# Privacy Policy

This is a translation of the Korean original. In case of any discrepancy, the Korean version prevails.

## Article 1 (General Provisions)

Tilldone (the "Company") complies with relevant laws, including the Personal Information Protection Act, and through this Privacy Policy informs members of the purposes for which and the ways in which the personal information they provide is used, and of the measures taken to protect personal information.

This Policy applies to the Sojan (소문난잔치) service provided by the Company (the "Service").

## Article 2 (Items of Personal Information Collected and Collection Methods)

(1) The items of personal information collected by the Company are as follows.

1. Items collected at sign-up

| Login method | Items collected |
|---|---|
| Kakao | Social account identifier, nickname, profile image (optional) |
| Naver | Social account identifier, nickname, profile image (optional) |
| Google | Social account identifier, nickname, profile image (optional) |
| Apple | Social account identifier, nickname (if provided) |

The Company receives the above items from the social login platform chosen by the user, based on the user's consent. This provision of information is not an entrustment of personal information processing; it is collection from a third party based on the user's consent.

The Company collects only the minimum information necessary to provide the Service. It does not collect or store real names, mobile phone numbers, dates of birth or connecting information (CI/DI). However, such information may be included in documents a user attaches to prove that they are the right holder in a rights infringement report under Item 7; it is used only to handle the report and is destroyed when handling is complete. Email addresses are not collected at sign-up either; only in the case of a rights infringement report under Item 7 does the Company process the email address entered by the user for the purpose of replying and notifying the result of handling.

2. Matters confirmed at sign-up

During the sign-up process, the Company obtains confirmation from users that they are 14 years of age or older. The Company does not collect dates of birth or ages themselves; it records only the fact of confirmation and its date and time.

3. Items collected when using Contact us

Contact us is available in the app.

| Channel | Items collected | Purpose of collection | How it is processed |
|---|---|---|---|
| App | Inquiry content, inquiry type, device information (model, operating system, app version) | Receiving inquiries and replying, identifying the cause of errors | Stored in the database and answered through in-app notifications |

Inquiries in the app are available only to members and are answered through the account, so email addresses are not received.

4. Preference survey information (optional)

This is information on fields of interest (experience themes such as food, activities, performances, lights and tradition) that members voluntarily enter for calculating personalized recommendations (personalization scores) of the Service and for displaying personalized advertising. Entry is optional; if it is not entered, personalization scores are calculated with default weights.

5. Information automatically collected while using the Service

(a) Festival viewing history
(b) Access logs, access IP information, cookies
(c) Device information (OS, device identifier, app version)
(d) Location information (with separate consent)
(e) App performance records (such as the time it takes for a screen to load)

6. Content registered by members

(a) Review text, ratings and satisfaction ratings
(b) Booth, menu and price information
(c) Photos registered

If a photo contains shooting location information (EXIF), the Company uses it only to determine whether the member visited the site. The coordinates needed for this determination are sent to the Company's servers, compared with the festival venue and immediately discarded; only the result of the determination is stored. Photos themselves are uploaded with the shooting information removed. Matters concerning this are set out in Article 12 and Article 12-2.

7. Items collected for rights infringement reports

When a user files a rights infringement report about a review in the app, the following information is collected with the user's consent. This is available regardless of whether the user is a member.

| Items collected | Purpose of collection | How it is processed |
|---|---|---|
| Email address, explanation of the infringement | Handling the report and notifying the result | Stored in the database; the operator replies with the result by email |
| Up to two copies of documents that can verify the right holder (business registration certificate, contract, ID, etc.) | Verifying that the reporter is the party whose rights were infringed | Stored in the database and not disclosed externally |

If a document copy contains a resident registration number, the Company receives a copy with the last digits masked.

If the report is filed while logged in, the report is stored linked to the member account.

(2) The Company collects personal information by the following methods.

1. Provision of information through the social login platform at sign-up
2. Direct entry by members while using the Service
3. Collection through automated collection tools while using the Service
4. Direct entry by users through the rights infringement report form in the app

## Article 3 (Purposes of Collecting and Using Personal Information)

(1) Member management

1. Identifying the person for the use of member services
2. Preventing fraudulent use by abusive members and unauthorized use
3. Confirming the intention to sign up and keeping records for dispute mediation

(2) Providing the Service

1. Providing festival information and interest-based recommendations
2. Calculating personalization scores and providing personalized recommendations using preference survey information
3. Posting and sharing content registered by members (reviews, booth and menu information)
4. Sending push notifications

(3) Improving the Service

1. Statistical analysis of Service use
2. Developing new services and improving features
3. Improving service quality and training artificial intelligence models using content registered by members

(4) Advertising

The Company may use personal information for the following purposes to secure funding for operating the Service.

1. Displaying advertisements on Service screens
2. Publicizing and marketing the Service and the Company using content registered by members
3. Displaying personalized advertising using preference survey information and Service use records (festivals viewed and saved, etc.)
4. Introducing products and services of partner businesses and providing partner links
5. Measuring advertising performance and statistical analysis

The Company provides partner links under item 4. Which partner links are shown is decided by festival information (dates, weather and host area), and members' personal information and Service use records are not used. Partner links do not carry information that can identify users, and once a user moves through a partner link, that partner business's privacy policy applies.

As of the effective date of this Policy, personalized advertising and the transmission of advertising information are not in operation. If either of them is introduced, the Company will announce it through notices before it starts, together with a way to opt out for members who do not want personalized advertising.

When sending advertising information for profit, such as event and benefit information, through electronic transmission media such as push notifications, the Company obtains separate prior consent to receive it in accordance with Article 50 of the Act on Promotion of Information and Communications Network Utilization and Information Protection. There is no restriction on using the Service even without consenting to receive it, and consent may be withdrawn at any time after it is given.

The Company does not provide information used for personalized advertising to advertisers in a form that can identify members, and provides advertisers only with performance information in statistical form.

(5) Responding to inquiries

Checking and replying to inquiries received through Contact us in the app, and identifying the causes of reported errors

(6) Fulfilling legal obligations

1. Keeping records in accordance with relevant laws
2. Handling disputes and responding to complaints

(7) Handling rights infringement reports

Verifying reports that rights have been infringed by a review, taking measures such as temporary measures and deletion, and notifying the result of handling (Article 44-2 of the Act on Promotion of Information and Communications Network Utilization and Information Protection)

## Article 4 (Retention and Use Period of Personal Information)

In principle, the Company destroys personal information without delay once the purpose of collection and use has been achieved.

(1) Member information

When a member withdraws, the Company processes the information it holds in the following three stages.

**Stage 1 — Destroyed immediately upon withdrawal**

| Item |
|---|
| Profile image (file deleted from storage) |
| Push notification tokens |
| Authentication tokens (logged out on all devices) |

**Stage 2 — Kept for 3 months after withdrawal and then destroyed**

| Item |
|---|
| Nickname |
| Preference survey information (fields of interest) |
| Records of consent to the use of location information |
| List of saved festivals of interest (saves) |
| List of blocked members |
| Records of notifications sent and read |
| Inquiry history |

The purpose of retention is account recovery. If a member signs up again with the same social account within 3 months after withdrawal, the member can recover the previous account with the above information carried over. After 3 months, the information is destroyed automatically, and a member who signs up again after that starts with a new account.

**Stage 3 — Kept without a set period**

| Item | Purpose of retention |
|---|---|
| Cryptographically transformed value of the social account identifier | Checking improper re-registration |
| Sign-up method (Kakao, Naver, Google, Apple) | Checking improper re-registration |
| Type and date and time of use restriction measures | Deciding whether to accept a sign-up under Article 4(4) of the Terms of Service |

This information does not include items that can identify a member, such as nicknames or profile images, and is used only for comparison with a value transformed in the same way when an application to sign up again is made.

No retention period is set because, if a member signs up again after such a period has passed, the previous use restriction history cannot be checked and Article 4(4) of the Terms of Service cannot operate.

(2) Content registered by members

Reviews, booth and menu information and satisfaction ratings are preserved after a member withdraws, with author information anonymized, for the convenience of other members, and the author is displayed as "Former member" for 3 months after withdrawal and as "Anonymous" thereafter. If a member requests deletion of content, it is deleted immediately, and after withdrawal the request can be made within 3 months through the contact details in Article 13. Once 3 months have passed, the information linking content to its author is destroyed and the content to be deleted can no longer be identified.

Secondary outputs created by reprocessing content or using it for artificial intelligence training are kept even after the original content is deleted or the member withdraws. These outputs do not contain information that can identify individual members.

(3) Records of post reports

Records of a member reporting another member's post are preserved after withdrawal for continuity of report handling and checking repeated reports, but information that can identify the reporter is anonymized.

(4) Inquiry information

| Channel | Retention |
|---|---|
| App | Kept regardless of whether it has been answered; if the member withdraws, destroyed 3 months after withdrawal in accordance with Stage 2 of Paragraph (1) |

App inquiries are kept even after they are answered because members need to be able to read past answers again on the inquiry history screen.

(5) Automatically collected information

Festival viewing history is kept for 90 days for usage statistics and improving recommendation quality and is then deleted automatically. If a member withdraws, it is also destroyed when the same period expires.

(6) Retention under relevant laws

| Item | Retention period | Legal basis |
|---|---|---|
| Access log records | 3 months | Protection of Communications Secrets Act |
| Records confirming the use and provision of personal location information | 1 year | Act on the Protection and Use of Location Information |

(7) Rights infringement report information

| Item | Retention |
|---|---|
| Email address | Destroyed without delay once the result of handling is notified |
| Explanation of the infringement, copies of attached documents, copy of the reported review at the time of the report | Destroyed without delay once handling of the report is complete |
| Emails replying with the result of handling | Kept only in the operator's email inbox for 3 months after the reply and then destroyed |

To verify that measures were taken, the reported review, the details of the measure and the dates and times of receipt and measure are preserved. These records do not contain information that can identify the user who filed the report.

## Article 5 (Provision of Personal Information to Third Parties)

(1) The Company processes members' personal information only within the scope specified in this Policy and does not process it beyond its original scope or provide it to third parties without the member's prior consent.

(2) Notwithstanding Paragraph (1), the following cases are exceptions.

1. When the member has given prior consent
2. When required by law, or when an investigative agency requests it for investigative purposes in accordance with the procedures and methods prescribed by law

## Article 6 (Entrustment of Personal Information Processing)

(1) To provide the Service, the Company entrusts personal information processing to external parties as follows.

| Trustee | Entrusted work | Retention and use period |
|---|---|---|
| Google Cloud Platform (Google LLC) | Cloud infrastructure and data storage | Until the retention period set out in Article 4 ends or the entrustment contract ends |
| MongoDB Atlas (MongoDB, Inc.) | Database hosting | Until the retention period set out in Article 4 ends or the entrustment contract ends |
| Firebase (Google LLC) | Push notifications, app distribution, app performance measurement | Until the retention period set out in Article 4 ends or the entrustment contract ends |
| Google Analytics for Firebase (Google LLC) | Statistical analysis of Service use | 26 months |

(2) When concluding an entrustment contract, the Company specifies in a contract or other document, in accordance with Article 26 of the Personal Information Protection Act, matters concerning the prohibition of processing personal information for purposes other than performing the entrusted work, technical and administrative protection measures, restrictions on re-entrustment, management and supervision of the trustee, and responsibilities such as compensation for damages.

## Article 6-2 (Overseas Transfer of Personal Information)

(1) To provide the Service, the Company transfers personal information overseas (including storage) as follows.

| Recipient | Contact | Country | Items transferred | Time and method of transfer | Purpose of use | Retention and use period |
|---|---|---|---|---|---|---|
| Google Cloud Platform (Google LLC) | googlekrsupport@google.com | United States | Member information, content, usage records, etc. | Transmitted over the network when the Service is used | Cloud infrastructure and data storage | Until the entrustment contract ends |
| Firebase · Google Analytics for Firebase (Google LLC) | googlekrsupport@google.com | United States | Device identifiers, push tokens, usage records, app performance records | Transmitted over the network when the Service is used | Push notifications, app distribution, statistical analysis, app performance measurement | Until the entrustment contract ends (26 months for statistical analysis) |
| MongoDB Atlas (MongoDB, Inc.) | privacy@mongodb.com | United States | Member information, content, etc. | Transmitted over the network when the Service is used | Database hosting | Until the entrustment contract ends |

(2) Members may refuse the overseas transfer of personal information and may request this through the contact details in Article 13. If a member refuses the overseas transfer, use of all or part of the services provided on a cloud basis may be restricted.

(3) When transferring personal information overseas, the Company implements the protection measures required by the Personal Information Protection Act.

## Article 7 (Rights and Obligations of Data Subjects and How to Exercise Them)

(1) Members may exercise the following rights against the Company at any time.

1. Request to access personal information
2. Request for correction if there are errors
3. Request for deletion
4. Request to suspend processing
5. Withdrawal of membership

(2) The rights in Paragraph (1) can be exercised in the following ways.

| Right | How to exercise |
|---|---|
| Withdrawal of membership | In the app: Profile tab > Delete account |
| Correction of nickname, profile image and preference survey information | Edit directly in the Profile tab of the app |
| Withdrawal of consent to the use of location information | In the app: Profile tab > Terms & policies > Location consent |
| Requests for access, deletion or suspension of processing, and exercise of other rights | Request by the email or contact details in Article 13 |

(3) The Company acts on members' exercise of rights without delay and handles requests within 10 days of receiving them.

## Article 8 (Destruction of Personal Information)

(1) In principle, the Company destroys personal information without delay once the purpose of collection and use has been achieved.

(2) The methods of destruction are as follows.

1. Personal information stored in electronic files: permanently deleted by a technical method that makes the records impossible to restore
2. Personal information printed on paper: shredded or incinerated

## Article 9 (Measures to Ensure the Security of Personal Information)

(1) Technical measures

1. SSL/TLS encryption of communication channels
2. Encryption at rest of cloud databases
3. Storing authentication tokens with one-way encryption (hashing)
4. Separation of access rights and application of the principle of least privilege
5. Installation of security programs and periodic checks
6. On-device masking of personal information in photos registered by members
7. Keeping access records of personal information processing systems and preventing their forgery or alteration

(2) Administrative measures

1. Minimizing and training employees who handle personal information
2. Managing access rights to personal information processing systems
3. Regular checks of the status of personal information processing

(3) Physical measures

Controlling physical access to personal information storage systems

## Article 10 (Installation, Operation and Refusal of Automated Collection Devices)

(1) The Company may use cookies to provide personalized services to members.

(2) The purposes of using cookies are as follows.

1. Keeping members logged in
2. Analyzing the frequency of Service use and visit records

(3) Members can refuse the storage of cookies through web browser settings, and when using the mobile app they can reset the advertising identifier or limit personalized advertising in device settings. In this case, use of some services may be restricted.

## Article 11 (Protection of Personal Information of Children under 14)

(1) The Company does not provide the Service to children under 14 years of age and does not collect personal information of children under 14.

(2) During the sign-up process, the Company obtains confirmation from users that they are 14 years of age or older.

(3) If the Company receives a report or becomes aware that a user is a child under 14, it immediately suspends the membership and destroys the related personal information.

## Article 12 (Automated Processing of Photos)

(1) When a member registers a photo with a review, the following processing takes place on the member's device before the photo is sent to the Company's servers.

1. Blocking the registration of inappropriate photos
2. Removing the photo's shooting information (EXIF)

(2) All processing in Paragraph (1) is performed on the member's device, and photos are not sent to the Company or third parties for this purpose.

(3) If a photo contains shooting location information, the Company receives the coordinates and compares them with the festival venue to determine whether the member visited the site. The coordinates are immediately discarded after the comparison and are not stored, and only the result of the determination is shown on the review.

(4) Members may object to blocking under Paragraph (1)1 and to the result of the determination under Paragraph (3), and the Company has an operator review the matter directly within a reasonable period and notifies the member of the result.

## Article 12-2 (Processing of Personal Location Information)

In accordance with Article 21 of the Act on the Protection and Use of Location Information, the Company discloses the following matters concerning the processing of personal location information. As a location-based service provider, the Company provides the Service using the location information of users' devices and does not receive personal location information from location information providers. Details on the use of location-based services are set out in the Location-Based Services Terms.

(1) The purposes of processing personal location information and the retention periods are as follows.

| Feature | Purpose of processing | Retention period |
|---|---|---|
| Viewing nearby festivals on the map | Searching for and providing nearby festivals based on the area the user views or the user's current location | Not retained (discarded immediately after temporary processing) |
| Writing and editing reviews | Determining whether the user visited the site and giving a reliability mark | Not retained (discarded immediately after the determination) |

The Company does not store users' location coordinates (latitude and longitude). Even if a photo attached to a review contains location information, it is used only to determine the site visit and is discarded after the determination, and the photo is stored after that information is removed.

(2) The legal basis and retention period for records confirming the use and provision of personal location information are as follows.

1. Based on Article 16(2) of the Act on the Protection and Use of Location Information, the Company automatically records and preserves the fact that personal location information was used in its location information system.
2. The items recorded are the user identifier, the date and time of use and the feature used; location coordinates are not recorded.
3. The retention period is 1 year; records are made in a way that cannot be added to or modified, and are automatically destroyed when the retention period expires.

(3) The procedures and methods for destroying personal location information are as follows.

1. Location coordinates processed to provide the Service are deleted from memory as soon as the purpose is achieved and are not stored separately.
2. Records confirming use and provision are deleted automatically when the retention period expires.
3. If a user withdraws consent to the use of personal location information, the Company handles it without delay in accordance with relevant laws.

(4) The Company does not provide users' personal location information to third parties.

(5) If in the future the Company provides personal location information to a third party designated by the user, it will obtain separate consent from the user before providing it and will immediately notify the user each time of the recipient, the date and time of provision and the purpose of provision. No such service is currently provided.

(6) The rights and obligations of guardians of children aged 8 or under and others, and how to exercise them, are as follows.

1. In accordance with Article 26 of the Act on the Protection and Use of Location Information, when a guardian consents to the use of personal location information to protect the life or body of a child aged 8 or under, a person under adult guardianship, or a person with a severe mental disability under the Act on Welfare of Persons with Disabilities ("children aged 8 or under and others"), the person concerned is deemed to have consented.
2. A guardian may exercise the following rights on behalf of children aged 8 or under and others.

(a) The right to withdraw all or part of the consent to the use of personal location information
(b) The right to request a temporary suspension of the use of personal location information
(c) The right to request access to, or notification of, records confirming the use and provision of personal location information
(d) The right to request correction if those records contain errors

3. Rights can be exercised by contacting the person in charge of location information management in Paragraph (7), and the Company does not refuse without a justifiable reason.
4. The Company does not provide location information services intended to protect the life or body of children aged 8 or under and others.

(7) The person in charge of location information management is as follows.

| Item | Details |
|---|---|
| Company name | Tilldone (틸던) |
| Name | Junghyun Oh (오정현) |
| Position | Representative |
| Email | tilldone.2026@gmail.com |
| Phone | +82-10-6512-3066 |

Inquiries related to location information, such as consent to or withdrawal of the use of personal location information and requests for access to or notification of records confirming use and provision, can be made through the contact details above.

## Article 13 (Chief Privacy Officer)

(1) To protect members' personal information and handle complaints related to personal information, the Company designates a Chief Privacy Officer as follows.

| Item | Details |
|---|---|
| Company name | Tilldone (틸던) |
| Name | Junghyun Oh (오정현) |
| Position | Representative |
| Email | tilldone.2026@gmail.com |
| Phone | +82-10-6512-3066 |

(2) Members may contact the Chief Privacy Officer about inquiries, complaint handling, remedies for damage and other matters related to personal information protection that arise while using the Service. Requests to access personal information are also received and handled through the contact details above.

## Article 14 (Remedies for Infringement of Rights)

Members may apply to the following organizations for dispute resolution or counseling to obtain remedies for infringement of personal information.

1. Personal Information Dispute Mediation Committee: 1833-6972 (kopico.go.kr)
2. Personal Information Infringement Report Center: 118 (privacy.kisa.or.kr)
3. Cyber Investigation Bureau, Korean National Police Agency: 182 (ecrm.cyber.go.kr)

## Article 15 (Changes to the Privacy Policy)

This Policy applies from its effective date, and any additions, deletions or corrections due to laws or this Policy will be announced through notices.

## Addendum

This Policy was announced on November 13, 2026 and takes effect on November 13, 2026.