VPICK PRIVACY POLICY

Cloudike Inc. (the “Company”) complies with the Personal Information Protection Act and other applicable laws and regulations of the Republic of Korea and establishes and publishes this Privacy Policy to process users’ personal information lawfully and securely.

This Privacy Policy applies to the Vpick service provided by the Company and related websites, account integrations, content processing, payments, customer support, and other associated features.

ARTICLE 1 — PURPOSES OF PROCESSING PERSONAL INFORMATION

The Company processes personal information for the purposes described below. Personal information will not be used for purposes other than those stated below, and if the purposes of use change, the Company will take any measures required by applicable law.

1. Membership Registration and Account Management

• User identification and account creation and management

• Login and identity verification

• Login through external authentication services such as Google, Naver, Kakao, and Cloudike SSO

• Management of account and service usage status

• Notices and service-related communications

• Prevention of unauthorized use and maintenance of security

• Handling inquiries, complaints, and customer support

2. Provision and Operation of the Vpick Service

• Uploading, storing, and managing videos, images, audio, and other content

• Importing external content designated by users, including YouTube URLs

• AI-based video analysis

• Analysis of scenes, persons, speech, subtitles, and content information

• Speech-to-Text (STT) and subtitle generation

• Highlight and short-form video generation

• Content editing and rendering

• Storage and management of generated content and analysis results

• Providing service status and processing results

• Identifying failures and improving service quality

3. AI-Based Content Analysis and Generation

• Analysis of video, audio, images, and text

• Scene and person analysis

• Speech recognition and subtitle generation

• Content summarization and key-scene extraction

• Generation of titles, descriptions, and other content-related information

• AI processing necessary for short-form content generation

The Company may use external AI and media-processing services such as NAVER Cloud Media Intelligence, AssemblyAI, and Google Gemini Developer API to provide the service.

4. External Platform Account Connection and Publishing

The Company provides integrations with the following platforms when users choose to connect them:

• YouTube

• Instagram

• TikTok

• Cafe24 (store account connection and integration) and other external platforms supported by the Company

Through external platform integrations, the Company may provide the following features. Content publishing and scheduled publishing are provided only for platforms for which the Company supports publishing, such as YouTube, Instagram, and TikTok. Cafe24 is used for store account connection and integration.

• Connecting external platform accounts

• Checking connected accounts and authorization status

• Publishing content selected by the user

• Scheduled publishing, where such functionality is provided

• Setting titles, descriptions, captions, tags, hashtags, and platform-specific publishing settings supported by the Service

• Displaying publishing progress and success or failure results

• Customer support related to external platform integrations

5. Payments and Billing

• Paid service and subscription payments

• Registration of payment methods

• Issuance and management of billing keys

• Billing and payment history management

• Payment approval, cancellation, and refunds

• Prevention of fraudulent payments and payment-related customer support

6. Customer Support and Service Communications

• Customer support through ChannelTalk and similar services

• Reviewing and responding to inquiries

• Support for service failures and usage issues

• Management of customer inquiry history

• Service-related notices by email

7. Service Usage Analytics and Improvement

• Analysis of visits and service usage

• Analysis of feature usage frequency

• Analysis of user flows and conversions

• Analysis of failures and errors

• Improvement of service performance and quality

• Statistical analysis for new features and service improvements

• Analysis of recent access time, return visits, and user activity

• Analysis of major feature usage flows, including project creation, video analysis, short-form generation, editing, and publishing

• Analysis of subscription/payment conversion and plan usage

• The Company may, to the extent necessary for service operation and improvement, associate member identifiers such as email addresses with service usage records in order to analyze account-level usage, recent access, feature usage history, conversions, and return visits. Such analysis is conducted for customer support, service operations, error response, product improvement, and understanding service usage.

8. Advertising and Marketing

• Measuring advertising effectiveness

• Measuring registration and service conversions

• Analyzing advertising campaign performance

• Providing events, promotions, and marketing information where the user has consented

• Operating advertising and retargeting services to the extent permitted by applicable law and user settings

ARTICLE 2 — CATEGORIES OF PERSONAL INFORMATION PROCESSED

The Company may process the following personal information in the course of providing the service.

1. Standard Membership Registration

Required information:

• Email address

• Password

• Service account identifier

2. Social Login

When a user logs in using an external authentication provider such as Google, Naver, Kakao, or Cloudike SSO, the following information may be processed within the scope authorized by the user:

• External service user identifier

• Email address

• Name or display name

• Profile-related information

• Authentication and authorization information

• Login provider information

The Company does not collect or store passwords for external login services. Google user data processed through Google Sign-In is used within the scope authorized by the user for login, member identification, and account management. For more information about how Google processes information through its services, please refer to the Google Privacy Policy: https://policies.google.com/privacy

3. Payment Information

The following information may be processed when using paid services:

• Type of payment method

• Payment amount and currency

• Payment and authorization number

• Payment date and time

• Cancellation and refund information

• Payment processor and PG transaction identifiers

• Billing key

• Card issuer and masked card information

Information required for registration and authentication of a payment method, such as the full card number or card password, may be processed through PortOne, payment gateways, and other payment service providers.

The Company may store billing keys issued by payment service providers and the minimum card metadata necessary to manage payments. As a general rule, the Company does not store full card numbers in its own service database.

4. Content-Related Information

The following information may be processed in connection with service use:

• Videos uploaded by users

• Images

• Music and audio

• Text

• Subtitles

• Video, image, and audio metadata

• External content URLs entered by users

• Editing information

• Generated short-form videos and other outputs

• AI analysis results

• Scene analysis information

• Person analysis information

• Tags and classification results

• Speech recognition results

• Subtitles and timecodes

• Generated information such as content titles, descriptions, and summaries

5. Information Automatically Generated During Service Use

• Access date and time

• Service usage records

• Access logs

• IP address and network information

• Browser and device information

• Operating system information

• Cookies and similar identifiers

• Referral source and referrer information

• Campaign information such as UTM parameters

• Page and feature usage records

• Error and failure records

• Service processing status

• Internal service identifiers for projects, assets, short-form videos, and similar items

• Recent access date/time or last access time

• Login, return-visit, and session usage information

• Feature usage records, including project creation, video analysis, short-form generation, editing, download, and publishing

• Subscription plan, credit usage, and major conversion status

6. Customer Support Information

When a user contacts customer support through ChannelTalk or similar services, the following information may be processed:

• Member identifier

• Email address

• Service language

• Inquiry and consultation details

• Date and time of consultation

• Service usage information related to the consultation

7. YouTube / Google Integration Information

• Google OAuth access token

• Google OAuth refresh token

• Approved OAuth scopes

• External user or channel identifier

• YouTube channel ID

• Channel name and display information

• Channel connection and authorization status

• Content selected by the user for publishing

• Title

• Description

• Tags

• Category ID

• Connection metadata such as channel URL and thumbnail, and connected-channel video-list metadata such as title, description, thumbnail URL, and live start/end times

• YouTube video ID

• Publishing, deletion, and processing status

• API processing results and error information, and donation-event information such as supporter display name, supporter message, donation amount, currency, displayed amount, related event identifiers, and relevant data included in YouTube API responses

8. Instagram / Meta Integration Information

• OAuth access token and related authentication information

• Approved permission information

• Instagram account ID

• Username and display information

• Account information within the supported scope

• Account connection status

• Published content

• Captions

• Hashtags

• Post or media ID

• Publishing status and results

• Error information

9. TikTok Integration Information

• OAuth access token

• OAuth refresh token

• TikTok account identifier, such as open_id

• Profile information within the approved scope, such as username and display name

• Account connection and authorization status

• Published content

• Title, caption, and hashtags

• Visibility settings within the scope provided by the service

• Publishing settings provided by the API, such as comments, Duet, and Stitch

• Commercial or branded content settings

• Post ID or publish ID

• Publishing status, results, and error information

10. Cafe24 Integration Information

When the Cafe24 integration is used, information such as mall ID, shop name, store owner or account name, store email address, store phone number, OAuth authentication information and approved scopes, and connection status may be processed. Some information, including a store phone number, may be received and processed during integration without being separately stored in the Company’s service database.

The Company processes external platform information only within the scope of permissions explicitly authorized by the user. YouTube donation-event information may include information relating to third-party supporters other than the Vpick member, such as supporter display names, messages, and donation amounts.

ARTICLE 3 — METHODS OF COLLECTION

The Company collects personal information through the following methods:

• Information directly entered by users during registration

• Information directly entered by users while using the service

• Videos, images, music, and other content directly uploaded by users

• External content URLs directly entered by users

• Information provided through external authentication services such as Google, Naver, Kakao, and Cloudike SSO

• Information provided through YouTube, Meta, TikTok, and Cafe24 OAuth authorization and APIs

• Information provided through PortOne and payment processors during payment processing

• Information directly provided during customer support interactions

• Cookies, logs, and usage information automatically generated during service use

• Information automatically generated or transmitted through analytics, advertising, and customer support tools

ARTICLE 4 — PROCESSING OF USER CONTENT AND EXTERNAL CONTENT

Videos, images, audio, text, and other content uploaded to Vpick or submitted for processing may be processed to provide the service.

At the user’s request, the Company may perform the following processing:

• Content storage

• Video and audio analysis

• Scene and person analysis

• Speech recognition

• Subtitle generation

• Short-form generation

• Content conversion

• Rendering

• AI analysis

• Publishing to external platforms

If a user imports content by providing a YouTube URL or another third-party service URL, the user must possess the lawful rights necessary to use, reproduce, analyze, and edit that content.

The Company does not independently verify all copyrights, neighboring rights, portrait rights, music rights, or other rights relating to content provided or submitted for processing by users.

The Company uses such content only to the extent necessary to process the user’s service request.

ARTICLE 5 — PERSONAL INFORMATION PROCESSING IN CONNECTION WITH AI SERVICES

1. NAVER Cloud Media Intelligence

The Company may use NAVER Cloud Media Intelligence for video analysis.

The following information may be processed:

• Video and audio content

• Video storage location and related identifiers

• Scene ranges

• Language settings

• Video and audio analysis results

• Scene, audio, person, tag, and thumbnail information

Analysis results may be stored in the Company’s systems to provide Vpick services.

2. AssemblyAI

The Company may use AssemblyAI to provide speech recognition and STT functions.

The following information may be processed:

• A restricted URL used to access audio or video

• Audio data

• Speech-recognition text

• Speaker diarization results

• Language information

• Word-level timecodes

• Analysis information such as speech-recognition confidence scores

AssemblyAI may receive a restricted Presigned URL that provides access to the original video or audio, and the URL is valid for approximately one hour. Under the current Production configuration, AssemblyAI processing data is subject to an approximately one-day TTL policy. Transcripts and related analysis information generated by AssemblyAI that are necessary to provide the service may be copied to and stored in the Company’s storage.

3. Google Gemini Developer API

The Company uses the Google Gemini Developer API to provide functions such as content analysis, summarization, and scene-context analysis.

Under the current service architecture, the following information may be transmitted to Gemini:

• Scene descriptions

• Speech-recognition results

• Subtitles

• Tags

• Titles and summary information

• Service-related metadata

• Images prepared for AI analysis or URLs that provide access to such images

Under the currently verified service architecture, the full original video or original audio is not directly stored using the Gemini Files function.

Under the applicable paid-service terms, input and output data are not used by Google to train models or improve products. Zero Data Retention is not separately enabled, and the service is operated without selecting a dedicated processing region.

ARTICLE 6 — YOUTUBE API SERVICES AND GOOGLE USER DATA

The Company uses YouTube API Services and Google OAuth 2.0 to allow users to connect their own YouTube channels to Vpick and publish content to those channels.

Where scheduled publishing functionality is provided, users may publish content according to a schedule they directly specify.

Connecting YouTube is an optional feature selected by the user.

The Company accesses YouTube and Google user data only within the scope expressly authorized by the user during Google’s authorization process.

The Company does not collect or store users’ Google account passwords.

The Company uses YouTube integration information only for the following purposes:

• Identifying and displaying the YouTube channel authorized by the user

• Maintaining YouTube connection and authorization status; synchronizing and displaying connected-channel video lists, live archives, and donation events such as Super Chat; and, where enabled by the user, generating short-form content based on donation events

• Publishing content selected by the user

• Scheduled publishing directly requested by the user

• Transmitting publishing information such as title, description, tags, category ID, and other platform-specific publishing information supported by the Service

• Displaying upload and publishing status

• Displaying success or failure results

• Error handling and customer support

The Company publishes content to YouTube only when the user has reviewed the destination channel, Content, and applicable publishing information and explicitly requested the publishing action. The Company may suggest or pre-populate publishing information such as titles, descriptions, and tags through AI or automated features; however, the final publishing information transmitted to YouTube remains subject to the user’s review, and the Company will not add, delete, or otherwise modify values finally confirmed by the user without the user’s explicit consent.

The Company does not publish content without the user’s request or to channels not authorized by the user. For Scheduled Publishing, when the user reviews the target channel, Content, scheduled date and time, and other applicable publishing information and submits a Scheduled Publishing request, the request is treated as the user’s explicit advance instruction to publish the specified Content at the designated time.

The Company does not use user data obtained through the YouTube API for the following purposes:

• Sale of user data

• User credit scoring

• Sale of user profiles

• General AI model training using YouTube user data

• Independent advertising or marketing purposes not authorized by the user

The Company’s use of Google user data is subject to the Limited Use requirements of the Google API Services User Data Policy and applicable YouTube API Services policies.

YouTube Disconnection and Data Deletion

Users may disconnect YouTube through Vpick’s connection-management interface.

When a user requests disconnection of YouTube in Vpick, the Company deletes the YouTube Access Token and Refresh Token stored by Vpick and deactivates the connection, thereby stopping YouTube API access using those deleted credentials. Disconnecting YouTube within Vpick may not automatically revoke Vpick’s access permission on the user’s Google account. Users may separately revoke Vpick’s access through their Google account connection and security settings.

To connect YouTube again after disconnection, the user must go through the Google OAuth connection process in Vpick again. If an existing authorization grant remains on the Google account, the way Google displays the consent screen may vary depending on Google policy and the account status.

Users may also revoke Vpick’s access directly through the connection and security settings of their Google account.

Users may request deletion of YouTube/Google user data stored by Vpick through support@vpick.ai. When YouTube is disconnected, the Access Token and Refresh Token stored by Vpick are deleted; however, channel metadata, synchronized video lists, live archives, or donation-event information stored during the integration are not necessarily all deleted immediately solely as a result of disconnection. Where a separate data deletion request is submitted, the Company processes the relevant data after identity verification in accordance with applicable law, platform policies, and the Company’s data-deletion procedures.

If the user directly revokes Vpick’s access through the connection or security settings of the Google account, the Company will no longer use the relevant authentication information after the revocation is confirmed. Users may request separate deletion of related YouTube/Google user data through support@vpick.ai.

Where scheduled publishing functionality is provided, editing, cancellation, or publishing of existing scheduled posts may be restricted after YouTube is disconnected.

Google Privacy Policy: https://policies.google.com/privacy

Google Account Connections and Permissions: https://security.google.com/settings/security/permissions

YouTube Terms of Service: https://www.youtube.com/t/terms

YouTube API Services Developer Policies: https://developers.google.com/youtube/terms/developer-policies

The retention, refresh, and deletion of YouTube API Data are subject to the YouTube API Services Developer Policies. The Company applies data refresh and deletion procedures within the scope of its actual service operations and implementation, and users may request deletion of related data stored by Vpick through support@vpick.ai.

Deleting YouTube data stored by Vpick does not automatically delete content that has already been published on YouTube itself.

Content published on YouTube must be deleted directly on YouTube or through a Vpick deletion feature where such functionality is provided.

Questions and deletion requests concerning YouTube/Google user data may be submitted to support@vpick.ai.

ARTICLE 7 — INSTAGRAM / META INTEGRATION DATA

The Company uses official APIs and OAuth authentication methods provided by Meta to allow users to connect supported Instagram accounts to Vpick and publish content.

Where scheduled publishing functionality is provided, users may publish content according to a schedule they directly specify.

The Company accesses Instagram/Meta data only within the scope of permissions authorized by the user.

The Company does not collect or store Instagram or Facebook account passwords.

Integration information is used for the following purposes:

• Identifying connected accounts

• Maintaining account connection status

• Transmitting content selected by the user

• Setting publishing information

• Immediate publishing

• Scheduled publishing requested by the user

• Checking publishing status and results

• Error handling and customer support

Users may revoke permissions at any time through Vpick’s connection-management features or through Meta/Instagram account settings.

Upon disconnection, the relevant authentication information is no longer used for Instagram/Meta integration. Users who wish to separately delete related integration data may submit a request to support@vpick.ai, and the Company processes the request in accordance with applicable law, Meta policies, and the Company’s data-deletion procedures.

The Company does not sell data obtained through Instagram/Meta integrations and does not use such data for purposes unrelated to providing the integration features requested by the user.

Deletion requests may be submitted to support@vpick.ai.

ARTICLE 8 — TIKTOK INTEGRATION DATA

The Company may use official TikTok integration methods, including TikTok Login Kit and Content Posting API, to allow users to connect TikTok accounts to Vpick and publish content.

The Company processes TikTok data only within the Scopes expressly authorized by the user during TikTok’s authorization process.

The Company does not collect or store TikTok account passwords.

TikTok integration information is used for the following purposes:

• Identifying the connected TikTok account

• Maintaining account and authorization status

• Providing account settings needed on the publishing screen

• Transmitting content and publishing information

• Publishing requested by the user

• Scheduled publishing requested by the user, where such functionality is provided

• Checking publishing status

• Error handling and customer support

Users may disconnect the integration to the extent available through TikTok or Vpick permission-management features.

When the connection is terminated, the relevant authentication information is no longer used for TikTok publishing. Users who wish to separately delete related integration data may submit a request to support@vpick.ai, and the Company processes the request in accordance with applicable law, TikTok policies, and the Company’s data-deletion procedures.

The Company does not sell TikTok integration data and does not use it for purposes unrelated to the integration functionality requested by the user.

Deletion requests may be submitted to support@vpick.ai.

ARTICLE 9 — DISCLOSURE OF PERSONAL INFORMATION TO THIRD PARTIES

As a general rule, the Company does not disclose users’ personal information to third parties. Exceptions may apply in the following cases:

• Where the user has provided prior consent

• Where the user directly requests publication of content to an external platform

• Where the user expressly connects an external service

• Where disclosure is specifically required by law or necessary to comply with legal obligations

When a user uses an external-platform publishing feature, the following information may be transmitted to the applicable platform:

YouTube / Google

• Purpose: YouTube channel connection and content publishing

• Information: Published content, title, description, tags, category ID, channel information, and authentication information

Meta / Instagram

• Purpose: Instagram account connection and content publishing

• Information: Published content, captions, hashtags, account information, and authentication information

TikTok

• Purpose: TikTok account connection and content publishing

• Information: Published content, title/caption/hashtags, visibility settings within the scope provided by the service, account information, and authentication information

Cafe24

• When the Cafe24 integration is used, mall ID, OAuth authentication information, and application-integration-related information may be exchanged with Cafe24 for OAuth authentication and store integration, while shop name, store account information, store email address, store phone number, and similar information may be received from Cafe24.

Information provided to external platforms is processed in accordance with the privacy policies and terms of those platforms.

ARTICLE 10 — OUTSOURCING OF PERSONAL INFORMATION PROCESSING

The Company may outsource certain personal-information processing activities to external service providers for the smooth provision of its services.

NAVER Cloud Corp.

• Outsourced activities: Cloud infrastructure operations, data storage, Object Storage, content transmission and conversion, Media Intelligence-based analysis, and email delivery

AssemblyAI, Inc.

• Outsourced activities: Speech-to-Text, multilingual speech recognition, and speech analysis

Google Gemini service provider

• Outsourced activities: Content and multimodal analysis through the Gemini Developer API

Korea PortOne Co., Ltd.

• Outsourced activities: Payment integration, payment method registration, billing-key issuance, and payment information processing

NICE Payments Co., Ltd.

• Outsourced activities: Card payment authorization, payment, cancellation, refund, and related payment-gateway services

Channel Corporation

• Outsourced activities: Provision of customer consultation and customer support systems

Enliple Co., Ltd.

• Outsourced activities: Mobion advertising and conversion measurement services

Analytics, advertising, and security providers such as Google Analytics, Google Ads, Meta Pixel, and Google reCAPTCHA are also described in Article 12 concerning automatically collected and behavioral information.

When outsourcing personal-information processing, the Company manages matters required by applicable law, including prohibitions on processing personal information outside the scope of the outsourced purpose, security measures, and management and supervision of subprocessors.

If a processor or the scope of outsourced activities changes, the Company will disclose the change through this Privacy Policy.

ARTICLE 11 — CROSS-BORDER TRANSFER OF PERSONAL INFORMATION

The Company may transfer personal information outside Korea in order to perform contracts with users, provide AI analysis, support external-platform integrations, and provide the service.

1. AssemblyAI

• Recipient: AssemblyAI, Inc.

• Country: United States

• Contact: legal@assemblyai.com

• Information transferred: URL used to access audio/video, audio data, and information related to speech recognition and analysis

• Purpose: STT, speaker diarization, multilingual speech recognition, and analysis

• Timing: When the user requests the applicable analysis function

• Method: Transmission over an encrypted network or provision of a restricted access URL

• Retention/use period: Under the current Production configuration, AssemblyAI processing data is subject to an approximately one-day TTL policy, after which the provider-side deletion process begins

• How to refuse transfer: The user may refuse the transfer by not using the applicable AI analysis function; in that case, the relevant audio-analysis functionality may be unavailable

2. Google Gemini Developer API

• Recipient: Google LLC or the applicable Google service entity

• Countries: Countries in which Google processes data to provide the service, including the United States (no dedicated processing region is selected)

• Information transferred: Scene descriptions, speech-recognition results, subtitles, tags, titles, summaries, related metadata, and analysis images or image URLs

• Purpose: Content analysis, scene-context analysis, summarization, and AI-based analysis

• Timing: When the user uses a Gemini-based AI function

• Method: API transmission over an encrypted network

• Retention/use period: Subject to applicable Google Paid Services policies and the actual Production configuration; Zero Data Retention is not separately enabled

• How to refuse transfer: The user may refuse by not using the applicable AI function; some AI-analysis functions may then be unavailable

3. YouTube / Google

• Recipient: Google LLC and applicable Google service providers

• Main countries: United States and other countries in which Google processes data to provide its services

• Information transferred: OAuth authentication/authorization information, YouTube channel information, published content, and publishing information

• Purpose: Connecting YouTube accounts, publishing content, and checking publishing status

• Timing: When connecting an account or requesting publication

• Method: API transmission over an encrypted network

• Retention/use period: Subject to applicable Google/YouTube policies, user account settings, and the Company’s actual service operations and data-deletion procedures.

• How to refuse transfer: The user may choose not to connect YouTube or may disconnect it; in that case, YouTube integration functions cannot be used

4. Instagram / Meta

• Recipient: Meta Platforms, Inc. or the Meta entity applicable to the user’s service region

• Countries: United States and countries in which Meta operates data-processing facilities

• Information transferred: OAuth authentication/authorization information, Instagram account information, content, and publishing information

• Purpose: Connecting Instagram accounts and publishing content

• Timing: When connecting an account or requesting publication

• Method: Transmission over an encrypted network

• Retention/use period: Subject to Meta policies and user account settings

• How to refuse transfer: The user may choose not to connect Instagram or may disconnect it; in that case, Instagram integration functions cannot be used

5. TikTok

• Recipient: TikTok Pte. Ltd. or the applicable TikTok service entity

• Main countries: Singapore and other countries in which information is processed to provide TikTok services

• Information transferred: OAuth authentication/authorization information, TikTok account information, content, and publishing information

• Purpose: Connecting TikTok accounts and publishing content

• Timing: When connecting an account or requesting publication

• Method: Transmission over an encrypted network

• Retention/use period: Subject to TikTok policies and user account settings

• How to refuse transfer: The user may choose not to connect TikTok or may disconnect it; in that case, TikTok integration functions cannot be used

6. Analytics and Advertising Services

When the Company uses services provided by overseas providers such as Google Analytics, Google Ads, Meta Pixel, and Google reCAPTCHA, usage information and behavioral information described in Article 12 may be transmitted to systems located outside Korea.

The specific recipient entity, country, and retention conditions may vary depending on applicable service contracts and configurations. The Company discloses current information based on the actual Production configuration.

ARTICLE 12 — COOKIES, BEHAVIORAL INFORMATION, ANALYTICS, AND ADVERTISING SERVICES

The Company may use cookies and similar technologies to analyze service usage, improve the service, and measure advertising effectiveness.

When users access the service, some usage information may be automatically transmitted to external providers of analytics or advertising services.

1. Google Analytics 4

The Company uses Google Analytics to analyze how users use Vpick.

Google Analytics may process the following information:

• Pages and screens visited

• Access time

• Referral source and Referrer

• Campaign information such as UTM parameters

• Browser and device information

• Operating system

• Cookies or similar identifiers

• Service-feature usage events

• Registration and major conversion events

• Processing results and feature usage information within the service

The Company uses this information for the following purposes:

• Analysis of visits and service usage

• Analysis of user flows

• Service performance analysis

• Feature improvement

• Analysis of conversion rates and service quality

Google Analytics data is retained in accordance with the retention settings of the Google Analytics Property configured by the Company and Google’s policies. The Vpick application does not currently use the Google Analytics User-ID feature.

2. Google Tag Manager

The Company may use Google Tag Manager to centrally manage analytics and advertising tags applied to the service.

Google Tag Manager is a tool for executing and managing analytics and advertising tags. The information actually collected depends on Google Analytics, Google Ads, and other tags executed through Tag Manager.

The Company manages Google Tag Manager so that information that directly identifies an individual, such as names, email addresses, or payment information, is not transmitted through Google Tag Manager.

Google Tag Manager Use Policy: https://marketingplatform.google.com/about/analytics/tag-manager/use-policy/

Google Privacy Policy: https://policies.google.com/privacy

3. Google Ads

The Company may use Google Ads-related tags to analyze advertising campaign performance and service conversions.

The following information may be processed:

• Advertising referral information

• Visit and conversion events

• Campaign performance information such as registrations

• Cookies and advertising identifiers

• Browser and device information

This information may be used to analyze advertising performance and operate advertising based on applicable user settings.

4. Meta Pixel

The Company may use Meta Pixel to measure the effectiveness of Meta advertising.

The following information may be transmitted to Meta:

• Page visits

• Conversion events such as registrations

• Browser and device information

• Cookies and similar identifiers

• Network-related information

• Advertising and campaign-related information

This information may be used for advertising effectiveness measurement, campaign analysis, and advertising operations based on applicable user settings.

5. Mobion OneTag

The Company may use Mobion OneTag provided by Enliple Co., Ltd. to measure advertising and conversion effectiveness, including registrations.

The following information may be processed:

• Page visits

• Conversion events such as registrations

• Browser and network information

• Cookies or similar identifiers

• Advertising campaign-related information

6. Google reCAPTCHA

The Company may use Google reCAPTCHA to prevent automated access and misuse.

The following information may be transmitted to Google in this process:

• reCAPTCHA verification token

• IP and network information

• Browser and device-related information

• Technical information related to service use

7. Google Fonts

If Google web fonts are used on service screens, the user’s browser may connect directly to Google servers, and IP address, browser information, and technical request information may be transmitted in that process.

8. Additional Analytics Notice for EEA/UK Users

Where the GDPR or UK GDPR applies, the Company may analyze how users interact with the service, including the number of visitors, frequently requested information, referral sources, pages accessed, frequency and duration of access, recent access, key feature usage, conversions, and return visits. This enables the Company to operate, secure, evaluate, and improve the service and user experience.

For internal service analytics that do not require consent under applicable law, the legal basis is the Company’s legitimate interests under Article 6(1)(f) GDPR in operating, securing, improving, and understanding use of the service. Where consent is required for cookies, advertising technologies, or similar tracking technologies, the Company relies on consent under Article 6(1)(a) GDPR and applicable ePrivacy rules.

Analytics data is pseudonymized or aggregated where technically and operationally appropriate, and the Company seeks to minimize the use of direct identifiers for analytics purposes. Directly identifying information such as names, email addresses, and payment information is not transmitted through Google Tag Manager, and the Vpick application does not currently use the Google Analytics User-ID feature.

Users may object to processing based on legitimate interests in accordance with Article 21 GDPR, subject to applicable legal requirements.

Cookie and Behavioral Information Opt-Out

Users may block or delete cookies through their web-browser settings.

If cookies are blocked, analytics and advertising measurement functions that rely on cookies or similar technologies, including Google Analytics, Google Ads, Meta Pixel, and Mobion, may be limited. Vpick’s current login-session persistence does not rely on cookies, so ordinary cookie blocking does not by itself prevent login status from being maintained.

Processing for personalized advertising or third-party advertising purposes may be restricted or refused in accordance with applicable laws, provider policies, and the privacy/advertising settings selected by the user.

Where separate consent is required under applicable law, the Company provides the necessary consent and choice mechanisms.

ARTICLE 13 — RETENTION AND USE PERIOD

The Company retains personal information only for the period necessary to achieve the applicable processing purpose.

• Member information: Until membership withdrawal or termination of the service agreement

• Login and account information: Until membership withdrawal or achievement of the processing purpose

• Uploaded/generated content: Until the user deletes the content, the service agreement ends, or the separately notified storage period expires

• AI analysis results: For the retention period of the related content or for the period necessary to provide the service

• External-platform authentication tokens: Until disconnection, revocation of authorization, membership withdrawal, or achievement of the processing purpose

• Scheduled publishing information: For the period necessary for operations and incident response after publishing is completed or canceled

• Customer support records: For the period necessary to provide the service and resolve disputes, or for the statutory retention period

• Payment-related information: For the period required by applicable law

• Service usage and analytics information: For the period necessary for service operations or according to the settings of each analytics service

Statutory Retention Periods

The following records may be retained for the periods required by applicable law:

• Records concerning labeling and advertising: 6 months

• Records concerning contracts or withdrawal of offers: 5 years

• Records concerning payment and supply of goods/services: 5 years

• Records concerning consumer complaints or dispute resolution: 3 years

• Other records required by applicable law: For the period specified by the relevant law

System Backups

Some data may remain in backup systems for a certain period for service stability and disaster recovery.

Under the current Production configuration, database backups may be retained for up to approximately 30 days. Backup copies are not reused for general service-provision purposes and are deleted according to the backup retention cycle.

ARTICLE 14 — DESTRUCTION PROCEDURES AND METHODS

The Company destroys personal information without undue delay when the processing purpose has been achieved or the retention period has expired.

However, information that must be retained under applicable law may be stored separately from other information for the required period.

Method of Destruction

• Electronic files: Deleted using methods designed to make recovery or restoration difficult

• Paper documents: Shredded or incinerated

When uploaded or generated content is deleted, deletion procedures are carried out in the service database and storage systems.

Data temporarily remaining in CDN caches, backups, or external processors’ systems may be additionally deleted according to the applicable retention cycle or deletion procedure.

Content already published to an external platform may not be automatically deleted merely because the original content or integration information is deleted from Vpick.

ARTICLE 15 — RIGHTS AND OBLIGATIONS OF DATA SUBJECTS AND HOW TO EXERCISE THEM

Users may exercise the following rights to the extent provided by applicable law:

• Request access to personal information

• Request correction of personal information

• Request deletion of personal information

• Request restriction or suspension of processing

• Withdraw consent to the collection and use of personal information

• Delete uploaded or generated content

• Disconnect external platforms

• Delete external-platform integration data

• Withdraw membership

Users may directly exercise certain rights, such as disconnecting external platforms, through connection-management features provided by Vpick. Requests requiring separate processing, including access, correction, deletion, restriction or suspension of processing, withdrawal of consent, and membership withdrawal, may be submitted to support@vpick.ai.

The Company may verify the user’s identity where necessary and processes requests in accordance with applicable law.

Where scheduled publishing functionality is provided, disconnecting an external platform may restrict editing, cancellation, or publishing of existing scheduled posts.

Even if Vpick deletes external-platform data it holds, content already published to YouTube, Instagram, or TikTok may remain stored on those platforms.

ARTICLE 16 — CHILDREN’S PERSONAL INFORMATION

As a general rule, the Company does not provide the service to children under 14 years of age and does not intentionally collect personal information from children under 14.

If the Company becomes aware that personal information of a child under 14 has been collected without lawful consent, it will take necessary measures under applicable law, including deletion of the information.

ARTICLE 17 — SECURITY MEASURES

The Company implements administrative, technical, and physical safeguards required by applicable law to protect personal information.

• Minimizing access privileges to personal information

• Access controls for personal-information processing systems

• Encryption of data in transit

• Authentication and session management

• Management of access records for personal and important information

• Logging and security monitoring

• Security vulnerability checks

• Incident-response procedures

• Training and management of personnel handling personal information

• Backup and disaster-recovery procedures

• Other safeguards required by applicable law

OAuth Credentials

The Company protects external-service authentication information such as OAuth Access Tokens and Refresh Tokens by restricting access, encrypting data in transit, preventing authentication information from being exposed in logs, and applying other necessary safeguards.

ARTICLE 18 — PRIVACY OFFICER AND REMEDIES FOR PRIVACY INFRINGEMENT

The Company designates a privacy officer to oversee personal-information processing and to handle privacy-related inquiries, complaints, and rights requests.

Privacy Officer

• Name: Hwan Ham

• Title: Manager

• Department: Business Division

• Email: support@vpick.ai

• Phone: +82-10-4444-3665

Privacy inquiries, external-platform disconnection requests, and deletion requests concerning YouTube, Google, Instagram, Meta, TikTok, or Cafe24 data may also be submitted through the above contact information.

Users may seek consultation or remedies from the following institutions in connection with privacy infringements:

• Personal Information Infringement Report Center

• Personal Information Dispute Mediation Committee

• Supreme Prosecutors’ Office

• Korean National Police Agency

For the latest contact information and procedures, please refer to the official guidance provided by each institution.

ARTICLE 19 — CHANGES TO THIS PRIVACY POLICY

The Company may revise this Privacy Policy due to changes in applicable laws, service functions, or personal-information processing methods.

If this Privacy Policy is changed, the effective date and major changes will be announced through the service interface or website.

If a change materially affects the rights of data subjects, the Company may provide separate notice in the manner and within the period required by applicable law.

ADDENDUM

• Effective date of the previous Privacy Policy: August 26, 2026

• Effective date of this revised Privacy Policy: September 2, 2026