CODE CRAYON Co., Ltd. (hereinafter referred to as the “Company”) complies with applicable laws and regulations, including the Personal Information Protection Act and the Act on Promotion of Information and Communications Network Utilization and Information Protection, and safely protects personal information processed in the course of providing the Shortime Studio service (hereinafter referred to as the “Service”).

This Privacy Policy has been established to describe the standards and protective measures applied to personal information processed by the Company as a B2B SaaS platform provider in the course of providing the Service, performing contracts, and conducting service operations.

Article 1 (Principles of Personal Information Processing)

1. The Company processes personal information in a lawful and fair manner in accordance with applicable laws and regulations for the purpose of providing the Service.
2. The Company collects and uses only the minimum amount of personal information necessary for service operation, and where the purpose of processing is changed, the Company shall comply with the procedures required under applicable laws.

Article 2 (Purpose of Processing Personal Information)

1. The Company processes personal information for the purposes set forth below.

   Personal information shall not be used for purposes other than those specified below, and where the purpose of use is changed, the Company shall take necessary measures in accordance with applicable laws.

   Purposes of Processing and Legal Basis

   Category	Purpose of Processing	Legal Basis
   Membership Registration and Account Management	• Identification of customer companies
   • Creation and management of administrator accounts
   • Authentication for service use	Article 15(1) of the Personal Information Protection Act
   Service Provision and Operation	• Provision of the administrator console
   • Content management
   • Service operation notices	Article 15(1) of the Personal Information Protection Act
   Contract and Billing Management	• Contract execution and maintenance
   • Billing and fee settlement
   • Invoice issuance	Article 15(1) of the Personal Information Protection Act
   Customer Support	• Responding to inquiries
   • Handling complaints
   • Notices and communications	Article 15(1) of the Personal Information Protection Act
   Legal Compliance	• Retention of accounting and tax records
   • Dispute response	Framework Act on National Taxes, Commercial Act, etc.

2. The specific personal information processed by the Company is limited to information directly provided by the Member (Customer) or administrator accounts during service use, such as name, email address, company name, job title, and contact information, and is processed only to the minimum extent necessary for each purpose.

Article 3 (Retention and Processing Period of Personal Information)

1. The Company retains and uses personal information until the purpose of collection and use has been achieved, and in principle, destroys such personal information without delay once the purpose has been fulfilled.
2. Notwithstanding the foregoing, where applicable laws require retention for a certain period, the Company may retain personal information for the period prescribed by such laws.

1. Retention Period Based on Service Use

1. Personal information collected and processed in connection with service use shall, in principle, be retained until the termination of the service use contract.
2. Upon termination of the contract or service use, the Company shall inform the Member of the procedures for returning or destroying personal information, and shall process such information in accordance with the Member’s choice or applicable laws.

2. Retention Required by Law

The Company retains personal information for the periods specified below where required by applicable laws: