Privacy Policy

immersivecast Co., Ltd. (the "Company") complies with the Personal Information Protection Act of the Republic of Korea and related laws, and processes personal information as described below. This policy applies to the Company website (immersivecast.com), the imSim solution portal (imsim.app, the "Portal"), inquiries and custom validation requests. This English text is a translation. If it differs from the Korean text, the Korean text prevails.

• Portal sign-up: email, password (stored encrypted; the Company cannot read it), name, organization, consent record (items agreed, text version, time) • Sign-up with a Google account: the email and name of the Google account • Customer organization members: the above plus two-step verification enrollment (authenticator app) • Inquiries: name, organization, reply email, inquiry type and field, inquiry text. When a non-member sends an inquiry, an anonymous temporary account (an identifier only) is created. • Information created while using the Portal: run requests (selected robot, test, mode, time) and results, monthly attempts used, uploaded robot files and check results, My AI connection information (connection name, endpoint address, target robot, encrypted connection key, connection logs), result files • Automatically created information: Portal account sign-in records (Google Firebase Authentication), website server access logs (IP address, browser information, requested address, time), My AI connection relay server access logs (IP address, time), Portal visit statistics (Section 9; no information that identifies a person) • Collection: entered by the user on the sign-up, inquiry and Portal screens, or created automatically while using the services.

• Sign-up and identity verification, account management and security (including two-step verification) • Providing the Portal: public results, direct runs and delivery of results, robot file checks, My AI connection tests, monthly attempt limits • Replying to inquiries, consulting on and contracting custom validation • Operating and improving the services: incident response, preventing misuse, visit statistics (statistics that do not identify a person) • Complying with legal obligations The Company does not use personal information for advertising or marketing without separate consent.

• Member information and usage records (run requests, results, attempts used): until the member withdraws; deleted without delay on withdrawal • Internal processing records of direct runs (run plans, basis for attempt counting): kept for 1 year after withdrawal for dispute handling, then destroyed • Uploaded robot files: deleted automatically 90 days after last use, with a notice on screen 7 days before deletion; deleted immediately on the member's request • My AI connection information: until the member deletes the connection or withdraws • Inquiries: 1 year from the reply; if a contract follows, the contract period plus 5 years (retention required by law) • Website server access logs and My AI connection relay server access logs: 14 days • Raw Portal visit records: within 1 day (deleted after daily statistics are made); the statistics contain no information that identifies a person • Information that the law requires to be kept: the period set by that law

• Personal information is destroyed without delay when its retention period ends or its purpose is achieved. • Electronic files are deleted so that they cannot be restored. The file storage is configured not to keep copies of deleted files. • Paper documents are shredded or incinerated.

The Company entrusts the processing of personal information as follows to provide the services. • Google LLC (Google Firebase, Google Cloud): Portal account authentication and authentication emails, storage of member information and usage records (database), storage of robot files and result files, delivery of Portal screens (hosting) • Google LLC (Gmail): sending notification emails to Company staff when an inquiry is received, and sending invitation emails to portal members The Company sets out the matters required by law in its entrustment agreements and announces any change of entrustee in this policy.

Portal account authentication information is processed abroad as follows. Separate consent is obtained on the sign-up screen. • Recipient: Google LLC (Google Firebase Authentication) · Contact: https://support.google.com/policies/contact/general_privacy_form • Country: United States • Items: email, password (encrypted form), sign-in records • Time and method: transmitted over the network at sign-up and sign-in • Purpose: account authentication and security • Retention: until withdrawal • How to refuse and consequences: do not give the transfer-abroad consent on the sign-up screen. You then cannot sign up for the Portal, but you can view public results and send inquiries without signing up. Member information, usage records, uploaded files and result files are stored in the Google Cloud Seoul region (Republic of Korea). Portal screens are delivered through Google's delivery network (Firebase Hosting), and the related connection handling takes place on Google infrastructure. Inquiry notification emails and invitation emails are sent through Google's email infrastructure.

The Company does not provide personal information to third parties, except when the user has consented in advance, when the law specifically provides for it, or when an investigative agency requests it following procedures set by law.

• The Company does not use tracking cookies or external analytics tools. • Portal visit statistics: when a screen is opened, only the screen path (without query conditions), the name of the referring site when the visit comes from outside, the screen language, the screen width class (wide or narrow) and the time are recorded. Member identifiers, names and IP addresses are not recorded. One value that marks whether a screen is the first one opened in the same tab is kept in the browser's session storage; it cannot identify a person and disappears when the tab is closed. Nothing is recorded when the browser's "Do Not Track" setting is on. • The Portal and the website store sign-in state, screen language, video autoplay setting and, before email confirmation, sign-up details (name, organization) on the user's device (browser storage). This information is not sent to the Company and is deleted when site data is cleared in the browser. If storage is blocked, some functions such as staying signed in are unavailable.

• Encryption in transit (HTTPS) • Access control: database access rules that let members read only their own information; only members who have confirmed their email can use the services • Two-step verification (authenticator app) required for customer organization members • Passwords are stored encrypted by Google Firebase Authentication; the Company cannot read them. • My AI connection keys are stored encrypted so that only a key on the Company's server can open them; they cannot be read back even on the member's screen. • Uploaded robot files are checked on an internal server by a separate check process that has no access to the file storage, and working copies are deleted after the check. • Least privilege: administrative credentials are kept on a single internal server with restricted access, and administrative actions such as viewing or deleting robot files are logged.

• Users may at any time request access to, correction, deletion or suspension of processing of their personal information, and may withdraw consent. • To withdraw membership or exercise these rights, email the Privacy Officer (contact@immersivecast.com). The request is handled within 10 days after identity verification, and the result is reported. • Requests may also be made through a legal representative or an authorized person. • Information that another law requires to be kept cannot be deleted; in that case the reason is given.

The Portal is intended for business users, and the Company does not accept sign-ups from children under 14.

• Privacy Officer: Janghee Han, CEO • Email: contact@immersivecast.com • Address: #315, LH Business Growth Center, 54 Changeop-ro, Sujeong-gu, Seongnam-si, Gyeonggi-do 13449, Republic of Korea Questions, complaints and requests for remedy regarding personal information are answered and handled without delay.

For counseling or dispute resolution on personal information infringement, you may contact: • Personal Information Dispute Mediation Committee: +82 1833-6972 (www.kopico.go.kr) • Personal Information Infringement Report Center (KISA): 118 (privacy.kisa.or.kr) • Supreme Prosecutors' Office: 1301 (www.spo.go.kr) • Korean National Police Agency: 182 (ecrm.police.go.kr)

Changes to this policy are announced on the website and the Portal 7 days before they take effect (30 days for changes that are unfavorable to users or significant). • Effective: October 25, 2026 • Previous version: January 30, 2026