Privacy Policy

1. Personal Information We Collect

The Company collects the minimum information necessary to provide the Service. Below are the items the Service actually handles today.

a. At sign-up (required)

• Email address
• Name or display name
• Password — only if you signed up by email; stored in a form that cannot be decrypted.

b. If you start with a social account (required)

If you start with a Kakao, Naver, Google, or LINE account, the Company receives the information below from that provider. You can check which items are shared on the consent screen at login.

• Member identifier from that service
• Email address
• Name set in the profile

c. If you apply as a business member (optional)

• Business name, representative's name, business registration number
• Business address, industry/type of business
• Contact person's phone number and email

The Company treats the business registration number as personal information and displays it on the Service screen only in a partially masked form.

d. Information automatically generated or collected while using the Service

• Access IP address and access time
• Browser type and device information
• Service usage records and error logs
• Cookies and session tokens needed to keep you logged in

e. Data you enter into the Service

Data you enter directly — such as the team name, items, receiving/shipping/inventory/processing records, and business partner names — is stored under that team.

A business partner name may include an individual's name or contact information. In that case, the User (the Team's Owner) decides what information to enter and is responsible for managing it, and the Company stores and processes it on the User's behalf, only to the extent necessary to provide the Service.

In other words, in this part of the Service, the User acts as the data controller and the Company as the processor. The Company does not use this data beyond the User's instructions and the scope stated in this Policy, and does not verify whether the User has obtained the necessary consent from data subjects such as its business partners. Confirming and providing that notice is the User's own responsibility.

The specific legal status may vary depending on the purpose and manner in which the User uses that information. The Company only describes the facts and each party's role as above, and does not substitute for a legal determination of any individual case.

2. How We Collect Personal Information

• Entered directly by the User on sign-up and service screens
• Provided by a social login provider (with the User's consent)
• Automatically generated or collected while using the Service

3. Purposes of Use

• Member identification, keeping you logged in, and identity verification
• Creating and managing teams, and inviting/managing member permissions
• Providing and maintaining the Service, including inventory management features
• Customer support, including delivering notices and responding to inquiries
• Preventing fraudulent use, responding to failures, and ensuring service stability
• Delivering web push notifications — only if you have allowed notifications in your browser.
• Confirming paid-plan applications and billing fees
• Statistical analysis to improve the Service — processed so individuals cannot be identified.

The Company uses a payment service through a payment gateway to provide paid services. Key payment information such as card numbers and CVCs is not stored directly by the Company and is processed through the payment gateway. The Company may process information necessary to provide the Service and preserve transaction records, such as payment status, payment amount, payment date and time, and payment approval number.

The Company does not use personal information for any purpose other than those listed above.

4. Retention and Use Period

The Company destroys personal information without delay once its retention period has elapsed or the purpose of processing has been achieved. However, information that must be retained for a set period under applicable law is kept separately for that period before being destroyed.

Except for the items retained above on a statutory basis, all other personal information is destroyed upon account withdrawal.

5. Provision of Personal Information to Third Parties

The Company does not provide Users' personal information to third parties, except where the User has given prior consent, or where an investigative agency or similar authority lawfully requests it under applicable law.

There is currently no third party that receives personal information. The Company does not disclose the inventory data a User enters to any outside party for advertising, sale, analysis, or any other purpose. If third-party provision becomes necessary, the Company will notify the recipient, purpose, items, and retention/use period in advance and obtain the User's consent.

The outsourcing described in Section 6 below is work the Company assigns to run the Service, which is different from providing information to a third party.

6. Outsourcing of Personal Information Processing

The Company outsources the following work to outside parties to operate the Service. The Company manages and supervises each processor by contract to ensure personal information is handled safely.

These five are all of them. If the outsourced work or the processor changes, the Company will revise this Policy and provide notice.

What web push notifications contain: only a notification title, a short message, and the address of the screen to open when clicked. They do not contain inventory quantities, business partner names, or item names. The Company does not separately store the content of notifications it has sent. You can turn off notifications at any time in your browser settings.

7. Overseas Transfer of Personal Information

The database and web servers the Company uses store data at a data center located in Seoul, Republic of Korea. However, because the operator of this Service is headquartered in the United States, the Company discloses the recipient, destination country, transferred items, purpose, and retention period below, as required by applicable law. The Company does not hide this fact.

The method of transfer is transmission over an information and communications network.

A User may refuse the overseas transfer of personal information. However, because the processing above is essential to providing the Service, refusing it will make sign-up and use of the Service difficult. If you wish to refuse, contact us at Contact and we will guide you through account withdrawal. To refuse only the transfer related to web push notifications, simply turn off notifications in your browser settings.

8. Destruction of Personal Information

Personal information whose retention period has passed or whose processing purpose has been achieved is destroyed without delay.

• Information in electronic file form: deleted using a method that prevents recovery
• Information in paper document form: shredded or incinerated

When a member withdraws, that member's information is destroyed together with the withdrawal process. Other personal information is destroyed within 5 days of the date the reason for destruction arises.

However, user data accumulated in a Team is retained for 30 days from the Team's termination date, in accordance with Terms of Service, Article 11, before being destroyed. Users may download the data during that period.

9. User Rights and How to Exercise Them

A User may exercise the following rights at any time.

• Request to access personal information
• Request for correction if there is an error
• Request for deletion
• Request to suspend processing
• Withdrawal of consent to collection/use (account withdrawal)

You can handle this directly on the settings screen within the Service, or contact us at Contact and we will act after confirmation.

About team data: where a Team is shared by multiple people, one person's withdrawal does not delete the entire Team's inventory records. The withdrawn person's member information is destroyed, but the receiving/shipping/inventory records they left in the Team remain as the Team's records and are managed by the Owner.

To clear a Team's records entirely, the Owner must terminate the Team, in which case the records are retained for 30 days from the termination date before deletion. If a Member wants a specific record they entered deleted, they may request it from the Team Owner or contact us at Contact.

10. Cookies and Other Automatic Collection Tools

The Company uses cookies and browser storage to keep you logged in. You may refuse to store cookies in your browser settings, but in that case you will not be able to use features that require login.

The Company may display advertising in some services, such as the Free plan. Where cookies, online identifiers, behavioral information, or personal information are processed in the course of serving ads, the Company will, before actually introducing the ad service, provide the necessary information through this Privacy Policy or similar means, in accordance with applicable law.

The Company does not currently use any analytics tool that tracks and records a User's behavior. Cookies and browser storage are used only to keep you logged in.

11. Personal Information of Children Under 14

The Company does not provide the Service to children under 14 years of age, and does not collect personal information from children under 14 years of age.

HeroG is a service for recording a business's inventory and is not directed at children under 14, and the Company does not maintain a separate age-verification process at sign-up. If it is confirmed that a child under 14 has signed up, the Company will promptly terminate that account and destroy the personal information collected.

12. Measures to Ensure Security

• Passwords are stored in a form that cannot be decrypted.
• Data in transit uses encrypted communication (HTTPS).
• Data access permissions are separated by team, so that data from a team you do not belong to cannot be accessed.
• An operator's access to the admin screen and any viewing/changes are kept in a separate log.
• Access to systems that process personal information is granted only to the minimum personnel necessary for their work, and is revoked immediately when their role changes.
• If a personal information breach is confirmed, the Company notifies Users and the relevant authorities in accordance with applicable law and takes measures to prevent further harm.

The Company takes the measures described above. However, it does not guarantee that all risk can be eliminated from exchanging and storing information over the internet.

13. Data Protection Officer

Inquiries, complaints, and requests for remedy regarding personal information processing are received at the email address above. The Company reviews what is received and responds without delay.

14. Remedies for Rights Infringement

If you need consultation or need to report a personal information breach, you may contact the organizations below.

Each organization's phone number and reception hours can be found on the website above. They are not listed in this Policy because they are subject to change.

If your rights are infringed by an action or omission of the Company related to personal information protection, you may also file an administrative appeal under the Administrative Appeals Act (행정심판법).

15. Changes to This Policy

If this Policy is changed, the Company will state the changes and the effective date and give notice through Notices starting 7 days before the effective date. For changes unfavorable to Users, the Company will give notice starting 30 days before the effective date and, during that same period, will separately notify each User by the email address registered at sign-up or through an in-service notification.

The previous Policy, effective from August 28, 2026, is superseded by this Policy as of its effective date.

Announced September 5, 2026 · Effective September 5, 2026