개인정보 처리 방침

Article 1 (General Provisions)
GNISoft Co., Ltd. (hereinafter referred to as 'the Company') values users' personal information and complies with relevant laws such as the 「Personal Information Protection Act」, 「Act on Promotion of Information and Communications Network Utilization and Information Protection, etc.」, and 「Communication Secret Protection Act」. Through this Privacy Policy, the Company informs users about how their personal information is processed, for what purposes, and what measures are taken to protect it.

Article 2 (Collected Personal Information Items and Collection Methods)
The Company collects the following personal information for service provision.

Information Collected upon Account Creation and Linking

• Guest Login: Unique Device ID, game play records, access logs, service usage records.
• Google Login: Unique Identifier (UID) provided by Google account, game play records (Note: User's email address may be used for authentication purposes during Google login, but the Company does not directly store or utilize the email address without the user's separate consent.)
• Apple Login: Unique Identifier (UID) provided by Apple account, game play records (Note: User's email address may receive some information according to Apple's policy during Apple login, but the Company does not directly store or utilize the email address without the user's separate consent.)

Information Collected during Service Use

• Nickname Setting: Nickname directly set by the user.
• Age Verification: Whether the user is under/over 20 years old (direct collection of date of birth or age is not performed).
• Game Play Data: Game scores, progress, item usage records, etc.
• Customer Support Inquiries (external web page): Mobile phone number (for identity verification and inquiry response notifications).
• Automatically Generated/Collected Information: IP address, visit date and time, service usage records, fraudulent usage records, mobile device information (OS version, model name, unique device number, etc.), telecommunication carrier information, payment records (for in-app purchases).

Information Automatically Collected for Advertising and Marketing Analysis (only for games using advertising measurement tools)

• Advertising identifiers (Android ADID, iOS IDFA — on iOS only if the user has allowed app tracking), IDFV
• Device information (model name, OS version, language and country settings), IP address
• In-app event information such as app installation, launch, sign-up, tutorial completion, and purchases
• Advertising source information (ad impression and click media, campaign information)

Personal Information Collection Methods:

• Direct input by the user during membership registration and service use (e.g., nickname).
• Login through affiliated services (e.g., Google/Apple login).
• Direct input by the user on the customer support web page (SMS verification).
• Automatic collection through advertising measurement tools (SDKs) installed in the app.
• Automatically generated and collected during service use.

Article 3 (Purpose of Collecting and Using Personal Information)
The Company utilizes the collected personal information for the following purposes.

Service Provision and Management

• User identification and authentication, guest account management, service usage record management, age verification.
• Content provision, payment settlement, user authentication, payment service provision.
• Providing optimized services and customized features to users.

Service Improvement and Development

• Development and specialization of new services (products), service improvement and quality enhancement based on statistical data.
• Providing ranking competition and social features among users (ranking system, friend features, etc.).
• Bug fixes, error checking and correction, service environment optimization.

Marketing and Advertising Utilization:

• Delivery of new service and event information, targeted advertising (based on user characteristics and interests).
• Understanding access frequency or statistical analysis of user's service usage.
• Analysis of advertising acquisition channels and measurement of advertising effectiveness (attribution).
• Performance analysis by advertising media and optimization of advertising campaigns.
• Providing personalized and retargeting advertisements based on users' interests.
• Verification of participation in rewarded advertisements and provision of rewards.

Security and Dispute Resolution:

• Prevention of fraudulent use and unauthorized access, prevention of account theft and illegal use.
• Handling user complaints and grievances, preservation of records for dispute resolution.

Article 4 (Overseas Transfer of Personal Information)
The Company utilizes global infrastructure such as Google Firebase for stable service provision and efficient operation. In this process, users' personal information may be transferred, stored, and processed in countries outside South Korea (primarily the United States, Europe, etc.).
The transferred personal information is securely managed in accordance with the personal information protection laws of the respective country and this Privacy Policy. The Company takes necessary protective measures, such as entering into Standard Contractual Clauses, in accordance with relevant laws to ensure that personal information is securely protected.

The Company transfers personal information overseas as follows for user authentication and account management, advertising performance measurement, and personalized advertising.

Users may refuse the overseas transfer. Overseas transfers for advertising purposes can be refused by following the methods described in Article 8 (Collection, Use, Provision, and Refusal of Behavioral Information); users can continue to use the game service even if they refuse, but personalized advertisements may not be provided. The overseas transfer to Google Firebase is essential for user authentication and account management; users who wish to refuse it may do so by withdrawing their membership, in which case use of the service will be restricted.

Article 5 (Retention and Use Period of Personal Information)
Users' personal information is retained and used from the conclusion of the service contract until the termination of the service. In principle, after the purpose of personal information collection and use has been achieved, the information is promptly destroyed. However, if there is a need for retention according to relevant laws, the Company retains user information for a certain period specified by law, as follows:

Upon Membership Withdrawal:

Upon request for membership withdrawal and personal information destruction, the information is promptly destroyed.
However, information that needs to be retained according to relevant laws (e.g., Act on the Consumer Protection in Electronic Commerce, etc., Communication Secret Protection Act) will be retained for the period specified by those laws.

Retention Period according to Relevant Laws:

• Records regarding contracts or subscription withdrawals: 5 years (Act on the Consumer Protection in Electronic Commerce, etc.)
• Records regarding payment and supply of goods: 5 years (Act on the Consumer Protection in Electronic Commerce, etc.)
• Records regarding consumer complaints or dispute resolution: 3 years (Act on the Consumer Protection in Electronic Commerce, etc.), including mobile phone numbers collected for customer support inquiries.
• Website visit records: 3 months (Communication Secret Protection Act)

Retention Period according to Internal Company Policy:

• Service usage records for preventing fraudulent use (e.g., records of abusive use): 1 year

Article 6 (Provision of Personal Information to Third Parties)
In principle, the Company does not provide users' personal information to external parties. However, exceptions are made in the following cases:

• When users have given prior consent.
• When required by law, or when investigative agencies request it for investigative purposes according to procedures and methods defined by law.

Article 7 (Outsourcing Personal Information Processing)
The Company outsources personal information processing tasks as follows to improve service. When entering into outsourcing contracts, the Company clearly stipulates compliance with personal information protection laws, confidentiality of personal information, prohibition of provision to third parties, and liability in case of incidents.

Article 8 (Collection, Use, Provision, and Refusal of Behavioral Information)
① The Company collects and uses behavioral information to provide users with optimized personalized advertisements and to measure advertising effectiveness during service use.
② The Company collects behavioral information as follows.

③ The Company allows the following advertising companies to collect and process behavioral information through the Company's apps.

• Companies collecting and processing behavioral information: AB180 Inc., Google LLC, Meta Platforms, Inc., NAVER Corp., Kakao Corp., TNK Factory Co., Ltd.
• Collection method: Automatically collected and transmitted through SDKs when the app is launched

④ The Company does not collect sensitive behavioral information (such as ideology, beliefs, or health). In addition, the Company does not provide personalized advertisements targeting children under 14 years old.

⑤ Users can refuse personalized advertisements or reset/delete their advertising identifier as follows.

• Android: [Settings] → [Google] → [Ads] → [Delete advertising ID] or [Reset advertising ID]
• iOS: [Settings] → [Privacy & Security] → [Tracking] → Turn off "Allow Apps to Request to Track"

※ Menu names may differ depending on the device OS version.

Advertising identifier settings limit personalized advertising and ad tracking, but may not stop the processing of other information such as IP addresses and in-app event information. To request that the Company stop processing behavioral information for advertising purposes and the overseas transfer for advertising purposes under Article 4, users may contact the Personal Information Protection Officer (Article 12, nyx@gnisoft.co.kr), and the Company will take action without delay.

⑥ Inquiries or damage reports related to behavioral information may be directed to the Personal Information Protection Officer (Article 12).

Article 9 (Rights of Users and Legal Representatives and Methods of Exercise)
As a personal information subject, users can exercise the following rights.

User's Rights:

• Right to Request Access to Personal Information: The right to request information on whether their personal information is being processed and details of its processing.
• Right to Request Correction/Deletion: The right to request correction or deletion of personal information if there are errors or if the purpose of personal information processing has been achieved (except for information required to be retained by law).
• Right to Request Suspension of Processing: The right to request temporary suspension of personal information processing.
• Right to Withdraw Consent (Membership Withdrawal): The right to withdraw consent for personal information collection and use at any time.

These rights can be exercised through the in-game account deletion function, written requests, email, etc., to GNISoft Co., Ltd., and the Company will take action without delay.

Personal Information of Children Under 14 Years Old:

The Company does not collect personal information of children under 14 years old. If collection of personal information of children under 14 years old is necessary due to service characteristics, the Company obtains consent from their legal representative in accordance with the 「Act on Promotion of Information and Communications Network Utilization and Information Protection, etc.」 and the 「Personal Information Protection Act」. Legal representatives can request access, correction, deletion, or suspension of processing of the child's personal information.

Users Residing in the European Economic Area (EEA) (GDPR-related Rights):

• Right to Data Portability: The right to transfer personal information to another service provider under certain conditions.
• Right to Object: The right to object to specific processing methods (e.g., for direct marketing purposes).
• Right regarding Automated Decision-Making and Profiling: The right to object to decisions based solely on automated processing.

Article 10 (Destruction of Personal Information)
In principle, the Company promptly destroys personal information after the purpose of personal information collection and use has been achieved.

Destruction Procedure:

The Company destroys personal information without delay when the retention period has expired or the purpose of processing has been achieved. However, information that must be retained under relevant laws or internal company policy (Article 5) is stored separately from other personal information and is not used for any purpose other than retention unless required by law.

Destruction Methods:

• Electronic file format: Deleted using technical methods that prevent reproduction of records.
• Personal information printed on paper: Destroyed by shredding or incineration.

Article 11 (Measures to Secure the Safety of Personal Information)
The Company takes the following measures to securely process users' personal information.

Administrative Measures:

• Establishment and implementation of internal personal information protection management plans, regular employee training.

Technical Measures:

• Access control for personal information processing systems, encryption of unique identification information, installation and periodic updates/checks of security programs.

Physical Measures:

• Storage of documents containing personal information, auxiliary storage media, etc., in secure locations with locking devices.

Article 12 (Contact Information of Personal Information Protection Officer and Department)
The Company designates the following Personal Information Protection Officer and department to protect users' personal information and handle personal information-related complaints.

Personal Information Protection Officer:

• Name: Ryan Park (박범석)
• Position: Head of Development
• Contact: nyx@gnisoft.co.kr

Personal Information Protection Department:

• Department Name: Development Department
• Contact: nyx@gnisoft.co.kr

Article 13 (Remedies for Infringement of User Rights)
If a user needs to report personal information infringement or consult, they can contact the following organizations for assistance.

• Personal Information Infringement Report Center (operated by Korea Internet & Security Agency): 118 (without area code) (privacy.kisa.or.kr)
• Personal Information Dispute Mediation Committee: 1833-6972 (www.kopico.go.kr)
• Supreme Prosecutors' Office Cyber Investigation Division: 1301 (without area code), cid@spo.go.kr
• National Police Agency Cyber Bureau: 182 (without area code) (cyberbureau.police.go.kr)
• Users residing in the EU/EEA: The data protection supervisory authority of your country of residence (list of authorities: edpb.europa.eu) (related to GDPR)
• California Privacy Protection Agency: cppa.ca.gov (related to CCPA)

Article 14 (Duty of Notification)
This Privacy Policy shall be effective from its enforcement date. In case of additions, deletions, or corrections to the content due to changes in laws or policies, the Company will notify users through announcements 7 days prior to the effective date of the changes.

Addendum
Date of Announcement: October 23, 2026
Effective Date: October 30, 2026
Key Changes:

• Added mobile phone number as a collected item for identity verification and inquiry response on customer support inquiries
• Added collected items (such as advertising identifiers) for advertising performance measurement and personalized advertising
• Added a new article on the collection, use, provision, and refusal of behavioral information (Article 8)
• Added outsourcing contractors, companies collecting behavioral information, and overseas transfer recipients