Summet Privacy Policy

CoMente (the “Company”) establishes and publishes this Privacy Policy (the “Policy”) to protect users’ personal information and promptly handle related complaints in accordance with the Personal Information Protection Act and other applicable laws. This Policy applies to the Summet website, desktop applications, mobile applications, smartwatch applications, and related services provided by the Company.

Article 1 (Personal Information Processed)

The Company may process the following personal information.

Article 2 (Purpose of Processing Personal Information)

The Company processes personal information for the following purposes.

1. Sign-up, login, identity verification, and account management
2. Providing service features such as meeting recording, speech transcription, the meeting agent, messages and voice calls with call translation and recording, the Summet assistant, summaries, Q&A, translation, meeting minutes, generating documents, images and videos, AI memory, scheduled tasks, cloud browser tasks, team chat, and maps
3. Storing user settings, synchronization, push notifications, and app operation
4. Customer support, inquiry response, and notices
5. Providing Paid Services, payment processing, purchase verification, subscription status confirmation, refunds, accounting and settlement, and preventing duplicate, fraudulent, or erroneous payments
6. Service improvement, feature development, quality enhancement, security, and incident response
7. Compliance with legal obligations, dispute handling, and prevention of unauthorized use
8. Choosing the display language and the currency shown based on the country of access (determined from the IP address)

Article 3 (Data Processing Method within the Service)

1. The Company may use Firebase for member authentication, user identification, settings synchronization, push notifications, and app operation support.
2. The Company may use external cloud infrastructure such as Amazon Web Services (AWS) for server operation, storage, backup, network, security, incident response, and performance optimization.
3. When users use AI summaries, Q&A, translation, meeting minutes, document generation, or similar features, the Company may process transcript text, memo content, prompts, portions of uploaded files, Q&A inputs, and related data.
4. The Company uses external AI service providers such as OpenAI (GPT), Anthropic (Claude), Google (Gemini), and Soniox (speech-to-text) to perform AI Features requested by users, and relevant data is transmitted to and processed by such providers within the necessary scope. Transmission to external AI providers takes place with the user’s separate consent (for earlier app versions without the consent screen, Article 11(1) applies); the recipients, the items sent, and how to consent and withdraw are set out in Article 11.
5. The Company handles personal information within the minimum scope necessary for processing purposes, and minimal technical logs may be temporarily generated for service operation, security, and incident response.
6. If a user has declined or withdrawn consent to third-party AI processing, the Company does not send that user’s information to external AI service providers (Article 11). Processing through external infrastructure such as Firebase or AWS may still occur for basic service provision, including authentication, storage, synchronization, security, and server operation.
7. Gmail and Google Workspace integrations are not currently offered. If they are offered again, the Company will set out the items and purposes in this Policy and notify users, will activate them only within the scope explicitly selected or consented to by users, and will process related information only within the minimum scope necessary to perform those features.
8. The Company may process transaction identifiers, order information, receipt verification information, or subscription status information provided by each Payment Channel to provide Paid Services, confirm payment status, verify purchases, confirm auto-renewal, reflect refund or cancellation status, and prevent duplicate or fraudulent payments.
9. When the user enables “Privacy protection mode” in settings, the Company may mask selected patterns (email, phone number, resident ID pattern, card number pattern, bank account pattern, address pattern) by replacing matched text with tokens before information is sent to external AI providers. AI chat messages are masked on the user’s device or browser, and message translation requests and the AI memory added to answers are masked on the Company’s server. The on/off state and selected item types are stored in device or browser storage. Masking is not applied when the mode is off.
10. Audio in voice calls in the app and on the web (friend calls, group calls and Summet assistant calls) is relayed through the Company’s servers, and on networks where a direct connection is not possible it may pass through Twilio’s relay servers. When a user turns on translation in a one-to-one call, only the audio of people who have consented to third-party AI processing is sent to Soniox to create captions and an interpreted voice, and the audio of Summet assistant calls is sent to OpenAI to produce replies (Article 11). Group calls have no translation or recording. Calls to and from phone numbers over the public telephone network (PSTN) are not currently offered.
11. Retention of call recordings and call records: When recording is turned on in an app or web voice call, the recording file is saved as belonging to the user who turned it on and can be played again from the call record in that conversation. When the user converts a recording to text, or when automatic after-call follow-up is on, the transcript, summary and to-dos are saved in that user’s records, and the user may delete them at any time from the records screen in the app or on the web. Call recording files and call records are deleted when a participant in that call withdraws membership; to delete a recording file before then, users may send a request to the contact below (help@comente.io). For calls that use translation without recording, audio processed temporarily for translation is not stored and is destroyed.
12. Personal information of the other party to a call: Because of the nature of a call, the voice and words of the person you speak with may also be processed and stored when you use call recording, transcription of recordings, or automatic after-call follow-up. The Company processes such information solely to provide you with the call feature and its outputs (transcription, translation, summary, to-dos), and does not use it for any other purpose or provide it separately. Because the recording indicator appears only on the screen of the person who turned recording on, you must use the recording feature without infringing the rights of the other party under applicable laws and, where required, inform them that the call is being recorded. The other party’s information is deleted together with the relevant call record or transcript, or upon your withdrawal.
13. Team plan: the team owner sees members’ names, emails and shared-credit usage; members see each other’s names and usage.
14. Cloud browser: When the user opens the cloud browser or asks the AI to do something on a website (such as searching, booking or purchasing), the Company runs an isolated browser used only by that user on AWS, and deletes that browser when the window is closed, or when it closes after 10 minutes without use or 60 minutes after it was opened. While the AI works, the browser screen is sent to Anthropic (Article 11), with card number and security code fields masked on screen. For tasks given in a message room, part of that room’s recent conversation is also sent so the AI understands the context. When a sign-in is needed, the server enters the ID and password the user types into the secure input field directly into the site’s fields; these values are not sent to the AI and are not kept in conversation history, memory or logs (although the AI can see the ID as it appears on the site’s screen). Final steps that are hard to undo, such as paying, booking or sending, are designed to proceed only after the user approves them (Terms of Service Article 9-2). Information the user enters, or asks to be entered, is sent to the website the user opened (Article 6), and that website’s privacy policy applies to it.
15. Saved browser sign-ins: While “Stay signed in” is on (it is on by default), the cookies (sign-in state) of sites the user signs in to in the cloud browser are kept encrypted only on the user’s device (browser storage on the web, app storage in the app), both during use and when the window closes; IDs and passwords are kept the same way only when the user chooses to save them on this device; and the Company’s server holds only half of the key needed to unlock them. When the user signs in directly on the cloud browser screen, the ID and password are passed through the server to the user’s device so the user can be asked whether to save them on the device, and they are discarded if the user does not save them. When the cloud browser is opened, saved site cookies are loaded into that browser and returned to the device when the work ends. If an ID and password are saved, then when the AI asks to sign in to that site, the device enters them through the server directly into the site’s fields without asking the user again (only on the site’s official address or the address they were saved for; these values are not sent to the AI either). Turning off “Stay signed in” stops saving and deletes what is saved on that device. Users can delete them at any time under Settings > Privacy > Saved browser logins on the web or Settings > Saved browser logins in the app; on account deletion, the server-side key is deleted, so copies left on devices can no longer be unlocked.
16. AI memory: When a conversation of a user who has consented to third-party AI processing ends, the Company uses OpenAI to organize facts learned in that conversation (such as name, work, preferences, ongoing tasks and decisions) and a short note of the conversation, keeps them, and refers to them when answering in other conversations or choosing booking or purchase options. AI memory organized from conversations is deleted when the conversation it came from is deleted or when the user withdraws membership; to-dos, events, promises, stated figures and per-person notes taken from recordings and call records are kept as set out in Article 4. For a user who still has a user summary from the former AI chat feature (Article 1), that summary is moved into AI memory once, when the user first uses AI memory; because this memory does not come from a particular conversation, it remains even when conversations are deleted (Article 4).
17. Guests who join through an invite link: People without an account can join the meeting agent and team chat through an invite link. The name a guest enters and the guest’s speech (as transcribed text), chats and uploaded files are saved as part of that meeting room or team and are visible to the member who opened the meeting or to team members, and the name the guest entered stays on past messages after the guest leaves. Meeting agent guests are told on the join screen that the meeting’s speech, chat and shared files are processed by external AI (OpenAI and Soniox), and team chat guests are asked for consent to third-party AI processing when they join (Article 11). Meeting agent rooms and guest information are deleted when the member who opened the meeting withdraws membership.
18. Information visible to other users: The user’s name, nickname and profile photo are visible to other users when adding friends and in messages, voice calls, co-editing and team chat. When the user creates a conversation share link, a copy of the conversation at that moment is public to anyone who has the link, and the user can delete the share.

Article 4 (Retention and Use Period)

As a rule, the Company destroys personal information without delay once the purpose of processing has been achieved. However, certain information may be retained for the periods below when required by applicable laws or service operation.

1. Member information: until membership withdrawal
2. Content created or uploaded by the user (recordings, transcripts, meeting minutes, documents, chats, attachments, etc.): until the user deletes it individually or withdraws membership (files and records moved to the trash are permanently deleted automatically after 30 days)
3. Payment and transaction records: under the Act on the Consumer Protection in Electronic Commerce, etc., records of contracts or withdrawal of offers and records of payment and supply of goods, etc. are kept for 5 years, and records of consumer complaints or dispute handling for 3 years (items retained: payment channel, purchased product, payment approval, cancellation and refund history with dates, subscription status, Paddle, App Store and Google Play transaction and subscription identifiers, and the email address used for web payments)
4. Customer inquiry and consultation records: five years after handling is completed
5. Records for prevention of unauthorized use and security response: until the purpose is achieved
6. Service operation logs and analytics data: retained within the scope of operational purposes and then deleted or de-identified
7. Call recording files and call records: until a participant in that call withdraws membership (to delete a recording file before then, users may send a request to the contact)
8. AI memory (facts and short conversation notes organized from conversations): until the conversation it came from is deleted or the user withdraws membership
9. To-dos, events, promises, stated figures and per-person notes taken from recordings and call records: until the user withdraws membership (they remain even if the original record is deleted; users may ask the contact to delete them earlier)
10. Cloud browser: until the window closes (it closes automatically after 10 minutes without use or 60 minutes after it was opened); saved browser sign-ins: until the user deletes them or the server-side key is deleted on account deletion
11. Meeting agent rooms (including guest information, transcribed speech and shared files): until the member who opened the meeting withdraws membership
12. Team chat posts and uploaded files, and guests’ names and third-party AI consent records: kept as the team’s records until the team is deleted (they remain even if a Team plan ends and the team is closed, or if the member who created the team or the author withdraws membership, and the withdrawn member’s name is then no longer shown; users can delete their own posts, the team owner can ask the contact to delete the whole team, and guests can ask the contact to delete their name, consent record and posts)
13. Records already stored by features no longer offered: the mobile phone number verified at sign-up and the record of that verification, call records, recordings and memos from phone-number calls, and meeting information, transcripts and in-meeting chat from video meetings, are kept until the user withdraws membership (users may ask the contact to delete them earlier, and the meeting information, transcripts and chat of video meetings that other people also joined may remain as that meeting’s records after withdrawal); new-mail alerts created while the Gmail integration was on are kept until the user deletes them or withdraws membership; and user summaries from the former AI chat feature, and the AI memory they were moved into, are kept until the user withdraws membership (they remain even when conversations are deleted; users may ask the contact to delete them earlier)

Article 5 (Destruction Procedure and Method)

1. When personal information becomes unnecessary due to expiration of the retention period or achievement of the processing purpose, the Company destroys such personal information without delay.
2. As a rule, the Company processes and stores personal information in electronic form, and electronically stored personal information is deleted using secure methods so that it cannot be restored or reproduced. If personal information is exceptionally recorded on paper documents, it is destroyed by shredding, incineration, or similar methods.
3. Even when a reason for destruction arises, such as withdrawal of membership, payment and transaction records retained under applicable laws in accordance with Article 4(3) are stored and managed separately from other personal information.

Article 6 (Provision of Personal Information to Third Parties)

As a rule, the Company does not provide users’ personal information to external parties. Exceptions apply in the following cases.

1. Where the user has given prior consent
2. Where a special provision of law exists or provision is unavoidable to comply with a legal obligation
3. Where an investigative agency or other public authority requests information through lawful procedures under applicable laws
4. Where related data is transmitted to an external AI service provider within the scope necessary to perform an AI Feature the user has consented to under Article 11 and requested
5. Where the user purchases a Paid Service through Paddle Checkout, in which case information necessary for payment is provided to Paddle.com Market Limited as Merchant of Record, as follows:
   • Recipient: Paddle.com Market Limited (United Kingdom)
   • Purpose: payment, recurring billing, invoicing, tax calculation, collection and remittance, refunds, fraud prevention, and buyer support as Merchant of Record
   • Items: email address, country or region, transaction and subscription identifiers, payment status, purchased product information, and the minimum other information needed to process the payment (the Company does not provide full card numbers, CVC, or similar sensitive data; Paddle collects those directly)
   • Retention: for the period required by Paddle’s policies and applicable laws
   Paddle’s processing is governed by Paddle’s privacy policy (https://www.paddle.com/legal/privacy). Completing Paddle Checkout constitutes consent to this provision.
6. Where information the user enters, or asks to be entered, in the cloud browser (such as site sign-in details, and the name and contact details needed for a booking or order) is sent at the user’s request to the website the user opened. That website’s privacy policy applies to this information.

Article 7 (Entrustment of Processing and Use of External Services)

The Company may use external service providers or entrust related tasks to provide the Service smoothly.

• Firebase: member authentication, data storage, push notifications, app operation support
• Amazon Web Services (AWS): server operation, data storage, backup, network and infrastructure management, and running the cloud browser (the web pages the user opens, what is entered into sign-in fields and site cookies saved on the user’s device are processed only while the window is open, and the whole runtime is deleted when the window closes)
• OpenAI: GPT-based AI Feature processing (Article 11)
• Anthropic: Claude-based AI Feature processing (Article 11)
• Google (Gemini, YouTube): AI Feature processing such as Gemini chat and voice conversations, web and YouTube search, YouTube video playback, and related service operation support (Article 11). The Service uses YouTube API Services, and the Google Privacy Policy (https://www.google.com/policies/privacy) applies to information Google processes in this context. When the YouTube video player is shown, Google may place or read cookies and similar technologies on the user’s browser or device (Article 11-5).
• Apple (App Store and Apple Push Notification service): iOS in-app payments, subscription management, payment status provision and related procedures, and delivering notifications and lock-screen call alerts to iOS devices
• Google Play: Android in-app payments, subscription management, payment status provision, and related procedures
• Twilio: relaying app and web voice calls (friend, group and Summet assistant calls) on networks where a direct connection is not possible
• Soniox: speech-to-text for recordings, live transcription, voice input, the meeting agent and call recordings, live translation, and text-to-speech (TTS) for the interpreted voice in translated voice calls (Article 11)
• Resend: sending verification-code emails to confirm ownership of an email address (email verification in the app, and confirmation before the first payment on the web)
• DuckDuckGo: web searches for public information that the voice assistant and meeting help features use in answers (only the search query is sent; this is not AI processing)
• Wikimedia Commons (Wikimedia Foundation): searches for public photos, videos and logos that can be placed in slides, AI answers and motion graphics (only the search keywords are sent; this is not AI processing)
• Expo (650 Industries, Inc.): previews of mobile apps made with the web & app builder — the app’s code, name, the libraries it uses and its image addresses are saved to Expo Snack, and anyone with the preview link can see that code (this is not AI processing)
• Google (Google Maps Platform): maps and place details in AI answers, finding nearby places, and travel times and transit directions between stops (requested directly from Google by the user’s browser or app; this is not AI processing)

The Company performs management and supervision obligations for processors or external service providers in accordance with applicable laws.

Article 8 (Overseas Transfer of Personal Information)

During service provision, some personal information or related data may be processed through providers or infrastructure located overseas.

Where required by applicable laws, the Company separately notifies or obtains consent for overseas transfers.

Article 9 (User Rights and How to Exercise Them)

Users may exercise the following rights against the Company at any time.

1. Request access to personal information
2. Request correction if there is an error
3. Request deletion
4. Request suspension of processing
5. Withdraw consent

Users may exercise these rights through service settings, customer support, or the contact below, and the Company will take action without delay in accordance with applicable laws.

Article 10 (Measures to Secure Personal Information)

The Company takes the following measures to secure personal information.

1. Minimization of access rights to personal information
2. Access control and authentication procedures
3. Security measures such as encryption during transmission
4. Log monitoring and abnormal-activity detection
5. Security updates and vulnerability response
6. Management and supervision of processors and external service providers

Article 11 (Use of Third-Party AI Services and Your Consent)

1. Summet’s AI Features produce answers and results with generative AI from outside providers. Before a user uses AI Features on the web or in an app version that includes the consent screen, the Company presents this Article on a separate screen and obtains the user’s explicit consent; users of earlier app versions are asked on the same screen after they update the app. In earlier app versions, when a user with no consent or refusal record requests an AI Feature, the information needed for that request is sent to external AI providers without a consent record, even before the user updates the app and answers on the consent screen. The information of users who decline or withdraw consent is not sent to external AI providers, including from earlier app versions, and users of earlier app versions can also decline or withdraw in Settings > Privacy > Third-party AI on the web.
2. The recipients and what they do are listed below; all of them are in the United States. App and web voice calls are connected by the Company’s servers and may pass through Twilio’s relay servers on networks where a direct connection is not possible (Articles 7 and 8).
   • OpenAI OpCo, LLC (privacy contact: privacy@openai.com): chat and documents, image generation, voice conversations and Summet assistant calls, the meeting agent’s spoken replies, message translation, and organizing AI memory and files for AI search
   • Anthropic, PBC (privacy@anthropic.com): chat, writing documents and slides, translating documents, and cloud browser tasks (viewing and operating the browser screen)
   • Google LLC (https://support.google.com/policies?p=privpol_privts): Gemini chat, voice conversations, translation and data analysis, image and video generation, web and YouTube search
   • Soniox Inc. (support@soniox.com): speech-to-text and live translation, and the interpreted voice in translated voice calls
3. Items sent: what the user types, their conversations and notes the AI keeps about them / contents of files, documents, photos and links the user adds, and saved files and records organized so AI can search them and suggest to-dos / audio from recordings, live transcription and voice input, and from meeting agent meetings (including invited guests) / call audio from Summet assistant calls and translated voice calls (for translation, only when the speaker has consented), and call recordings the user has transcribed, including the other person / the browser screen while the AI works on a task in the cloud browser (sign-in details typed into the secure input field are not sent; what is visible, such as a username or booking details, may be included, with password fields and card number and security code fields masked) / email, calendar and other connected content the user asks AI to use, and details a request needs such as the user’s name. Email addresses, phone numbers and payment information are not sent unless they are part of the request itself or appear on the browser screen.
4. Other people’s information: when a user uses AI Features on material that contains what other people wrote or said — such as chats, shared documents, meeting recordings or a call — that content is sent as well. Users must use AI Features without infringing those people’s rights.
5. Timing and method: each time the user uses an AI Feature, the information that request needs is sent over encrypted networks. The server organizes saved files and records for AI search and to-do suggestions after they are uploaded or saved, organizes AI memory after a conversation ends, runs scheduled tasks the user set up at the chosen time, and performs automatic follow-up on recorded calls after the recording is saved (this can be turned off under Auto follow-up after calls in the app’s settings); all of this is done only for users who have consented.
6. Purpose and retention: recipients use the information only to process the user’s request and delete it after the period each provider sets under its contract with the Company (including short retention for abuse monitoring). The Company uses these services only on terms under which users’ information is not used to train the recipients’ AI models.
7. Equal protection: the Company enters into data processing agreements with the recipients requiring them to protect personal information at least to the standard of this Policy, and manages and supervises their compliance.
8. Consent, refusal and withdrawal: on the consent screen, users can choose “Agree and continue” or “Don’t agree”, and they can consent or withdraw at any time in Settings > Third-party AI in the app or Settings > Privacy > Third-party AI on the web. The app and the web share the same record. If a user does not consent or withdraws, nothing is sent to external AI providers from then on and only the AI Features become unavailable. Features that do not use AI — messages, voice calls without translation, viewing and exporting records, recording without transcription, editing documents, settings, 1:1 customer support inquiries and account deletion — keep working, and results already created stay in the account. Consent is given by each person; a Team plan owner cannot consent or withdraw on behalf of team members. Guests who join team chat through an invite link without signing in are shown this Article and asked for consent when they join, and guests who join the meeting agent through an invite link are told on the join screen that the meeting’s speech, chat and shared files are processed by external AI (OpenAI and Soniox).
9. Records: the Company keeps what was chosen (consent, refusal or withdrawal), when, and the version of the notice shown at that time until the user deletes their account. If something material changes, such as the recipients or the items sent, the Company informs users again and asks for consent again.
10. Generative AI and accuracy: answers and results of AI Features are produced by generative AI. AI answers and results can be wrong, so please check anything important.
11. If the Company intends to use user data for independent AI training or improvement beyond service provision purposes, it will provide separate notice or obtain consent in accordance with applicable laws.

Article 11-2 (Limited Use of Google User Data — Google API Services User Data Policy)

Summet’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. Today the only user data the Company receives through a Google account is the basic information needed to sign in with Google (name, email address, profile photo and account identifier); integrations with Gmail, Google Drive, Google Docs, Google Sheets, Google Slides and Google Calendar are not offered. The items below also apply if those integrations are offered again, in which case the Company will update this Policy and notify users.

1. The Company uses Google user data only to provide user-facing features that the user explicitly requests (such as email summaries and reply drafts, calendar integration, Drive file search and integration, and assistance with creating or editing Docs, Sheets, and Slides).
2. The Company does not use Google user data for advertising and does not sell Google user data to third parties.
3. The Company does not allow humans to read Google user data, except: (a) with the user’s explicit consent; (b) for security purposes (such as investigating abuse); (c) to comply with applicable law; or (d) for internal operations where the data has been aggregated and anonymized so that it cannot identify any individual.
4. The Company processes Google user data only transiently and to the minimum extent necessary to provide the requested feature, and does not retain, or destroys without delay, data that is no longer needed to provide the feature.
5. The Company does not retain or transfer AI/ML models trained on Google user data, and does not use such data for general model training.
6. The Company sends user data received through Google APIs to the external AI providers in Article 11 only when needed to perform an AI Feature the user requested, and that data is not used to train the recipients’ AI models.

Article 11-3 (Marketing and Event Notifications)

1. The Company may obtain separate opt-in consent before sending promotional push notifications for events, promotions, discounts, or similar commercial communications.
2. Optional items: marketing/event notification consent status, consent/withdrawal timestamps, dates of consent reminders
3. Purpose: informing users about events, promotions, benefits, and related customer communications
4. How to consent: optional consent at sign-up, or by turning on "Event & promotion notifications" in Settings > Notification settings in the app or on the web
5. How to withdraw: users may withdraw consent anytime in Settings > Notification settings in the app or on the web without affecting access to the Service. When consent or withdrawal is processed, the Company notifies the user of the result and the date.
6. Promotional notifications start with "(광고)" (Korean for "advertisement"; "(광고) [Ad]" for users whose app or web language is English) and state how to unsubscribe.
7. Every 2 years from the date of consent, the Company notifies consenting users of their consent (including the consent date) and how to keep or withdraw it.
8. Informational notifications (maintenance, updates, required notices) may be sent separately from marketing consent and can be turned off by type in notification settings in the app or on the web.
9. The Company does not send promotional notifications between 9:00 p.m. and 8:00 a.m. Korea Standard Time (KST, UTC+9), and discards promotional notifications not delivered to a device before 9:00 p.m. KST.

Article 11-4 (Personal Information of Children Under 14)

1. The Company does not provide its services to children under the age of 14 and does not accept membership registration from children under 14.
2. Users must confirm that they are 14 years of age or older when registering, and the Company does not approve registrations that have not passed this confirmation step.
3. If the Company becomes aware that personal information of a child under 14 has been collected without the consent of a legal representative, it will destroy such information and delete the related account without delay.
4. If you believe personal information of a child under 14 has been collected, please notify us at help@comente.io.

Article 11-5 (Automatic Collection Devices and Right to Refuse)

1. The Company uses cookies on its website to keep users signed in, to protect against security threats (CSRF), to remember the display language, and to continue team invitations, and uses browser storage to keep user settings, saved cloud browser sign-ins and similar information.
2. The types and purposes of cookies used are as follows.
   • a. Sign-in cookie (__session): keeps the user signed in and confirms who they are. It is deleted when the user signs out and expires 14 days after it was last renewed.
   • b. Security cookie (csrftoken): prevents cross-site request forgery (CSRF) attacks.
   • c. Browser storage (local storage and IndexedDB): stores, in that browser, values chosen by the user such as privacy protection mode settings, information used to continue a team chat invite link after signing in (one hour), the entry pass of team chat guests who joined through an invite link, and site cookies saved with the cloud browser’s “Stay signed in” and the IDs and passwords the user chooses to save (encrypted).
   • d. Team invitation cookie (summet_team_invite): keeps a pending team invitation for one hour so it can continue after the user signs in or signs up.
   • e. Language cookie (django_language): remembers the display language the user chose. It expires when the browser is closed.
3. The Company does not itself place third-party advertising or analytics cookies for ad identification, behavioral data collection, or user tracking. However, when the YouTube video player or Google Maps is shown, Google may place or read its own cookies and similar technologies on the user’s browser or device, and the Google Privacy Policy (https://www.google.com/policies/privacy) applies to them.
4. You may refuse or delete cookies through your browser settings. However, if you refuse essential cookies required to maintain the sign-in state, some services such as logging in may be restricted.
5. How to manage cookies: (Chrome) Settings → Privacy and security → Third-party cookies / (Edge) Settings → Cookies and site permissions / (Safari) Preferences → Privacy.

Article 12 (Privacy Officer and Contact)

The Company may designate a privacy officer or responsible department as follows to oversee personal information processing and handle user complaints and remedies related to personal information processing.

Article 12-2 (Remedies for Infringement of Rights)

You may apply for dispute resolution or consultation with the organizations below to obtain relief from personal information infringement. These organizations are separate from the Company; please contact them if you are not satisfied with the Company’s own complaint handling and remedy results, or if you need more detailed assistance.

• Personal Information Dispute Mediation Committee: +82-1833-6972 / www.kopico.go.kr
• Korea Internet & Security Agency Privacy Infringement Report Center: 118 / privacy.kisa.or.kr
• Supreme Prosecutors’ Office Cyber Investigation Division: 1301 / www.spo.go.kr
• National Police Agency Cyber Bureau: 182 / ecrm.police.go.kr

In addition, a person whose rights or interests have been infringed by a disposition or omission by the head of a public institution regarding a request under Articles 35 (access), 36 (correction or deletion), or 37 (suspension of processing) of the Personal Information Protection Act may request an administrative appeal under the Administrative Appeals Act.

Article 13 (Changes to this Policy)

This Policy may be amended due to changes in laws, services, or internal policies. If there are material changes, the Company will notify users in advance or afterward through service screens, the website, or other appropriate methods.

This Policy takes effect on November 15, 2026.