Consent to the Collection and Use of Personal Information

Your consent is required to use AIPro member services. Please review the following and decide whether to give your consent.

Effective date: September 7, 2026

Legal basis

Personal Information Protection Act (PIPA) Article 15 (Collection and Use of Personal Information), Paragraphs 1(1) and 2
PIPA Article 22 (Methods of Obtaining Consent)
PIPA Article 22-2 (Special Provisions on Processing Personal Information of Children Under 14)
PIPA Article 26 (Restrictions on Processing Entrusted Personal Information)
PIPA Article 28-8 (Cross-Border Transfer of Personal Information)
Act on Promotion of Information and Communications Network Utilization and Information Protection

AI Pro Co., Ltd. (the “Company”) collects and uses personal information as described below for the purpose of member registration and the provision of member services.

The Company collects only the minimum personal information necessary for the stated purposes, and obtains consent separately for required and optional items.

This English text is provided for convenience. In the event of any discrepancy, the Korean version prevails.

1. Personal Information Collected and Used

The following personal information is entered directly by the member. Required items are indispensable for providing member services. You may decline the optional items without any restriction on registration or use of the service.

Type	Purpose of Collection and Use	Items Collected	Retention and Use Period
Required	Verifying intent to register and identifying the member Verifying the registrant through email confirmation Managing the account and password, and maintaining login sessions Providing service notices and responding to inquiries Preventing fraudulent registration and misuse, and establishing facts in the event of a dispute	Email address (used as the login ID) Password (stored using one-way encryption; the Company cannot read the original value) Name Country	Destroyed without delay upon withdrawal of membership or withdrawal of consent Where a retention obligation exists under applicable law, stored separately from other personal information for the period stated in Section 3
Optional	Providing technical materials and consultation suited to your organization Statistical analysis of service usage and service improvement	Organization name (company, public agency, school, or other institution)	Destroyed without delay upon withdrawal of membership or withdrawal of consent for this item

The Company does not collect sensitive information under PIPA Article 23 (such as ideology, beliefs, political opinions, health, or sex life) or unique identifiers under PIPA Article 24 (such as resident registration numbers).

2. Information Generated Automatically During Service Use

Even where not entered by the member, the following information may be generated and collected automatically in the course of using the service.

Item	Purpose of Use	Retention and Use Period
Access IP address	Blocking repeated registration or login attempts from the same IP (rate limiting)	Used transiently while the request is processed; not stored as member information
Access country code	Detecting access from unusual countries and determining the response language and time zone	Until withdrawal of membership
Browser time zone (IANA Time Zone)	Determining send times for notification emails and available support hours	Until withdrawal of membership
Last login timestamp	Managing long-dormant accounts and detecting unauthorized access	Until withdrawal of membership
Session cookies (vp_at, vp_rt)	Maintaining and protecting the login session	Access token cookie: 1 hour; refresh token cookie: 14 days; deleted immediately upon logout
Device fingerprint hashes (one-way hashes of the installation identifier, motherboard serial number, and system UUID)	Identifying the single PC a paid license is registered to and detecting use of one license on multiple machines	Until the device is released or membership is withdrawn
Device name and application version	Showing members which of their PCs is registered, and supporting troubleshooting requests	Until the device is released or membership is withdrawn
Access location hash (partial one-way hash of the IP address the application connects from)	Detecting whether one license is used alternately from different locations (duplicate-use prevention)	Up to 10 records from the last 24 hours

You may refuse session cookies through your browser settings. However, these are strictly necessary cookies for maintaining a login session; if refused, services that require a login cannot be used.

Device fingerprints and access locations are never transmitted or stored in their original form. Only irreversible one-way hashes are used for comparison, and those values reveal nothing about the hardware or the location.

Device information is collected only when a paid license is registered to a PC. It is not collected if you use only the free version.

3. Retention Required by Law

Personal information is destroyed without delay once the retention period expires or the processing purpose is achieved. However, the following records are stored separately from other personal information for the periods prescribed by law before being destroyed.

Records Retained	Retention Period	Legal Basis
Records on contracts or withdrawal of subscription	5 years	Act on Consumer Protection in Electronic Commerce
Records on payment and supply of goods	5 years	Act on Consumer Protection in Electronic Commerce
Records on consumer complaints or dispute resolution	3 years	Act on Consumer Protection in Electronic Commerce
Records on labelling and advertising	6 months	Act on Consumer Protection in Electronic Commerce
Service access (log) records	3 months	Protection of Communications Secrets Act

Method of destruction: personal information in electronic files is permanently deleted using technical means that make recovery impossible; printed materials are shredded or incinerated.

4. Entrustment of Personal Information Processing

The Company entrusts the processing of personal information as follows in order to provide the service.

In accordance with PIPA Article 26, entrustment agreements specify the purpose and scope of the entrusted work, restrictions on re-entrustment, safeguards, supervision of the trustee, and liability including damages, and the Company supervises whether trustees process personal information safely.

Trustee	Entrusted Work	Retention and Use Period
Amazon Web Services, Inc.	Operation of cloud infrastructure storing member information (Seoul region, Republic of Korea)	Until termination of the agreement or withdrawal of membership
Vercel Inc.	Website and member interface hosting, and handling of access requests	Until termination of the agreement
Resend, Inc.	Delivery of account emails such as email verification and password reset	Until the delivery purpose is achieved
Cloudflare, Inc.	Automated registration prevention (Turnstile) and blocking of abnormal traffic	Destroyed immediately upon completion of verification

If the entrusted work or the trustee changes, the Company will disclose the change without delay through this document and the Privacy Policy.

5. Cross-Border Transfer of Personal Information

The Company stores member personal information within the Republic of Korea (Amazon Web Services Seoul region). However, personal information is transferred abroad for the purposes below. The following is disclosed in accordance with PIPA Article 28-8(2).

Recipient (Contact)	Destination Country	Items Transferred	Timing and Method of Transfer	Purpose of Use	Retention and Use Period
Resend, Inc. (privacy@resend.com)	United States	Email address Name	Encrypted transmission over the information and communications network when a verification email is sent	Sending email verification and account-related notices	Until the delivery purpose is achieved
Cloudflare, Inc. (privacyquestions@cloudflare.com)	United States and other countries where the Cloudflare network is located	Access IP address Browser information	Encrypted transmission over the information and communications network at the time of a registration or login request	Blocking automated (bot) registration and defending against abnormal traffic	Destroyed immediately upon completion of verification
Vercel Inc. (privacy@vercel.com)	United States	Access IP address Access records	Encrypted transmission over the information and communications network at the time of service access	Website hosting and handling of access requests	Destroyed immediately after the request is processed (operational logs up to 30 days)

You may refuse the cross-border transfer

You have the right to refuse the transfer of your personal information abroad. Please notify us at business3.aipro@gmail.com or 02-760-0189.

However, email verification and automated registration prevention are indispensable steps in the registration process. If you refuse the transfer, registration and use of member services will be restricted. Services available without registration remain fully available to you.

6. Provision to Third Parties

The Company does not use personal information beyond the purposes disclosed in Section 1, nor does it provide personal information to third parties.

Personal information may be provided exceptionally in the following cases, pursuant to PIPA Articles 17 and 18.

Where the member has separately consented in advance to the provision to a third party
Where there are special provisions in law, or where it is unavoidable in order to comply with a legal obligation
Where an investigative agency requests it for investigative purposes in accordance with the procedures and methods prescribed by law
Where it is manifestly necessary for the urgent life, bodily, or property interests of the data subject or a third party

7. Personal Information of Children Under 14

AIPro member services are available only to persons aged 14 or older.

In accordance with PIPA Article 22-2, the Company does not collect the personal information of children under the age of 14 without the consent of their legal representative, and confirms that the registrant is aged 14 or older at the time of registration.

If it is subsequently confirmed that a member is under the age of 14, the Company destroys the account and the personal information collected without delay.

8. Rights of the Data Subject and How to Exercise Them

Members may exercise the following rights against the Company at any time (PIPA Articles 35 through 37 and Article 39-7).

Right to request access — available directly on the account page or by contacting us below.
Right to request correction of errors — available directly on the account page or by contacting us below.
Right to request deletion — handled through withdrawal of membership; deletion of individual items may be requested below.
Right to request suspension of processing — may be requested below.
Right to withdraw consent — consent under this document is withdrawn together with withdrawal of membership.

Rights may be exercised in writing, by telephone, or by email. The Company will take action and notify you of the result within 10 days of receiving the request.

Rights may also be exercised through a legal representative or an authorized agent. In such cases, a power of attorney in the form prescribed by the Notice on Methods of Processing Personal Information must be submitted.

Requests for access or suspension of processing may be restricted under PIPA Articles 35(4) and 37(2), and deletion may not be requested for personal information expressly designated for collection by other statutes.

9. Measures to Ensure the Security of Personal Information

Pursuant to PIPA Article 29 and Article 30 of its Enforcement Decree, the Company implements the following safeguards.

Administrative — establishing and implementing an internal management plan, minimizing the number of personnel handling personal information, and providing regular training
Technical — access rights management for the processing system, access control, one-way encryption of passwords, encryption in transit (TLS), and retention and tamper-protection of access logs
Physical — access control over systems where personal information is stored

10. Right to Refuse Consent and Consequences of Refusal

You have the right to refuse consent

You have the right to refuse consent to the collection and use of personal information described above.

However, the required items in Section 1 are the minimum information indispensable for registration and the provision of member services. If you refuse, registration will be restricted. Services available without registration (product information, materials, and sales inquiries) remain fully available to you.

Refusing the optional items in Section 1 places no restriction whatsoever on registration or use of the service. The Company does not refuse to provide services on the ground that consent to optional items has been declined (PIPA Article 22(5)).

11. Privacy Officer and Contact

The Company has designated a Privacy Officer as follows, who is responsible for overseeing personal information processing and for handling member inquiries, complaints, and remedies relating to personal information processing.

Item	Details
Privacy Officer	Chunsoo Park (Chief Executive Officer)
Email	business3.aipro@gmail.com
Phone	02-760-0189
Address	Room 70505, Central Academic Information Center, Sungkyunkwan University, 25-2 Sungkyunkwan-ro, Jongno-gu, Seoul, Republic of Korea

For reports or consultations regarding infringement of personal information, you may contact the following organizations.

Personal Information Dispute Mediation Committee — +82-1833-6972 (www.kopico.go.kr)

Korea Internet & Security Agency Privacy Report Center — 118 (privacy.kisa.or.kr)

Supreme Prosecutors’ Office Cybercrime Investigation Division — 1301 (www.spo.go.kr)

National Police Agency Cyber Bureau — 182 (ecrm.police.go.kr)

I have read and understood the above and consent to the collection and use of my personal information.