Privacy Policy

EVERBLACK Co., Ltd. (hereinafter "Company") complies with the Personal Information Protection Act and the Act on Promotion of Information and Communications Network Utilization and Information Protection, etc., and other applicable laws, and is committed to safeguarding users' personal information and guaranteeing the right to informational self-determination.

As an information and communications service provider, the Company collects personal information necessary for the service provision process and processes it lawfully and legitimately in accordance with the purposes of use. This Privacy Policy applies to all services provided by the Company and specifies the Company's policies regarding the processing of personal information of service users residing in Korea.

By clicking the "Agree" button during membership registration or completing a separate consent procedure, the User is deemed to have fully understood and agreed to the contents of this Privacy Policy.

Article 1 (Purposes of Processing Personal Information)

The Company processes personal information for the following purposes:

Article 2 (Information Not Collected / Privacy-First Policy)

The Company prioritizes the protection of user privacy. The core functions of the Service (slate recognition, file organization, etc.) are executed within the user's PC, and video source files are not transmitted to or collected by the server.

Information not collected: Video source files, video thumbnails, editing project files (.prproj, .drp, .fcpxml, etc.), script files

Exceptions

In the following cases, limited data may be transmitted with the user's explicit consent:

• Error Reporting (Send Logs): Crash logs, error messages, OS/SW version → Software stability improvement (popup consent)
• AI Improvement Participation (Optional): Slate region images only (cropped) → AI recognition accuracy improvement (Settings Opt-in)

Data Collection Principles

(1) The above data is collected only when the user has directly activated consent, and the default setting is disabled (OFF).

(2) Collected data is processed anonymously, separately from user account information, and identifiable information such as file names and paths and text information within images is removed or masked.

(3) Users may withdraw their data transmission consent at any time in the settings. To request deletion of previously collected data, please contact [email protected].

Article 3 (Items of Personal Information Collected)

The Company collects only the minimum personal information necessary for service provision.

3.1 Items Collected During Registration and Service Use

• Required: Name, email address, password (encrypted) — Membership registration and identity verification
• Required: Phone number — SMS verification for one-account-per-person confirmation, account security enhancement, B2B customer technical support
• Required: Hardware identification information (motherboard serial number, CPU serial number, GPU serial number, MAC address, etc.) — License authentication (1 PC policy), prevention of duplicate access
• Optional: Title, business name, address — B2B customer management, emergency technical support

3.2 Items Collected During Payment

• Required: Payment transaction ID, payment status — Transaction identification information issued by TossPayments or Paddle (credit card information is processed directly by the payment processor; the Company does not store it)
• Required: Payment records (amount, date/time, approval number) — Transaction history management, refund processing
• Required: Billing address (for international payments) — Paddle payment processing, tax calculation

3.3 Automatically Collected Items

• Automatic: IP address, country — Prevention of fraudulent use, access region verification
• Automatic: Cookies — Login maintenance, user settings storage
• Automatic: Access logs, browser information — Service usage records, dispute resolution
• Automatic: OS version, software version — Compatibility verification, technical support

3.4 Items Collected for Service Improvement (Optional Consent)

• Optional: Error logs, error messages, OS/SW version — Software stability improvement (popup consent)
• Optional: Slate region capture images — AI recognition accuracy improvement (Settings Opt-in)

* The above items are not collected without the user's explicit consent.
* Complete video source files are never collected under any circumstances.

Slate images are utilized solely for AI model training on EVERBLACK's domestic (Republic of Korea) servers. They are destroyed within 6 months after training completion. File names, paths, and text within images are masked. As processing occurs on domestic servers, this does not constitute a cross-border transfer.

3.5 Coin Usage History

• Required: Coin purchase date/time, package name, quantity purchased, payment amount — Payment history management
• Required: Coin usage date/time, quantity used, remaining coin balance — Service provision and dispute resolution

3.6 Collection Methods

(1) When users consent to the collection of personal information and directly enter information during the membership registration and service use process

(2) Automatic collection of IP address and browser information upon service login

(3) Automatic collection of hardware unique identification information of the device used through the software activation process during installation (used only for anti-piracy and license authentication purposes; stored in encrypted form)

(4) Collection of crash logs with user consent through a popup when an error occurs

(5) Collection of slate region images when 'AI Improvement Program Participation' is enabled in the settings menu

(6) Automatic recording of transaction history by the system during coin purchase and use

Article 4 (Retention and Use Period of Personal Information)

The Company processes and retains personal information within the retention period prescribed by applicable laws or the retention period consented to by the data subject.

Dormant Account Processing

Accounts that have not been logged into for 3 years are automatically converted to dormant accounts (processed automatically daily at 3:00 AM), separately stored, and immediately destroyed when the relevant retention period expires. Coin balances of dormant accounts are maintained as-is and are automatically restored upon login. Coin balances are separately preserved during dormant processing and restored upon reactivation.

Article 5 (Entrustment of Personal Information Processing)

The Company entrusts personal information processing as follows for smooth personal information operations.

5.1 Domestic Entrustment

* Email delivery (via Gmail SMTP) constitutes a cross-border transfer by Google LLC and is separately described in Article 6, Section 6.3.

5.2 Overseas Entrustment

Entrustment to overseas entities is separately described in Article 6 (Cross-border Transfer of Personal Information).

In accordance with Article 26 of the Personal Information Protection Act, the Company takes necessary measures to ensure that trustees process personal information safely, including compliance with personal information protection laws, technical and administrative protective measures, restrictions on re-entrustment, liability for damages, and return or destruction of personal information upon completion of processing, when entering into entrustment contracts.

Article 6 (Cross-border Transfer of Personal Information)

The Company transfers personal information overseas as follows for service provision.

6.1 Cloudflare R2 (Data Storage and Authentication Server)

6.2 Paddle (International Payment Processing)

6.3 Google LLC (Email Delivery)

6.4 User Rights

Users have the right to refuse consent to the above cross-border transfers of personal information.

• Refusal of Cloudflare R2 transfer → License authentication unavailable → Service use unavailable
• Refusal of Paddle transfer → International payment unavailable → Only domestic payment (TossPayments) available
• Refusal of Google LLC transfer → Unable to receive verification emails and service notifications → Some features such as membership registration and password reset may be restricted
• Refusal of AI training data → No impact on service use (optional)

Article 7 (Destruction of Personal Information)

The Company shall destroy personal information without delay when it is no longer needed, such as upon expiration of the retention period or achievement of the processing purpose.

7.1 Destruction Procedure

Personal information subject to destruction is selected, and destruction is carried out upon approval of the Company's Personal Information Protection Officer.

7.2 Destruction Methods

• Electronic files: Permanently deleted using methods that prevent recovery
• Paper documents: Shredded or incinerated

7.3 Destruction of Hardware Identification Information

(1) Hardware identification information is used for software activation and anti-piracy purposes and is immediately destroyed when the purpose of use has been achieved.

(2) When a user deletes the software or withdraws their account, the corresponding hardware identification information is immediately destroyed and cannot be recovered by any means.

(3) Collected hardware information is stored in a separate encrypted area and is not combined with personally identifiable information.

Article 8 (Provision and Sharing of Personal Information)

(1) As a general principle, personal information cannot be provided to third parties unrelated to the service without the user's consent.

(2) However, the Company may provide personal information to third parties without the user's consent in the following cases in accordance with applicable laws:

• When requested by investigative agencies or other government bodies through lawful procedures pursuant to law
• When credit and debt relationships remain from service use, until the settlement of such relationships
• Even after a user withdraws, information of users who engaged in improper conduct may be retained for 3 years from the date of withdrawal to prevent recurrence of fraudulent use
• Other cases required by law

Article 9 (Rights and Obligations of Data Subjects and Methods of Exercise)

9.1 Rights of Data Subjects

Users (or legal representatives) may exercise the right of access, right of correction, right of deletion, and right to suspension of processing against the Company at any time.

9.2 Methods of Exercise

• Email: [email protected]
• In-service settings: 'Account Settings > Personal Information Management' menu

The Company shall take action within 15 days of receiving a rights exercise request and notify the requester of the results.

9.3 Exercise Through a Representative

Users may exercise their rights through a representative by submitting a power of attorney in accordance with the Personal Information Protection Act.

Article 10 (Measures to Ensure the Security of Personal Information)

The Company implements the following measures in accordance with Article 29 of the Personal Information Protection Act:

10.1 Administrative Measures

Establishment of internal management plans, minimization of processing personnel and access management, regular security training

10.2 Technical Measures

Differentiated access authorization, access log retention, encrypted storage of unique identification information, SSL encrypted communications, application of security solutions

10.3 Physical Measures

Server access control, operation of security facilities, establishment of access log management systems

Article 11 (Response to Hacking and Viruses)

The Company operates up-to-date security programs to prepare for external attacks such as hacking, ransomware, and viruses, and conducts regular backups to prevent damage to personal information.

Article 12 (Protection of Minors' Personal Information)

Registration of children under the age of 14 is restricted. The Company enforces policies including the right of legal guardians to exercise rights, the principle of minimum collection, and prohibition of marketing targeting minors.

Article 13 (Installation, Operation, and Rejection of Automatic Personal Information Collection Devices)

13.1 Purpose of Cookie Use

• Essential cookies: Login maintenance, security (upon session termination)
• Functional cookies: User settings storage (1 year)
• Analytics cookies: Service usage statistics (1 year)

13.2 How to Reject Cookie Settings

Users may reject cookie storage through web browser settings (Chrome, Edge, Safari, etc.).

* Rejecting cookie storage may cause difficulty in using some services such as login maintenance.

Article 14 (Personal Information Protection Officer)

Article 15 (Remedies for Rights Infringement)

• Personal Information Infringement Report Center: 118 (no area code) (privacy.kisa.or.kr)
• Personal Information Dispute Mediation Committee: 1833-6972 (www.kopico.go.kr)
• Supreme Prosecutors' Office Cyber Investigation Division: 1301 (no area code) (www.spo.go.kr)
• National Police Agency Cyber Bureau: 182 (no area code) (cyber.go.kr)

Article 16 (Changes to This Privacy Policy)

This Privacy Policy may be amended through additions, deletions, or modifications of content in accordance with changes in laws, policies, or security technologies. In the event of changes, notice shall be given at least 7 days prior to the effective date. In the event of material changes affecting user rights, notice shall be given at least 30 days in advance.

Supplementary Provisions

Article 1 (Effective Date) This Privacy Policy shall take effect on April 1, 2026.

Article 2 (Previous Policy) The previous Privacy Policy (v1.4) shall remain in effect until the day before the effective date of this Policy.

Effective Date: April 1, 2026