Witcom Co., Ltd. (the “Company”) values the privacy of users of SafeBite Korea (the “Service”) and complies with the Personal Information Protection Act (PIPA) and other applicable laws of the Republic of Korea. This Privacy Policy explains what personal data the Company processes, for what purposes, and how it is protected. The Company recognizes that allergy and dietary information is sensitive data directly related to a user’s health, and its guiding principle is to process such data minimally and, in principle, only on the user’s own device.

Article 1 (Data Processing Principles)

(1) The Company aims to provide a service usable without account registration, and processes only the minimum data necessary to provide the Service.

(2) The allergy/dietary profile, favorites, and analysis history entered by the user are, in principle, stored only on the user’s device and are not transmitted to or collected by the Company’s servers.

(3) Menu/food photos are processed for analysis and then deleted immediately; the Company does not, in principle, store original images.

Article 2 (Personal Data Processed and Collection Methods)

The personal data processed by the Company is as follows.

Collection methods: direct input by the user within the app (selecting allergens/diets, taking photos, submitting reports), and automatic generation/collection in the course of using the Service.

Notice on captured images: In analyzing menu/food photos, the Company does not identify or separately collect personal information unrelated to the purpose of the Service, such as individuals (faces, etc.) that may appear in an image, and does not use such information for any purpose other than AI analysis; it is deleted immediately upon completion of analysis.

Article 3 (Processing of Sensitive Data)

(1) Allergy information constitutes sensitive data (information concerning health) under Article 23 of PIPA. The Company obtains the user’s separate consent, distinct from consent to the processing of other personal data, before processing such information.

(2) Allergy/dietary information is, in principle, stored only on the user’s device and is not transmitted to servers. Only where the user uses a server-based add-on feature such as account synchronization will such data be processed after obtaining explicit consent, and it will be encrypted.

(3) If the user does not consent to the processing of sensitive data, use of related features such as allergy/dietary analysis may be restricted.

Article 4 (Purposes of Collection and Use)

• Provision of the Service: analysis of food allergen/dietary suitability, recognition and analysis of menu/food photos, multilingual translation, and generation of staff guidance cards
• Improvement of the Service: enhancing analysis accuracy, diagnosing/fixing errors, and verifying menu/ingredient data based on user reports
• Advertising and credits: providing rewarded advertising, granting credits for viewing ads, and preventing fraudulent accrual
• Fraud prevention: detecting and responding to abuse such as fraudulent reward accrual
• Customer support: handling inquiries/complaints and delivering notices and important information

Article 5 (Retention and Use Period)

(1) The Company destroys personal data without delay once the purpose of collection and use has been achieved.

• Data stored on the device (allergy/dietary/favorites, etc.): deleted immediately when the user deletes it in the app or uninstalls the app
• Menu/food photos: deleted immediately upon completion of analysis
• Server usage records/logs: retained and destroyed in accordance with the periods prescribed by applicable law (see table below)

(2) In accordance with applicable laws, the following information is retained for the specified periods.

Article 6 (Provision to Third Parties)

(1) The Company does not use personal data beyond the scope stated in this Policy or provide it to third parties. Exceptions apply only where the user has consented in advance or where specifically required by law.

(2) To provide personalized/rewarded advertising, advertising identifiers and similar data may be provided as follows.

Users may limit personalized advertising in device settings (see Article 10).

Article 7 (Entrustment of Processing)

For smooth provision of the Service, the Company may entrust the processing of personal data as follows, and stipulates necessary matters in the entrustment agreement to ensure data is managed safely.

Where the processors or scope of work change, the Company will disclose this through this Policy without delay.

Article 8 (International Transfer of Personal Data)

Some processing—such as AI analysis, cloud operation, and advertising—may take place outside Korea, in which case personal data may be transferred abroad as follows.

Users may refuse the international transfer of their personal data; in such case, related features (e.g., photo-based AI analysis) may be restricted.

Article 9 (Rights of Users and How to Exercise Them)

(1) Users may at any time request access to, correction, deletion of, or suspension of processing of their personal data.

(2) Allergy/dietary information and records stored on the device can be edited or deleted directly in the app settings, and uninstalling the app deletes all such information.

(3) Requests concerning data processed on servers may be submitted to the Data Protection Officer in writing or by email (kbu0519@witcom.co.kr), and the Company will act without delay in accordance with applicable law.

Article 10 (Automatic Data Collection and Opt-out)

(1) The Company may use advertising identifiers (ADID/IDFA) and similar technologies for personalized advertising and service analytics.

(2) Users may refuse or reset these in device settings as follows.

• iOS: Settings > Privacy & Security > Tracking — decline app tracking requests
• Android: Settings > Google > Ads — reset advertising ID or opt out of personalization

Article 11 (Destruction Procedure and Method)

(1) Destruction procedure: personal data whose purpose has been achieved is destroyed without delay; where retained under law, it is stored separately before destruction.

(2) Destruction method: electronic files are deleted using technical methods that render them unrecoverable, and printed materials are shredded or incinerated.

Article 12 (Security Measures)

• Administrative: establishing/operating an internal management plan, minimizing personnel handling personal data, and regular training
• Technical: encryption of personal data, access control, retention of access logs, and installation/updating of security programs
• Physical: access control to server rooms and data storage areas

Article 13 (Personal Data of Children Under 14)

In principle, the Company does not collect the personal data of children under the age of 14. Where a child under 14 wishes to use the Service, the consent of a legal guardian is required, and where the laws of the user’s country set a different age threshold, that threshold applies.

However, it is an exception where a guardian stores and uses a child’s allergy/dietary information locally on the device through in-app features; the Company does not collect or transmit such information to servers, and it is deleted immediately when the guardian deletes it in the app or uninstalls the app.

Article 14 (International Users and GDPR Notice)

(1) The Service is provided to foreign visitors to Korea in multiple languages (Korean, English, Chinese (Simplified/Traditional), and Japanese).

(2) Users in the European Economic Area (EEA)/UK may have rights under applicable law (such as the GDPR), including access, rectification, erasure, restriction of processing, data portability, and objection; the Company’s legal bases for processing are the user’s consent and legitimate interests.

(3) For EEA users, allergy and other health-related information constitutes special category data under the GDPR, and its processing is based on the user’s explicit consent (GDPR Article 9(2)(a)). Users may withdraw consent at any time.

(4) This Policy is originally written in Korean; in the event of any discrepancy in interpretation with a translated version, the Korean version prevails.

Article 15 (Data Protection Officer)

Data Protection Officer: Kim Byung-wook / Team Lead, Solution Sales Team

Department: Solution Business Division, Solution Sales Team

Contact: +82-2-2149-7733 / Email: kbu0519@witcom.co.kr

Users may direct inquiries, complaints, and remedy requests concerning personal data protection to the contact above, and the Company will respond promptly and sufficiently.

Article 16 (Remedies for Infringement of Rights)

Users may seek consultation, reporting, or dispute mediation regarding personal data infringement from the following bodies.

• Personal Information Dispute Mediation Committee: +82-1833-6972 (www.kopico.go.kr)
• Privacy Infringement Report Center: 118 (privacy.kisa.or.kr)
• Supreme Prosecutors’ Office Cybercrime Division: 1301 / National Police Agency Cyber Bureau: 182

Article 17 (Changes to this Privacy Policy)

(1) This Policy may be amended in line with changes in law or the Service. Any amendment will be announced through in-app notices at least 7 days before the effective date; for changes that materially affect user rights, at least 30 days in advance.

Announcement date: Jul 21, 2026 Effective date: Jul 21, 2026