Preamble

We (the “Company”) establish this Privacy Policy (this “Policy”) regarding the handling of personal information of customers (“Users”) who use the application “NaviU” provided by the Company (the “App”). The Company will handle personal information appropriately in accordance with this Policy and in compliance with the Act on the Protection of Personal Information (the “APPI”) and other applicable laws and regulations. Terms used in this Policy have the meanings given to them under the APPI.

Article 1 (Information We Collect)

The Company may collect the following User information through the App: (1) Identity information

• Name, username, gender, date of birth, profile photo, language, and other profile information
• Address, postal code, phone number, email address, and other contact information
• Information from social media accounts linked by the User

(2) Payment information

• Payment amount, date and time, order number/transaction ID, payment result, and other transaction information

When Apple Pay or other external payment services are used, the Company does not collect or store the User’s credit card number, security code, or other card information that the Company does not need to obtain directly. (3) Information collected when using the Service

• Current location information obtained via GPS or other means
• Device information, device identifiers such as cookie IDs, browsing history, and other Service usage information (including IP address and access logs)
• Preferences, travel requirements, and other preference information entered by the User; saved travel plans; visit, movement, and other travel/activity history
• Information about friends and travel companions entered by the User (only where the consent of such friends or travel companions has been obtained)
• Health and fitness information obtained from linked services with the User’s permission
• Images and video captured by the User’s device camera when using AR navigation or the AI assistant, conversations with the AI, and related analysis results

The information in this Item is collected to the extent necessary to provide each feature; however, because it is transmitted to and processed by External Service providers under Article 4, it is not stored by the Company. (4) Inquiry information

• Information relating to inquiries and communications from the User to the Company

(5) Other information provided by the User to the Company in connection with use of the Service

Article 2 (Method of Collection)

The Company collects the information described in the preceding Article through User input and posts; through device functions or permissions; through integration with health/fitness services, social media, or similar services authorized by the User; and automatically through use of the Service. For location, camera, microphone, and other information requiring device permissions, the Company will request permission on the device to the extent necessary to use each feature.

Article 3 (Purposes of Use)

The Company collects and uses Users’ personal information within the scope of the following purposes, and will not use it for any other purpose except with the User’s consent or as permitted by law: (1) To register Users for the Service, verify identity when using the Service, and manage User accounts (2) To provide navigation features based on the User’s current location and other location information, including displaying the current location, route guidance to destinations, and information on nearby tourist facilities, shops, etc. (3) To analyze the User’s location information, travel wishes and preferences, settings, saved travel plans, travel history, and other information, and to create, suggest, or optimize travel plans, tourist destinations, routes, experiences, and other information using AI and other technologies (4) When the User uses AR navigation, to analyze camera images, etc., recognize objects, scenery, etc. in the real world, and display guidance information (5) When the User uses the AI assistant, to analyze text, images, video, audio, and other information entered or sent by the User, and to provide AI features such as recognition of objects and scenery, answering questions, translation, and guidance (6) To obtain and display health and fitness information and show Users their activity status (7) To provide paid services and manage subscription status (8) For interaction between Users, sharing of travel plans, and other social features, to provide profile information, travel plans, location information, and other information that the User has chosen to make public or share, to other Users designated by the User or others within the configured visibility scope (9) To deliver advertising and other information about third-party products, services, campaigns, etc. tailored to the User’s location information, travel history, preferences, etc. (10) To provide anonymously processed information, etc. under Article 12 to third parties (11) For maintenance of the Service, troubleshooting, security, fraud prevention, and quality improvement (12) For analysis of usage, compiling statistics, improving features, and planning and developing new features (13) To respond to inquiries and contact Users (14) To conduct campaigns and surveys (15) To take actions required by law

Article 4 (External Services, etc.)

1. The Company may use APIs and other external services provided by third parties (“External Services”) to provide functions necessary to operate the Service, including provision of the Service, map and navigation features, AR features, AI-based creation and suggestion of travel plans, the AI assistant and other AI-powered features, user authentication, push notifications, ad delivery, usage analysis, and crash analysis.
2. In connection with the use of External Services, the User’s location information, device information, IP address, device identifiers, text entered by the User, travel wishes and preferences, travel plans and travel history, images and video captured by the camera, conversations with the AI, app usage information, crash and diagnostic information, and other information necessary to provide each External Service may be transmitted to, or processed by, the provider of that External Service.
3. The privacy policies and other terms established by each External Service provider may apply to that provider’s handling of transmitted information. The Company will take necessary and appropriate measures regarding the handling of information in connection with the use of External Services in accordance with the APPI and other applicable laws. Information necessary for AI features will be provided to AI providers only to the extent necessary to use those features and will not be used for learning, training, or improving AI models.
4. To the extent necessary to provide the functions described in Paragraph 1, the Company may entrust the handling of Users’ personal data to, or provide personal data to, External Service providers located in foreign countries. The main External Services used by the Company, their providers, the information transmitted, and the purposes of use are set out in the Appendix “List of External Recipients.” Users consent to the Company providing personal data to such foreign providers to the extent necessary to achieve the above purposes.
5. If an AI provider uses AI usage information for learning, training, or improving AI models, the Company will clearly inform Users of this, the information concerned, and other necessary matters, and will obtain the User’s prior consent where required by law. The Company will also review the terms under which AI providers use AI usage information for learning, training, or improving AI models, and will take necessary measures in accordance with the APPI and other applicable laws.

Article 5 (Information Sharing Between Users)

1. The Service may provide features that allow Users to connect with other Users and mutually view or share profiles, travel plans, and other information designated by the Company.
2. When a User uses such features, the Company will, based on the User’s consent, provide the information that the User has chosen to make public or share to other Users designated by that User or others within the visibility scope of that information, to the extent necessary to provide the feature.
3. Users may set or change the scope of public visibility or sharing of information through settings in the Service or other methods designated by the Company. However, information that a User has already shared with other Users may remain even after sharing is stopped, due to it being saved by the recipient User or other circumstances.

Article 6 (Incidental Capture of Third Parties)

When the Service performs navigation by analyzing camera images, etc. and recognizing objects, scenery, etc. in the real world, the Company may analyze photos and other images that the User has provided to the Service or allowed the Service to access, using AI or other image analysis technologies. In such cases, if a third party other than the User appears in the images being analyzed, personal information relating to that third party’s face or other physical characteristics may be incidentally or accidentally obtained and provided to AI providers.

Article 7 (Retention of Personal Information)

1. The Company retains personal information collected under Article 1 only to the extent necessary to achieve the purposes of use set out in Article 3 and only for the periods set out in Paragraph 2 of this Article. However, where retention is required by law, or where it is reasonably necessary to retain the information to perform contractual rights and obligations or to respond to disputes, incidents, fraudulent use, or other matters, the Company may retain it for the necessary period. 2. The Company determines retention periods according to the type of personal information retained and its purposes of use, based on the following criteria: (1) Identity information under Article 1, Item (1) is, in principle, retained while the account exists, and will be deleted 30 days after the date on which the User deletes their account, except for information that must be retained for legal or business reasons. (2) Of the payment information under Article 1, Item (2), transaction records obtained by the Company, such as payment amount, payment date and time, order number/transaction ID, and payment result, are retained for the period required by law or for business purposes, for the performance of contracts, handling of refunds and inquiries, accounting and tax processing, dispute resolution, and other necessary purposes. The Company does not store credit card numbers, security codes, or other card information that the Company does not need to obtain directly. (3) Information under Article 1, Item (3) is transmitted to and processed by External Service providers to the extent necessary to provide each feature of the App, and is not stored by the Company. For whether such information is stored by External Service providers, and for their retention periods, deletion, and other handling of it, please refer to Article 4 and the privacy policies of each provider listed in the Appendix “List of External Recipients.” (4) Inquiry information under Article 1, Item (4) is handled in accordance with the Company’s separate complaint handling rules. (5) Information under Article 1, Item (5) is retained for the period prescribed by law or reasonably determined by the Company, for compliance with legal retention obligations, performance of contracts, billing and refunds, accounting and tax processing, dispute resolution, and other necessary purposes. 3. When the retention period expires or it is no longer necessary to hold the personal information, the Company will, except where retention is required by law, delete the information using a method that makes restoration difficult, or anonymize it so that individuals cannot be identified. 4. For backups and other copies of data, it may not be possible to delete individual information immediately due to system operations. In such cases, the Company will exclude the data from ordinary use and delete it in accordance with the prescribed backup update or erasure cycle. 5. When the Company entrusts the handling of personal information to a third party, the Company will exercise necessary and appropriate supervision over that third party, such as requiring it not to retain personal information beyond the period necessary to achieve the purposes of use and to appropriately delete or return the information after the retention period ends.

Article 8 (Provision to Third Parties)

The Company may provide Users’ personal information to third parties without obtaining the User’s prior consent in the following cases:

1. When entrusting the handling of personal data to the extent necessary to achieve the purposes of use
2. When required by law
3. When necessary to protect a person’s life, body, or property, and it is difficult to obtain the User’s consent
4. When especially necessary to improve public health or promote the healthy development of children, and it is difficult to obtain the User’s consent
5. When necessary to cooperate with a national government agency, local government, or a party entrusted by them in performing affairs prescribed by law, and obtaining the User’s consent is likely to impede the performance of such affairs
6. When the third party is an academic research institution, etc., and the third party needs to handle the personal information for academic research purposes (including where part of the purpose of providing the personal information is academic research, but excluding cases where there is a risk of unjustly infringing the rights and interests of individuals)
7. In other cases permitted under the APPI or other laws

Article 9 (Security Control Measures)

1. To prevent leakage, loss, damage, unauthorized access, misuse, and other incidents involving the personal information it collects, the Company will take necessary and appropriate security control measures in accordance with the APPI and other relevant laws. 2. For the secure management of personal information, the Company will appropriately implement the following measures according to the nature, volume, and use of the personal information it handles: (1) Organizational security measures Appointing a person responsible for handling personal information, establishing handling rules, managing access rights, reviewing how personal information is handled, and establishing a system for reporting and responding to leakage or other incidents. (2) Personnel security measures Training officers, employees, and other related persons who handle personal information, and ensuring they comply with confidentiality obligations. (3) Physical security measures Appropriately managing equipment, recording media, and documents used to handle personal information, and preventing their theft, loss, and unauthorized removal. (4) Technical security measures Access control, authentication, encryption of communications, measures against unauthorized access, system monitoring, and other measures necessary to protect personal information. (5) Understanding the external environment When handling personal information in a foreign country, the Company will take necessary and appropriate security control measures after understanding that country’s personal information protection system and other aspects of its external environment. 3. When the Company entrusts the handling of personal information to an outside business, the Company will confirm the contractor’s security control measures for personal information and exercise necessary supervision through contracts or other appropriate means. 4. If a leakage or other incident involving personal information occurs or is likely to have occurred, the Company will promptly investigate the facts and take the measures necessary to prevent further damage, identify the cause, and prevent recurrence, and will report to the Personal Information Protection Commission and notify the affected individuals in accordance with law.

Article 10 (User Rights)

In accordance with applicable law, Users may request the Company to notify them of the purposes of use of, disclose, correct, add to, or delete, suspend the use of or erase, or stop the provision to third parties of, their personal information held by the Company, and may make other requests. Requests under this Article may be made through the dedicated form in the App described in Article 14.

Article 11 (Use by Minors)

If it is found that a User is under 13 years of age, the Company may restrict use of the account, delete information, or take other necessary actions.

Article 12 (Use of Anonymously Processed Information, etc.)

In accordance with law, the Company may use statistical information and other information that has been appropriately processed so that specific individuals cannot be identified, for analyzing and improving the Service, business considerations, etc., or may provide it to third parties. When creating, using, or providing to third parties anonymously processed information, the Company will handle it in accordance with the APPI and other applicable laws.

Article 13 (Changes to This Policy)

The Company may change this Policy as necessary, and will post any changes in the App. In that case, the revised Policy will apply from the effective date separately determined by the Company.

Article 14 (Inquiries)

Users may make inquiries regarding this Policy and the handling of their personal information by entering the details of the inquiry in the dedicated form in the App.

Supplementary Provisions

Established: [October 28, 2026] Last revised: [October 28, 2026]

Appendix: List of External Transmission Destinations

External Service	Provider	Main Information Transmitted / Processed	Purpose of Use
Firebase Authentication	Google LLC	User authentication	Email address, User ID (UID), authentication token, sign-in method
Firebase Crashlytics	Google LLC	Crash diagnostics and app stability monitoring	Device model, OS version, crash logs, stack traces, app version, and (in some settings) IP address at time of crash
Firebase Analytics	Google LLC	App usage analysis	Device identifier (App Instance ID), device model, OS version, usage events, approximate location (estimated from IP address), session duration
Google Cloud Vertex AI (Gemini)	Google LLC	AI-based image recognition, chat, and voice processing	Images, audio, and text sent for processing (temporary only; not retained after processing on Google Cloud servers)
Google Maps Platform (Map Tiles API)	Google LLC	Map display and custom map styling	Requested tile coordinates, API key, device IP address (used for request routing), map style request content
Cesium (Cesium ion)	Cesium GS, Inc.	3D terrain and globe rendering	API token/account identifier, requested asset/tile coordinates, usage measurement data
Google Geospatial API / ARCore	Google LLC	AR navigation and high-precision geolocation (Visual Positioning System)	Camera images (used for VPS location processing), GPS coordinates, device orientation/motion data
Google Places API	Google LLC	Place search and display of visited/saved places	Place search queries, Place ID, coordinate information
Health App Integration (Apple HealthKit / Google Fit)	Apple Inc. / Google LLC	Displaying step count within the app	Step count (read-only access, based on User permission)