Language notice. This English text is a translation provided for convenience. If there is any conflict with the Korean Privacy Policy, the Korean version prevails.

FORCIERS Co., Ltd. (the “Company”) establishes and discloses this Privacy Policy under Article 30 of the Personal Information Protection Act of Korea to protect the personal information of data subjects and to handle related complaints promptly and smoothly for ‘LINKBOO’ (linksboo.com), the global blog traffic and marketing platform it operates, the LINKBOO app, and the connected multilingual blog service ‘LINKBLOG’ (linksboo.blog) (together the “Service”).

Article 1 (Purposes of Processing)

The Company processes personal information for the following purposes. It is not used for other purposes; if a purpose changes, the Company will take the necessary steps, such as obtaining separate consent under Article 18 of the Personal Information Protection Act.

1. Website and app membership: confirming the intent to register, identifying and verifying members (email and phone verification, Google sign-in), maintaining membership, preventing misuse such as macros, multiple accounts and VPN bypass, preventing misuse such as re-registering right after withdrawal, and handling complaints
2. Handling inquiries: identifying the requester, checking the request, contacting for fact-finding, and notifying the result
3. Providing the platform and Reward settlement: registering and exposing LINKBOO links, creating and publishing AI multilingual review-style curation/translation pages, measuring valid views and dwell time, determining visitors’ country (statistics and exposure), point top-ups, payments and refunds and recovering points when payments are cancelled or refunded, preventing payment fraud, exchanging Free Points for mobile coupons, sharing ad revenue, paying out Reward Points and handling withholding tax
4. App notifications: sending service notifications (push) such as messages, comments and points when the member allows notifications in the app
5. Marketing and advertising (optional consent): developing new services and personalized services, providing events and promotional information and opportunities to participate, checking service effectiveness, and compiling usage statistics
6. Community (Lounge) and report handling: posts, comments, messages, friends and blocks; automatic translation of posts and comments (Korean and English); the Aquarium, Daily Fortune and Billboard; reviewing and handling reported posts and messages; restricting members who break the rules; and reporting illegal content such as child sexual abuse material to the authorities

Article 2 (Retention Periods)

1. The Company processes and keeps personal information within the period required by law or consented to by the data subject at collection.
2. Membership, inquiries and service provision: kept from registration until withdrawal in principle. When a member withdraws, the nickname, profile photo, bio and social links, mobile number, Google account ID, point balances and app push tokens are deleted immediately, the email address is made unidentifiable and the password is invalidated. The anonymized basic account record and the remaining member data (Google profile picture URL, hashed device identifiers, etc.) are deleted completely 30 days after withdrawal.
3. Incomplete sign-ups: accounts that never completed email verification, never signed in and have no service use (links, points, phone verification, etc.) are deleted without delay once the verification link expires (48 hours after the verification email is sent; if a new verification email was requested, the most recent one counts). If the same email signs up again, such an account whose link has expired may be removed before the new registration.
4. Preventing re-registration right after withdrawal: to apply the re-registration limit in Terms Article 16, irreversibly converted values (hashes) of the withdrawn member’s email address and mobile number are kept for 1 month after withdrawal and then destroyed. To allow restrictions if abuse is discovered after withdrawal, hashes of the email address, mobile number and Google account ID are also kept with the basic account record for 30 days.
5. Preventing re-registration by abusers: for members restricted (blocked) or terminated under Terms Article 14, hashes of the email address, mobile number and Google account ID, together with the reason and date of the restriction, are kept separately for 5 years from the restriction to limit re-registration and verification, even if the account is deleted. Hashed app device identifiers used by a restricted account are kept until that account’s data is deleted, to decide payment restrictions for other accounts on the same device.
6. Payment and point records: order, payment, refund and chargeback records and the point credit/spending history are kept for the statutory period in paragraph (9) (5 years). If a member gave up the right to a refund of unassigned Paid Points when withdrawing, the amount and time of agreement are recorded in the point history for dispute handling and kept for 5 years as a record of contracts and withdrawals of offers.
7. Community posts and messages: posts, comments and messages a member deletes stop showing in the Service right away, and a message is destroyed once both members delete it. Report records, and posts or messages removed after a report, are kept for 3 years after the report is resolved and then destroyed; in cases such as child sexual abuse material they are kept for as long as an investigation or trial requires.
8. Usage records: link visit records are deleted automatically after 30 days, first-visit source records (access IP stored only as a hash) after 90 days, and referral visit records (Article 3(4)) 90 days after the visit date.
9. Retention required by law: where laws require retention, the information is kept separately for the statutory period.
   1. Records of contracts or withdrawal of offers: 5 years (Act on the Consumer Protection in Electronic Commerce)
   2. Records of payment and supply of goods: 5 years (same Act)
   3. Records of consumer complaints and dispute handling: 3 years (same Act)
   4. Records of labeling and advertising: 6 months (same Act)
   5. Website access records (logs, IP): 3 months (Protection of Communications Secrets Act)

Article 3 (Items Processed)

The Company collects and processes the following personal information to provide the Service.

1. Membership and account management
   1. Required: email address, password, nickname, consent records (versions and times of consent to the Terms and Privacy Policy, confirmation of age 14 or older)
   2. When verifying a phone: mobile number
   3. When signing up or in with a Google account: Google account ID, email address, name (used only to create a nickname), profile picture URL
   4. Optional: how you joined (referral code), whether you consent to marketing information and the time of consent or withdrawal
   5. Security: the mobile number, Reward payout account details (bank name, account number, account holder), payment identifiers (payment email, card issuer, partly masked card number) and temporary values stored during phone verification are stored encrypted with KISA SEED (symmetric key), and passwords are protected with a one-way hash that cannot be decrypted.
2. Paid point payments and refunds
   1. Common: order number, product (point package), amount and currency, payment/refund/chargeback status and time
   2. Credit card and other Korean won payments: payment gateway payment number, card issuer name, partially masked card number, receipt URL
   3. PayPal (US dollar) payments: PayPal order, transaction and refund IDs, dispute status
   4. Google Play in-app purchases: Google Play order number, purchase token (and its hash), product ID, refund/cancellation reason
   5. The Company does not collect full card numbers or PayPal or Google account passwords; payment providers process payment details directly.
3. Reward settlement and payouts — required: account holder name, bank name, account number, country of residence, identity information (name, mobile number), valid view and dwell statistics, tax documents (where required by law)
4. Information collected automatically during use (security and abuse prevention)
   1. Purpose: blocking deceptive activity such as macros, bots, VPN/proxy bypass, self-clicking and multiple accounts; measuring valid dwell and views under the Company’s criteria (per the Policy); visitor country statistics
   2. Items: access IP address, access country (country code determined from the IP by Cloudflare), cookies, service use and access logs, browser information (type and version, visible/blur state), and a device hash derived from browser information
   3. Non-logged-in visitors who arrive through a referral link (?ref=): referrer cookies (rid and lb_ref — the referrer’s ID and referral code, 30 days) and referral visit records used to decide referral visit credits (Article 5(4) of the Points & Rewards Policy): the referrer, the link visited, the visit date, a non-reversible hash combining the visitor’s IP address and the link, and the device hash. Referral visit records are kept for 90 days from the visit date and then deleted (Article 2(8)).
5. When using the app
   1. App push token (Firebase Cloud Messaging registration token), if the member allows notifications in the app
   2. Device identifier: an irreversible hash of the Android device ID (cookie lb_dev), used only to prevent payment fraud from devices previously used by restricted accounts
6. Community (Lounge)
   1. Items: posts and comments you write (including automatic translations), messages you send and receive (content, sender, recipient, time), friend and block lists, reports (reason, time, outcome), Aquarium, Billboard and Cosmetics shop activity records, Question of the day votes and quiz answers, activity score and titles, Aquarium showcase posts and share cards, and creator profile visibility settings
   2. Message content is reviewed by the Company only when the recipient reports it.
   3. Daily Fortune: your date and time of birth are not stored on our server. Only an irreversibly converted value of your input and the reading are stored; your input stays only on your device (browser). To write the reading, the calculated Saju, zodiac and tarot information and the gender you choose are sent to the Google Gemini API (Article 8).
7. AI Multilingual Blog
   1. Purpose: creating and publishing AI multilingual review-style curation/translation pages and supporting search exposure
   2. Items: the original blog URL you register, body text, image URLs and image data in the post
8. When exchanging Free Points for mobile coupons: mobile number to receive the coupon, exchanged item and sending records

Article 4 (How Consent Is Obtained; Separate Marketing Consent)

1. At sign-up, the Company clearly separates required and optional items so that users can understand and consent to the collection and use of personal information.
2. Consent to receive marketing and promotional information (email, text messages, etc.) is optional; not consenting does not limit sign-up or use of the core platform services in any way.
3. Members can turn marketing consent on or off at any time under “Marketing messages” on the My Info screen; turning it off withdraws consent. The Company records the time of consent and withdrawal. Consent can also be withdrawn through Customer Support.

Article 5 (Children Under 14)

Considering the nature and audience of the Service, the Company in principle does not collect personal information from children under 14 and does not allow them to register.

Article 6 (Provision to Third Parties)

1. The Company processes personal information only within the scope stated in Article 1 and provides it to third parties only where Articles 17 and 18 of the Personal Information Protection Act apply, such as with the data subject’s prior consent or under special provisions of law.
2. The Company does not provide members’ personal information to outside third parties without authorization.
3. When illegal content such as child sexual abuse material is confirmed, the Company may provide that content and related account information to investigative agencies, the Korea Communications Standards Commission and other relevant authorities as required by law.

Article 7 (Entrustment of Processing)

The Company entrusts the following processing to run the Service smoothly and supervises the processors to make sure they handle personal information safely. For overseas processors, the country, items and other details are also given in Article 8.

If further entrustment is needed (e.g. messaging or email services), the Company will amend and announce this Policy before starting it.

Article 8 (Overseas Transfer of Personal Information)

1. To conclude and perform its contract with data subjects, the Company transfers personal information overseas (entrustment and storage) as shown below and discloses it in this Policy under Article 28-8(1)(3) of the Personal Information Protection Act. Transfers take place over encrypted networks (API communication) each time the relevant feature is used.
2. For Google Play billing, Google Sign-In and Google Analytics/AdSense, Google processes personal information as the provider of its own services, and information members give directly to Google follows Google’s privacy policy.

If you do not want your personal information transferred overseas, you can ask Customer Support (info@linksboo.com) or the privacy officer in Article 16 to stop the transfer. The Company will then stop transferring that information overseas, and use of the related features may be limited as described in the table above. The Company does not look up visitors’ countries through external geolocation services; it uses only the country code passed on by Cloudflare.

Article 9 (Destruction Procedure and Method)

1. When personal information is no longer needed, for example because the retention period has passed or the purpose has been achieved, the Company destroys it without delay.
2. Where other laws require continued retention, the information is moved to a separate database or stored in a different place.
3. Service shutdown: if the Service is permanently shut down for unavoidable reasons such as closure of the business, all personal information except information the law requires to be kept is destroyed completely without delay.
4. Method
   1. Electronic files: deleted completely using technical methods that make the records unrecoverable (low-level format, overwrite, etc.)
   2. Paper documents: shredded or incinerated

Article 10 (Members Who Do Not Use the Service for a Long Time)

1. Following the amendment of the law (abolition of the personal information validity period), the Company does not force members who completed email verification into dormancy or destroy their information because of long inactivity unless they ask or withdraw, and keeps their membership, points and Reward data safely.
2. Paragraph (1) does not apply to incomplete sign-ups that never completed email verification and never signed in; those are destroyed after the retention period under Article 2(3) and Article 9.
3. To prevent account takeover and misuse of inactive accounts, the Company may require additional verification when such a member signs in again, where needed for security.

Article 11 (Rights of Data Subjects and Legal Representatives)

1. Data subjects may at any time ask the Company to access, correct, delete or stop processing their personal information.
2. Requests may be made in writing, by email or through Customer Support, and the Company will act without delay. Marketing consent can be turned on or off on the My Info screen, app notifications in the app, and you can delete your account under “Delete account” on the My Info screen.
3. If a data subject asks for correction or deletion of errors, the Company does not use or provide that information until the correction or deletion is complete.

Article 12 (Security Measures)

1. Administrative: an internal management plan, minimizing staff who handle personal information, and regular security training
2. Technical: KISA SEED encryption of mobile numbers, Reward payout account details, payment identifiers and temporary phone-verification values, no phone numbers stored in order records, one-way hashing of passwords, keeping identifiers used for re-registration limits, restrictions and device checks only as hashes from which the original cannot be recovered, HTTPS/SSL encrypted communication, blocking PHP execution in upload directories and web server hardening, restricted ownership of key back-end sources and system folders
3. Physical: access control to databases and server systems

Article 13 (Cookies and Similar Technologies)

1. The Company uses cookies, which store and retrieve usage information, to provide personalized services and keep traffic settlement stable.
2. Purposes of cookies
   1. Keeping members signed in and managing sessions
   2. Measuring valid dwell time and valid views of the AI Multilingual Blog and LINKBOO links (per the Policy)
   3. Monitoring and preventing fraudulent clicks (abuse) based on IP and browser identifiers
   4. Recording the first-visit source (30 days) and the referrer of visitors who arrive through a referral link (referrer cookies rid and lb_ref, 30 days — used for referral sign-ups and referral visit credits)
   5. Passing the hashed device identifier in the app (lb_dev, LINKBOO app only) to prevent payment fraud
   6. Remembering the screen theme (dark mode) choice (lb_theme, 1 year) and a short cooldown that prevents duplicate visit credits (cs_surf, a few seconds)
3. How to refuse: you can allow all cookies, be asked each time, or refuse all cookies in your browser settings (Chrome: Settings > Privacy and security / Edge: Settings > Cookies and site permissions).
4. Effect of refusing: automatic sign-in stops working, and earning Free Points for mutual promotion and accumulating valid views for Rewards may be limited.

Article 14 (Behavioral Information)

1. The Company may collect and use behavioral information to provide optimized services, benefits and online personalized advertising.
2. On the web, the Company automatically collects and analyzes visit history and traffic validity through Google AdSense and Google Analytics 4 (GA4). AdSense ads are not shown in the LINKBOO app.
3. You can refuse personalized ads through your browser cookie settings and Google’s ad settings page.

Article 15 (Video Surveillance Devices)

As an online platform provider, the Company does not install or operate fixed or mobile video surveillance devices (CCTV, etc.).

Article 16 (Privacy Officer and Department)

The Company has designated the following privacy officer and department to take overall responsibility for personal information processing and to handle complaints and remedies.

• Chief Privacy Officer (CPO) — Woocheol Jeong (정우철), CEO / Phone: +82-70-8708-9968 / Email: jeong@linksboo.com / Fax: +82-70-7614-2071
• Privacy department — Customer Management Team / Contact: JEONG Sung-hak (정성학), Team Leader / Phone: +82-70-8708-9972 / Email: volume@linksboo.com / Fax: +82-70-7614-2071

Article 17 (Remedies)

Data subjects may apply to the following bodies for dispute resolution or advice on privacy infringements.

• Personal Information Dispute Mediation Committee: 1833-6972 (www.kopico.go.kr)
• Privacy Infringement Report Center (KISA): 118 (privacy.kisa.or.kr)
• Supreme Prosecutors’ Office: 1301 (www.spo.go.kr)
• Korean National Police Agency: 182 (ecrm.cyber.go.kr)

Article 18 (Use of YouTube API Services)

1. The Company uses YouTube API Services to show public YouTube video information (title, thumbnail, channel name, view, like and comment counts, etc.) in the home feed, Flow, search and similar screens. The Company does not access or collect users’ YouTube account information through YouTube API Services. YouTube API Services are not used for YouTube links registered by Members; their titles and thumbnails are registered by the Members themselves.
2. By watching YouTube videos or using YouTube features in the Service, users agree to be bound by the YouTube Terms of Service.
3. Information processed through YouTube API Services is subject to the Google Privacy Policy.
4. When an embedded YouTube player plays in the Service, Google (YouTube) may store or read cookies or similar technologies on the user’s device. The Company also uses cookies under Article 13 to process watch and visit records within LINKBOO.
5. Users may ask the Company to delete stored information as described in Article 11. In addition, users can revoke LINKBOO’s access to their Google account at any time on the Google security settings page.
6. Video information received through YouTube API Services is kept only for the retention periods set in Article 7(3) of the Terms of Service (from 1 to 24 months counted from the YouTube publish date; videos bookmarked by a Member are kept as long as a bookmark remains). After that period the video stops being shown, is moved to the trash, and is permanently deleted 30 days later.

Addendum

Article 1 (Effective Date)

This Privacy Policy (v1.7) applies from 12 October 2026. The previous v1.6 and v1.5 applied from 8 October 2026 until this Policy took effect. Earlier, v1.4 applied from 5 October 2026, v1.3 applied from 2 October 2026, v1.2 from 10 September 2026, v1.1 from 1 September 2026, and the first version from 1 August 2026.

Article 2 (Revision History)

1. When this Policy is amended, the Company keeps and provides the revision history and previous versions for a reasonable period through a linked screen in the Service.