Privacy Policy

1. Scope and Principles

Rodac Technologies LTD (the "Company") complies with Korea's Personal Information Protection Act, Act on the Protection and Use of Location Information, and related law to protect users of the KixScan mobile app and web app.

The Company processes information necessary for the stated purposes and deletes it without undue delay when no longer necessary, subject to lawful retention. Optional features remain optional. Consent is obtained separately where required; this Policy is a disclosure, not blanket consent. This Policy applies to the KixScan beta.

2. Purposes, Data, Legal Bases, and Retention

Captures undergo face detection/blurring, sneaker-focused background blurring and NSFW filtering. Unprocessed source images are deleted without delay when the necessary recognition, privacy and safety processing is complete; processed copies follow the core-record rule. Account links, blurring or location generalization do not by themselves make information anonymous.

KixChat is text-only and uses Perplexity’s API. KixScan does not attach its internal account identifiers or device-derived location as chat context. Typed text can itself contain personal information. Do not enter sensitive information, credentials or unnecessary personal information.

Signed-in Members can review their own saved questions and answers in the KixChat History tab. Within Rodac, access to chat contents is limited to designated employees authorized for safety monitoring, harmful-answer reports and related misuse or security investigations. The app provides harmful-answer reporting. Chats are not published to the community; private chats are not used for commercial datasets or AI/ML training. Statutory access and deletion rights remain available.

Processing necessary to provide the Service, including KixChat answers and saved history, relies on PIPA Article 15(1)(4). Legal duties rely on Article 15(1)(2); necessary legitimate interests, including proportionate safety/misuse monitoring, rely on Article 15(1)(6) only where its balancing conditions are met. Other consent-based processing follows Article 15(1)(1); personal-location processing follows location law. The Company collects no resident registration number or biometric identifier for signup. Retention ends when the stated purpose is achieved; account activity or a possible future feature does not justify keeping otherwise unnecessary records.

3. Collection Methods

• Information submitted directly through registration, profiles, Captures, Data Missions and Data Tasks, quizzes, comments, reports, exchanges, and support

Information authorized in Google login or Sign in with Apple: provider identifier, authentication values, email (which may be an Apple private-relay address), and name if supplied in the login flow. KixScan does not receive the user’s Google or Apple password.

• Information needed for a user-initiated feature through operating-system camera, media, and location permissions
• Logs, device information, errors, and misuse signals generated automatically during Service use

Text entered in KixChat and generated replies; service-email requests and delivery records; blocking settings; and account-deletion confirmations submitted through Settings.

4. Public Information and Community Features

Depending on the feature, username, avatar, badges, Contributor Ranking position, public Captures, posts, comments, activity events, and a generalized area or venue name may be visible to other users. Precise coordinates and date of birth are not made public.

Users may enable Private Mode in the Service settings. When Private Mode is enabled, other users cannot access that user's Community profile, and the user's name is displayed as ‘Anonymous’ in Contributor Rankings and on public Captures. The Company's internal association between the account and contribution records is still maintained for Service operation, verification, security, and legal obligations.

Public content is subject to automated face detection and blurring, background blurring outside the sneaker-focused image area, and NSFW content filtering. Automated processing may not obscure every identifying detail or block every inappropriate image. Users may delete their content or contact support and may report content that identifies them or infringes their rights.

Users may block other accounts in the app. The blocking relationship is used to prevent User Content from a blocked account from appearing to the blocking user; blocking does not remove that content for other users. KixChat messages are not published to the community feed.

5. Third-Party Disclosure

The Company does not sell identifiable personal information. It discloses personal information to an independent third party only with a lawful basis, including separate consent where required or an applicable legal obligation.

Coupon delivery through SK planet’s Bizcon is entrusted processing described in Section 6. A user’s own registration with or redemption through a Coupon issuer is governed by that provider’s notices. Any separate personal-data disclosure by the Company requiring consent will be disclosed and consented to before it occurs.

Public User Content is visible as described in Section 4. Commercial datasets or analytics exclude personal information unless a lawful basis and safeguards permit it; Section 8 explains the anonymity standard.

6. External Service Providers and Entrusted Processing

Providers perform the tasks below. Entrusted processing on Rodac’s behalf is distinguished from providers’ independent account services. Company retention follows Section 2; overseas processing and provider retention follow Section 7.

Recognition, face/background blurring, NSFW filtering and analytics use the Company’s own systems. Separate AI product-reference descriptions use product metadata without user personal information. External push notifications are not currently used.

The Company applies written processing safeguards and supervision required by PIPA Article 26. Applicable onward providers and changes are disclosed as required; provider notices do not replace the Company’s duties.

7. Overseas Transfers

For overseas entrustment or storage necessary to perform a user-requested service contract, the Company relies on PIPA Article 28-8(1)(3) with the required disclosure. This ground is not applied automatically to an independent third-party disclosure. Where another lawful basis or separate consent is required, it is established before transfer. This Policy itself is not consent.

AWS service storage and recovery backups are in Seoul (Section 9). The external processing below involves the stated overseas locations.

For access, correction, deletion, withdrawal or processing-suspension requests relating to these transfers, contact info@rodac.co.kr. The Company handles its duties under Korean law and coordinates with processors where required.

8. Retention Exceptions

After the stated purpose ends, the Company deletes personal information without delay. Only the minimum record covered by a legal duty or a continuing, separately justified investigation/dispute is retained. Statutory records are separated and used only for that purpose. The following entries do not impose blanket retention on all app data.

For a continuing investigation or dispute, relevant evidence is retained only until that purpose ends or an applicable legal period expires; unnecessary material is removed. Entire chats, Captures and precise-location histories are not retained merely because a transaction record must be kept.

Genuinely anonymous product data, statistics and outputs may remain for research, data products and AI/ML improvement after account or content deletion. Anonymous means no individual can reasonably be identified, even with other information, considering time, cost and technology. Removing an account link alone is insufficient. Pseudonymized information remains personal information and requires a lawful basis and safeguards. Private KixChat and support communications remain excluded from the commercial dataset/training licence.

9. Destruction

When information is no longer necessary or its lawful retention period ends, the Company destroys it without undue delay. Electronic data is deleted so it cannot be recovered or reproduced; paper records are shredded or incinerated. Records retained by law are separated and used only for the permitted purpose.

Deletion includes Company-controlled email copies. Providers’ residual deletion procedures are described in Section 7 and do not extend the Company’s permitted retention period.

Restricted recovery backups are stored in AWS Seoul and expire through the rolling 7-day database backup cycle. Deleted records are not returned to ordinary use; deletion restrictions are reapplied on restoration. Backups do not override a shorter statutory destruction obligation.

10. User Rights

Users may request access, correction, deletion, processing suspension and withdrawal of consent under applicable law. Portability and rights concerning solely automated decisions apply where their statutory scope and conditions are met. Requests can be made through available account controls or the contact in Section 15, including through an authorized representative. The Company verifies identity/authority only as necessary and responds within the applicable statutory period.

The Company generally does not use or disclose information under correction until correction is complete. If a lawful refusal ground applies, it will explain the ground and available challenge method.

Account deletion can be requested in Settings through “Delete my account” and confirmation, without having to send an email. The request is sent to the Company for processing; submission is not instantaneous deletion. The Company verifies the request where necessary and deletes the account and associated personal information without undue delay, except information lawfully retained under this Policy. Support at info@rodac.co.kr remains available for deletion and other rights requests.

Saved KixChat conversations may be deleted on request through an available in-app control or info@rodac.co.kr. Account deletion also removes saved history, except the minimum records lawfully retained under Section 8; any such exception does not keep deleted conversations in the user-facing history.

11. Automated Processing and Review

Automated processing supports product recognition, contribution acceptance, duplicate/fraud detection, face detection/blurring, sneaker-focused background blurring and NSFW filtering. Main inputs are submitted images and product/label/validation data, relevant event location/time, contribution records and security signals. Checks consider product match, clarity, duplication, consistency with disclosed task conditions and signs of manipulation or unsafe content. Results can affect publication, KDP credit, Contributor Rankings, Elite Contributor Bonuses or account restrictions.

Users may request an explanation or reconsideration at info@rodac.co.kr. Where PIPA Article 37-2 applies, the Company provides the required information, explanation and review. Refusal rights for solely automated decisions significantly affecting rights or duties are subject to statutory exceptions; applicable explanation rights remain.

KixChat generates answers and does not determine KDP or account eligibility. Its screen identifies generative AI and provides harmful-answer reporting. Relevant records may be reviewed only as stated in Section 2. Applicable AI-generated reference/collection content carries AI notices and may differ from actual products.

12. Cookies, Permissions, and Behavioral Data

The web app may use essential cookies or local storage for authentication, security, and core operation. Blocking them in a browser may prevent logged-in features from working.

The beta does not use third-party behavioral data or advertising trackers for personalized advertising. If introduced, the Policy will first disclose the data, method, purpose, period, and opt-out method.

Camera, photo/media, and location permissions can be refused or withdrawn through device/browser settings without losing access to unrelated app functions. Location permission is needed for functions based on the user’s location, such as map Data Missions and Data Tasks, nearby location-based events and location validation. Camera permission is needed for the scanner and camera Capture submissions that may earn KDP. Denial limits those corresponding functions only. A device permission is not a substitute for legally required personal-location consent.

13. Minimum Age and Minors

The Service is available from age 15, calculated from date of birth. The Company blocks registration by users under 15 and does not operate a guardian-consent signup route for them. If an under-15 account or related personal information is discovered, the Company closes the account and promptly deletes that information, except records that must separately be retained by law.

For users aged 15 or older, personal-information and personal-location consent are handled under the applicable laws. This does not remove any legal representative’s consent required for a minor’s contract or content licence under the Terms of Service. A user or authorized representative may exercise rights through Section 10; the Company requests only information necessary to verify identity or authority.

14. Security

The Company applies safeguards appropriate to its processing scale and risk, including least-privilege access, secure credential storage, encryption in transit, access-log retention and review, anti-malware controls, backup, and incident response.

15. Privacy and Location Contacts; Remedies

• Privacy officer: Haein Kim, CEO
• Location information manager: Haein Kim, CEO
• Email: info@rodac.co.kr
• Telephone: 010-2175-5942
• Address: A-457, Room 403, 4F, 8 Gukhoe-daero 38-gil, Yeongdeungpo-gu, Seoul, Republic of Korea

In Korea, users may also contact the Personal Information Infringement Report Center at 118 or the Personal Information Dispute Mediation Committee at 1833-6972.

16. Additional Personal Location Information Terms

Personal location information is processed to show current map position, provide nearby content, validate location for Captures, Data Missions, and Data Tasks, place and operate Beacons, and prevent fraud.

Current map position is primarily processed on the device during active use, without background tracking or continuous Company storage. Precise Capture, Data Mission, Data Task or Beacon event location sent to the backend is destroyed as soon as its validation, fraud-prevention or review purpose is achieved, subject only to lawful exceptions. Generalized outputs may remain only where genuinely anonymous. Map-provider processing is separately disclosed in Section 7.

The Company automatically records location collection/use/provision confirmation facts under Location Information Act Article 16(2), without retaining precise coordinates as part of those confirmation records, and keeps them for 6 months subject to statutory withdrawal/deletion rules. Other personal location information is destroyed immediately when its purpose is achieved unless a lawful exception applies.

The Company does not ordinarily disclose account-linked precise event location to an independent third party. Direct OpenFreeMap/CDN requests can reveal the displayed area and IP address as explained in Section 7. If a feature provides personal location information to a user-designated third party, the Company identifies the recipient and purpose, obtains the required separate consent and gives the recipient/time/purpose notice required by location law.

Users may withdraw all or part of location-use/provision consent, request temporary suspension and exercise statutory access/correction rights for confirmation logs and third-party disclosure details. Device settings stop future permission-based collection; they do not by themselves request deletion of information already held or record a withdrawal of legal consent. Send such requests to info@rodac.co.kr or use an available in-app rights control. On withdrawal, information within its scope is destroyed as required by location law, subject to applicable legal exceptions.

KixScan is available only to users aged 15 or older. It does not operate the under-14 guardian-consent service under Article 25 of the Location Information Act or protective tracking under Article 26. If either service is introduced, the applicable consent, rights and procedures will be established before that processing starts.

Location permission may be refused without losing unrelated features. KixChat does not attach device-derived location to provider requests; a location a user types is handled as chat text. Account deletion can be requested through Settings or the Section 15 contact.

17. Changes, Language, and Effective Date

The Company publishes amendments with their effective date and material content. Changes materially affecting user rights are notified before or when they take effect, with advance notice, individual notice or separate consent wherever required by law or the applicable agreement. Other updates are disclosed as legally required.

If the Korean version conflicts with a translation, the Korean version controls to the extent permitted by Korean law.

Effective date: October 22, 2026