1What is the Privacy Policy?

TARA T.P.S. Co., Ltd. (hereinafter the "Company") collects and uses personal information based on lawful grounds, including the user's consent, for the use of the tooldi service (hereinafter "tooldi"), and actively guarantees the user's rights (the right to self-determination of personal information).

The Company complies with the relevant laws of the Republic of Korea and personal information protection regulations and guidelines applicable to information and communications service providers. The Company processes personal information based on legal grounds such as ① the data subject's consent, ② the conclusion and performance of the service use agreement, and ③ the performance of legal obligations.

This Privacy Policy applies to the tooldi service (the "Service"). If the Company amends this Privacy Policy, it will notify users via the notice section of the Service's customer center page or by individual notification.

2Collection of Personal Information

The Company collects the minimum personal information necessary to provide the Service.

※ Payments are processed through Toss Payments (PG), and the Company does not store full payment-means information such as full card numbers.

• Mandatory information: information necessary to perform the essential functions of the Service.
• Optional information: additional information the Company collects to provide more specialized services (basic use of the Service is not restricted even if optional information is not provided).

The Company collects the following additional information for creator settlement and identity verification.

• Identity verification is performed through identity verification agencies (KakaoPay, Toss, NICE, Kakao Cert, etc.) or by SMS verification, and settlement requires completion of identity verification.
• Unique identifiers such as the resident registration number are processed solely for the purpose of creator reward settlement and tax filing, including withholding and submission of payment statements under the Income Tax Act (Articles 145, 164, etc.) (Personal Information Protection Act Article 24-2). The collected resident registration number is stored with safeguards such as encryption, and the Company does not use it for any purpose other than the foregoing.

Methods of collection

• The user consents and directly enters information during sign-up or use of the Service
• The user submits copies and account information when applying for creator settlement
• Receipt of verification results through identity verification agencies (KakaoPay, Toss, NICE, Kakao Cert, etc.)
• Provision from affiliated services or organizations
• Information such as name, email, microsite address, and phone number obtained during customer center consultations
• Participation in online/offline events

Information collected automatically during use of the Service

Device information (OS, screen size, device ID), IP address, cookies, visit date/time, fraud records, service usage records, advertising identifiers, etc. may be automatically generated and collected.

Personal information of children under the age of 14 is collected and used with the consent of their legal representative.

Where the Company collects, uses, or provides the personal information of a child under the age of 14, it obtains the consent of the child's legal representative. To verify such consent, the Company collects the minimum information of the legal representative (name, contact, etc.), which is used solely for consent verification. The child's personal information is processed to the minimum extent necessary, and the legal representative may at any time request access to, correction, deletion, suspension of processing of, and withdrawal of consent to the collection and use of the child's personal information.

3Use of Personal Information

Used for member management, service provision and improvement, and development of new services.

• Member identification and verification of intent to register, confirmation of agreement to terms, fraud prevention
• For children under 14, verification of legal representative's consent and identity when exercising rights
• Provision of features such as transmission/recommendation of creative content and follow
• Member activity notifications, user search, content verification
• Development of new services, handling of inquiries/complaints, delivery of notices
• Payment for paid services and reward settlement / tax filing for creator content activities
• Prevention of and sanctions against acts that impede service operation (account theft, fraudulent use, etc.)
• Event participation confirmation, marketing and advertising (SMS, email, DM, etc.) with optional consent
• Statistics, customized services, and service improvement

4Provision of Personal Information

The Company does not provide users' personal information to third parties.

Except where the data subject separately consents or where required by statute, the Company does not provide personal information to third parties, and there is currently no personal information regularly provided to third parties. However, the overseas transfer of behavioral information to overseas advertising providers (Google, Meta) for customized advertising is described separately in Articles 7 and 8.

The Company entrusts the following tasks to external providers for smooth service operation.

5Destruction of Personal Information

Personal information is destroyed without delay once the purpose of collection and use is achieved (Personal Information Protection Act Article 21). Electronic files are securely deleted so as to be unrecoverable, and other records are shredded or incinerated. However, per internal policy, the account and withdrawal-notice email address are stored in encrypted form for notice emails and CS responses, and fraud records are retained for up to one year before destruction. The Company does not operate a dormant-account separate-storage system.

Personal information retained for a certain period under statute:

6Rights of Users and Legal Representatives

Users (or the legal representative for children under 14) may exercise the following rights at any time:

1. Request to access personal information
2. Request to correct errors
3. Request to delete
4. Request to suspend processing
5. Withdraw consent to collection/use or terminate membership
6. Object to / request an explanation of decisions made by fully automated systems (e.g., AI) (Personal Information Protection Act Article 37-2, where applicable)

• How to exercise: via the information change / "delete account" function in the Service settings, or by contacting the customer center, in writing, by phone, or by email (serviceinfo@tooldi.com). The Company takes action within 10 days of receiving the request.
• A power of attorney must be submitted when exercising rights through a representative.
• If the Company refuses a request for legitimate reasons, it notifies the user of the reasons and how to object.
• Upon a request for correction, the Company does not use or provide the relevant personal information until correction is complete.

7Cookie Policy

Cookies are small text files sent by the website server to the user's browser and stored on the user's device, used to maintain settings and provide customized services.

Refusing cookies — Users may, through browser settings, allow all cookies, confirm each time a cookie is stored, or refuse all cookies. If cookies are refused, use of some services requiring login may be limited.

• Chrome: Settings > Privacy and security > Cookies and other site data
• Edge: Settings > Cookies and site permissions
• Safari: Preferences > Privacy
• Mobile: Device settings > Reset advertising identifier / Limit tracking

Customized advertising and behavioral information

The Company provides customized advertising based on the cookie and customized-advertising consent obtained at sign-up, using visit records, activity logs, and search history, and users may withdraw (refuse) such consent at any time.

• The Company does not collect sensitive information and does not combine behavioral information with personally identifiable information without separate consent.
• The Company does not provide customized advertising to children known to be under the age of 14.
• How to refuse: block cookies via the browser (above), reset the mobile advertising identifier, Google Ads settings (adssettings.google.com), Meta ad preferences, etc.

8The Company's Efforts

The Company transparently discloses the status of overseas transfers of personal information.

For customized advertising, the Company transfers personal information (advertising behavioral information) overseas to advertising providers as follows.

• Cloud infrastructure (AWS) is operated in a domestic (Seoul) region and does not constitute an overseas transfer; its entrustment status is described in Article 4.
• Overseas transfer/provision of behavioral information to Google, Meta, etc. for advertising is based on customized-advertising consent, and users may refuse it via the methods in Article 7.
• Inquiries regarding overseas transfers may be submitted to the Privacy Officer (serviceinfo@tooldi.com).
• The Company takes necessary measures to protect personal information even when transferred overseas.

The Company encrypts personal information. Personal information is transmitted over encrypted channels, and important information such as passwords and unique identifiers is stored encrypted.

Protection against hacking and viruses. The Company maintains access controls and intrusion detection/blocking systems for its personal information processing systems with 24-hour monitoring, operates antivirus software, retains and manages access logs for 2 years or more and prevents forgery/alteration (processing of unique identifiers), and continuously researches and applies new security technologies.

Minimization of access. The Company minimizes staff handling personal information, establishes systematic access-authority standards, and conducts ongoing audits.

Regular employee training on personal information protection obligations and security is provided.

9Notice of Changes to the Privacy Policy

This Privacy Policy applies from its effective date. Where there are additions, deletions, or corrections, the Company will give notice via the homepage notice section from at least 7 days (or 30 days for material changes) before the effective date, and will post the before-and-after contents together and make the previous version available.

10Inquiries Regarding Personal Information

For inquiries, complaints, or advice regarding personal information protection, please contact the Privacy Officer and the responsible department.

• Privacy Officer: Park Young-hoon
• Department: D Platform Business Team, Privacy Protection Part
• Phone: 070-7602-0872
• Email: serviceinfo@tooldi.com

11Remedies for Infringement of Rights

To obtain remedies for infringement of personal information, data subjects may apply for dispute resolution or consultation to the following organizations:

1What is the Privacy Policy?

TARA TPS Co., Ltd. (hereinafter referred to as the "Company") collects, uses, and provides personal information based on the consent of users for the use of the tooldi service (hereinafter referred to as "tooldi") and actively guarantees the rights of users (right to self-determination of personal information).

The Company complies with the relevant laws, personal information protection regulations, and guidelines of the Republic of Korea that information and communication service providers must comply with.

The "Privacy Policy" means the guidelines that the Company must comply with to ensure that users can use the services with confidence by protecting their valuable personal information. The Company processes personal information based on legal grounds such as ① the consent of the data subject, ② the execution and performance of the Service Use Agreement, and ③ the performance of obligations under laws and regulations. The Company also makes every effort to safely protect and manage personal information to ensure that users' rights and interests are not infringed. Personal information is used for membership registration, smooth customer consultation, and provision of paid services, etc., and the purpose of this Privacy Policy is to provide transparent information related to "personal information protection," such as what information the Company collects, how it uses the collected information, with whom it shares it as necessary ('entrusted' or 'provided'), and when and how personal information that has achieved the purpose of use is destroyed.

This Privacy Policy applies to the tooldi service (hereinafter referred to as the "Service"). If the Company amends this Privacy Policy in the future, it will notify users by posting a notice on the Service's Customer Center page or by providing individual notice.

2Collection of Personal Information

The Company collects the minimum personal information necessary for the provision of the Service.

When users register for membership or use the Service, the Company collects the minimum personal information necessary to provide the Service through its homepage, individual websites, web applications, or programs.

In order to provide various specialized functions, some services may collect additional personal information, with your consent, beyond the information provided at the time of entering into the tooldi account agreement.

• What is Mandatory Information?: Information necessary to perform the essential functions of the Service
• What is Optional Information?: Additional information collected by the Company to provide more specialized services (failure to provide optional information does not restrict the use of basic services).

The methods of collecting personal information are as follows.

When the Company collects personal information, it provides prior notice to users and obtains their consent through the following methods:

• Where users consent to the collection of personal information and directly provide information during the membership registration or service use process
• Where personal information is provided by affiliated services or organizations
• Where personal information, such as name, email address, personal microsite address, or telephone number, is obtained through inquiries made via the customer service center
• Where users participate in online or offline events or promotional activities

The personal information collected from users during the course of service use is as follows.

During the use of PC web and mobile web/app services, information such as device information (OS, screen size, device ID), IP address, cookies, visit date and time, records of unauthorized use, and service usage records may be automatically generated and collected.

3Use of Personal Information

Personal information is used for purposes such as membership management, service provision and improvement, development of new services, etc.

When users register for membership or use the Service, the Company collects the minimum personal information necessary to provide the Service through its website or individual websites, web applications, or programs as follows.

• Identification of members, confirmation of intent to register, verification of agreement to the Terms and Conditions, and prevention of unauthorized use
• Confirmation of consent from a legal representative for the collection of personal information of children under the age of 14, and verification of the legal representative's identity when exercising rights
• Provision of functions such as the transmission of content created by users, content recommendations, and user follow features
• Notifications of user activity within the Service, user search, and content verification
• Development and provision of new or various services, handling of inquiries or complaints, and delivery of notices
• Settlement of fees related to user content creation activities when using paid services
• Prevention of, and sanctions against, acts that hinder the smooth operation of the Service (including account theft and fraudulent use)
• Confirmation of participation in events, and use for marketing or advertising purposes (SMS, email, DM, etc.) with optional consent
• Use for service usage records, analysis of access frequency and service usage statistics, establishment of a service environment for personal information protection, provision of customized services, and Service improvement

4Provision of Personal Information

The Company shall not provide users' personal information to third parties except with your separate consent or as required by applicable law.

However, personal information may be provided to third parties for service integration and collaboration. In such cases, the Company shall obtain users' prior consent to the extent necessary for users to utilize the services of external affiliates or similar entities. When personal information is shared with business partners or other third parties, the Company shall notify users through the [List of Third Party Provision Status].

In addition, the Company entrusts the processing of personal information to external service providers in a secure manner to ensure the smooth provision of the Service. This is because certain essential tasks necessary for service provision are performed in collaboration with or by external companies. The Company also manages and supervises the entrusted companies to ensure compliance with applicable laws and regulations.

5Destruction of Personal Information

Personal information shall be promptly destroyed once the purpose of its collection and use has been fulfilled. The procedures and methods for destruction are as follows.

In the case of electronic files, personal information shall be securely deleted to prevent recovery or reproduction. Other records, including printed materials and documents, shall be destroyed by shredding or incineration. In accordance with internal policies, account and withdrawal notification email addresses may be encrypted and retained for the purpose of sending notification emails and responding to customer service inquiries, and records of service misuse may be retained for up to one year before destruction. In addition, the Company separately stores or deletes personal information of members who have not used the Service for one year in accordance with the "Personal Information Retention Period System," and such separately stored personal information shall be destroyed without delay after four years of retention.

Other personal information that must be retained for a certain period under statutes and the applicable statutes are as shown in the table below.

6Rights of Users and Legal Representatives

The Company protects your rights.

Users may at any time inquire about, update, or correct their personal information (or their legal representative may do so if the user is under the age of 14). Users may also request withdrawal of consent for collection or use of personal information, or termination of membership. More specifically, for changes or registration/termination (withdrawal of consent), users may use the "Account Deletion" function via the Service or Customer Center. If these methods are not feasible, users may contact the Company via the Customer Center, in writing, by telephone, or by email, and the Company will take appropriate action without delay.

If a user requests correction of inaccurate personal information, the Company will not use or provide such information until the correction has been completed.

7Cookie Policy

Cookies may be used in certain cases to provide PC-based services.

Cookies are employed to facilitate faster and more convenient use of the website and to deliver personalized services.

What is a cookie?: Cookies are small text files sent to the user's browser by the server operating the website and stored on the user's device.

Purpose of Use: Cookies are used to store and retrieve user information from time to time to provide personalized and customized services. When a user visits the website, the website server reads the contents of cookies stored on the user's device to maintain the user's settings and provide customized services. Cookies also enable users to access the website conveniently as per their configured preferences. In addition, cookies may be used to deliver customized information, including optimized advertisements, based on the user's website visit history and usage patterns.

Refusal to Collect Cookies: Cookies do not store personally identifiable information such as names or phone numbers. Users may choose whether to accept cookies. Accordingly, users can configure their web browser to allow all cookies, confirm each time a cookie is stored, or refuse all cookies; provided, however, that refusing cookies may limit convenience and affect the use of services requiring login.

Example of Browser Settings:

• Chrome: Settings menu (right side of browser) > Advanced settings (bottom of screen) > Content settings under Personal information > Cookies
• Internet Explorer: Tools menu (top of browser) > Internet Options > Privacy > Settings

Cookies may be used for the provision of customized advertising.

Customized advertising includes text, image, and video advertisements displayed within websites, including the homepage and editor of the Service.

Method of Providing Customized Advertising to Users: Customized advertising delivers relevant advertisements to users based on their visit records, activity logs, and search history on the Company's services, as well as visit records of affiliated websites participating in customized advertising. The content displayed consists of advertisements provided by advertisers recruited through the Service's online advertisement pages or advertising partners. To provide appropriate advertisements, "advertising cookies" are used within the Web Services. Cookies are small files stored on the user's device by the website upon the user's first visit and are a technology used to facilitate convenient web service usage. Advertising identifiers are identifiers issued by the operating system (OS) and are used to provide users with customized information or advertisements.

Protection of User Information for Customized Advertising: The Company takes the protection of user information seriously. The Company does not collect sensitive information that could infringe on users' rights, interests, or privacy, and does not combine behavioral information collected through advertising cookies or advertising identifiers with personally identifiable information without separate consent from users. Behavioral information collected through advertising cookies or identifiers is retained for up to 180 days and is then either completely destroyed or stored separately in a manner that prevents recovery, solely for the purpose of providing customized advertising and content based on estimated demographic characteristics, such as gender, age group, and interests. The Company does not collect activity log information from children under the age of 14, or from online services primarily used by children under 14, and does not provide customized advertising to users identified as under the age of 14.

8Efforts of the Company

The Company makes the following efforts to protect users' valuable personal information.

The Company regards users' personal information as the most valuable asset and makes every effort in processing personal information as follows.

Users' personal information is not provided or transferred overseas.

The Company does not provide, entrust, store, or transfer personal information to any third parties or foreign entities outside Korea. Personal information is processed only within the Republic of Korea. The Company does not store personal information on systems operated by foreign service providers, nor allow remote access or processing from outside Korea. In the event that international transfer of personal information becomes necessary in the future, the Company will notify users in advance of the destination country, recipient, purpose and items of transfer, retention/use period, and will obtain users' consent prior to any transfer in accordance with applicable laws.

Users' personal information is encrypted.

Users' personal information is transmitted through encrypted communication channels, and sensitive information such as passwords is stored in encrypted form.

Efforts to protect against hacking or computer viruses.

To prevent leakage or damage to users' personal information due to hacking or computer viruses, the Company installs systems in areas with controlled external access. Intrusion detection and prevention systems are in place to monitor 24/7, and antivirus programs are installed to prevent infection by the latest malware or viruses. In addition, the Company continuously researches new hacking and security technologies and applies them to its services.

Access to personal information is minimized.

The number of employees who can access personal information is kept to a minimum. Internet access on work computers is restricted to reduce the risk of personal information leakage. The Company establishes systematic standards for password creation and modification, as well as access permissions for databases and systems storing or processing personal information, and conducts regular audits.

Regular training for employees on personal information protection.

All employees handling personal information receive regular training and campaigns regarding their obligations for personal information protection and security.

9Notice of Changes to the Personal Information Processing Policy

This Personal Information Processing Policy shall take effect from the effective date. In the event of any additions, deletions, or corrections made in accordance with applicable laws, regulations, or this Policy, the Company shall notify users by posting an announcement on the homepage of the Service at least seven (7) days prior to the effective date of such changes.

10Inquiries Regarding Personal Information

For any inquiries, complaints, advice, or other matters related to personal information arising from the use of the Service, users may contact the Personal Information Protection Officer and the responsible department. The Company will carefully review all inquiries and take appropriate measures to provide prompt and thorough responses.

Personal Information Protection Officer and Responsible Department

• Officer in charge: Park, Young Hoon (Personal Information Protection Officer)
• Responsible department: D Platform Business Team, Personal Information Protection Division
• Contact number: +82-70-7602-0872
• Email: serviceinfo@tooldi.com