# Privacy Policy

Kinkaku, Inc. (hereinafter referred to as "the Company") hereby establishes this Privacy Policy (hereinafter referred to as "this Policy") regarding the handling of users' personal information in connection with the AI character conversation service "Anirole" (including the website and mobile applications; hereinafter referred to as "the Service").

Please read this Policy carefully before using the Service. By using the Service, users are deemed to have agreed to this Policy.

## Article 1 (Definition of Personal Information)

Personal information refers to information relating to a living individual that can identify the user of the Service (including information that, while not sufficient on its own to identify a specific individual, can be readily combined with other information to enable such identification).

## Article 2 (Information We Collect)

The Company collects the following information in connection with the provision of the Service.

The Company collects the following information to process conversations with users, provide basic messaging and various conversation content and conversation services. The Company also uses the collected information to identify records of unauthorized use and to improve artificial intelligence conversation algorithms.

### (a) Categories of Personal Information Collected

Required Information
- Nickname (including honorifics), gender, date of birth
- Email address, device information (including model name, carrier, operating system, unique device identifier, advertising ID, time information, etc.), application information (version, etc.) (applicable when using the mobile application)
- Linked account information (identifiers and other information provided by applicable services such as Google and Apple for social login functionality)
- Message information exchanged (including time of message transmission, message content (including multimedia materials such as emojis, stickers, images, videos, and audio), etc.), user reaction information, status information displayed to others, etc.
- Other service usage history of the user (including records of unauthorized use)

Optional Information
- Profile image

Inquiry Information
- Content of inquiries to customer support (email address, content of inquiry, etc.)

### (b) Methods of Personal Information Collection

The Company collects personal information through the following methods:

- Collection through information provided by Google, Apple, and other services for the provision of linked services
- Collection through user input of personal information during the registration process
- Collection through voluntary provision by users during use of the Service
- Collection through information automatically generated during use of the Service

## Article 3 (Purposes of Use of Information)

The information collected by the Company is used for the following purposes:

1. Provision and operation of the Service: Provision of the AI character conversation service, account management, and identity verification
2. Processing of AI character conversations: Transmitting conversation content entered by users (message content, nicknames, and other information necessary for conversations) to third-party AI service providers (including OpenAI, Anthropic, Microsoft, and BytePlus Pte Ltd.; please refer to Article 5 for details) in order to generate AI character responses
3. Maintenance and improvement of the Service: Bug fixes, improvement of service quality, and improvement of AI conversation algorithms
4. Development of new services: Planning and development of new services and features, including research and development of AI technology
5. Customer support: Responding to inquiries from users
6. Billing: Processing of charges for paid services
7. Notices and notifications: Delivery of service updates, maintenance information, and important announcements
8. Marketing and advertising: Service provision based on statistical analysis, delivery and optimization of advertisements
9. Prevention of unauthorized use: Detection and response to conduct that violates the Terms of Service, prevention of unauthorized access
10. Legal compliance: Compliance with applicable laws, regulations, and legal proceedings

## Article 4 (Sharing and Provision of Personal Information)

(a) Where the user has given prior consent to disclosure: Prior to the collection or provision of information, the Company will notify the user of who the business partner is, and how and until when the information will be protected and managed, and will seek the user's consent. If the user does not consent, no additional information will be collected or shared with the business partner.

(b) Where required by applicable laws or regulations, or where there is a request from an investigative authority in accordance with the procedures and methods prescribed by law for investigative purposes.

## Article 5 (Entrustment of Personal Information Processing)

The entities to which the Company entrusts the processing of personal information and the scope of the entrusted operations are as follows.

### (a) Data Transmission to Third-Party AI Service Providers

The Service may transmit user data to the following third-party AI service providers in order to provide the AI character conversation functionality.

Types of data transmitted:
- Message content entered by users (including text, images, and other multimedia data)
- User information necessary for the context of the conversation, such as nicknames
- Conversation history (to the extent necessary for the AI character to generate appropriate responses)

Third-party cloud and AI service providers to which data is transmitted:

Service Provider: Microsoft (Azure OpenAI Service)
Scope of Entrusted Operations: Generation of AI character conversation responses and research and development for service improvement
Data Transmitted: Conversation-related data as described above
Retention and Use Period: Until the purpose of use of personal information is fulfilled or the entrustment agreement is terminated

Service Provider: OpenAI
Scope of Entrusted Operations: Generation of AI character conversation responses and research and development for service improvement
Data Transmitted: Conversation-related data as described above
Retention and Use Period: Until the purpose of use of personal information is fulfilled or the entrustment agreement is terminated

Service Provider: Anthropic
Scope of Entrusted Operations: Generation of AI character conversation responses and research and development for service improvement
Data Transmitted: Conversation-related data as described above
Retention and Use Period: Until the purpose of use of personal information is fulfilled or the entrustment agreement is terminated

Service Provider: BytePlus Pte Ltd.
Scope of Entrusted Operations: Generation of AI character conversation responses and research and development for service improvement
Data Transmitted: Conversation-related data as described above
Retention and Use Period: Until the purpose of use of personal information is fulfilled or the entrustment agreement is terminated

The Company has entered into agreements with the above third-party AI service providers regarding the protection of users' personal information and has confirmed that each provider protects users' personal information to a standard equal to or greater than that set forth in this Policy. Each provider shall not use data transmitted by the Company for purposes other than generating conversation responses (including, but not limited to, training the provider's own AI models).

### (b) Infrastructure Providers

Service Provider: Amazon Web Services
Scope of Entrusted Operations: Infrastructure management for service provision and analysis
Retention and Use Period: Until the purpose of use of personal information is fulfilled or the entrustment agreement is terminated

Service Provider: Google Cloud Platform
Scope of Entrusted Operations: Infrastructure management for service provision and analysis
Retention and Use Period: Until the purpose of use of personal information is fulfilled or the entrustment agreement is terminated

Service Provider: RunPod
Scope of Entrusted Operations: Infrastructure management for service provision and analysis
Retention and Use Period: Until the purpose of use of personal information is fulfilled or the entrustment agreement is terminated

### (c) Analytics and Marketing Providers

Service Provider: Adjust
Scope of Entrusted Operations: Customer service usage analysis, marketing activities, and personalized advertising
Retention and Use Period: Until the purpose of use of personal information is fulfilled or the entrustment agreement is terminated

Service Provider: Mixpanel
Scope of Entrusted Operations: Collection and analysis of service usage information
Retention and Use Period: Until the purpose of use of personal information is fulfilled or the entrustment agreement is terminated

Service Provider: Meta Platforms
Scope of Entrusted Operations: Marketing activities and personalized advertising
Retention and Use Period: Until the purpose of use of personal information is fulfilled or the entrustment agreement is terminated

Service Provider: TikTok Pte. Ltd
Scope of Entrusted Operations: Marketing activities and personalized advertising
Retention and Use Period: Until the purpose of use of personal information is fulfilled or the entrustment agreement is terminated

## Article 6 (Cross-Border Transfer of Personal Information)

The details regarding the cross-border transfer of personal information by the Company are as follows.

Service Provider: Amazon Web Services Inc
Country of Transfer: United States
Timing and Method of Transfer: Transmitted via network during use of the Service
Personal Information Transferred: Personal information and logs collected during use of the Service
Scope of Entrusted Operations: Infrastructure management for personal information processing
Retention and Use Period: Until the purpose of use of personal information is fulfilled or the entrustment agreement is terminated

Service Provider: Google Cloud Platform
Country of Transfer: United States
Timing and Method of Transfer: Transmitted via network during use of the Service
Personal Information Transferred: Personal information and logs collected during use of the Service
Scope of Entrusted Operations: Infrastructure management for personal information processing and research and development for service improvement
Retention and Use Period: Until the purpose of use of personal information is fulfilled or the entrustment agreement is terminated

Service Provider: RunPod
Country of Transfer: United States
Timing and Method of Transfer: Transmitted via network during use of the Service
Personal Information Transferred: Personal information and logs collected during use of the Service
Scope of Entrusted Operations: Infrastructure management for personal information processing and research and development for service improvement
Retention and Use Period: Until the purpose of use of personal information is fulfilled or the entrustment agreement is terminated

Service Provider: Microsoft (Azure OpenAI Service)
Country of Transfer: United States
Timing and Method of Transfer: Transmitted via network during use of the Service
Personal Information Transferred: Conversation message content, user information necessary for conversations such as nicknames, and conversation history
Scope of Entrusted Operations: Generation of AI character conversation responses and research and development for service improvement
Retention and Use Period: Until the purpose of use of personal information is fulfilled or the entrustment agreement is terminated

Service Provider: OpenAI
Country of Transfer: United States
Timing and Method of Transfer: Transmitted via network during use of the Service
Personal Information Transferred: Conversation message content, user information necessary for conversations such as nicknames, and conversation history
Scope of Entrusted Operations: Generation of AI character conversation responses and research and development for service improvement
Retention and Use Period: Until the purpose of use of personal information is fulfilled or the entrustment agreement is terminated

Service Provider: Anthropic
Country of Transfer: United States
Timing and Method of Transfer: Transmitted via network during use of the Service
Personal Information Transferred: Conversation message content, user information necessary for conversations such as nicknames, and conversation history
Scope of Entrusted Operations: Generation of AI character conversation responses and research and development for service improvement
Retention and Use Period: Until the purpose of use of personal information is fulfilled or the entrustment agreement is terminated

Service Provider: BytePlus Pte Ltd.
Country of Transfer: Singapore, Malaysia
Timing and Method of Transfer: Transmitted via network during use of the Service
Personal Information Transferred: Conversation message content, user information necessary for conversations such as nicknames, and conversation history
Scope of Entrusted Operations: Generation of AI character conversation responses and research and development for service improvement
Retention and Use Period: Until the purpose of use of personal information is fulfilled or the entrustment agreement is terminated

Service Provider: Adjust
Country of Transfer: Germany
Timing and Method of Transfer: Transmitted via network during use of the Service
Personal Information Transferred: Personal information and logs collected during use of the Service
Scope of Entrusted Operations: Customer service usage analysis, marketing activities, and personalized advertising
Retention and Use Period: Until the purpose of use of personal information is fulfilled or the entrustment agreement is terminated

Service Provider: Mixpanel
Country of Transfer: United States
Timing and Method of Transfer: Transmitted via network during use of the Service
Personal Information Transferred: Personal information and logs collected during use of the Service
Scope of Entrusted Operations: Collection and analysis of service usage information
Retention and Use Period: Until the purpose of use of personal information is fulfilled or the entrustment agreement is terminated

Service Provider: Meta Platforms
Country of Transfer: United States
Timing and Method of Transfer: Transmitted via network during use of the Service
Personal Information Transferred: Personal information and logs collected during use of the Service
Scope of Entrusted Operations: Marketing activities and personalized advertising
Retention and Use Period: Until the purpose of use of personal information is fulfilled or the entrustment agreement is terminated

Service Provider: TikTok Pte. Ltd
Country of Transfer: United States, Singapore, Malaysia
Timing and Method of Transfer: Transmitted via network during use of the Service
Personal Information Transferred: Personal information and logs collected during use of the Service
Scope of Entrusted Operations: Marketing activities and personalized advertising
Retention and Use Period: Until the purpose of use of personal information is fulfilled or the entrustment agreement is terminated

Users may refuse the cross-border transfer of their personal information by contacting the Company's data protection officer at [email protected]. If a user refuses the cross-border transfer of personal information, the Company will exclude that user's personal information from cross-border transfers. However, in such cases, the use of certain services that require the cross-border transfer of personal information may be restricted.

## Article 7 (Installation, Operation, and Refusal of Automated Data Collection Devices)

The Company uses cookies and other automated data collection devices that store and retrieve user information from time to time in order to provide individually customized services. A cookie is a very small text file that a server used to operate a website sends to a user's browser, which is stored on the user's computer hard drive.

Cookies do not automatically or actively collect personally identifiable information. Users may refuse or delete the storage of these cookies at any time.

### (a) Google Analytics

Purpose of Using Cookies

The Company uses Google Analytics, a web analytics service provided by Google, Inc. (hereinafter referred to as "Google"), to collect anonymous cookie information (such as demographic data) for the purpose of providing better services to users, analyzing and evaluating how the Service is used, understanding user needs, improving and customizing services and products, and providing efficient services.

The processing of information collected through Google Analytics is subject to the Google Privacy Policy and Google Analytics Terms of Service.

The Company does not collect personally identifiable information through Google Analytics and does not combine collected information with personally identifiable information obtained through other channels.

### (b) How to Refuse Cookie Settings

Users have the right to choose regarding the installation of cookies. Accordingly, users may opt out of automated cookie information collection through the following methods.

How to refuse cookies by browser:
- Microsoft Edge: Settings → Cookies and site permissions → Cookie settings
- Safari: Preferences → "Prevent cross-site tracking" and "Block all cookies"
- Chrome: Top-right menu (three dots) → Settings → Privacy and security → Cookies and other site data → Settings

If you refuse the storage of cookies, it may become difficult to use certain services that require login.

### (c) Advertising Identifiers

In the mobile application, the Company may obtain the device's advertising identifier (IDFA/AAID) for the purposes of advertising optimization and service usage analysis. Users may restrict the use of advertising identifiers through their device settings.

- iOS: Settings → Privacy & Security → Tracking → Turn off "Allow Apps to Request to Track"
- Android: Settings → Google → Ads → Turn on "Opt out of Ads Personalization"

## Article 8 (Retention Period of Personal Information)

The Company retains personal information for the following periods.

### (a) Retention Based on Company Internal Policies

Records of unauthorized use
Reason for retention: Retention of personal information for the prevention of unauthorized use
Retention period: 1 year

Service usage records
Reason for retention: Temporary retention for the improvement of user experience and research for enhancement of service performance
Retention period: Until the research purpose is fulfilled

Anonymized service usage records
Reason for retention: Retention of pseudonymized information for the improvement of AI conversation algorithms
Retention period: 5 years

### (b) Retention Based on Applicable Laws and Regulations

Where it is necessary to retain information pursuant to applicable laws and regulations, including the Commercial Code, the Act on Electronic Consumer Contracts, and the Consumer Contract Act, the Company will retain member information for the periods prescribed by such laws and regulations. In such cases, the Company will use the retained information solely for the purpose of its retention, and the retention periods are as follows.

Records relating to contracts or withdrawal of applications
Reason for retention: Act on Electronic Consumer Contracts
Retention period: 5 years

Records relating to payment settlement and supply of goods
Reason for retention: Act on Electronic Consumer Contracts
Retention period: 5 years

Records relating to consumer complaints or dispute resolution
Reason for retention: Consumer Contract Act
Retention period: 3 years

Records relating to access logs
Reason for retention: Act on Protection of Secrecy of Communications
Retention period: 3 months

## Article 9 (Security Measures for Personal Information)

The Company implements the following measures to prevent leakage, loss, or damage of personal information and to otherwise ensure the secure management of personal information.

1. Organizational security measures: Appointment of a person responsible for the handling of personal information and establishment of handling procedures
2. Personnel security measures: Implementation of training for employees regarding the handling of personal information
3. Physical security measures: Management of areas where personal information is handled and prevention of theft of equipment and electronic media
4. Technical security measures: Access control, prevention of unauthorized access, and encryption of communications (SSL/TLS)

## Article 10 (User Rights)

Users may exercise the following rights with respect to the Company.

1. Request for disclosure of personal information: Users may request disclosure of personal information held by the Company about them.
2. Request for correction, addition, or deletion of personal information: Where personal information held is inaccurate, users may request its correction, addition, or deletion.
3. Request for suspension of use or erasure of personal information: Where personal information is processed beyond the scope of its purpose of use or has been obtained through wrongful means, users may request suspension of its use or erasure.
4. Deletion of account: Users may delete their account at any time through the settings screen of the Service or by contacting customer support. After account deletion, the Company will delete personal information after the retention periods specified in Article 8 have elapsed.

To make any of the above requests, please contact the inquiry point specified in Article 12. The Company will respond without delay after verifying the identity of the requester.

## Article 11 (Changes to the Privacy Policy)

1. In the event that the Company changes the content of this Policy, the Company shall provide notice within the Service or on the Company's website no later than 7 days prior to the effective date of the revised Policy.
2. The revised Privacy Policy shall take effect from the effective date specified in the notice.

## Article 12 (Contact Information)

For inquiries regarding this Policy, or requests for disclosure, correction, or deletion of personal information, please contact us at the following:

- Company: Kinkaku, Inc.
- Email: [email protected]