Privacy Policy

Splab Inc. (the "Company") processes users' personal information in accordance with the Personal Information Protection Act of the Republic of Korea ("PIPA") and other applicable laws when providing Umoh and related services (the "Service"). This Privacy Policy explains what personal information the Company processes, for what purposes and on what legal bases, and how it is protected. This Privacy Policy was originally written in Korean. If a translation differs from the Korean version, the Korean version prevails.

1. Purposes of Processing

The Company processes personal information for the following purposes. If a purpose changes, the Company takes the necessary measures, such as obtaining separate consent under Article 18 of PIPA.

• Hosts and organizations: creating accounts and signing in, running organizations and inviting members, creating, publishing and running events, registering payment methods and settling and charging fees, analyzing use of the Service and improving the Service, responding to inquiries, and handling outages.
• Participants: registering for events and accepting invitations, approvals, providing profiles and participant lists, 1:1 messages, meeting requests, scheduling and schedule management, sending event-related notification emails, relaying inquiries to hosts, drafting profile introductions with AI on request, answering questions through the AI assistant, and analyzing use of these features.
• Website visitors: sending quotes and following up, chat support, notifying people on the launch waitlist, and analyzing use of the website.
• Common: preventing fraud and abuse, and complying with legal obligations.
• Marketing messages: sending Umoh service news to participants who have consented to receive it.

2. Personal Information We Process and Legal Bases

Processed without the data subject's consent

1. Host accounts and running organizations
   • Legal basis: Article 15(1)(4) of PIPA (entering into and performing a contract)
   • Items: email address, name, organization name, preferred language, member role, email addresses of invited colleagues, host console activity records, organization logo, event contact email address and sender name (if entered), and the profile photo of the Google account (when signing in with Google)
2. Registering payment methods and settling and charging fees
   • Legal basis: Article 15(1)(4) of PIPA (entering into and performing a contract)
   • Items: the billing contact's email address, billing currency, card brand, last four digits and expiration date, and settlement and billing records. Card details are entered directly on the payment processor's payment page, and the Company does not store them.
3. Participant and speaker information registered by hosts
   • Legal basis: Article 26 of PIPA (processing outsourced by the host)
   • Items: participants' names, email addresses, participant types and answers to items set by the host, and speakers' names, job titles, companies, introductions and photos
   • The Company processes information that a host uploads in a participant list file or registers directly on the host's behalf, to invite participants to and run the event. After a participant consents while joining the event, the information is processed as described under "Processed with the data subject's consent".
4. Service usage records and fraud prevention
   • Legal basis: Article 15(1)(4) of PIPA (performing a contract), and Article 15(1)(6) of PIPA (legitimate interests) for website usage analytics
   • Items: IP address, browser information, access time, service usage records, cookies, browser signals for bot detection, host console usage analytics (member ID, email address, page view and click records, and error records), AI-drafted introduction usage analytics (member ID, request, revert and save records, processing time, and error records), AI assistant usage analytics (member ID, questions and answers, processing time, and error records), and website usage analytics (page view and click records, and referral sources)
5. Quote requests, chat support and launch waitlist sign-ups
   • Legal basis: Article 15(1)(4) of PIPA (measures requested by the data subject in the course of entering into a contract)
   • Items: company name, name, email address and phone number (quote requests), what visitors enter during the chat (chat support), and email address (launch waitlist)
6. AI-drafted introductions requested by participants
   • Legal basis: Article 15(1)(4) of PIPA (performing a contract)
   • Items: company, job title, answers to choice items, participant type and event name
7. The AI assistant used by participants
   • Legal basis: Article 15(1)(4) of PIPA (performing a contract)
   • Items: questions, conversation history and answers, and the information used to create answers (the participant's own profile items visible to other participants, remaining meeting count, availability, meeting schedule, announcements received, the senders and number of unread messages, and event information)
   • Other participants' visible profile items, times open for meeting requests, and the number of meeting requests they have received and meetings they have left are also used to create answers. Visible profile items are used only within the visibility those participants agreed to when joining the event (item 1 under "Processed with the data subject's consent"), and the meeting counts are used only to keep suggestions from concentrating on a few participants.

Processed with the data subject's consent

1. Joining events
   • Legal basis: Article 15(1)(1) of PIPA (consent)
   • Items: name, email address, participant type, answers to items set by the host, profile photo and meeting availability (if entered), 1:1 messages and attachments, meeting requests, responses and messages, notification settings, unsubscribe records, inquiries sent to hosts (name, email address and content), records of consent to terms, and participation status records
   • Items set by the host are answers given in text, choice, file, checkbox or link formats (for example, company, job title, introduction, and LinkedIn, Instagram, Facebook and X profile links). The items for each event, whether each is required, and who can see them are shown on the event's registration screen.
2. Receiving marketing messages (optional)
   • Legal basis: Article 15(1)(1) of PIPA (consent)
   • Items: email address

How information is collected

Users enter it on Service screens or website forms. When a host signs in with a Google account, the Company receives the email address, name and profile photo from Google. When a host uploads a participant list file or registers participants and speakers directly, the Company receives the information from the host. Service usage records are created and collected automatically while the Service is used.

3. Retention Periods

1. The Company processes and retains personal information within the retention period set by law or the retention period to which the data subject has consented.

• Host accounts, payment information and host console usage analytics: until deletion of the account is requested.
• Website usage analytics: one year from collection (once linked to a host console account, until deletion of the account is requested).
• AI-drafted introduction usage analytics: until deletion of the account is requested.
• AI assistant conversation history: 30 days after the last message.
• AI assistant usage analytics (including questions and answers): until deletion of the account is requested.
• Participant and speaker information: until one year after the event page end date. If a participant requests deletion earlier, the Company destroys the information without delay.
• Consent to marketing messages: until the consent is withdrawn or the participant's information is destroyed.
• Quote request information: one year from the date of the request.
• Chat support records: one year from the date of the chat.
• Launch waitlist email addresses: until the launch notice is sent (no later than one year after sign-up).

2. Information that must be preserved under other laws is kept for the periods those laws require.

• Records of contracts or withdrawal of offers: 5 years (Article 6(1)(2) of the Enforcement Decree of the Act on the Consumer Protection in Electronic Commerce).
• Records of payments and supply of goods: 5 years (Article 6(1)(3) of the same Decree).
• Records of consumer complaints or dispute resolution: 3 years (Article 6(1)(4) of the same Decree).
• Books and supporting documents for transactions (invoices and payment records): 5 years (Article 85-3 of the Framework Act on National Taxes).
• Access records (IP address and access time): 3 months (Article 15-2 of the Protection of Communications Secrets Act).

4. Destruction of Personal Information

1. The Company destroys personal information without delay when its retention period expires or its purpose has been achieved and it is no longer needed.

2. Personal information that must continue to be preserved under other laws is stored separately from other personal information. The items, legal bases and periods are listed in Section 3, paragraph 2.

3. Procedure: the Company selects personal information for which a reason for destruction has arisen and destroys it with the approval of the Chief Privacy Officer.

4. Method: personal information in electronic files is deleted in a way that cannot be restored. Information remaining in database backups is deleted when the backup retention period (7 days) expires.

5. Provision of Personal Information to Third Parties

1. The Company provides personal information to third parties only in cases permitted by Articles 17 and 18 of PIPA, such as when the data subject consents or a law specifically requires it.

2. When a participant consents while joining an event, the Company provides the participant's personal information as follows:

Note 1: The name of the organization running the event is shown on the event page.

Note 2: The items for each event are shown on the event's registration screen.

Participants may refuse to consent, but then cannot join the event.

3. Other participants of the same event can see the profile items that the host has made visible, but not email addresses. The participant list also shows whether a participant has used the event page recently and whether they have checked in at the venue today. Meeting notification emails include the other participant's name, company, job title and photo. When another participant asks the AI assistant a question, these visible items and times open for meeting requests may be used to create the answer (see Section 11).

6. Outsourcing of Personal Information Processing

1. The Company outsources the following processing in Korea to provide the Service.

2. When entering into an outsourcing contract, the Company sets out in a written contract or other document, in accordance with Article 26 of PIPA, matters such as the prohibition of processing for purposes other than the outsourced task, technical and administrative safeguards, restrictions on re-outsourcing, management and supervision of the outsourcee, and liability such as compensation for damages, and supervises whether the outsourcee processes personal information securely.

3. If the outsourced tasks or outsourcees change, the Company discloses the change in this Privacy Policy without delay. Outsourcing that involves processing outside Korea is described in Section 7.

7. International Transfers of Personal Information

1. To perform its contracts with users, the Company outsources the processing of personal information to, or stores it with, recipients outside Korea, and discloses the following under Article 28-8(1)(3) of PIPA. Personal information is transferred over encrypted connections (TLS) whenever the Service is used.

2. Users who do not want their personal information transferred outside Korea can refuse by contacting support@umoh.io. However, users who refuse transfers needed to provide the Service, such as hosting, sign-in, email delivery and payments, cannot use the Service. No information is transferred for AI-drafted introductions, the AI assistant or the launch waitlist unless the user uses them. Even participants who do not use the AI assistant may have their visible profile items and times open for meeting requests transferred to AI model providers when another participant of the same event asks a question, and names and companies included in answers may also be transferred as usage analytics.

8. Rights of Data Subjects and How to Exercise Them

1. Data subjects may ask the Company to give access to, correct or delete their personal information, suspend its processing, or withdraw consent.

2. Hosts can change their name and language in the host console settings. Participants can edit their profiles and turn off notifications on the event page, and can stop receiving emails through the unsubscribe link in the emails.

3. Other requests can be sent to support@umoh.io. The Company takes action within 10 days of receiving a request and notifies the requester of the result. However, deletion cannot be requested for information that must be preserved under other laws.

4. Requests concerning participant information that the organization running an event has downloaded from the Service and keeps must be made to that organization.

5. Data subjects may exercise their rights through a representative, such as a legal representative or a person authorized by them. In this case, a power of attorney in Form 11 of the Notice on Methods of Processing Personal Information must be submitted.

6. The Company verifies that the person exercising a right is the data subject or a legitimate representative.

7. Requests for access and for suspension of processing may be restricted under Article 35(4) and Article 37(2) of PIPA.

9. Security Measures

The Company takes the following measures to process personal information securely:

1. Technical measures: managing and controlling access to personal information processing systems, encrypting data in transit and at rest, and separating access by organization.
2. Physical measures: storing personal information in cloud data centers with controlled access.

10. Cookies and Similar Technologies

1. The Company uses cookies and similar technologies ("cookies") to keep users signed in, remember language settings and analyze use of the host console and the website. A cookie is a small piece of information that a website sends to and stores in the user's browser, and that the browser sends back to the website on later visits.

The website and the host console share the analytics cookies, so when a user signs in to the host console in the same browser, their earlier website usage records are linked to the account's usage analytics.

2. The following third parties collect information directly from users' browsers.

3. Users can refuse or delete cookies in their browser settings. However, users who refuse essential cookies cannot sign in.

• Chrome: ⋮ menu at the top right > Settings > Privacy and security > Delete browsing data (to delete stored cookies) or Third-party cookies (to block them)
• Edge: … menu at the top right > Settings > Privacy, search, and services > Cookies
• Safari (mobile): device Settings > Apps > Safari > Advanced > Block All Cookies

11. AI Features

1. AI-drafted introductions: When a participant asks for an AI-drafted introduction while editing a profile, the Company sends the company, job title, answers to choice items, participant type and event name to an AI model to create the draft. The Company does not send names, email addresses, text the participant has written, links or files. No information is sent unless the participant asks, and the participant reviews and edits the draft before saving it. When analyzing use of this feature, the Company does not include the information sent or the text of the draft.

2. AI assistant: Participants of events that offer the AI assistant can ask it about people to meet and about the event on the event page. When a participant asks a question, the Company sends the question, the earlier messages in the conversation and the information needed to answer to an AI model. That information is the participant's own profile items visible to other participants, remaining meeting count, availability, meeting schedule, announcements received, the senders and number of unread messages, and event information. Other participants' visible profile items (name, company, job title, visible answers and introduction), times open for meeting requests, and the number of meeting requests they have received and meetings they have left are sent as well. The Company does not send message content, email addresses or items hidden from other participants.

   • Conversation history is kept for 30 days after the last message and then deleted.
   • To review the quality of answers and improve the feature, the Company keeps questions and answers as usage analytics until deletion of the account is requested.
   • Participants should not include sensitive information about themselves or others, such as health or financial information, in their questions. Inappropriate answers can be reported to support@umoh.io.

3. AI model providers do not use the information they receive to train their models, and delete it within 30 days after the draft or answer is generated. However, information flagged as violating a provider's usage policy may be kept for up to 2 years to review the violation. The providers and countries are listed in Section 7.

12. Marketing Messages

1. The Company may send Umoh service news by email to participants who consented to receive marketing messages when joining an event. Refusing does not affect joining events, and consent can be withdrawn at any time through the unsubscribe link in the email or at support@umoh.io.

2. Information from quote requests is used only for the quote and follow-up consultation, and launch waitlist email addresses only for the launch notice.

13. Personal Information of Children Under 14

The Company does not provide the Service to children under 14, and hosts must not register the personal information of children under 14 on the Service.

14. Chief Privacy Officer

The Company has designated a Chief Privacy Officer who oversees the processing of personal information and handles related complaints and remedies.

• Name: Minseung Seon
• Title: CEO
• Phone: +82-2-1600-4138
• Email: support@umoh.io

15. Remedies for Infringement of Rights

Data subjects may apply to the following Korean institutions for dispute resolution or consultation regarding infringement of personal information:

• Personal Information Dispute Mediation Committee: 1833-6972, www.kopico.go.kr
• Personal Information Infringement Report Center (KISA): 118, privacy.kisa.or.kr
• Supreme Prosecutors' Office: 1301, www.spo.go.kr
• Korean National Police Agency: 182, ecrm.police.go.kr

16. Changes to This Privacy Policy

1. This Privacy Policy takes effect on October 23, 2026.

2. When the Company changes this Privacy Policy, it announces the changes on the website at least 7 days before they take effect. For significant changes to data subjects' rights, such as changes to the items collected or the purposes of use, it announces them at least 30 days before they take effect, comparing the old and new versions.