adobaRo Privacy Policy

Effective Date: January 28, 2026

Version: 1.1

---

[adoba Corporation](hereinafter referred to as the "Company") values the personal information of its users and complies with the "Personal Information Protection Act" and related laws and regulations.

This Privacy Policy explains what personal information the Company collects, for what purpose, how it is used, stored, and destroyed, and what rights users can exercise in the course of using the adobaRo service (hereinafter referred to as the "Service") provided by the Company.

1. General Provisions

1. The Company takes necessary technical, administrative, and physical measures to safely protect users' personal information, and collects and uses personal information within the minimum scope required by relevant laws and regulations.

2. The Service is primarily intended for individual users (consumers), but corporate or group accounts may be created as needed, in which case this Policy also applies.

3. The Company posts this Privacy Policy on the initial screen of the Service or in the settings menu so that it can be easily accessed at any time.

2. Purpose of Collection and Use of Personal Information

The Company collects and uses personal information within the scope of the following purposes.

The Company does not process information beyond the scope for which the user has given prior consent, unless otherwise permitted by law.

2.1 Required Purposes

Membership Registration and Management

- Confirmation of intent to sign up and identity verification (social login, etc.)

- Member identification and account management

- Prevention of fraudulent sign-ups and unauthorized use

- Delivery of announcements and notices related to Service use

- Handling complaints and responding to inquiries

- Verification of facts and record keeping in case of a dispute

Service Provision

- Provision of AI-based content processing and localization services (automatic translation, subtitle generation, dubbing, thumbnail text conversion, etc.)

- Support for creating, operating, verifying, and connecting business for main or localized channels (multilingual channels) (※ Profit settlement, etc., are in principle subject to the policies of each external platform or counterparty, and the Company is not directly responsible for the settlement process itself.)

- Integration with external platforms (e.g., YouTube, Bilibili, etc.) to automate content upload and distribution

- Content information analysis and provision of statistics and reports

- Provision of Agent service (subscription-based AI feature) and management of usage history

- Management of Ro-Power (paid points) charging and usage history

- Analysis of Service usage patterns for service quality improvement (within a scope where personal identification is difficult)

Fee Payment and Settlement

- Ro-Power charging and processing payments for paid services

- Payment and settlement of Agent subscription fees

- Issuing invoices, confirming payment details

- Processing refunds (if applicable)

2.2 Optional Purposes

Marketing and Advertising

- Information on events, promotions, and new services

- Providing information on discounts, coupons, and benefits

- Recommending personalized content/services through analysis of interests and usage patterns (based on cookies, logs, etc.)

※ Data obtained through YouTube API Services is NOT used for marketing, advertising, or any purposes other than providing and improving the functionality of adobaRo service.

※ Even if the user does not agree to the optional purposes, there are no restrictions on using essential services. However, refusal to agree may result in the inability to receive information on personalized benefits and events.

---

3. Items of Personal Information Collected and Collection Methods

3.1 Collected Items

During sign-up and account management

(Required)

- Social login account information: Email address, name (or nickname), profile image (if provided)

- Social account identifier (ID token, OAuth identifier value, etc.)

- Sign-up date and time, last access date and time

- The Company does not directly collect or store passwords. Password management is handled by social login providers such as Google and Apple.

(Optional)

- Mobile phone number (for text notifications, when identity verification is required)

- Profile information (language settings, preferred platform, etc.)

Automatically collected during service use

- IP address, access date and time

- Service usage records (feature usage history, menu clicks, error logs, etc.)

- Device information (operating system, browser type and version, device type, etc.)

- Access and usage records collected through cookies and similar technologies

During payment

- Payment method information (credit card company, card type, approval number, etc.)

※ Sensitive information such as full card number, password, and CVC is processed directly by the Payment Gateway (PG) company, and the Company can only check some information in a masked form.

- Bank account information (for bank transfers)

- Payment, cancellation, and refund details

- Refund account information (only when a refund is necessary)

When linking with YouTube API Services

The Company collects the following information using the YouTube API Services:

- YouTube channel information: Channel name, Channel ID, Channel profile image, etc.

- Content metadata: Title, description, tags, category, thumbnail information, etc.

- Channel/video statistics data: View count, like count, comment count, subscriber count, etc.

- Permissions and information necessary for content upload and management (upload, modification, setting to private, localization, etc.)

The above information is linked through the YouTube API Services and is processed in accordance with the policies of YouTube and Google and the Google Privacy Policy.

When linking with Chinese platforms

- Platform account information for Bilibili, Rednote, Kuaishou, etc. (ID, channel name, etc.)

- Linked channel and content metadata

- Basic statistics data within the platform (views, likes, etc.)

When analyzing content

- Content files (including original images, videos, audio tracks, etc.)

- Voice data within the content (for voice recognition and translation processing purposes)

- Subtitle files and text scripts

- Thumbnail images and text within images (for translation/regeneration purposes)

3.2 Collection Method

- Information directly entered by the user during the sign-up and Service usage process

- OAuth integration with social login providers such as Google, Apple, etc.

- Automatic collection through API integration with external platforms such as YouTube, Bilibili, etc.

- Automatic collection through logs generated during Service use and cookies/analytics tools

---

3.3 YouTube API Services and Google Limited Use Requirements

---

4. Processing and Retention Period of Personal Information

4.1 Basic Principles

In principle, the Company destroys personal information without delay after the purpose of collection and use has been achieved.

However, if relevant laws and regulations require storage for a certain period, or if it is necessary for purposes such as dispute prevention and response, the information is stored safely for that period and then destroyed.

Retention According to Laws and Regulations

"Act on the Consumer Protection in Electronic Commerce"

- Records on withdrawal of contracts or orders, etc.: 5 years

- Records on payment settlement and supply of goods, etc.: 5 years

- Records on the handling of consumer complaints or disputes: 3 years

- Records on display and advertising: 6 months

"Protection of Communications Secrets Act"

- Log records related to Service use: 3 months

"Electronic Financial Transactions Act"

- Records on electronic financial transactions: 5 years

Retention According to Company's Internal Policy

- Records for preventing fraudulent use and responding to account theft/misuse: Up to 1 year after membership withdrawal

- Records for preventing and responding to disputes in Service operation: Stored for the minimum period necessary and then destroyed

4.2 YouTube API Data

- Data collected through YouTube API Services is used only for the period necessary to provide the Service, and related linked tokens and account information are deleted without delay when the member disconnects the YouTube link or withdraws their membership.

- Members can directly revoke adobaRo's access to YouTube data at any time on the Google security settings page.

- YouTube API data is retained only for the minimum duration necessary to provide content localization services and is not retained longer than required.

4.3 Payment Information

- Payment and settlement-related information is stored for a maximum of 5 years in accordance with relevant laws such as the "Electronic Financial Transactions Act" and then destroyed.

- Card information is managed by the PG company, and the Company can only view some of the information necessary for payment approval.

4.4 Platform Data

- Platform-linked data is processed in accordance with the privacy policy and local laws of the respective platform.

- It is deleted or de-identified when a member disconnects the link or withdraws their membership.

4.5 Content and Processed Deliverables

- In principle, the Company does not store the content itself long-term.

- It is temporarily stored to perform localization tasks (translation, subtitles, dubbing, etc.) and then deleted or de-identified within a reasonable period from the time of processing completion or upload completion.

- If a user separately uses the storage/management function within the Service, the retention period according to the guidance for that function may be applied.

---

5. Provision of Personal Information to Third Parties

As a general rule, the Company does not provide users' personal information to third parties. However, it may be provided exceptionally in the following cases.

- When the user has given individual consent in advance

- When there are special provisions in other laws, or when requested by public institutions such as investigative agencies or courts in accordance with procedures prescribed by law

- In cases where there is an imminent threat to the life or body of the user, or it is necessary for a significant interest in property, and there is a justifiable reason for being unable to obtain consent from the user or their legal representative

- When integration with a third-party platform is required for Service provision

※ Data obtained through YouTube API Services is NOT shared with third parties for purposes other than providing adobaRo's core service functionality.

---

6. Entrustment of Personal Information Processing

The Company entrusts the processing of personal information to external professional companies as follows to improve its services:

| Consignee | Entrusted Task Details | Retention and Use Period |

|---------|---------------|-----------------|

| PG company (Paddle, PayPal, etc.) | Payment processing and settlement | Until the statutory retention period or termination of the entrustment contract |

| Cloud service (AWS, GCP, etc.) | Server hosting and data storage | Until membership withdrawal or termination of the entrustment contract |

| Google LLC | YouTube API Services integration, account/content management | Until member account unlinking or membership withdrawal |

| Chinese platform operators (Bilibili, Rednote, Kuaishou, etc.) | Processing necessary for Service provision, such as supporting Chinese platform account integration, authentication, content upload/distribution, and statistics viewing | Until member account unlinking or termination of the entrustment contract (However, data held by each platform itself is subject to the privacy policy and local laws of the respective platform) |

When entering into an entrustment contract, the Company clearly stipulates matters under Article 26 of the Personal Information Protection Act (e.g., restriction on re-entrustment, security measures, supervisory duties) and manages and supervises the consignee to ensure secure processing of personal information.

In the event of any changes to the consignees or the entrusted tasks, the Company will notify users through this Privacy Policy or a notice within the Service.

---

7. Rights of Users and Their Legal Representatives and How to Exercise Them

7.1 User Rights

Users may exercise the following rights with respect to the Company at any time.

1. Request to view (inquire about) personal information

2. Request to correct or delete personal information

3. Request to suspend the processing of personal information (except where restricted by law)

4. Withdrawal of consent for the collection, use, and provision of personal information

5. Membership withdrawal

7.2 How to Exercise Rights

Users may exercise their rights through the following methods.

- Directly edit/delete through the "My Info / Settings" menu within the Service

- Request through the Customer Center (email, phone, mail)

- Email: [support@adoba.net]

- Phone: [+82-10-6952-0109]

- Mail: [Unit 421, Hyundai Parkville, 41 Gongwon-ro, Guro-gu, Seoul, Republic of Korea]

The Company will inform the user of the results of the measures taken within the period prescribed by relevant laws (generally within 10 days) after verifying their identity.

If a request for access, correction, deletion, or suspension of processing is restricted by law, the Company will inform the user of the reason.

7.3 Rights of Legal Representatives

- The legal representative of a child under 14 years of age may exercise the same rights as above with respect to the child's personal information.

- The Company may request supporting documents to verify the status of a legal representative if necessary.

7.4 Revoking Access to YouTube Data

- Users can revoke adobaRo's access to their YouTube data at any time through the Google Account Permissions page.

- Upon revocation, all YouTube API data associated with the user's account will be deleted from adobaRo's systems.

---

8. Destruction of Personal Information

The Company destroys personal information without delay when the retention period expires or the purpose of processing has been achieved and the information is no longer necessary.

8.1 Destruction Procedure

- Personal information for which a reason for destruction has arisen is destroyed without delay after establishing a destruction plan.

- If separate storage is required by law, the information is stored separately in a separate DB or storage location and is destroyed after the relevant period expires.

8.2 Destruction Deadline

- Personal information whose retention period has expired: Within 30 days from the expiration date

- Personal information for which the purpose of processing has been achieved: Within 30 days from the date when it is no longer necessary

8.3 Destruction Method

- Electronic file format: Permanently deleted using a method that makes recovery and restoration impossible

- Paper documents: Shredded with a shredder or incinerated

8.4 Destruction of YouTube and Content Data

- When a member unlinks their YouTube account or withdraws their membership, the linkage token and account-related information collected and stored through the API are deleted.

- Content files are deleted within a reasonable period after the processing purpose (localization, upload, etc.) is achieved, and deletion from the platform server follows the policies of each respective platform.

---

9. Measures to Ensure the Security of Personal Information

The Company takes the following measures to prevent personal information from being lost, stolen, leaked, forged, altered, or damaged.

9.1 Administrative Measures

- Designation of Chief Privacy Officer and person in charge of personal information protection, assignment of roles and responsibilities

- Conducting regular training for employees who handle personal information

- Establishment and inspection of internal personal information handling policies

- Managing access rights to allow only the minimum number of personnel to access personal information

9.2 Technical Measures

- Encryption when transmitting and storing personal information (e.g., SSL/TLS, database encryption, etc.)

- Passwords (if applicable) are stored encrypted using a hash algorithm or similar methods.

- Management of access permissions and operation of access control systems

- Operation of security solutions such as intrusion prevention systems and anti-malware systems

- Storing access logs and preventing forgery/alteration

9.3 Physical Measures

- Storing documents, auxiliary storage media, etc. containing personal information in a secure location with a locking device

- Access control for computer rooms, data storage rooms, etc.

---

10. Operation of Cookies

10.1 What is a Cookie?

A cookie is a small piece of information that a website stores in the user's browser (PC, mobile, etc.), and it is used for maintaining login status, analyzing Service usage statistics, etc.

10.2 Purpose of Using Cookies

- Maintaining login and session

- Service usage statistics and access frequency analysis

- Error analysis, Service quality improvement

- Providing customized content and advertisements (only when consent is given)

※ Cookies are NOT used to track or analyze YouTube API data for purposes other than providing adobaRo's core service functionality.

10.3 Installation, Operation, and Rejection of Cookies

Users have the option to refuse to save cookies or to confirm each time they are saved through their web browser settings.

- The user has the right to choose whether to install cookies.

- By setting the options in your web browser, you can allow all cookies, confirm each time a cookie is saved, or refuse to save all cookies.

How to Adjust Cookie Settings (Examples)

- Chrome: Settings > Privacy and security > Cookies and other site data

- Edge: Settings > Cookies and site permissions > Manage and delete cookies and site data

- Safari: Preferences > Privacy > Cookies and website data

※ If you block cookies, there may be restrictions on using some services, such as logging in.

---

11. Chief Privacy Officer

The Company oversees and is responsible for tasks related to personal information processing, and has designated a Chief Privacy Officer and a responsible department for handling user inquiries and complaints.

Chief Privacy Officer

- Name: [Kim Jun-seong]

- Position: [Head of Division]

- Contact: [+82-2-6952-0109]

- Email: [js.kim@adoba.net]

Department in Charge of Personal Information Protection

- Department Name: [Product Division]

- Person in Charge: [Euna]

- Contact: [+82-2-6952-0109]

- Email: [support@adoba.net]

Users can make all inquiries, complaint handling requests, and damage relief requests related to personal information protection that arise while using the Service to the contact information above, and the Company will diligently respond and process them without delay.

---

12. Request to Access Personal Information

Users can request access to personal information in accordance with Article 35 of the Personal Information Protection Act from the department below.

Department for Receiving and Processing Requests to Access Personal Information

- Department Name: [Product Division]

- Person in Charge: [Euna]

- Contact: [+82-2-6952-0109]

- Email: [support@adoba.net]

---

13. Remedies for Infringement of Rights

Users can contact the organizations below for consultation and dispute resolution regarding personal information infringement.

Reporting and Consultation for Personal Information Infringement

- Personal Information Dispute Mediation Committee: 1833-6972 (www.kopico.go.kr)

- Personal Information Infringement Report Center: (without an area code) 118 (privacy.kisa.or.kr)

- Supreme Prosecutors' Office Cybercrime Investigation Department: (without an area code) 1301 (www.spo.go.kr)

- National Police Agency Cyber Bureau: (without an area code) 182 (cyberbureau.police.go.kr)

---

14. Content Processing and Use of AI Technology

14.1 Processing of Content

The Company may temporarily store and process content that members link or upload for the purpose of providing the Service.

- Details of Processing:

- Script extraction through speech-to-text (STT)

- Generation of translated/localized text

- Generation of subtitle/dubbing files and sync adjustment

- Detection, translation, and regeneration of thumbnail text, etc.

- After processing is complete, original content that is no longer necessary for Service provision will be deleted within a reasonable period, and content uploaded to external platforms will be subject to the policies of those platforms.

14.2 Regarding AI Model Training

- In principle, the Company does not use members' original content and personally identifiable information as training data for the AI model itself.

- Data obtained through YouTube API Services is NEVER used for AI model training or machine learning purposes.

- For Service quality improvement, the Company may analyze statistical and log information, such as translation accuracy and error frequency, in a form that does not identify individuals and does not include YouTube API data.

- If the Company needs to use a limited scope of data (excluding YouTube API data) for AI model training purposes for separate services or functions, it will obtain the necessary consent separately within the scope permitted by relevant laws and regulations.

14.3 Member Rights

- Personal information and original content are automatically deleted according to the Company's internal processing policies. Members may request deletion if necessary, but the timing and method of deletion will follow the Company's policies.

- The authority to manage, delete, or transfer (migrate) channels created or content posted on external platforms through the service is determined by the Service provision method, technical limitations, operational policies, or the regulations of the relevant platform. On some platforms, members can delete content themselves. However, the Company does not bear the obligation to directly perform or guarantee management actions such as deletion, blocking, modification, or transfer (migration) of channels created or content posted on external platforms.

---

15. Matters Concerning International Transfer

During the process of using the Service, some data may be transferred to and stored on servers or platforms located overseas.

15.1 Data Related to YouTube and Google

Data collected through YouTube API Services is processed on overseas servers operated by Google LLC.

- Country of transfer: United States and countries where Google data centers are located (e.g., USA, Singapore)

- Time and method of transfer: Network transmission upon linking with YouTube API and using the Service

- Items transferred: Account information required for YouTube integration, channel and content metadata, statistical information, etc.

- Retention and use period: Until the member unlinks the integration or terminates the Service (in accordance with Google's policy)

- Purpose of use: Strictly limited to providing and improving adobaRo's content localization service functionality, in compliance with Google API Services User Data Policy and Limited Use requirements.

15.2 International Transfer of Personal Information and Platform Data

When distributing content to platforms such as Bilibili, Rednote, and Kuaishou, the related information and data are transferred to the respective local countries in accordance with each platform's terms of use.

- Recipient of transfer: Linked platforms such as Bilibili, Rednote, and Kuaishou

- Country of transfer: United States, China, and regions where each platform operates (in accordance with the respective platform's regulations)

- Time and method of transfer: Transmission via network when using services such as platform integration, account authentication, and content upload

- Items of personal information to be transferred: Account information, personal authentication information, content and metadata, etc.

- Retention and use period: In accordance with the privacy policy of each platform

15.3 Cloud Service Providers

The Company uses the following cloud services to provide its Service, and data may be transferred overseas:

- Recipient of transfer: Amazon Web Services, Inc., Google LLC

- Country of transfer: Countries where each cloud provider's data centers are located, such as the United States, Japan, and Singapore

- Time and method of transfer: Network transmission during the Service use process

- Retention and use period: Until membership withdrawal or termination of the entrustment contract, or for the period required by law

---

16. Protection of Children's Personal Information

- In principle, the Company does not aim to provide services to children under the age of 14. If a child under the age of 14 signs up for membership, the Company obtains consent from their legal representative in accordance with relevant laws and regulations.

- A legal representative may request access, correction, deletion, suspension of processing, or withdrawal of consent for the personal information of a child under the age of 14 at any time.

- The Company may operate age verification and legal representative consent procedures to protect children's personal information, and may take measures such as restricting the account if the provision of false information is confirmed.

17. Changes to the Privacy Policy

- This Privacy Policy may be amended in accordance with changes in laws, Service content, or internal policies.

- If the Company changes the Privacy Policy, it will provide notice of the changes and the effective date through announcements within the Service and other means starting 7 days before the effective date,

- In the case of changes that are unfavorable to users or important (expansion of items collected, extension of retention period, etc.), notice will be given at least 30 days in advance.

- If a user does not agree to the changed Privacy Policy, they may stop using the Service and request to withdraw their membership. If the user continues to use the Service after the changes, they may be deemed to have agreed to the changed content.

---

Addendum

Effective Date: January 28, 2026

Version: 1.1

Version 1.1 Update Summary:

- Added explicit compliance with Google API Services User Data Policy and Limited Use requirements

- Clarified that YouTube API data is not used for marketing, advertising, AI training, or third-party sharing

- Added information about users' ability to revoke YouTube data access

- Enhanced transparency regarding YouTube data handling and retention

---

[adoba Corporation]

CEO: [Ahn Jun-han]

Address: [Unit 421, Hyundai Parkville, 41 Gongwon-ro, Guro-gu, Seoul, Republic of Korea]

Business Registration Number: [390-87-00239]

Mail-order Business Report Number: [No. 2022-SeoulSeocho-2017]

Main Phone Number: [+82-2-6952-0109]

Email: [support@adoba.net]

Chief Privacy Officer: [Kim Jun-seong]

Email: [js.kim@adoba.net]

Phone: [+82-2-6952-0109]