identifier and authentication token (values needed to keep you signed in)
3. 3.Items entered directly by the User regardless of sign-up method: name (used for identity verification and Service-related contact; not shown to other Users. Collected only from Members who sign up on or after September 11, 2026; it is not requested from Members who signed up before that date or from Members who sign in with an Apple account. Where sign-in is by social account, the name received under item 2 is also used for this item), nickname (display name; shown on the public profile), phone number (used for identity verification, account recovery, and Service-related contact; not shown to other Users), gender (used only for aggregate statistics from which no individual can be identified; not shown to other Users), date of birth (used to confirm that the User is at least 14 years old and to restrict viewing by content rating; not shown to other Users). Users registered as Creators are not asked again for phone number, gender, or date of birth under this paragraph; the information received during the Creator registration process is used instead

③ When you sign in with a Google or Apple account, personal information is transferred to the United States (Article 9). When you sign in with a Kakao or NAVER account or sign up with an email address and password, personal information is not transferred abroad. NAVER account sign-in applies only where the Company offers it. However, usage statistics (paragraph ⑤, item 6) and playback quality records (paragraph ⑤, item 7) are transferred to the United States regardless of the sign-in method, under Article 9, paragraph ⑧ and Article 9, paragraph ⑤ respectively, and, if you have allowed notifications in the app, the app push token and notification content (paragraph ⑤, item 5) are transferred to the United States regardless of the sign-in method, under Article 9, paragraph ⑨. If you use the business matching service, some of the items processed in that course are transferred abroad under Article 9, paragraphs ⑩ through ⑬.

④ The items entered directly by the User while using the Service are as follows. The profile items in items 1 and 2 are optional; the Service can be used without entering them, and they are shown on the public profile. The items in items 4 and 6 are processed only when a Member using the business matching service enters or submits them directly on the relevant screen, and are not processed for Members who do not use the business matching service.

1. 1.Profile: profile picture, bio, handle (generated automatically at sign-up)
2. 2.Creator profile: country and city of activity, specialties, tools used, languages used, roles, whether bank transfers are accepted (for display), collaboration terms (available hours, time zone, team size, external links)
3. 3.Posts and comments: body text, attached images
4. 4.Commissions (Client): the commission form (purpose, format, length, aspect ratio, medium, style, mood, topic, target audience, intended use, period of use, region, country, budget, desired delivery date, commission message, reference links, reference works, preferred Creators), files attached to the commission form, needs survey responses, brand guide (prohibited words, prohibited colors, logo usage rules, tone), comments and notes on planning documents, revision request comments (including comments by timecode), and messages left for the dedicated PM (body and attachments)
5. 5.Reports: reason for the report, detailed description
6. 6.Business matching participation (Creator): career and track record (brand and advertising work, broadcast, OTT and film credits, awards and selections, years of activity), private portfolio for business matching (videos, images, external video links and their titles and descriptions), draft and final submissions (video files or share links, title, production intent, tools used, declared music license, designated preview segment), edits to content introductions, and messages left for the dedicated PM (body and attachments)

⑤ The items generated while using the Service are as follows.

1. 1.Playback records: playback start, progress, and end events, and the resume position
2. 2.View records: profile views
3. 3.Recommendation impression records: which recommendations were shown and selected
4. 4.Relationship records: follows, blocks, favorites, likes
5. 5.Notifications: notification title, body, and sender, and, if you have allowed notifications in the app, the app push token of that device
6. 6.Usage statistics: which screens were opened and which buttons were pressed (page views; playback start, progress, and completion; favorites; likes; follows; shares; whether a search was run; checkout start; app open; app install button; errors (error type only)), and the usage environment (language, app or web, and whether the User is signed in). These are aggregated with a third-party analytics tool. Values that identify the User, such as the Member number or email address, and search terms are not sent; visitors are distinguished only by a random cookie identifier stored in the browser (Article 9, paragraph ⑧ and Article 12). In addition, for service operation (checking errors and responding to outages), the fact that an error occurred, its type, and whether the app or the web was used are also recorded on the Company's servers; these records contain no value that identifies the User
7. 7.Playback quality records: how much of a video was played and where it stopped; playback failures, stalling (rebuffering), and picture quality; and the device, browser, screen size, and connection conditions at that time. These are aggregated with a third-party analytics tool. Values that identify the User, such as the Member number or email address, are not sent, and no cookie is used. Records are kept only per video and per single playback, and are not linked to that person's other playbacks (Article 9, paragraph ⑤)
8. 8.Business matching processing records: work analysis results (tags such as a work's category, style, mood and keywords, and their confidence), matching candidate rankings, scores and grounds, proposed career scores and the values confirmed by the dedicated PM, review results for drafts and final videos (automated check results and the dedicated PM's decisions), project progress records such as commissions, acceptances, payments and deliveries, records of concluding a contract by submitting a commission form (time of conclusion, method of consent, connecting IP address, browser information), and AI processing records (only the type of task, model used, volume processed and result code are kept; the body of text sent and received is not kept). These items are generated only for Members who use the business matching service (including Creators whose public works are eligible for business matching recommendations), and because the dedicated PM reviews and confirms matching rankings and career scores, they are not determined solely by automated means
9. 9.Search records: search terms entered, number of results, time of search, and the Member number if signed in
10. 10.Access records: connecting IP address, time of access and browser information, kept for security and incident response

⑥ Activity records made while not signed in contain no value that identifies the User and remain only as aggregate data from which no individual can be identified. These records are not personal information.

⑦ The items processed only in connection with paid use and with payment, settlement and refunds for business matching are as follows. They are processed only when a Member who pays for a pass or the price of business matching production, receives settlement payments, or receives a refund enters or submits them directly on the relevant screen, and are not processed if you do not use those features.

1. 1.Payment: payment identifier, order name, type of payment method, payment amount, currency, payment time, receipt URL. When the card payment window is opened, the payer's name, mobile phone number and email address already processed under paragraph ② are passed to the payment agency. For bank transfers, the depositor name and the deposit confirmation record are processed. Information about the payment method itself, such as card numbers and bank account numbers, is processed by the payment agency (PayPal for overseas payments) and is not received by the Company. However, when a card is registered for business matching, the Company keeps the automatic payment key issued by the payment agency and the registered card display information (card issuer and last 4 digits)
2. 2.Settlement account: account holder name, bank, account number. Required to pay settlement amounts
3. 3.Unique identification information: resident registration number or foreigner registration number. Used only for withholding tax and filing of payment statements as required by the Income Tax Act and the Corporate Tax Act; stored encrypted and masked on screen (Article 13)
4. 4.Business information: trade name, business registration number, representative's name, place of business address. Collected only from business-registered Creators who issue tax invoices
5. 5.Client information: company name, business registration number, industry, company size, country, contact person name and contact details, and, for issuing tax invoices, the representative's name, business type, business item, place of business address, email address for receiving tax invoices, and a copy of the business registration certificate (including the matters stated on it). Required to conclude and perform production contracts and to issue tax invoices, and received only when the Client enters or attaches them directly on the sign-up, organization information or payment screen
6. 6.Refund account: account holder name, bank, account number. Received only when refunding a payment made by bank transfer

⑧ Unique identification information is used only for the purpose prescribed by law (withholding tax) and is destroyed once that purpose has ended and the retention period in Article 6 has elapsed. This item is stored encrypted and separately from other information.

⑨ The Company does not collect the following information. If a feature requiring it is introduced, this Policy will be changed first.

1. 1.Unique identification information not listed in paragraph ⑦, such as passport numbers and driver's license numbers (there is no storage field for it)
2. 2.Sensitive information such as ideology, beliefs, health, and sex life (there is no storage field for it)

⑩ The following items are processed only for Members who have chosen to consent to receiving marketing communications. Not consenting does not restrict sign-up or use of the Service.

1. 1.Consent records: whether consent was given, refused, or withdrawn, and the date and time
2. 2.Items used for sending: email address, nickname, app push token (if you have allowed notifications in the app)

⑪ Where the Company offers mobile phone identity verification, it processes the following items only for Members who go through that verification. The purpose of processing is explained on the verification screen, and the items are not processed if you do not go through verification. Resident registration numbers are not received.

1. 1.Items entered during verification: name, date of birth, gender, domestic/foreign national status, mobile phone number, mobile carrier
2. 2.Items received as the verification result: connecting information (CI), duplicate sign-up verification information (DI), verification result and time

Article 5 (Purposes of Processing Personal Information)

The Company processes the items listed in each of the following for the following purposes.

1. 1.Member identification and keeping you signed in: email address, social account identifier, authentication token
2. 2.Public profile display (including display of translations into the screen language chosen by the User): display name, profile picture, handle, bio, Creator profile
3. 3.Content ranking and home screen composition: playback and view records (aggregated)
4. 4.Resume playback: playback position
5. 5.Recommendation display and performance measurement: recommendation impression and click records
6. 6.Social features such as following and blocking: relationship records
7. 7.Sending notifications (in-Service notifications, email and app push, and, where the Company offers them, text messages and KakaoTalk notification messages): notification recipient and content, email address, mobile phone number (text messages and KakaoTalk notification messages only), app push token
8. 8.Receiving and handling reports: reason for the report, details, outcome
9. 9.Receiving and handling commissions (business matching): the commission items in Article 4, paragraph ④, item 4
10. 10.Audit records of operator actions: who acted, the target, the reason, the result
11. 11.Payment and refund of paid passes and the price of business matching production: the payment items in Article 4, paragraph ⑦, item 1, pass records, refund account (bank transfer refunds only)
12. 12.Creator settlement and withholding tax: account holder name, bank, account number, unique identification information, business information, playback logs
13. 13.Conclusion and performance of production contracts (business matching — including Creator matching, drafting planning documents, storyboards and content introductions, reviewing drafts and final videos, relaying messages through the dedicated PM, and translating text into the screen language, part of which is processed by AI and machine translation provided by the trustees in Articles 8 and 9): commission items, Client information, Creator profile and portfolio, business matching participation items (Article 4, paragraph ④, item 6), business matching processing records (Article 4, paragraph ⑤, item 8), and the name and phone number of business matching users (contact regarding commissions, contracts, and settlements; Article 4, paragraph ②)
14. 14.Compliance with legal obligations (transaction and tax records): order, payment, tax invoice, and settlement records, and tax invoice issuance information (Article 4, paragraph ⑦, item 5)
15. 15.Identity verification, account recovery, and Service-related contact: name (Members who signed up on or after September 11, 2026, and business matching users), phone number, mobile phone identity verification result (Article 4, paragraph ⑪, only where the Company offers it)
16. 16.Age verification and viewing restrictions by rating: date of birth
17. 17.Aggregate statistics (only in a form from which no individual can be identified): gender
18. 18.Analysis of usage statistics (which screens are used most and where Users leave): usage statistics (Article 4, paragraph ⑤, item 6)
19. 19.Analysis of playback quality (in which works playback fails or stalls): playback quality records (Article 4, paragraph ⑤, item 7)
20. 20.Sending marketing communications (informing only Members who have given optional consent about new works, events, and offers by email and app push notification): email address, nickname, app push token, consent records (Article 4, paragraph ⑩)
21. 21.Providing and improving search: search records (Article 4, paragraph ⑤, item 9)
22. 22.Security and incident response: access records (Article 4, paragraph ⑤, item 10)

The legal bases for the processing in the items above are as follows. Processing needed to provide the Service and to conclude and perform business matching contracts (items 1 through 11, 13, 15, 16, 21 and 22) is based on Article 15, paragraph ①, item 4 of the Personal Information Protection Act; settlement, tax withholding and transaction and tax records (items 12 and 14) on item 2 of the same paragraph; usage statistics and playback quality analysis (items 18 and 19) on item 6 of the same paragraph; and marketing communications (item 20) and items a Member chooses to enter (such as gender in item 17) on consent under item 1 of the same paragraph. Provision to third parties under Article 7 is based on consent under Article 17, paragraph ①, item 1 of the same Act or on legal obligations.

Article 6 (Processing and Retention Period of Personal Information)

① Member information is retained while membership continues and is destroyed after a withdrawal request in accordance with the procedure in Article 10.

② Transaction and tax records are retained without destruction for the following periods as required by applicable laws, and are stored and managed separately from other personal information.

1. 1.Order, payment, and refund records: 5 years, as records of payment and supply of goods under the Act on the Consumer Protection in Electronic Commerce
2. 2.Withdrawal of subscription and contract records: 5 years, as records of withdrawal of subscription and contracts under the Act on the Consumer Protection in Electronic Commerce
3. 3.User complaint and dispute resolution records: 3 years, as records of consumer complaints and dispute resolution under the Act on the Consumer Protection in Electronic Commerce
4. 4.Labeling and advertising records: 6 months, as records of labeling and advertising under the Act on the Consumer Protection in Electronic Commerce
5. 5.Tax invoices and transaction evidence (including the counterparty's name, business registration number, and email address): 5 years (7 years for offshore transactions), as transaction evidence under the Framework Act on National Taxes
6. 6.Settlement records, contracts, and project records: 5 years, as contract records under the Act on the Consumer Protection in Electronic Commerce and as transaction evidence under the Framework Act on National Taxes
7. 7.Unique identification information and payment details related to withholding tax: 5 years, as the basis for withholding tax and filing of payment statements under the Income Tax Act and the Corporate Tax Act

③ Because the Company sells passes directly and is a party to production contracts, it retains all of the records in paragraph ②. Under an interpretation that treats the Company as an intermediary, the scope of retention would be narrower, but because the Company retains the wider scope, it satisfies the statutory retention obligation under either interpretation. The retention periods are those in paragraph ② under either interpretation.

④ For records left in the course of using the Service, once the following periods have elapsed, the values linking the record to the User are deleted or the record itself is deleted. Records may remain as statistics, but it becomes impossible to tell who left them.

1. 1.Viewing and view records: after 90 days, the User identifiers (Member number and session number) are deleted. Impression counts per work remain as statistics
2. 2.Signage device status records: deleted after 30 days
3. 3.Playback logs (basis for settlement): deleted 400 days after the settlement payment is completed. They are not deleted before payment because they are the basis for settlement
4. 4.Discarded playback records: deleted after 365 days
5. 5.Access records: deleted after 1 year
6. 6.Recommendation impression records and search records: retained until withdrawal; on withdrawal, the User identifiers are deleted under paragraph ⑤

⑤ When an account is deleted, these records are processed together regardless of the periods in paragraph ④. They are destroyed after the 30-day grace period following withdrawal, and the User identifiers in the usage records are deleted at the same time (Article 10).

⑥ The periods in paragraph ④ are actually applied by a deletion job that runs every hour.

⑦ The items in Article 4, paragraph ⑩, item 2 are used for sending marketing communications until you withdraw consent to receive marketing communications or withdraw your membership. The consent records in item 1 of the same paragraph are evidence of consent and withdrawal, and are kept until they are destroyed under Article 10 after withdrawal of membership.

⑧ The refund account in Article 4, paragraph ⑦, item 6 is destroyed without delay after the refund is completed. However, the portion that must be preserved as a refund record under paragraph ②, item 1 is stored separately for that period.

⑨ The tax invoice issuance information and the copy of the business registration certificate in Article 4, paragraph ⑦, item 5 are retained until the Client deletes the organization information or withdraws membership, so that they can be reused for the next payment, and the portion that constitutes evidence for issued tax invoices is preserved under paragraph ②, item 5. The identity verification result in Article 4, paragraph ⑪ is retained while the membership is maintained.

Chapter 3 Provision, Outsourcing, and Cross-Border Transfer of Personal Information

Article 7 (Provision of Personal Information to Third Parties)

① The Company provides personal information to third parties only in the following cases and not otherwise. Processing outsourcing required for operating the Service is not provision to a third party and is governed by Articles 8 and 9.

1. 1.To a Member who has commissioned production through business matching (the Client), the Company provides the activity name, profile picture, specialties, tools used, portfolio, and number of completed projects of the Creators who submitted drafts. The time of provision is when the Client pays the draft-viewing fee; before then, the Creators are masked so that they cannot be identified. The Creator's contact details are not provided to the Client, and contact goes through the Company (the dedicated PM). The purpose is draft selection and production, and the retention period is until the project ends
2. 2.To a Creator to whom the Company sends a commission, the Company provides the Client's industry and the commission details written in the commission form, and to a Creator who has accepted the commission, it additionally provides the Client's company name (an individual client is shown only as "Individual client") (Article 20 of the Terms of Service). The name and contact details of the Client's contact person are not provided to the Creator, and contact goes through the Company (the dedicated PM). The purpose is reviewing and performing the commission, and the retention period is until the project ends (for Creators who do not accept, until the response deadline)
3. 3.To the National Tax Service, the Company provides the payee's name, unique identification information, and payment amount when filing withholding tax returns and payment statements. The purpose is compliance with legal obligations, and the retention period is the period prescribed by law

② The provision under items 1 and 2 of paragraph ① is based on the consent obtained under Article 20④ of the Terms of Service when the Client submits a commission form and when the Creator accepts a commission, respectively, and the provision under item 3 is based on a legal obligation. Users may refuse consent under items 1 and 2; if they refuse, that commission cannot proceed, but use of other services is not affected.

Article 8 (Outsourcing of Personal Information Processing)

① To provide the Service, the Company outsources (entrusts) the processing of personal information as follows.

1. 1.To Amazon Web Services, Inc.: service infrastructure (servers, data storage, and delivery of service emails), processed domestically
2. 2.To Amazon Web Services, Inc.: image delivery, processed abroad (United States and other countries)
3. 3.To Google LLC: social sign-in authentication and profile image hosting, processed abroad (United States)
4. 4.To Apple Inc.: social sign-in authentication, processed abroad (United States)
5. 5.To Kakao Corp.: social sign-in authentication, processed domestically
6. 6.To Mux, Inc.: video encoding, streaming, and playback quality analysis, processed abroad (United States)
7. 7.To Toss Payments Co., Ltd.: payment processing and refund processing for passes and the price of business matching production, processed domestically. Only where the Company offers payment through Toss Payments
8. 8.To Google LLC: usage statistics analysis, processed abroad (United States)
9. 9.To Google LLC: delivery of app push notifications sent to Android devices, processed abroad (United States)
10. 10.To Apple Inc.: delivery of app push notifications sent to iOS devices, processed abroad (United States)
11. 11.To Korea PortOne Co., Ltd.: payment window integration and relay of payment, cancellation and refund information, and, where the Company offers mobile phone identity verification through PortOne, relay of verification requests and results, processed domestically
12. 12.To KG Inicis Co., Ltd.: payment processing and refund processing for credit cards and other payment methods, processed domestically
13. 13.To NICE Payments Co., Ltd.: payment processing and refund processing for credit cards and other payment methods, processed domestically. Only where the Company offers payment through NICE Payments
14. 14.To PayPal Pte. Ltd.: payment processing and refund processing for overseas payments (US dollars and Japanese yen), processed abroad (Singapore, United States and other countries)
15. 15.To Anthropic, PBC: AI processing for business matching (organizing briefs; drafting planning documents, storyboards and content introductions; automated review comments on drafts and final videos; work analysis; career score proposals) and, where the Company offers automatic translation of work and artist introductions, that translation, processed abroad (United States and other countries)
16. 16.To OpenAI, L.L.C.: transcription of video audio, processed abroad (United States and other countries). Only where the Company offers this feature
17. 17.To Google LLC: machine translation of text written by Members, processed abroad (United States and other countries). Only where the Company offers this feature
18. 18.To NAVER Corp.: social sign-in authentication, processed domestically. Only where the Company offers NAVER account sign-in
19. 19.To NICE Information Service Co., Ltd., Korea Mobile Certification Inc. and Danal Co., Ltd.: mobile phone identity verification; and to SK Telecom Co., Ltd., KT Corporation and LG Uplus Corp.: mobile phone identity confirmation, processed domestically. Only where the Company offers mobile phone identity verification; the actual trustees are the identity verification provider contracted by the Company and the mobile carrier the User subscribes to
20. 20.To NHN Cloud Corp.: sending text messages (SMS and LMS) and KakaoTalk notification messages on the Company's behalf; and to Kakao Corp.: delivery of KakaoTalk notification messages, processed domestically. Only where the Company offers sending text messages or KakaoTalk notification messages

② Service infrastructure and data storage are processed domestically. Only the items marked "abroad" in paragraph ① are processed abroad, and the details are set out in Article 9.

③ Among the items in paragraph ①, outsourcing marked "only where the Company offers" takes place from the time the Company begins offering that feature or payment method, and before then no personal information is passed to the relevant trustee. The items entrusted are limited to those the Company already processes under this Policy that are necessary for that work. The Company announces within the Service the features it begins offering.

Article 9 (Cross-Border Transfer of Personal Information)

① To provide the Service, the Company entrusts the processing and storage of personal information to overseas providers. This is processing outsourcing and storage necessary for the performance of the contract concluded with the User, and because the matters required by law are disclosed in this Policy, separate consent is not obtained.

② The transfer to Google LLC (social sign-in authentication and profile image hosting; contact googlekrsupport@google.com) is as follows.

1. 1.Items transferred: the connecting IP address and browser information at the time the User is redirected to the Google sign-in screen (collected directly by Google). Because a copy of the profile picture is kept in the Company's storage at sign-up, it is not transferred through this route, and the IP address of a person viewing the profile is not transferred to Google either
2. 2.Destination country, timing, and method: to the United States and other countries where Google operates, transferred over an encrypted connection at the time of a sign-in attempt
3. 3.Purpose of use and retention period: used for sign-in authentication and provision of profile images. Google does not publish a single retention period; it varies by data type and user settings. The transfer continues for as long as the Company offers Google as a sign-in method
4. 4.How to refuse: if you sign up with another sign-in method, such as Kakao (domestic) or email and password, no information is transferred to Google

③ The transfer to Apple Inc. (social sign-in authentication; contact https://www.apple.com/legal/privacy/contact/) is as follows.

1. 1.Items transferred: the connecting IP address and device information at the time the User is redirected to the Apple sign-in screen (collected directly by Apple)
2. 2.Destination country, timing, and method: to the United States, transferred over an encrypted connection at the time of a sign-in attempt. Apple states that personal information collected worldwide is stored by Apple Inc. in the United States
3. 3.Purpose of use and retention period: used for sign-in authentication. Apple does not publish a single retention period. The transfer continues for as long as the Company offers Apple sign-in
4. 4.How to refuse: if you sign up with another sign-in method, such as Kakao or email and password, no information is transferred to Apple

④ During the sign-in process, the Company does not send any value identifying the User to the providers in paragraphs ② and ③. The only value carried in the sign-in request is a temporary value confirming that the request originated from the Company's screen; the Member number, email address, and similar values are not included.

⑤ The transfer to Mux, Inc. (video encoding, streaming, and playback quality analysis; contact privacy@mux.com) is as follows.

1. 1.Items transferred: original video files uploaded by Creators; the viewer's IP address and playback request information at the time a video is played; and playback quality records (Article 4, paragraph ⑤, item 7 — the identifier of the video played, the amount played and the point at which it stopped, playback failures and stalling, device, browser, screen size, time of access, and approximate region at city level). The Company does not send User identifiers to Mux and does not use cookies for playback quality records
2. 2.Destination country, timing, and method: to the United States, transferred over an encrypted connection when a video is uploaded or played
3. 3.Purpose of use and retention period: used for video encoding and streaming delivery, and for the analysis of playback quality. Playback quality analysis is used only to find and fix where playback fails or stalls, and is not used for advertising. Mux does not publish a single retention period. Original video files are retained until the Company deletes the asset, and viewer IP addresses and playback quality records follow Mux's policy
4. 4.How to refuse: if you do not play videos, your viewer IP address is not transferred. However, because video viewing is the core of the Service, use is effectively difficult. Creators who do not upload videos have no original files transferred

⑥ The transfer to Amazon Web Services, Inc. (image delivery; contact aws-korea-privacy@amazon.com) is as follows.

1. 1.Items transferred: profile pictures, content thumbnails, and images attached to posts (public files only)
2. 2.Destination country, timing, and method: to delivery infrastructure in countries near the User, such as the United States and Japan, by transmitting the file over an encrypted connection when it is requested and keeping it temporarily
3. 3.Purpose of use and retention period: used to improve delivery speed. Deleted when the temporary retention period ends; the original remains domestically
4. 4.How to refuse: files can be destroyed by withdrawing membership. However, if you refuse, profile pictures and thumbnails will not be displayed

⑦ The storage location for paragraph ⑥ is domestic. Originals are in Korea, and what is transferred abroad is a copy for delivery. Files that require sign-in to view (original videos and settlement statements) do not pass through this route. Because profile pictures are displayed on public screens and pass through this route, the User decides whether to upload potentially sensitive images, such as a photo of their face, to their profile.

⑧ The transfer to Google LLC (usage statistics analysis; contact googlekrsupport@google.com) is as follows. What is transferred is only a random cookie identifier not linked to any account and the usage records attached to it, and any User, whether a Member or not signed in, may refuse this transfer alone by the method in item 4.

1. 1.Items transferred: a random cookie identifier stored in the browser (Article 12, paragraph ①, item 4), the URL and title of the screen opened, the type of button pressed (playback start, progress, and completion; favorites; likes; follows; shares; whether a search was run; checkout start; app open; app install button; errors (error type only)), the usage environment (language, app or web, and whether the User is signed in), device, browser, and screen size, time of access, and approximate location at the city level. Values that identify the User, such as the Member number, email address, or name, and search terms are not sent. The connecting IP address is used by Google only to estimate the location and is not stored
2. 2.Destination country, timing, and method: to the United States and other countries where Google operates, over an encrypted connection when a screen is opened or a button is pressed
3. 3.Purpose of use and retention period: used to analyze Service usage statistics, such as which screens are used most and where Users leave. Not used for advertising or personalized advertising, and advertising personalization signals are turned off. User-level records are retained by Google for 14 months and then deleted automatically; after that, only aggregate statistics from which no individual can be identified remain
4. 4.How to refuse: if you refuse or delete the cookies in Article 12, paragraph ①, items 4 and 5 in your browser, or install the Google Analytics opt-out browser add-on provided by Google, no information is transferred. Refusing does not restrict your use of the Service

⑨ The transfer to app push notification delivery providers is as follows. Notifications to Android devices are sent through Google LLC (contact googlekrsupport@google.com) and notifications to iOS devices through Apple Inc. (contact https://www.apple.com/legal/privacy/contact/); a notification for a given device is transferred only to the one provider that corresponds to that device's operating system. This applies only if you have allowed notifications in the app, and nothing is transferred when you use the Service in a web browser.

1. 1.Items transferred: the app push token of that device (Article 4, paragraph ⑤, item 5) and the title and body of the notification. Values that identify the User, such as the Member number, email address, or name, are not sent. Because the device connects directly to the provider when the app obtains a token, the provider directly collects that device's connecting IP address and device information
2. 2.Destination country, timing, and method: to the United States and other countries where the provider operates, by the device making a request directly to the provider when a token is obtained after notifications are allowed in the app, and over an encrypted connection each time a notification is generated
3. 3.Purpose of use and retention period: used to deliver Service notifications (Article 5, item 7) and, only for Members who have given optional consent, marketing communications (Article 5, item 20) to the device. Notification content is kept temporarily for delivery to the device; if it cannot be delivered immediately because the device is not connected, Google keeps it for up to 4 weeks and Apple for the period set by Apple, and then delivers or discards it. Google and Apple do not publish a single retention period for delivery records
4. 4.How to refuse and its effect: if you do not allow notifications in the app, no token is issued or registered and nothing is transferred. If you turn off app notifications in the device settings after allowing them, notifications are not displayed on the device, but notification delivery requests may continue to be transferred to the provider until you sign out on that device. Signing out revokes that device's token and stops the transfer. Withdrawing consent to receive marketing communications in the settings screen stops only app push notifications for marketing communications; Service notifications continue to be delivered by app push. In either case your use of the Service is not restricted, and notifications can be viewed in the notification list within the Service

⑩ The transfer to PayPal Pte. Ltd. (overseas payments; domestic agent contact paypal@generalagent.co.kr) is as follows.

1. 1.Items transferred: order identifier, order name (project name), payment amount, currency, refund reason (when refunding). The Company does not send the User's name, email or member number to PayPal. The PayPal account and payment method information the User enters directly in the PayPal window are collected directly by PayPal and do not pass through the Company
2. 2.Destination country, timing, and method: to Singapore, the United States and other countries where PayPal operates, transferred over an encrypted connection when the User chooses overseas payment and pays or is refunded
3. 3.Purpose of use and retention period: used to authorize, capture and refund overseas payments. PayPal's retention period follows PayPal's privacy policy, and the Company preserves payment records under Article 6, paragraph ②
4. 4.How to refuse: choosing a domestic payment method (card or bank transfer) avoids the transfer. However, payment in foreign currencies (US dollars and Japanese yen) is offered only through PayPal, so if you refuse, you can pay only in Korean won

⑪ The transfer to Anthropic, PBC (AI processing for business matching and automatic translation of work introductions; contact privacy@anthropic.com) is as follows. Only the items the Company already processes that are needed for the task are sent, and values identifying an account, such as member numbers and account email addresses, are not sent. Values in free text that take the form of email addresses, phone numbers or resident registration numbers are masked before sending.

1. 1.Items transferred: (a) Commission processing — the content of the commission form (the items in Article 4, paragraph ④, item 4, excluding attachments, reference links and needs survey responses; reference works by title only), the brief organized by AI, the planning document from the previous stage, the title, production intent and tools used of the selected draft, and the Client's notes on the second planning document. (b) Review of drafts and final videos — the title, production intent, tools used and declared music license of the submission, still frames extracted from the submitted video, the brief summary, and the Client's brand guide. (c) Work analysis — representative still frames, title, description, genre, length and aspect ratio of public works and private business matching portfolios, and part of the transcribed audio (if any). (d) Career score proposals — the career and track record entered by the Creator (brand and advertising; broadcast, OTT and film; awards and selections). The Creator's name and contact details are not sent. (e) Automatic translation of work and artist introductions (only where the Company offers it) — work titles, subtitles and synopses, and artist bios. If a person appears in a still frame, their image is transferred with it
2. 2.Destination country, timing, and method: to the United States and other countries where Anthropic operates, transferred over an encrypted connection when the work in item 1 is processed
3. 3.Purpose of use and retention period: used only to produce the results of the tasks in item 1 (summaries, planning documents, review comments, classification tags, score proposals, translations) and return them to the Company. The results are drafts and are reviewed by the dedicated PM. Anthropic states that it deletes inputs received and outputs produced within 30 days of receipt, but that where a violation of Anthropic's usage policies is detected, it may keep them for up to 2 years and the classification scores for up to 7 years
4. 4.How to refuse and its effect: if you do not use the business matching service, the transfers in item 1 (a), (b) and (d) do not occur. If a Creator does not enter career and track record, the transfer in (d) does not occur. A Creator may request through the channel in Article 25 of the Terms of Service that their works be excluded from the analysis in (c), in which case those works are not used for business matching recommendations or matching. While using business matching, you cannot refuse only the transfers in (a) and (b), because drafting planning documents and reviews are part of performing the business matching contract

⑫ The transfer to OpenAI, L.L.C. (transcription of video audio; contact privacy@openai.com) is as follows. Only where the Company offers this feature.

1. 1.Items transferred: the audio tracks of public works, business matching submissions and private portfolio videos. Values identifying the User, such as member numbers, names and email addresses, are not sent
2. 2.Destination country, timing, and method: to the United States and other countries where OpenAI operates, transferred over an encrypted connection when work analysis is processed
3. 3.Purpose of use and retention period: used only to transcribe audio into text for work analysis (paragraph ⑪, item 1 (c)). OpenAI states that it does not use the data it receives for model training and keeps abuse monitoring logs for up to 30 days unless the law requires longer retention
4. 4.How to refuse and its effect: the same as the request for exclusion from work analysis under paragraph ⑪, item 4. If excluded, the audio of that work is not transferred either

⑬ The transfer to Google LLC (machine translation of text written by Members; contact googlekrsupport@google.com) is as follows. Only where the Company offers this feature.

1. 1.Items transferred: text on business matching screens written in a language different from the screen language chosen by the User (project titles, briefs, messages, draft titles and production intent, revision requests, work introductions, planning documents). Values identifying an account, such as member numbers and account email addresses, are not sent, and values in the text that take the form of email addresses, phone numbers or resident registration numbers are masked before sending
2. 2.Destination country, timing, and method: to the United States and other countries where Google operates, transferred over an encrypted connection when the User opens that text on screen
3. 3.Purpose of use and retention period: used only to produce and return translations. Google states that it keeps text briefly for translation and does not use the text it receives for purposes other than providing the translation service or for training or improving its translation features
4. 4.How to refuse and its effect: setting the screen language to the language in which the text was written avoids the transfer. In that case, text written in other languages is shown in the original

⑭ The method, procedure, and effect of refusing cross-border transfer are as follows. Users who do not want the transfer may stop it by withdrawing membership, and the withdrawal procedure follows Article 10.

1. 1.Individual trustees cannot be selected and refused separately. The providers in paragraphs ② through ⑦ are infrastructure required for the Service to operate, and if any one of them is excluded, the Service does not function
2. 2.If you refuse, you cannot use the Service. This is because sign-up, sign-in, video playback, and profile display all run on the above infrastructure
3. 3.The transfers in paragraphs ⑤ and ⑥ can be partially avoided by not using the relevant features (uploading a profile picture directly, not playing videos)
4. 4.The transfer in paragraph ⑧ (usage statistics analysis) is a statistics tool rather than infrastructure required for the Service to operate, so unlike items 1 and 2, it can be refused on its own; the method and effect follow paragraph ⑧, item 4
5. 5.The transfer in paragraph ⑨ (app push notification delivery) takes place only if you have allowed notifications in the app, so unlike items 1 and 2, it can be refused on its own; the method and effect follow paragraph ⑨, item 4
6. 6.The transfer in paragraph ⑩ (PayPal) takes place only if you choose overseas payment, so it can be refused on its own; the method and effect follow paragraph ⑩, item 4
7. 7.The transfers in paragraphs ⑪ through ⑬ (AI processing, audio transcription and machine translation) take place only if you use the business matching service or the relevant feature is used; the method and effect follow item 4 of each paragraph

Chapter 4 Destruction of Personal Information and Rights of Data Subjects

Article 10 (Procedure and Method of Destroying Personal Information)

① The destruction procedure is as follows.

1. 1.The User requests withdrawal (account deletion)
2. 2.A 30-day grace period applies. The request can be cancelled during this period
3. 3.Once the grace period ends, the destruction job that runs daily at 03:00 (Korea Standard Time) processes it

② If any of the following grounds exists, destruction is deferred until that ground is resolved. Once the ground is resolved, destruction proceeds automatically without a new request, and the reason for the deferral is shown on the request screen.

1. 1.A project is in progress: resolved automatically when the project ends
2. 2.Unpaid settlement amounts exist: resolved automatically when settlement is completed
3. 3.A report or dispute is being handled: resolved automatically when handling is completed
4. 4.An active subscription exists: resolved only when the User cancels it themselves
5. 5.A refund deduction balance remains: you must contact the channel set out in Article 25 of the Terms of Service

③ Personal information linked to the account is deleted, and identifying information is erased from records that must retain references for transactions and settlement. Linked sign-in accounts are processed to the same extent. What is deleted and what remains for each target is as follows.

1. 1.Account: name, email address, email verification time, and profile picture are deleted; only the internal identifier remains
2. 2.Profile: handle and previous URLs, display name, legal name, phone number, gender, date of birth, age verification time, profile picture, and bio are deleted; the sign-up time, role, withdrawal status indicator, and the record of its reason remain
3. 3.Company information: contact person name, contact person details, business registration number, representative's name, business type, business item, place of business address, email address for receiving tax invoices, copy of the business registration certificate, brand guide, and needs survey responses are deleted; company name, country, industry, and company size remain. The portion that constitutes evidence for issued tax invoices is stored separately under Article 6, paragraph ②, item 5
4. 4.Settlement information: account number, account holder name, and unique identification information are deleted after the retention period in Article 6 has elapsed; payment amounts and dates are tax evidence and are stored separately
5. 5.Playback and view records: who performed the action and whose profile was viewed are deleted; the action itself remains for aggregation
6. 6.Search term records: who searched is deleted; the search terms remain
7. 7.Recommendation impression records: who saw them is deleted; the impression records remain

④ The body text and ratings of posts, comments, and reviews you wrote, and the works, photos, and videos you uploaded, including originals and thumbnails, are deleted. Publication and playback of your works are stopped, and only the empty records needed to maintain references to transaction records are kept. Passwords, sign-in sessions, and social sign-in link information are also deleted.

⑤ Destruction is carried out in a way that cannot be reversed, and matters relating to destruction are recorded and managed. If cleanup at external storage or the video provider fails, it is retried, and the deletion is marked complete only after external cleanup has finished. You can check the receipt, processing status, and final result on the account deletion guide screen of the device from which the request was made (Article 12, paragraph ①, item 6). After destruction, the Chief Privacy Officer verifies the result.

⑥ The transaction and tax records in Article 6, paragraph ② are not destroyed and are stored separately.

⑦ For accounts signed in with Apple, the Company requests that the Apple link be revoked using the stored authentication token. Even where a previous version did not store the token needed for revocation, account deletion proceeds, and the account deletion guide screen provides instructions for revoking the link directly in your Apple account settings.

Article 11 (Rights and Obligations of Data Subjects and Legal Representatives, and How to Exercise Them)

① Users may exercise the following rights at any time.

1. 1.Access: you may check the personal information about you that the Company processes
2. 2.Correction and deletion: you may request that inaccurate information be corrected or deleted
3. 3.Suspension of processing: you may request that processing of your personal information be stopped
4. 4.Withdrawal of consent: you may withdraw consent for personal information processed on the basis of consent

② Profile information can be edited directly on the profile edit screen.

③ Other requests are received through the contact channel set out in Article 25 of the Terms of Service. The Company processes the request and notifies you of the result within 10 days of receiving it.

④ If the Company refuses a request or is unable to act on it, it notifies you of the reason without delay.

⑤ Users may also make requests through a legal representative or an authorized person.

⑥ Consent to receive marketing communications is handled as follows.

1. 1.You may withdraw consent or consent again at any time on the Settings screen, and the change takes effect immediately
2. 2.When consent, refusal, or withdrawal is processed, the date of processing and the result are shown on that screen as notice
3. 3.Every 2 years from the date of consent, the Company checks whether you wish to keep receiving marketing communications
4. 4.Marketing communications are not sent by app push notification between 9 PM and 8 AM the following day

Article 12 (Devices That Automatically Collect Personal Information)

① The Company uses the following cookies.

1. 1.Sign-in cookie: a cookie for keeping you signed in, with a lifetime of 30 days. If refused, you cannot stay signed in
2. 2.Language cookie: a cookie for remembering your chosen display language; it disappears when the browser is closed (session cookie). If refused, your language choice is not remembered on your next visit
3. 3.Playback count cookie: a random identifier for counting playback starts from the same browser as one while not signed in, with a lifetime of 1 year. It is not linked to any account and cannot identify who you are (Article 4, paragraph ⑥), and refusing it does not restrict your use of the Service
4. 4.Usage statistics cookie: a random identifier for distinguishing visitors, with a lifetime of 2 years. It is not linked to any account, and refusing it only excludes you from usage statistics without restricting your use of the Service
5. 5.Usage statistics session cookie: session state for the same visitor, with a lifetime of 2 years. The effect of refusing is the same as in item 4
6. 6.Withdrawal receipt cookie: a tamper-proof receipt for checking the processing result on the same device after a withdrawal request, with a lifetime of 180 days. It carries no sign-in authority. If refused or deleted, you cannot check the status by receipt on that device. It does not affect the processing of account deletion
7. 7.Biz sign-up cookie: a cookie for remembering the sign-up type and company information (company name, industry and business registration number) chosen on the Biz sign-up screen until sign-up is completed, with a lifetime of 1 day. It is no longer used after sign-up; if refused, you enter the company information again after sign-up
8. 8.Commission check cookie: a cookie for remembering when a Creator last checked the list of received commissions, with a lifetime of 180 days. If refused, the indication of new commissions may be inaccurate
9. 9.BIZ language cookie: a cookie for remembering the language chosen on the BIZ screens, with a lifetime of 1 year. If refused, the language must be chosen again on the next visit
10. 10.BIZ mode cookie: a cookie for remembering the mode chosen on the BIZ screens (client, creator or PM), with a lifetime of 180 days. If refused, the first mode opens on the next visit

② Users may refuse cookie storage or delete stored cookies in their browser settings. However, if the sign-in cookie is refused, features that require sign-in cannot be used.

③ The Company uses usage statistics cookies (paragraph ①, items 4 and 5) for the purpose of analyzing usage statistics. Third-party cookies for advertising purposes are not used. The method and effect of refusing analytics cookies follow Article 9, paragraph ⑧, item 4.

Chapter 5 Security Measures and the Chief Privacy Officer

Article 13 (Measures to Ensure the Security of Personal Information)

① The Company implements the following measures.

1. 1.Access control: access is restricted so that only the signed-in User's own information can be viewed
2. 2.Separation of privileges: Service operation privileges are separated from administrative privileges
3. 3.Tamper-proof consent records: consent and withdrawal records are kept so that they cannot be modified or deleted
4. 4.Audit records of operator actions: operator actions are recorded with who acted, what was done, why, and what the result was, and cannot be modified or deleted
5. 5.Protection of sign-in information: security settings are applied to the sign-in cookie
6. 6.Video access control: videos open only with playback permission that is valid for a limited time
7. 7.Encryption in transit: all external transmissions use encrypted connections
8. 8.Protection of unique identification information: resident registration numbers and foreigner registration numbers received for settlement are encrypted as required by law and stored separately from other information. Access is restricted to settlement staff, the values are masked on screen, and who accessed them and when is recorded
9. 9.No storage of payment information: information about the payment method itself, such as card numbers and bank account numbers, is processed by the payment agency. The Company's systems have no storage field for it
10. 10.Internal management plan: an internal management plan for handling personal information securely is established and implemented
11. 11.Retention of access records: what operators do with personal information is recorded and not erased. Service access records are retained for 1 year
12. 12.Encryption of stored data: stored data is encrypted. Passwords are not stored in their original form and are kept only in an irreversible form
13. 13.Malware prevention and physical access control: servers are operated in the cloud provider's data centers, and the Company does not operate its own server room

② The Company does not process sensitive information and has no storage field for it.

③ Unique identification information is received only from Creators who receive settlement payments, for the statutory purpose of withholding tax, and the encryption and access controls required by law are applied as set out in paragraph ①, item 8.

④ The specific details of the measures in paragraph ① are set out in the internal management plan.

Article 14 (Items Not Applicable)

The following items, which the law requires to be stated only where applicable, do not apply to the Company.

1. 1.Possibility of disclosure of sensitive information and how to opt out: the Company does not process sensitive information
2. 2.Processing of pseudonymized information: the Company does not process pseudonymized information
3. 3.Criteria for additional use and provision: the Company does not use or provide information beyond the purpose for which it was collected
4. 4.Countries in which personal information of domestic Users is collected directly from abroad: there is no flow of direct collection from abroad

Article 15 (Personal Information of Children Under 14)

① The Company does not process the personal information of children under 14 years of age. This applies regardless of the User's country of residence.

② On first use after sign-up, the User confirms that they are at least 14 years old, and this is verified again by the date of birth entered next (Article 4, paragraph ②, item 3). The Service cannot be used before this confirmation, and a date of birth indicating that the User is under 14 is not stored and sign-up does not proceed.

③ The fact and time of confirmation, and the date of birth, are recorded. The date of birth is not used for any purpose other than age verification and viewing restrictions by content rating.

④ Although the age prescribed by law differs by country, 14 years satisfies all of the following standards.

1. 1.The Personal Information Protection Act of the Republic of Korea sets the age at 14, the same as the Company's standard
2. 2.COPPA in the United States and the UK GDPR set the age at 13, so the Company's standard is stricter
3. 3.Article 8 of the GDPR (European Economic Area) sets the age between 13 and 16 as determined by each member state, and paragraph ⑤ applies

⑤ Article 8 of the GDPR sets the age that applies when consent is used as the legal basis for processing (it expressly refers to Article 6(1)(a) of the same regulation). Because the Company processes personal information for providing the Service on the basis of the performance of a contract (Article 18, paragraph ④), the age requirement in that provision does not apply as such. Accordingly, the Company does not distinguish between the different ages of member states on screen and applies the single standard of 14 years.

⑥ If the Company learns that a User is under 14, it destroys that account's personal information without delay. The child or their legal representative may notify the Company through the contact channel set out in Article 25 of the Terms of Service.

⑦ The confirmation in paragraph ② is a self-declaration that does not go through an identity verification agency. Because the law does not specify a verification method, this method is used for now. In features where the Company offers mobile phone identity verification (Article 4, paragraph ⑪), age may be confirmed using the date of birth in the verification result.

Article 16 (Chief Privacy Officer)

① The Chief Privacy Officer is the Representative, Song Sanghoon, and no separate department is established for personal information protection. Contact: telephone +82-2-6385-0031, email dev@impactstation.kr.

② Requests for access to personal information are received and handled directly by the Chief Privacy Officer without a separate department. The contact channel follows Article 25 of the Terms of Service.

③ Because the Company is a domestic corporation, it is not obligated to designate a domestic representative. The obligation to designate a domestic representative applies to businesses that have no address or place of business in the Republic of Korea.

Article 17 (Remedies for Infringement of Rights)

① Users who need help regarding infringement of personal information may contact the following organizations.

1. 1.Personal Information Dispute Mediation Committee (1833-6972): applications for dispute mediation and collective dispute mediation
2. 2.Personal Information Infringement Report Center (118): reporting infringements
3. 3.Supreme Prosecutors' Office (1301): requests for investigation
4. 4.Korean National Police Agency (182): requests for investigation

② Users who object to a disposition by the personal information controller may file an administrative appeal under the Administrative Appeals Act.

Chapter 6 Supplementary Provisions

Article 18 (Matters Applicable to Overseas Users)

① The Service is available in multiple countries. Depending on the User's country of residence, that country's personal information laws also apply, and this Article sets out what differs in that case.

② The storage location is the Republic of Korea regardless of the country of residence. From the moment the User's personal information reaches the Company, it is processed in accordance with Articles 8 and 9.

③ Because the Company provides the Service to residents of the European Economic Area (EEA) and the United Kingdom, the GDPR (and the UK GDPR) applies, and the Company is the controller within the meaning of those laws.

④ The legal bases for processing the personal information of EEA and UK residents are as follows.

1. 1.Providing the Service, including account creation, sign-in, video playback, and profile display, is based on the performance of a contract
2. 2.Maintaining security, handling misuse and reports, and aggregation for Service improvement are based on legitimate interests, and the balance against Users' rights has been assessed
3. 3.Retention of transaction and tax records is based on legal obligations

⑤ EEA and UK residents may exercise the following rights. Requests to exercise rights are received through the contact channel set out in Article 25 of the Terms of Service, and the Company processes them and notifies you of the result within 1 month.

1. 1.Access: you may receive a copy of the personal information about you that the Company processes
2. 2.Rectification: you may request that inaccurate information be corrected
3. 3.Erasure: you may request deletion (the "right to be forgotten")
4. 4.Restriction of processing: you may request that processing be suspended
5. 5.Portability: you may receive your information in a machine-readable format and transfer it elsewhere
6. 6.Objection: you may object to processing based on legitimate interests
7. 7.Withdrawal of consent: you may withdraw consent at any time for processing based on consent. Processing carried out before withdrawal remains valid

⑥ The following also apply to EEA and UK residents.

1. 1.You may lodge a complaint with a supervisory authority. For the EEA, this is the supervisory authority of your member state of residence; for the UK, it is the Information Commissioner's Office (ICO)
2. 2.The Company does not carry out processing that produces legal effects on Users based solely on automated decision-making
3. 3.The European Commission adopted an adequacy decision for the Republic of Korea in December 2021. Accordingly, no additional safeguards such as standard contractual clauses are required to transfer personal information from the EEA to the Republic of Korea. The UK also recognizes the Republic of Korea as an adequate country

⑦ The following apply to residents of the United States.

1. 1.The Company does not knowingly collect the personal information of children under 13 (COPPA), and destroys it without delay if it becomes aware of such collection
2. 2.The Company does not sell personal information and does not share it for targeted advertising. It does not use third-party cookies for advertising purposes, and the usage statistics analytics cookies are described in Article 12
3. 3.Whether certain state laws, such as those of California, apply depends on the scale of the business. When they become applicable, this Article will be changed and notice given before they take effect

⑧ Where the laws of the country of residence grant Users residing in other countries broader rights than this Policy, those rights prevail. The rights in Article 11 may be exercised through the contact channel set out in Article 25 of the Terms of Service regardless of the country of residence.

Article 19 (Changes to the Privacy Policy)

① When this Policy is changed, notice is given by posting the changed Policy within the Service. For changes that affect Users' rights, such as an increase in the items processed or the purposes of processing, Users are asked to review the changed Policy before continuing to use the Service, and that review screen also serves as the notice of the change. Processing that requires consent is consented to separately.

② The changes can be reviewed in the revision history, with the text before and after the change shown side by side.

③ The revision history is as follows.

1. 1.Effective September 1, 2026: initial enactment. There is no before-and-after comparison
2. 2.Effective September 8, 2026: Article 4, paragraph ②, item 3 and Article 5, items 15 through 17 were newly added so that nickname, phone number, gender, and date of birth are collected at sign-up; the item in Article 4, paragraph ⑨ stating that date of birth is not collected was deleted; and Article 15, paragraphs ② and ③ were changed accordingly. Members who signed up before the change are asked for the same items after consenting to the changed Policy. The method of giving notice of changes in Article 19, paragraph ① was changed from a prior notice period to posting and renewed consent. On the same effective date, Article 12, paragraph ①, item 3 (the anonymous playback counting cookie) was added
3. 3.Effective September 11, 2026: Article 4, paragraph ②, item 3 and Article 5, item 15 were changed so that name is collected from Members who sign up on or after the effective date. Name is not collected from Members who signed up before the change, and because the items and purposes of processing for those Members do not change, renewed consent is not obtained and notice is given by posting
4. 4.Effective September 12, 2026: Article 4, paragraph ⑤, item 6; Article 5, item 18; Article 8, paragraph ①, item 9; Article 9, paragraph ⑨; and Article 12, paragraph ①, items 4 and 5 were newly added so that Service usage statistics are aggregated with a third-party analytics tool; Article 12, paragraph ③ was changed from "third-party cookies for advertising or analytics purposes are not used" to "Google Analytics cookies are used for the purpose of analyzing usage statistics, and third-party cookies for advertising purposes are not used"; and Article 4, paragraph ③; Article 4, paragraph ⑨, item 3; Article 9, paragraph ⑧, item 4; Article 9, paragraph ⑩; and Article 18, paragraph ⑦, item 2 were changed accordingly. Because usage statistics are aggregated only by a random cookie identifier not linked to any account, the items and purposes of processing for individual Members do not change, so renewed consent is not obtained and notice is given by posting

1. 1.Effective September 14, 2026: the scope of destruction in Article 10, paragraphs ③ through ⑤ was clarified to include legal name, phone number, gender, and date of birth, as well as posts, comments, reviews, and uploaded files you created; and revocation of the Apple link and guidance for existing accounts were added to Article 10, paragraph ⑦. The receipt cookie for checking withdrawal results was specified in Article 12, paragraph ①, item 6. Because this change reduces the scope of retention and provides a means of confirming withdrawal processing, existing consent continues to be recognized and notice is given by posting
2. 2.Effective September 21, 2026: Article 4, paragraph ⑤, item 7 and Article 5, item 19 were newly added so that video playback quality is aggregated with a third-party analytics tool; playback quality analysis was added to the entrusted purpose and the transferred items for Mux in Article 8, paragraph ①, item 6 and Article 9, paragraph ⑤; and Article 4, paragraph ③ was changed accordingly. Article 12 does not change, because no cookie is used for playback quality records. Because playback quality records are kept only per single playback, without values identifying the User and without cookies, the items and purposes of processing for individual Members do not change, so renewed consent is not obtained and notice is given by posting
3. 3.Effective September 30, 2026: Article 4, paragraph ⑩; Article 5, item 20; Article 6, paragraph ⑦; and Article 11, paragraph ⑥ were newly added so that marketing communications are sent by email and app push notification to Members who have given optional consent; and Article 4, paragraph ⑤, item 5 and Article 4, paragraph ⑨, item 4 were changed to reflect that app push tokens are recorded. Article 8, paragraph ①, items 10 and 11 and Article 9, paragraph ⑩ were newly added to reflect that app push notifications are sent through Google LLC to Android devices and through Apple Inc. to iOS devices; the former Article 9, paragraph ⑩ was moved to paragraph ⑪ and item 5 was added to it; and Article 4, paragraph ③ and Article 9, paragraph ⑧, item 4 were changed accordingly. Because receiving marketing communications is optional and the relevant items are processed only for Members who consent, the items and purposes of processing for Members who do not consent do not change, so renewed consent is not obtained and notice is given by posting

1. 1.Effective September 30, 2026: Article 4, paragraph ② was changed to reflect that the Service may be used without entering a phone number or gender, and item 3 of the same paragraph was changed to reflect that a name is not requested from Members who sign in with an Apple account. Because this revision adds no item or purpose of processing and merely states accurately the scope already in effect, renewed consent is not obtained and notice is given by posting

1. 1.Effective September 30, 2026: Article 4, paragraph ② was changed so that Members who sign in with an Apple account are not asked for the items in item 3 of that paragraph. In that case the display name is the name passed by that provider or the handle generated automatically at sign-up, and whether the Member is at least 14 years old is established by the confirmation recorded on the consent screen. Because this revision reduces the items processed, renewed consent is not obtained and notice is given by posting

1. 1.Effective October 1, 2026: the exception in Article 4, paragraph ②, previously limited to Apple accounts, was extended to all social accounts. Members who sign in with a social account are not asked for the items in item 3 of that paragraph; the display name and the confirmation of being at least 14 years old are as set out in item 8. Because this revision reduces the items processed, renewed consent is not obtained and notice is given by posting

1. 1.Effective October 13, 2026: checkout start, app open, app install button, and errors (error type only) were added to the kinds of actions aggregated as usage statistics, and language, app or web, and whether the User is signed in were added as the usage environment, so that Article 4, paragraph ⑤, item 6 and Article 9, paragraph ⑨, item 1 reflect the items actually sent. Because usage statistics continue to be aggregated only by a random cookie identifier not linked to any account, and values identifying the User and search terms are not sent, the items and purposes of processing for individual Members do not change, so renewed consent is not obtained and notice is given by posting

1. 1.Effective October 16, 2026: a sentence was added to Article 4, paragraph ⑤, item 6 stating that, for service operation (checking errors and responding to outages), the fact that an error occurred, its type, and whether the app or the web was used are also recorded on the Company's servers. These records contain no value that identifies the User, such as the Member number or email address, so the items and purposes of processing for individual Members do not change; the change is therefore announced by posting without asking for consent again

1. 1.Effective October 22, 2026: a sentence was added to Article 4, paragraph ② so that Members who wish to use the business matching service (Contentrip AI BIZ) are asked for their name, phone number, gender, and date of birth regardless of how or when they signed up, and Article 5, items 13 and 15 were changed accordingly. These items are processed only when a Member who wishes to use the business matching service enters them directly on the input screen after being informed of the purposes of processing, and because the items and purposes of processing for Members who do not use the business matching service do not change, renewed consent is not obtained and notice is given by posting

1. 1.Effective October 22, 2026: email delivery was added to the work entrusted to Amazon Web Services, Inc. under Article 8, paragraph ①, item 1, so that service emails such as password reset links are sent. Emails are sent to the email address already being processed, the items and purposes of processing do not change, and the change adds entrusted work processed domestically, so renewed consent is not obtained and notice is given by posting

1. 1.Effective October 29, 2026: the following were changed to reflect the actual processing of the business matching service (Contentrip AI BIZ). The commission items, Creator participation items, payment, tax invoice issuance information, refund account and business matching processing records, which are processed only when a Member using business matching enters or submits them directly on the relevant screen, were set out in Article 4, paragraph ④, items 4 and 6, paragraph ⑤, item 8 of the same Article (including the record of concluding a contract by submitting a commission form — time of conclusion, method of consent, connecting IP address and browser information), and paragraph ⑦, items 1, 5 and 6 of the same Article; and the scope of Article 5, items 2, 7, 9, 11, 13, 14 and 15 was specified accordingly. The trustees for payment processing (Korea PortOne Co., Ltd., KG Inicis Co., Ltd., NICE Payments Co., Ltd., PayPal Pte. Ltd.), AI processing (Anthropic, PBC; OpenAI, L.L.C.), machine translation (Google LLC), social sign-in (NAVER Corp.), mobile phone identity verification, and sending of text messages and KakaoTalk notification messages were set out in Article 8, paragraph ①, items 11 through 20 and Article 9, paragraphs ⑩ through ⑬; the price of business matching production was added to the work entrusted to Toss Payments Co., Ltd.; and Article 8, paragraph ③ was added, providing that no personal information is passed to the trustees of features the Company does not yet offer until it offers them. The mobile phone identity verification items (Article 4, paragraph ⑪) are processed only for Members who go through verification where the Company offers that feature, and in that case may also be used for age confirmation under Article 15, paragraph ⑦. Former Article 9, paragraph ⑪ was moved to paragraph ⑭ with items 6 and 7 added; the contact details of recipients were added to Article 9, paragraphs ②, ③ and ⑤; and Article 4, paragraph ③, Article 6, paragraphs ⑧ and ⑨, and Article 10, paragraph ③, item 3 were amended accordingly. In addition, gender was made optional for business matching in Article 4, paragraph ②; the basis for the provision under Article 7, paragraph ①, items 1 and 2 was changed to the consent obtained when a commission form is submitted and when a commission is accepted (Article 20④ of the Terms of Service); search records and access records were set out in Article 4, paragraph ⑤, items 9 and 10 and Article 5, items 21 and 22, and Article 4, paragraph ⑨, items 3 and 4 were deleted; the legal basis of each processing was set out in Article 5, the automatic payment key and display information of a registered card in Article 4, paragraph ⑦, item 1, and the company size that remains after withdrawal in Article 10, paragraph ③, item 3; the retention periods of access records, recommendation impression records and search records were set out in Article 6, paragraph ④; the cookies in Article 12, paragraph ①, items 7 through 10 and the contact details in Articles 16 and 17 were added; and the change notice in Article 19, paragraph ① was changed to a review screen. To reflect that scheduled jobs were moved to domestic infrastructure, the outsourcing to GitHub, Inc. (former Article 8, paragraph ①, item 8) and the cross-border transfer to it (former Article 9, paragraph ⑧) were deleted and the following items and paragraphs were renumbered, and details of infrastructure configuration were removed from the descriptions of outsourcing, cross-border transfers, cookies and security measures. Article 7, paragraph ①, items 1 and 2 were amended to reflect how business matching actually works (the Client and the Creator do not exchange contact details and communicate through the dedicated PM; the Client receives Creator information after paying the draft-viewing fee, and the Creator receives the industry and commission details when commissioned and the Client's company name after accepting), narrowing the scope of provision. The new items are processed only when a Member using the business matching service enters them directly or goes through the relevant feature after being informed of the purposes of processing on the input screen; the outsourcing and cross-border transfers entrust items already being processed to trustees; and because the items and purposes of processing for Members who do not use the business matching service do not change, renewed consent is not obtained and notice is given by posting

Addendum

① This Policy takes effect on October 29, 2026.

② The amended provisions of Article 7, paragraph ①, items 1 and 2 and paragraph ② apply from November 5, 2026, the effective date of Article 20④ of the Terms of Service.