Privacy Policy

OVERAY Inc. (the "Company" or "OVERAY") values your personal information and complies with applicable laws, including the Personal Information Protection Act and the Act on Promotion of Information and Communications Network Utilization and Information Protection. This Privacy Policy sets out the principles that apply commonly across all services provided by the Company, and may be updated in line with changes to applicable laws, guidelines, or our internal policies.

1. Purposes of Processing Personal Information

The Company processes personal information for the following purposes. Where the purpose changes, the Company will obtain separate consent in accordance with Article 18 of the Personal Information Protection Act. (i) Sign-up and identity verification (ii) Providing, operating, and improving the services (iii) Handling inquiries and complaints, and delivering notices (iv) Preventing misuse and maintaining security (v) Fulfilling legal obligations and responding to disputes The specific personal data items and purposes handled by each product are governed by that product's own privacy policy.

2. Personal Information We Process

The Company processes the minimum personal information necessary to provide its services. The items processed commonly across the Company are as follows. - Account identifiers: email address, authentication provider identifier, display name - Automatically collected data: access logs, IP address, authentication session cookies, service usage records, and cookies and device identifiers used for usage analytics Product-specific items — such as payment information and uploaded or generated content — are defined in each product's own privacy policy.

3. Retention, Use, and Destruction of Personal Information

The Company destroys personal information without delay once the purpose of processing has been achieved or the user ends their use of the service (account withdrawal). However, where applicable laws require retention for a certain period, the information is stored securely for that period. When destroying personal information, electronic files are deleted using technical methods that prevent recovery or reproduction, and printed materials are shredded or incinerated. The specific retention periods and items required by law are governed by each product's own privacy policy.

4. Rights and Obligations of Data Subjects and How to Exercise Them

Users may at any time request access to, correction of, deletion of, or suspension of the processing of their personal information, and may refuse consent to processing or request account withdrawal. These rights may be exercised through each product's account settings or by contacting the privacy officer listed at the end of this Policy. The Company does not, as a rule, collect personal information from children under the age of 14. Requests to exercise rights may be limited to the extent that retention obligations exist under other laws.

5. Measures to Ensure the Security of Personal Information

In accordance with Article 29 of the Personal Information Protection Act, the Company implements the following safeguards. - Administrative: minimizing personnel who handle personal information, managing access privileges, and conducting regular security training - Technical: encryption in transit (HTTPS/TLS), protection of stored data, access controls, and audit logging - Physical: adherence to the data-center physical security policies of our cloud infrastructure providers

6. Operation of Cookies and the Right to Refuse

The Company uses two categories of cookies. (i) Essential cookies — necessary to provide the service, such as maintaining your login session; refusing them may restrict your use of the service. (ii) Analytics cookies — used to aggregate usage statistics for service improvement; refusing them does not restrict your use of the service. The Company does not operate cookies for advertising or retargeting purposes. You may refuse the storage of cookies through your browser settings, and may refuse analytics cookies selectively using the opt-out add-on provided by Google (tools.google.com/dlpage/gaoptout). Additional cookies used by a particular product are described in that product's own privacy policy.

7. Cross-Border Transfer of Personal Information

As the Company uses global cloud infrastructure, personal information may be processed and stored outside Korea, in which case the Company takes the measures necessary to ensure its security under applicable law. In particular, cookie-based device identifiers and usage behaviour data are transferred to Google LLC (processing location: Google data centers, including the United States) for service usage analytics. IP addresses are anonymized by Google upon collection and are not stored. Users to whom mandatory regional laws apply — such as residents of the European Economic Area (EEA) or California (GDPR, CCPA, etc.) — may exercise the rights granted under those laws.

8. Privacy Officer and Remedies for Infringement

The Company designates a privacy officer to oversee the processing of personal information and to handle complaints and remedies for data subjects, as follows. Privacy Officer: Sangjin Jeong Contact: [email protected] For reports or consultations regarding personal information infringement, you may contact the following Korean authorities. - Personal Information Dispute Mediation Committee (www.kopico.go.kr / 1833-6972) - Privacy Infringement Report Center (privacy.kisa.or.kr / 118) - Supreme Prosecutors' Office Cybercrime Investigation (www.spo.go.kr / 1301) - National Police Agency Cyber Bureau (ecrm.police.go.kr / 182)

9. Changes to This Privacy Policy

This Privacy Policy is effective as of September 10, 2026. If the Policy is changed, the Company will provide notice within the service before the effective date, and will give notice at least 30 days in advance for material changes such as the addition of processing purposes.