Privacy Policy

The Company processes personal information only for the following purposes. If a purpose changes, the Company will take the necessary measures, such as obtaining separate consent.

1. Responding to service inquiries: reviewing inquiries, replying, and consultation
2. Member management: confirming the intention to register, email verification, and provision of sample reports
3. Website operation: prevention of misuse and response to service failures

The Company does not accept membership registrations from children under the age of 14.

Where applicable laws require the information to be preserved, it is retained for the period so required.

The Company provides personal information to third parties only with the consent of the data subject or where specifically provided by law. The Company currently provides no personal information to third parties.

In accordance with each processor's terms and data processing addendum (DPA), the Company applies a prohibition on processing beyond the outsourced task, security safeguards, and restrictions on further outsourcing, and supervises its processors.

For the outsourcing described in Article 5, the Company transfers personal information overseas as follows pursuant to subparagraph 3 of Article 28-8(1) of the Personal Information Protection Act. The transfer takes place over information and communications networks at the time the website is used.

Data subjects may refuse the cross-border transfer. In that case, they may contact the Company by email (contact@dillab.ai) instead of using the inquiry form or registering as a member, but member features will not be available. Because access logs are essential to hosting, a data subject who refuses their transfer cannot use the website.

When the retention period has expired or the purpose of processing has been achieved, the Company destroys the personal information without delay after confirmation by the Chief Privacy Officer. Electronic files are deleted by a method that makes them unrecoverable, and paper documents are shredded or incinerated. Information preserved under applicable laws is stored separately.

(1) Data subjects may at any time request access to, correction or deletion of, or suspension of processing of their personal information, or withdraw their consent.

(2) Requests to exercise these rights and to withdraw membership are made by email (contact@dillab.ai). After verifying that the requester is the data subject or a duly authorized representative, the Company takes action without delay and handles requests for access within 10 days.

(3) A representative making a request on behalf of a data subject must submit a power of attorney.

(4) Deletion may not be requested for personal information that other laws specify as subject to collection.

1. HTTPS (TLS) encryption on all connections
2. Storage of passwords as one-way hashes
3. Sample reports provided only to members whose login has been verified on the server
4. Minimized access rights to management consoles
5. Secret keys managed only as environment variables and never included in source code
6. Request rate limiting and protection against automated submissions

(1) The Company uses only essential cookies (authentication session cookies) to keep users logged in. A cookie is a small file of information that a website stores in the user's browser.

(2) The Company does not use analytics or advertising cookies, and the display language is determined by the URL path (/ko, /en). If the Company introduces analytics tools, it will amend this Policy and give notice in advance.

(3) Users may refuse or delete cookies in their browser settings. If cookies are refused, logging in and downloading reports will not be available.

• Name and title: Suhee Kim, CEO
• Email: contact@dillab.ai

Requests for access to personal information are handled directly by the Chief Privacy Officer.

• Email: contact@dillab.ai
• Address: 8, Seongnam-daero 331beon-gil, Bundang-gu, Seongnam-si, Gyeonggi-do, Republic of Korea

Data subjects may file a report or request counseling regarding the infringement of personal information with the following organizations.

• Personal Information Infringement Report Center: 118 (no area code), privacy.kisa.or.kr
• Personal Information Dispute Mediation Committee: 1833-6972, www.kopico.go.kr
• Supreme Prosecutors' Office: 1301 (no area code), www.spo.go.kr
• Korean National Police Agency: 182 (no area code), ecrm.police.go.kr

If this Policy is changed, the Company will post a notice on the website from 7 days before the change takes effect, or from 30 days before for changes that materially affect the rights of data subjects.

This Policy takes effect on October 26, 2026.