Privacy Policy

1

Personal information we collect and how we collect it

The Company collects the following personal information to provide the Service:

• Sign-up (required): email, password, name, nationality and country of residence, preferred language, passport number, date of birth, email verification code
• Sign-up (optional): gender, mobile phone number
• When you use social login: account identifiers provided by the service through your Google or Facebook account (such as email and name)
• When you verify a visit by scanning a QR code: your device location (GPS coordinates used to check whether you are within 300 m of the store) and visit records (date, time, and store visited)
• Content you write yourself, such as reviews and photos
• When you use push notifications: your device push token (Firebase Cloud Messaging) and device platform
• When you use a paid service: payment approval information and transaction history (payment method details such as card numbers are processed by the payment provider and are not stored by the Company)
• Collected automatically while you use the Service: access logs, IP address, device and browser information, cookies, and service usage records

Collection methods: information is entered by you during sign-up and use of the Service, or generated and collected automatically while you use it. Text recognition (OCR) for the passport scan feature runs only on your own device, and passport images are not sent to or stored on our servers. However, the passport number, date of birth, and nationality entered at sign-up (or filled in automatically by the scan) are stored on our servers as member information. The Service is not directed at children under 14, and if we learn that we have collected personal information of a child under 14, we delete it without delay.

2

Purposes of processing

The Company processes the personal information it collects for the following purposes, and takes necessary measures, such as obtaining separate consent, if the purposes change:

• Member registration and management: identity verification, prevention of improper use, confirming intent to sign up, notices
• Providing the Service: information on participating stores, QR visit verification, earning and using discounts and points, the review service, sending push notifications
• When providing paid services: payment and settlement, and handling of withdrawal, cancellation, and refunds
• Service improvement and statistical analysis (processed in a form that does not identify individuals)
• Handling complaints and resolving disputes, and fulfilling legal obligations

3

Retention and use period

The Company retains and uses your personal information until you withdraw your membership, and destroys it without delay upon withdrawal. However, the following information is kept for the periods below as required by law or for service operations:

• Records on contracts or withdrawal of purchase: 5 years (E-Commerce Act)
• Records on payment and supply of goods: 5 years (E-Commerce Act)
• Records on consumer complaints or dispute handling: 3 years (E-Commerce Act)
• Website access records: 3 months (Protection of Communications Secrets Act)
• Discount agreement consent records: 1 year (service operations)

4

Provision to third parties

In principle, the Company does not provide your personal information to third parties. The exceptions are:

• When you have given prior consent
• When the minimum necessary information (the fact of a visit and whether a discount was applied) is provided to the relevant participating store for visit verification and discount confirmation
• When an investigative agency or similar authority requests it by lawful procedure under applicable law

The Company does not sell your personal information.

5

Entrustment of processing

To provide the Service smoothly, the Company entrusts the processing of personal information as follows, and manages and supervises the processors so that they handle it securely:

• Vercel Inc. (United States): website hosting and content delivery network (CDN) operation
• Cloudtype (Republic of Korea): backend server and database hosting
• Google LLC (United States): social login (Google account), push notification delivery (Firebase Cloud Messaging), and map services
• Payment service provider: payment processing when paid services are introduced (processors will be added to this policy and announced at that time)

6

Transfer of personal information abroad

To provide the Service, the Company transfers personal information abroad as follows:

• Vercel Inc. (United States) — Items: access information generated when you visit the Service (IP address, device and browser information) / Purpose: website hosting and content delivery / Time and method: transmitted over the information network each time you use the Service / Retention: until the entrustment contract ends or the purpose is achieved
• Google LLC (United States) — Items: social login authentication information, push token, device information, and request information when using maps / Purpose: social login, push notification delivery, and map services / Time and method: transmitted over the information network each time you use the relevant feature / Retention: until the entrustment contract ends or the purpose is achieved

You may refuse the transfer abroad. However, if you refuse, access to the Service, social login, push notifications, and maps may be restricted. To refuse, please email the Chief Privacy Officer below.

7

Destruction procedure and method

The Company destroys personal information without delay once the retention period has passed or the purpose of processing has been achieved.

• Procedure: personal information for which a reason for destruction has arisen is selected and destroyed with the approval of the person in charge. Information that must be kept by law is stored separately and destroyed after the retention period ends
• Method: electronic files are permanently deleted in a way that cannot be recovered, and paper documents are shredded or incinerated

8

Your rights and how to exercise them

You may exercise the following rights at any time:

• Request access to, correction of, or deletion of your personal information
• Request suspension of processing and withdraw consent
• Withdraw your membership (withdrawal of consent)
• Opt out of marketing and push notifications

You can exercise these rights through the profile and settings menu in the app or by emailing the Chief Privacy Officer, and the Company will act without delay. You may also exercise your rights through a legal guardian or an authorized agent.

9

Security measures

The Company takes the following measures to keep personal information secure:

• Passwords are stored using one-way encryption, and data in transit is encrypted with HTTPS (TLS)
• Staff with access to personal information are kept to the minimum, and access rights are managed
• Access records are kept and managed to prevent forgery, alteration, theft, and loss
• Important data is backed up regularly

10

Cookies and automatic collection devices

The Company uses cookies and similar storage technologies (such as local storage) to keep you signed in, save your settings, and understand service usage statistics.

• Cookies are small pieces of information that the server used to operate a website sends to your browser and that are stored on your device
• How to refuse: you can allow or block cookies in your browser settings. However, if you block them, some features such as signing in may be restricted

View the Cookie Policy

11

Chief Privacy Officer

The Company has designated a Chief Privacy Officer as follows to oversee the processing of personal information and to handle complaints and provide remedies for data subjects:

Contact

rebatekorea@gmail.com

12

Remedies for infringement of rights

If you need to report or seek advice about a personal information infringement, you may contact the following organizations:

• Personal Information Dispute Mediation Committee: 1833-6972 (kopico.go.kr)
• Personal Information Infringement Report Center (Korea Internet & Security Agency): 118, no area code (privacy.kisa.or.kr)
• Cyber Investigation Division, Supreme Prosecutors' Office: 1301, no area code (spo.go.kr)
• Cyber Investigation Department, Korean National Police Agency: 182, no area code (ecrm.police.go.kr)

13

Changes to this policy

This policy takes effect on October 17, 2026. If content is added, deleted, or modified, we will announce it within the Service at least 7 days before it takes effect, and at least 30 days before for significant changes to your rights.