Personal Information Collection and Use Consent

(Required) Consent to Collection and Use of Personal Information

OneTherapy Co., Ltd. (the “Company”) collects and uses personal information as described below to provide the AI saju and fortune conversation service, Sajuping. Please read the following carefully before providing your consent.

Article 1 (Personal Information Collected and Collection Methods)

The Company collects the following personal information to provide the service and respond to customer inquiries.

1. [Required] When signing up for membership and using the service
   • Information entered by the member: name, nickname (including preferred form of address), gender, date of birth (including solar/lunar calendar status), time of birth, city of birth
   • When using social login: linked account information (identifiers and email provided by the applicable service, such as Kakao, Google, Apple, or LINE)
   • Information about other people registered by the user: name (form of address), gender, date of birth (including solar/lunar calendar status), and time of birth registered to analyze the saju of other people, such as family members or acquaintances. The user must obtain the consent of the data subject before providing this information, and it is retained and destroyed together as part of the registering user’s account information (paragraph 2 of Article 3).
   • Automatically collected items: device information (model name, manufacturer, operating system and version), app version, app installation identifier, push notification token, and access IP and access date and time. The advertising ID is processed separately under Article 9.
   • Service usage records: exchanged messages (questions, AI responses, and transmission times), attached images, voice when the voice consultation feature is used, reaction information on responses, and improper usage records
2. [Required] When using paid services
   • Purchase and transaction identification information, subscription status, and payment and transaction records provided by app markets (Apple App Store and Google Play) and payment processing services. The Company does not collect payment method information such as card numbers or account numbers.
3. [Optional] When contacting customer support
   • Inquiry content, email address for replies, and app and device information at the time of the inquiry

Article 2 (Purpose of Use of Personal Information)

The Company uses collected personal information for the following purposes.

1. Service provision and contract performance: provision of AI saju and fortune conversation services, provision of content (premium interpretations and reports), paid payment processing and settlement (including Ping top-ups), and provision of customized results
2. Service improvement: development of new services and content, preparation and analysis of statistics, and service quality improvement. The Company does not use users’ conversation content to train AI models.
3. Member management: identity verification for membership services, prevention of improper use by bad actors and unauthorized use, confirmation of sign-up intent, restriction of registration by children under 14, record retention for customer support and dispute resolution, and delivery of notices

Article 3 (Retention and Use Period of Personal Information)

The Company destroys personal information without delay once the purpose of its collection and use has been achieved. The specific retention periods and destruction criteria are as follows.

1. Destruction upon membership withdrawal and grace period: When a member requests withdrawal, the Company retains the account information for a grace period of 30 days from the date of the request and then destroys it without delay. If the member logs in again during the grace period, the withdrawal request is cancelled and the account is restored; once the grace period has passed, the account cannot be restored.
2. Information about other people registered by the user: Information that a user registers to analyze the saju of other people, such as family members or acquaintances, is retained together as part of the registering user’s account information and is destroyed together with it when the user withdraws.
3. Retention under applicable laws: The following information is kept separately from other personal information for the periods below even after withdrawal, and is destroyed when the period expires.
   • Records concerning contracts or withdrawal of offers, and payment and supply of goods, etc.: 5 years (Act on the Consumer Protection in Electronic Commerce, etc.)
   • Records concerning the consent of legal representatives: 5 years (Personal Information Protection Act)
4. Records generated during service use: The following records are retained for the periods below from the date they are generated and then destroyed.
   • Service access and usage records (access date and time, IP address, screen usage records, etc.; for service operation, security, and statistics): up to 1 year
   • Notification delivery records, and service operation and quality measurement records: up to 180 days
   • Error and diagnostic records: up to 30 days
5. Access records of personal information handlers: Access records for the personal information processing system are retained for 2 years. (Standards for Measures to Ensure the Safety of Personal Information)
6. Customer inquiry records: Destroyed together with the account information upon membership withdrawal.
7. The retention periods for information whose processing has been entrusted or that has been transferred overseas follow Articles 5 and 6.

Article 4 (Processing of Pseudonymized Information)

1. The Company does not newly create or use pseudonymized information. Service quality improvement and the preparation of statistics are carried out only by processing original personal information within the scope of the service provision purposes under Article 2.
2. Information that was previously pseudonymized and is currently stored is kept safely, separated from additional information, and is not used; it is being destroyed through the destruction procedure. Pseudonymized information of withdrawn members is also destroyed through the same procedure.

Article 5 (Entrustment of Personal Information Processing)

The Company entrusts certain tasks to external providers as described below for smooth service provision, and specifies necessary matters in entrustment agreements so that personal information is managed safely in accordance with applicable laws.

Only the information necessary to provide the relevant feature (conversation content, saju information, and information entered or attached by the user) is sent to AI service processing providers. The Company has contracts and settings in place so that these providers do not use the transmitted information to train AI models, and the transmitted information is deleted after processing is complete, either immediately or within a limited period according to each provider’s policy.

Article 6 (Overseas Transfer of Personal Information)

The Company transfers personal information overseas (for entrusted processing and storage) as described below to provide services and store data using global cloud servers and overseas AI services. Transferred data is sent over encrypted connections at the time the service is used.

Only information necessary for each provider’s service is transferred. Article 9 separately describes the processing and overseas transfer of information by Google and advertising partners when ads are served. Users may refuse the overseas transfer through the procedure in Article 7 or by contacting the Personal Information Protection Officer listed in Article 10; however, refusing the transfer of personal information necessary to provide core services may restrict use of the service.

Article 7 (Rights of Users and Legal Representatives and How to Exercise Them)

1. Users may view or modify their registered personal information at any time and may request termination of membership (membership withdrawal).
2. Users may directly withdraw by selecting “Settings > Delete Account” in the app. The 30-day grace period after a withdrawal request and account restoration are governed by paragraph 1 of Article 3.
3. While a subscription made through the App Store or Google Play is active, withdrawal requests are restricted. Membership withdrawal does not automatically cancel a store subscription, so the subscription must be cancelled separately in the relevant store; users may withdraw after cancelling the subscription or after the subscription period expires.
4. The Company does not allow children under 14 to directly register for or use the service. However, if an adult member (legal representative) directly enters a child’s date of birth or other information for the purpose of analyzing the child’s saju, such information is treated as information provided with the consent of the legal representative and will not be used for purposes other than service provision.

Article 8 (Right to Refuse Consent and Disadvantages)

You have the right to refuse consent to this collection and use of personal information. However, this consent is required to provide the Sajuping service, so membership registration and service use may be restricted if you refuse consent.

Article 9 (Google AdMob Banner Ads and Advertising Data)

1. The Company may show Google AdMob banner ads while a chat response is pending and at the top of the profile and saju chart screens. When an ad is requested, displayed, or clicked, Google LLC and participating ad partners may process the IP address (which can be used to estimate general location), app and device information and identifiers (including an advertising ID where available), ad impressions and interactions, and diagnostic and performance data. This information may be used to serve ads, manage frequency, measure effectiveness, conduct analytics, and prevent fraud. See how Google uses information from apps that use its services.
2. At sign-up and terms acceptance, the Company asks users to make a separate, optional choice about the use of information for personalized ads and ad effectiveness measurement. Declining this choice does not prevent use of the app’s core features. Depending on location and consent choices, personalized, non-personalized, or limited ads may be served, or no ad may be shown. Non-personalized ads may still use identifiers for frequency capping and aggregated reporting. Users can change their advertising choice in the app under Settings > Terms and Consents. Where Google’s ad privacy options screen is available, users can reopen it from the app’s settings to change those choices.
3. On iOS, the app may separately request App Tracking Transparency (ATT) permission. If permission is denied, the iOS advertising identifier (IDFA) is not sent in Google’s ad requests. ATT permission can be changed under iOS Settings > Privacy & Security > Tracking. On Android, users can reset or delete their advertising ID in device settings. Operating system permission and the in-app advertising choice are separate controls.
4. To serve ads, the information in paragraph 1 may be transmitted from the app over the network to Google LLC (United States) and participating ad partners, and may be processed abroad in locations where Google operates its global infrastructure or those partners operate. Where a Google advertising consent screen is provided, it identifies participating partners and their processing purposes. Retention periods depend on Google’s and each partner’s policies and the user’s choices. For details, see Google’s Privacy Policy and each partner’s policy linked from the advertising consent screen.

Article 10 (Personal Information Protection Officer)

The person responsible for overseeing or handling personal information protection matters is as follows.

• Name: Yoonseop Lee
• Email: yoon@sajuping.ai

For personal information protection inquiries, you may contact the email address above or cs@sajuping.ai.

Addendum

The revision date of this Privacy Policy is November 15, 2026. Existing members will be asked separately for consent in the app; the revised policy applies to each such member from one month after the date on which that member consents (or from the revision date, if that day falls before it), and the previous policy applies until then. For members who sign up on or after the revision date, it applies from the date they consent at sign-up. The previous Privacy Policy (effective October 15, 2026) is available here.