Privacy Policy

SpineFairy Co., Ltd. (the “Company”) establishes and discloses this Privacy Policy in accordance with Article 30 of the Personal Information Protection Act (Korea) in order to protect the personal information of data subjects and to promptly and smoothly handle related complaints.

Article 1 (Scope of Application)

This Privacy Policy applies commonly to all services operated by SpineFairy, and any service-specific matters for each game may be stipulated in a separate additional privacy policy.

Article 2 (Basic Principles for Processing Personal Information)

The Company processes personal information in compliance with the following principles:

• Clarifying purposes of processing and collecting the minimum necessary personal information
• Processing lawfully within the scope of purposes and prohibiting use beyond the purposes
• Ensuring accuracy of personal information and keeping it up to date
• Taking technical, administrative, and physical measures to ensure security
• Ensuring the data subject’s rights and transparency in personal information processing
• Establishing a personal information protection management system based on the accountability principle

Article 3 (General Processing of Personal Information)

The Company processes personal information to the minimum extent necessary to provide the Service.

Personal information processed without the data subject’s consent

(1) Information collected upon account creation and service use

• Legal basis: Article 15(1)4 of the Personal Information Protection Act (“performance of a contract”)
• Items collected/used: Email address
• Purpose of collection/use: User identification, login, service provision and operation
• Retention/use period: Until account deletion (however, if retention is required under applicable laws, for such required period)

(2) Information collected for payments

• Legal basis: Article 15(1)4 of the Personal Information Protection Act (“performance of a contract”)
• Items collected/used: Store account ID
• Purpose of collection/use: Payment processing and purchase history management
• Retention/use period: Kept for 5 years from completion of payment (statutory retention obligation under the Act on Consumer Protection in Electronic Commerce, etc.)

As a rule, the personal information that the Company directly collects from users is as follows:

• Email address (account creation and handling customer inquiries)
• Store account ID for payment processing (support for payment verification and refunds)

In the course of using the Service, the following information may be automatically generated and collected

(whether collected may vary depending on device/OS settings, usage environment, and enabled features):

• Access logs (usage records), IP address, date/time of service use
• Device information (device model, OS version, language/region settings, app version), network information
• Error/crash logs and diagnostic information (for service stability)
• Advertising identifiers (e.g., IDFA/AAID) and advertising-related event information such as ad impressions/clicks (for ad provision and measurement)

The Company may process certain automatically collected information through external service providers for advertising, analytics, error collection, etc. In such cases, the provider may be either (i) the Company’s processor (service provider) or (ii) an independent third-party controller (advertising partner) that processes information for purposes such as ad performance measurement.

The type of provider and processing details applied to each game (items, purposes, retention, overseas transfer, etc.) will be provided through in-service notices or separate disclosures (e.g., settings/consent screens).

All game services provided by the Company are operated on a server basis, and users’ game data is safely stored and managed on the Company’s servers.

Personal information processed with the data subject’s consent

None at this time. Any service-specific matters will be added in an additional privacy policy for the relevant game.

Article 4 (Provision of Personal Information to Third Parties)

The Company processes personal information only within the scope specified in Article 1, and provides personal information to third parties only where the data subject has consented, where there are special provisions in laws, or where it falls under Articles 17 and 18 of the Personal Information Protection Act.

As a rule, the Company does not provide users’ personal information to third parties. However, where the user consents to personalized advertising or where advertising/performance measurement features are applied, certain information such as advertising identifiers (IDFA/AAID) and advertising event information may be provided to advertising partners (independent third-party controllers). Details will be disclosed through Article 10 and separate in-service disclosures (e.g., settings/consent screens).

Article 4-2 (Outsourcing of Processing and Overseas Transfer)

Where necessary to provide the Service smoothly, the Company may outsource part of its personal information processing 업무 to external 전문업체. In such cases, the Company will take required measures in accordance with applicable laws such as entering into an outsourcing agreement, supervising and managing the processor, and restricting sub-processing.

Major outsourcing details are as follows (the actual processors and processing details may be additionally disclosed through in-service settings/notices/consent screens):

Category	Outsourced work	Personal information items (examples)	Retention/Use period	Processor / Service provider
Service operation / Customer support	Receiving and responding to customer inquiries (via email)	Email address, inquiry contents	After inquiry is resolved, for the period required by law or internal policy	Separate in-service disclosure
Payment / Refund support	Supporting payment verification and refund procedures (linked to platform policies)	Store account ID; purchase/payment-related information (within the scope provided by the platform)	Period required by applicable laws or platform policies	Platform operators (Apple/Google/Steam, etc.)
Analytics / Statistics	Usage analytics and analysis for feature improvement	Access logs, device/app info, event logs	Until purpose achieved or period disclosed separately	Separate in-service disclosure
Error / Quality	Error and crash analysis; ensuring service stability	Crash logs, diagnostic info, device/app info	Until purpose achieved or period disclosed separately	Separate in-service disclosure
Advertising / Measurement	Ad provision and performance measurement (impressions/clicks, etc.)	Advertising identifiers (IDFA/AAID), ad event info	Until purpose achieved or period disclosed separately	Separate in-service disclosure

If some processors or advertising partners used by the Company have servers located overseas, an overseas transfer may occur. In such cases, the Company will provide notice (in advance or without delay, as required) and obtain any necessary consent in accordance with applicable laws, including the recipient, destination country, transferred items, purposes, retention/use period, timing/method of transfer, and the user’s right to refuse and how to exercise such right (where applicable).

Article 5 (Destruction Procedures and Methods)

The Company will destroy personal information without delay when it becomes unnecessary, such as upon expiration of the retention period or achievement of the processing purpose.

The procedures and methods of destruction are as follows:

(1) Procedure

The Company selects personal information subject to destruction and destroys it after obtaining approval from the Company’s personal information protection officer.

(2) Method

• Electronic files: destroyed in a manner that prevents restoration or reproduction.
• Paper documents: shredded or incinerated.

Article 6 (Rights of Data Subjects and Legal Representatives and How to Exercise Them)

1. Data subjects may exercise rights such as requesting access, correction, deletion, or suspension of processing at any time.

2. Requests may be made to the Company in writing, by email, etc. in accordance with Article 41(1) of the Enforcement Decree of the Personal Information Protection Act, and the Company will take action without delay.

3. Rights may be exercised through a legal representative or an authorized agent. In such cases, a power of attorney in the form of Appendix No. 11 of the “Public Notice on Personal Information Processing Methods (No. 2020-7)” must be submitted.

Article 7 (Measures to Ensure Security)

The Company takes the following measures to ensure the security of personal information:

(1) Administrative measures

• Minimizing personnel handling personal information and conducting training
• Establishing and implementing internal management plans related to personal information processing
• Conducting regular self-inspections

(2) Technical measures

• Access control and limitation of access rights to personal information
• Applying encryption technology for secure storage/transmission
• Installing and regularly updating security programs to prevent hacking/malware
• Preserving access logs and preventing tampering

(3) Physical measures

• Controlling access to computer rooms and document storage rooms
• Using locks and other measures to securely store documents and storage media containing personal information

Article 8 (Personal Information Protection Officer / Department)

The Company appoints the following personal information protection officer to oversee personal information processing and handle complaints and remedies:

• ▶ Personal Information Protection Officer: Jae-hyeok Jang
• Title: CEO
• Contact: support@spinefairy.com

If you have any inquiries, complaints, or requests for remedies related to personal information protection while using the Service, you may contact the officer above. The Company will respond and handle such inquiries without delay.

If you need to report or consult about personal information infringement, please contact the following organizations:

• Privacy Infringement Report Center: 118 (Korea) (privacy.kisa.or.kr)
• Personal Information Dispute Mediation Committee: 1833-6972 (www.kopico.go.kr)
• Supreme Prosecutors’ Office Cyber Investigation Division: 1301 (www.spo.go.kr)
• National Police Agency Cyber Bureau: 182 (cyberbureau.police.go.kr)

Article 9 (Service Platforms and Age)

1. The Company provides game services through various platforms such as the Apple App Store, Google Play Store, and Steam, and complies with each platform’s policies.

2. The Company provides services globally and complies with the laws and regulations of the countries where services are provided.

3. The Company’s services are available without age restrictions, including users under the age of 14. For users under 14, consent from a legal representative may be required, and the Company has procedures in place to verify such consent in accordance with applicable laws.

Article 10 (Use of Advertising Identifiers)

The Company may use advertising identifiers (e.g., IDFA/AAID) for ad provision and ad performance measurement (e.g., impression/click counts, frequency capping). In addition, advertising partners may independently collect and use advertising identifiers and advertising-related event information. Users can restrict personalized ads or reset advertising identifiers at any time in their device settings.

• iOS: Settings > Privacy & Security > Tracking > Turn off “Allow Apps to Request to Track”
• Android: Settings > Google > Ads > Opt out of Ads Personalization

Article 11 (Changes to This Privacy Policy)

1. This Privacy Policy is effective as of March 1, 2026.

2. If the Company changes this Privacy Policy, it will continuously disclose the timing of the change and the changed contents, and will disclose comparisons between the previous and updated versions so that data subjects can easily review them.

3. Previous versions of this Privacy Policy can be reviewed as follows:

• Not applicable (first enactment)