Apioni Privacy Policy

Effective date: 2026-06-13

This English version is a courtesy translation. The Korean-language version is the legally binding document; in case of any discrepancy, the Korean version prevails.

Foo AI Corp. (hereinafter the "Company") establishes and discloses the following privacy policy in accordance with Article 30 of the Personal Information Protection Act (개인정보 보호법), in order to protect the personal data of data subjects and to handle related concerns promptly and smoothly.

Core Principle: Minimal Collection

Apioni is on-device software. Using the app requires no account, and the app collects no usage statistics or telemetry. The documents and queries you work with in the app are processed solely on your device and are never transmitted to the Company. The personal data the Company collects is limited to the minimal information you enter when purchasing a license.

1. Items of Personal Data Collected and Methods of Collection

• Payment information such as card numbers is collected and processed directly by our payment gateway, KG INICIS; the Company does not collect or store it.
• No personal data is collected during the trial download or while using the app.

The Company processes the items above on the basis of Article 15(1)4 of the Personal Information Protection Act (개인정보 보호법), namely, where processing is unavoidable for the performance of a contract (issuance and delivery of the license), and obtains the buyer's consent as part of the checkout process. A data subject may decline to consent to the collection and use of this personal data; however, because an email address is information that is strictly necessary to issue and deliver a license key, declining may limit your ability to purchase a license and receive your key.

2. Purposes of Processing Personal Data

The Company processes the collected personal data only for the following purposes.

1. Issuing, delivering, and managing the validity of license keys
2. Handling withdrawals of subscription such as refunds, and verifying identity in connection therewith
3. Delivering essential license-related notices, such as security patches

The Company does not use the collected personal data for marketing purposes, and where processing for marketing purposes becomes necessary, it will obtain separate consent.

3. Period of Processing and Retention of Personal Data

1. The Company retains personal data for the period necessary to issue and manage license keys (in the case of a perpetual license, for as long as that license is validly maintained).
2. The following records are retained for the corresponding periods in accordance with the Act on Consumer Protection in Electronic Commerce, etc. (전자상거래 등에서의 소비자보호에 관한 법률).
   • Records on contracts or withdrawal of subscription: 5 years
   • Records on payment and the supply of goods, etc.: 5 years
   • Records on consumer complaints or dispute resolution: 3 years
3. Personal data whose retention period has elapsed is destroyed without delay in accordance with the procedure in Section 6 (Destruction).

4. Entrustment of Personal Data Processing

The Company entrusts the processing of personal data for payment handling as follows.

When entering into an entrustment agreement, the Company reflects in the contract, in accordance with Article 26 of the Personal Information Protection Act (개인정보 보호법), provisions prohibiting the processing of personal data beyond the purpose of performing the entrusted work, technical and managerial safeguards, restrictions on re-entrustment, and the like, and it supervises whether the entrustee processes personal data safely. Should the content of the entrusted work or the entrustee change, the Company will disclose this through this policy.

5. Provision of Personal Data to Third Parties

The Company does not provide a data subject's personal data to third parties. It may do so on an exceptional basis only where the data subject has given prior consent or where there is a specific provision in the applicable laws.

6. Procedure and Method of Destroying Personal Data

1. The Company destroys the personal data without delay when it becomes unnecessary, for example, upon the lapse of the retention period or the achievement of the processing purpose.
2. Information that must be retained under the applicable laws is kept separately in a distinct storage space and is destroyed without delay once the retention period has elapsed.
3. Information in the form of electronic files is deleted using a technical method that renders it unrecoverable, and paper documents are shredded or incinerated.

7. Rights and Obligations of Data Subjects and How to Exercise Them

1. A data subject may, at any time, request the Company to provide access to, correct, delete, or suspend the processing of their personal data.
2. Such requests may be made to contact@fooai.io in writing, by email, or by similar means, and the Company will act on them without delay.
3. Rights may also be exercised through the data subject's legal representative or an authorized agent. In such cases, a document establishing the lawful authority must be submitted.
4. Even where deletion is requested, information that is subject to a retention obligation under the applicable laws (such as the electronic commerce records in Section 3) may not be deleted during the relevant retention period, and the Company will inform the data subject of the reason.

8. Matters Concerning Automatic Data Collection Devices

1. The Apioni app does not use any automatic personal data collection device such as cookies, telemetry, or behavioral information collection tools.
2. Should the Company introduce an automatic collection device such as an analytics tool on the website (apioni.com), it will amend this policy to disclose the items collected, the purpose, and how to opt out.

9. Measures to Ensure the Security of Personal Data

The Company takes the following measures in accordance with Article 29 of the Personal Information Protection Act (개인정보 보호법).

1. Managerial measures: minimizing the number of personnel who handle personal data, and providing training
2. Technical measures: managing access privileges to the personal data processing system, encrypting data in transit, and applying security software
3. Physical measures: access control for equipment on which personal data is stored

10. Personal Data Protection Officer

The Company designates a Personal Data Protection Officer as follows to oversee work related to the processing of personal data and to handle data subjects' complaints and remedy harm.

• Personal Data Protection Officer: Song Ji-ho / Representative Director / +82-2-581-3001
• Contact: contact@fooai.io

Data subjects may direct any inquiries, complaints, or requests for remedy concerning personal data protection arising from their use of the Company's services to the Personal Data Protection Officer, and the Company will respond and act without delay.

11. Remedies for Infringement of Rights

To seek remedy for a personal data breach, a data subject may apply for dispute resolution or consultation to the following bodies.

• Personal Information Dispute Mediation Committee: 1833-6972 (www.kopico.go.kr)
• Personal Information Infringement Report Center (Korea Internet & Security Agency): 118 without an area code (privacy.kisa.or.kr)
• Supreme Prosecutors' Office: 1301 without an area code (www.spo.go.kr)
• National Police Agency: 182 without an area code (ecrm.police.go.kr)

12. Personal Data of Children Under the Age of 14

1. Apioni is not a service directed at children under the age of 14, and the Company does not collect the personal data of children under the age of 14.
2. Should the Company become aware that the personal data of a child under the age of 14 has been collected without the consent of a legal representative, it will destroy that data without delay.

13. Changes to This Privacy Policy

1. This policy applies from 2026-06-13.
2. Where content is added, removed, or amended due to changes in laws, policy, or security technology, the Company will give notice through the website at least 7 days before the change takes effect (at least 30 days before, in the case of a change unfavorable to data subjects).