Privacy Policy

Swifin Inc. (the "Company") establishes and discloses this Privacy Policy as follows in accordance with the Personal Information Protection Act ("PIPA") and other applicable laws, in order to protect the personal information of data subjects and to handle related grievances promptly and smoothly. This Privacy Policy applies to the Swifin service provided by the Company and its website (collectively, the "Service").

Article 1 (Purposes of Processing Personal Information)

The Company processes personal information for the following purposes and does not use it for any purpose other than these. Where a purpose of use changes, the Company will take the necessary measures in accordance with applicable laws.

1. Member sign-up and management: identifying Members, confirming the intent to sign up, verifying identity, maintaining and managing membership, preventing fraudulent use of the Service and restricting use in response to violations of the Terms of Service, sending notices and notifications, and processing terminations of membership
2. Provision of the Service: providing the Service, such as portfolio analysis, providing analysis results based on information registered by users, and managing Service usage records
3. Handling customer inquiries and the exercise of rights: responding to inquiries, processing data subjects' requests to exercise their rights, and keeping records for resolving disputes and responding to legal claims
4. Operation and improvement of the Service: ensuring the stability of the Service, responding to security issues and fraudulent use, compiling Service usage statistics, and developing new features and improving quality
5. Recruitment: verifying applicants, conducting the recruitment process and notifying applicants of the results
6. Product inquiries and adoption consultations: responding to persons who send an inquiry through the inquiry form on the website, and providing product information and consultations on adoption of the Service (Article 3-2)

Article 2 (Items of Personal Information Processed and Methods of Collection)

(1) The Company processes the following personal information.

(2) The Company collects personal information by the following methods.

1. Direct entry or registration by the user in the course of signing up for and using the Service
2. Where the user signs in with a Google or Apple account, receipt from that business operator of information within the scope to which the user has consented
3. Automatic generation and collection in the course of using the Service
4. Submission in the course of inquiries, requests to exercise rights and job applications made by email or other means
5. Direct entry by the person making an inquiry in the inquiry form on the website

(3) The Company does not collect unique identification information, such as resident registration numbers, or sensitive information for the provision of the Service, and does not request securities or bank account numbers, passwords for financial institutions or authentication certificates. Users must not enter sensitive information, unique identification information or the personal information of others in free-text fields such as notes and queries.

Article 3 (Processing and Retention Periods of Personal Information)

(1) The Company processes and retains personal information within the retention period prescribed by law or the retention period consented to by the data subject when the personal information was collected, and destroys it without delay once the purpose of processing has been achieved.

(2) The retention period for each category is as follows.

(3) Notwithstanding paragraph (2), where preservation is required under applicable laws, the information is preserved for the period so required.

(4) Notwithstanding paragraphs (2) and (3), in any of the following cases, the relevant personal information is retained until the relevant ground ceases to exist.

1. Where an investigation, inquiry or similar proceeding concerning a violation of applicable laws is in progress: until that investigation or inquiry is concluded
2. Where a dispute concerning the use of the Service is in progress, or claims and obligations arising from the use of the Service remain outstanding: until that dispute is resolved or those claims and obligations are settled

Article 3-2 (Inquiries Received Through the Website Inquiry Form)

(1) The Company processes as follows the personal information of persons who consent to the collection and use of their personal information and its transfer overseas and send an inquiry through the inquiry form on the website. No Member sign-up is required.

The result of the check and the value derived from the check token are processed under paragraph (3), and the inquirer lookup value and inquirer ID, inquiry handling records, staff notes, the subject category and the content summary are processed under paragraph (4). Product inquiries sent by email (contact@swifin.app) instead of through the inquiry form are handled as customer inquiries under Article 2, not under this Article, and are kept for the retention period for customer inquiry records in Article 3 (1 year from resolution). The consent to overseas transfer obtained in the inquiry form and the matters notified for it are governed by items 2 and 3 of paragraph (1) of Article 7.

(2) Other than its response to the inquiry, the Company does not send advertising or promotional messages. So that the person in charge can review inquiries, the Company sends each accepted inquiry in a notification email to its inquiry mailbox (contact@swifin.app) (when a large number of inquiries are received within a short time, notification emails are combined and sent once an hour, and no notification email is sent for an inquiry that appears to have been sent by an automated program), and on days when unhandled inquiries remain, it sends a summary email listing them to the same mailbox at 9:00 a.m. Korea Standard Time (inquiries that appear to have been sent by an automated program are listed separately with only the name and company name of the person who made the inquiry and the opening of the message). The Company sends its response from that mailbox to the email address of the person who made the inquiry. For an inquiry accepted after passing the bot check, the Company may automatically send a receipt confirmation email containing only the reference number and the inquiry type to the email address of the person who made the inquiry. If a receipt confirmation email bounces permanently or its recipient reports it as spam, the email address is recorded on Amazon Web Services' suppression list so that no further receipt confirmation emails are sent to it; it is removed automatically 3 years after it was added to the list, and before then without delay upon request. The outsourcing and overseas transfer involved in this process are governed by Articles 6 and 7.

(3) To prevent an excessive number of inquiries from the same source within a short time and the repeated submission of the same text or the same check token, and to prevent an excessive number of receipt confirmation emails from being sent, the Company records through the inquiry form values derived from the IP address (or its leading part), the email address, the inquiry message and the check token, each of which cannot be reversed without a secret value; the number of inquiries and the number of receipt confirmation emails sent (per email address, mail domain, and IP address or its leading part); the reference number of the original inquiry, so that a resubmission of the same text can be answered with that reference number; and a value derived from the inquirer ID that cannot be reversed without a secret value, so that bounces and spam reports about receipt confirmation emails from the same person are counted only once. These records expire within 1 day of their creation and are no longer used, and expired records are deleted automatically within a few days. In addition, so that the sending of receipt confirmation emails and the bounces and spam reports about them are counted only once in the last 7 days for the same source, the Company records a value derived from the leading part of the IP address that cannot be reversed without a secret value; this record expires within 7 days of its creation and is no longer used, and expired records are deleted automatically within a few days. This derived value is also carried in a message tag of the receipt confirmation email, and it is used only to count a bounce or spam report about that email once when the result returns to the Company through Amazon Web Services; the Company does not separately store the value carried in the message tag. Overall counts from which no individual person or source can be identified (the number of distinct sources to which receipt confirmation emails were sent and the number of bounces and spam reports concerning them, counted by date) are used only to regulate the sending of receipt confirmation emails and expire within 8 days of their creation. The Company does not store the original IP address or device and browser information in connection with inquiries. In addition, to block inquiries sent by automated programs, when a user consents in the inquiry form to both the collection and use of personal information and its transfer overseas, Cloudflare, Inc., to which the Company outsources the bot check (Turnstile), receives the IP address and device and browser information (including browser identification information and characteristics of the encrypted connection) through the user's browser and processes them. This processing is based on the Company's legitimate interests in the security of the Service and the prevention of fraudulent use (Article 15(1)(vi) of PIPA), and the overseas transfer of this information is made under the consent to overseas transfer given in the inquiry form (paragraph (1) of Article 7). The check does not start until both consent boxes are checked, and it stops if either box is unchecked. Using the check token sent with the inquiry, the Company queries Cloudflare, Inc. for the result of the check and receives only that result, which it uses only to decide whether to accept the inquiry and whether to send a receipt confirmation email. An inquiry that does not pass the check is not accepted, and its content is not stored. However, if Cloudflare, Inc. does not respond with a result or returns an error, the Company accepts inquiries only up to a set number per hour, marks them as verification pending, and does not send receipt confirmation emails for them. The result of the check (whether the inquiry is marked verification pending) is kept with the inquiry for the same period. Separately from the processing it performs on the Company's behalf, Cloudflare, Inc. also processes this information as an independent controller to improve its detection of automated programs, and that processing is governed by its Turnstile Privacy Addendum (www.cloudflare.com/turnstile-privacy-policy) (see paragraph (2) of Article 5, Articles 6 and 7 and paragraph (5) of Article 9).

(4) To prevent inquiries from going unanswered by oversight and to keep their handling traceable, the Company records the following information on the basis of its legitimate interests in managing responses to inquiries (Article 15(1)(vi) of PIPA).

1. A value derived from the email address that cannot be reversed without a secret value (the inquirer lookup value), used to find earlier inquiries from the same person, and an inquirer ID generated from that value. For this purpose, addresses that differ only in letter case, in a tag added after a "+", or in the dots of a Gmail address are treated as the same address
2. The handling status of the inquiry (unhandled, replied, handled or spam) and handling records that list, in chronological order, steps such as receipt, notification, the sending of the receipt confirmation email and any bounce or spam report concerning it, inclusion in a summary email, and changes of status (including the pseudonymous ID of the staff member who changed the status), notes that staff add to the inquiry (staff notes), the subject of the inquiry chosen by staff from a fixed list (subject category), and a one- or two-line summary of the inquiry written by staff without names, company names, job titles, contact details or anything else that could identify a person or a company (content summary)
3. Operational logs of the inquiry intake system (these logs do not contain the name, company name, job title, inquiry message, staff notes, content summary or IP address; the email address appears only in a masked form that shows part of it; otherwise the logs contain the reference number, the inquirer ID, a trace number assigned to each request, the pseudonymous ID of the staff member who took an action, and the outcome of each step)
4. Operational alert emails sent to the Company's operations mailbox (ops@swifin.app) when a problem occurs with the receipt of inquiries, notifications or the sending of emails, and when copies in the inquiry mailbox are due to be deleted (these emails do not contain the inquirer's name, email address, company name, job title, inquiry message, staff notes, content summary or IP address; as to inquiries, they contain only the reference number, the inquirer ID, the date of receipt and counts)

The records in items 1 and 2 are kept for the same period as the inquiry concerned, the records in item 3 are deleted automatically 1 year after they are created, and the emails in item 4 are deleted 1 year after they are received. If a new inquiry arrives from the same email address (determined as in item 1) as an inquiry that the person in charge marked as spam, the new inquiry is still accepted and is marked so that the person in charge can see this.

(5) The Company stores the name, email address, company name, job title and inquiry message received through the inquiry form, and the staff notes and content summaries on those inquiries, with each item encrypted. When consent is withdrawn or the retention period ends, the inquiry and the records in items 1 and 2 of paragraph (4) are deleted without delay. However, from an inquiry that is deleted because its retention period has ended, the Company continues to keep only the following two kinds of information, processed so that they cannot identify anyone (nothing is kept from inquiries for which consent was withdrawn). The first is statistical information that counts, for each month of receipt, inquiries separately by inquiry type, display language, plan selected, the part of the website where the inquiry was started, outcome of handling and subject category; the Company holds these counts without any personal information until the retention period has ended for all inquiries received in that month and then records them at once, and any category with fewer than 5 inquiries is not kept separately but is combined into "other" or into the total for that month. The second is the content summary: a content summary that contains the name, email address (including the part before the @), company name or job title of the same inquiry, or anything in the form of an email address, a web address or a long number such as a telephone number, is not kept, and a content summary that is kept is stored with only the month of receipt and the subject category attached (a subject category that is not kept separately in the statistical information is changed to "other", and no subject category is attached if the total for that month is fewer than 5), without the reference number, inquirer ID or date, so that it cannot be linked back to the inquiry. The notification emails, summary emails and copies of replies concerning that inquiry that remain in the Company's inquiry mailbox are located using the reference number and deleted by the person in charge: without delay when consent is withdrawn, and within 5 days after the day on which the retention period ends. Information deleted from the inquiry intake system remains in backups for disaster recovery for up to 7 days and is then erased automatically. However, where paragraph (3) or (4) of Article 3 applies, the information is handled in accordance with that paragraph.

Article 4 (Procedures and Methods for Destroying Personal Information)

(1) When personal information is no longer needed, such as when the retention period has expired or the purpose of processing has been achieved, the Company destroys that personal information without delay.

(2) Where personal information must continue to be preserved under Article 3(3), the Company stores and manages that personal information separately from other personal information.

(3) The procedures and methods of destruction are as follows.

1. Destruction procedure: The Company selects the personal information for which a reason for destruction has arisen and destroys it under the responsibility of the Chief Privacy Officer.
2. Destruction method: Information in the form of electronic files is deleted using technical methods that make recovery or reproduction impossible, and information recorded on paper documents is shredded or incinerated.

Article 5 (Provision of Personal Information to Third Parties)

(1) The Company processes data subjects' personal information only within the scope of the purposes of processing set out in Article 1, and provides personal information to third parties only in cases falling under Articles 17 and 18 of PIPA, such as where the data subject has consented or where a law contains a special provision.

(2) The Company does not currently provide personal information to third parties. However, where Cloudflare, Inc., under paragraph (3) of Article 3-2, processes information it receives from the user's browser during the bot check as an independent controller to improve its detection of automated programs, that information is not provided directly by the Company, and that processing is governed by Cloudflare, Inc.'s Turnstile Privacy Addendum.

Article 6 (Outsourcing of Personal Information Processing)

(1) The Company outsources personal information processing work as follows for the smooth provision of the Service.

(2) When entering into an outsourcing contract, the Company sets out in writing the matters prescribed in Article 26 of PIPA and supervises whether processors process personal information securely.

(3) Where a processor further outsources work outsourced to it, the sub-processors and the details of the sub-outsourced work can be found in the information each processor discloses on its website or by other means.

(4) Any change in the outsourced work or in the processors will be disclosed through this Privacy Policy.

Article 7 (Overseas Transfer of Personal Information)

(1) The Company transfers personal information overseas as follows in order to provide the Service. The transfers in items 1 through 3 constitute outsourcing of processing necessary for the conclusion and performance of contracts with data subjects (including steps taken at the data subject's request before a contract is concluded, such as responding to product inquiries from persons who are not Members and consulting on adoption of the Service) and are made by disclosure in this Privacy Policy pursuant to Article 28-8(1)(iii)(a) of PIPA, and the transfer in item 4 is made with the consent of data subjects pursuant to Article 28-8(1)(i) of PIPA. However, for persons who make an inquiry through the inquiry form on the website (Article 3-2), the transfers of their information involved in the bot check in item 2 and the inquiry-related emails in item 3 are made with their separate consent to overseas transfer obtained in the inquiry form, pursuant to Article 28-8(1)(i) of PIPA.

1. OpenAI OpCo, LLC

1. Cloudflare, Inc.

1. Spaceship, Inc.

1. Google LLC (where the user has consented to analytics)

(2) Data subjects may refuse overseas transfers. Because the transfers in items 1 through 3 of paragraph (1) are essential to the provision of the Service, a data subject who wishes to refuse them may stop the transfers by terminating their membership, in which case the data subject will be unable to use the Service. The transfers in items 2 and 3 of paragraph (1) in connection with the inquiry form may be refused in the overseas transfer consent box of the inquiry form; a person who refuses cannot send an inquiry through the form but may write to us directly at contact@swifin.app (an inquiry sent by email also passes through the mailbox in item 3 of paragraph (1)). A person who has made an inquiry may stop the transfer in item 3 of paragraph (1) by withdrawing consent or requesting deletion (contact@swifin.app), in which case that person will not receive a reply. The transfer in item 4 may be refused, or consent to it withdrawn, at any time under "Cookie settings" at the bottom of the website, and refusal does not restrict the use of the Service.

Article 8 (Measures to Ensure the Security of Personal Information)

The Company takes the following measures to ensure the security of personal information.

1. Administrative measures: establishing and implementing internal management procedures for the protection of personal information, and minimizing the number of, and training, personal information handlers
2. Technical measures: managing access rights to, and controlling access to, the personal information processing system, encrypting passwords and important information, encrypting data in transit, detecting and blocking abnormal access, and responding to security threats
3. Physical measures: controlling access to the facilities and equipment in which personal information is stored

Article 9 (Installation, Operation and Refusal of Devices That Automatically Collect Personal Information)

(1) The Company uses cookies, which store and retrieve usage information, in order to provide users with a smooth Service. A cookie is a small amount of information that a website sends to the user's browser and that is stored on the user's device.

(2) The cookies used by the Company are as follows.

(3) Users may change whether optional cookies are used at any time under "Cookie settings" at the bottom of the website, and may refuse the storage of cookies or delete stored cookies through their web browser settings. However, if a user refuses the storage of essential cookies, the user cannot use services that require signing in.

(4) The Company may store information for convenience of use, such as display settings and content entered by the user, in the browser storage of the user's device, and users may delete this information through their browser settings.

(5) For the bot check on the inquiry form (paragraph (3) of Article 3-2), Cloudflare, Inc. may store cookies or other information needed for the check in the user's browser, in accordance with its Cookie Policy (www.cloudflare.com/cookie-policy). Because this check is used for the security of the Service, it cannot be turned off in the cookie settings, in the same way as the essential (security) cookies in the table in paragraph (2); however, users may refuse such storage or delete stored information through their browser settings, and may also write to us directly at contact@swifin.app instead of using the inquiry form.

Article 10 (Rights and Obligations of Data Subjects and Legal Representatives, and Methods of Exercising Them)

(1) Data subjects may at any time exercise rights against the Company, such as requesting access to, correction or deletion of, or suspension of the processing of their personal information, and withdrawing consent.

(2) You can exercise these rights from the account page in the Service or by email (contact@swifin.app), and the Company will act without delay within the period required by applicable law. You can terminate your membership by requesting deletion of your account.

(3) Rights may be exercised through a representative, such as the data subject's legal representative or a person authorized by the data subject. In this case, a power of attorney in the form of Annexed Form No. 11 to the Public Notice on Methods of Processing Personal Information must be submitted.

(4) The Company verifies whether the person making a request to exercise rights is the data subject or a legitimate representative.

(5) Requests for access to, and suspension of the processing of, personal information may be restricted under Article 35(4) and Article 37(2) of PIPA, and deletion of personal information may not be requested where other laws specify that personal information as subject to collection.

(6) Data subjects must keep their personal information accurate and must not wrongfully use or enter the personal information of others.

Article 11 (Personal Information of Persons Under 19 Years of Age)

Only persons 19 years of age or older may sign up for the Service. If it is confirmed that a Member is under 19 years of age, the Company will terminate the service agreement and destroy the relevant personal information, except where it must be preserved under applicable laws.

Article 12 (Automated Decisions and Use of Artificial Intelligence)

(1) The Company does not make decisions that significantly affect the rights or obligations of data subjects by processing personal information with fully automated systems.

(2) The Company provides some features of the Service using generative artificial intelligence, and the outsourcing of processing and overseas transfer of personal information in connection with this are governed by Articles 6 and 7.

Article 13 (Chief Privacy Officer)

(1) The Company has designated the following Chief Privacy Officer to take overall responsibility for work relating to the processing of personal information and to handle data subjects' complaints, provide remedies for damage and deal with similar matters relating to the processing of personal information.

• Chief Privacy Officer: Kang Junhyeok (CEO)
• Contact: contact@swifin.app

(2) Data subjects may direct to the Chief Privacy Officer all inquiries, complaints, requests for remedies for damage and other matters relating to personal information protection that arise while using the Service, and the Company will respond to and handle them without delay.

Article 14 (Remedies for Infringement of Rights and Interests)

To obtain remedies for infringement of personal information, data subjects may apply to the following bodies for dispute resolution, consultation and the like.

1. Personal Information Dispute Mediation Committee: 1833-6972 (within Korea) · www.kopico.go.kr
2. Personal Information Infringement Report Center: 118 (within Korea) · privacy.kisa.or.kr
3. Supreme Prosecutors' Office: 1301 (within Korea) · www.spo.go.kr
4. Korean National Police Agency Cyber Bureau: 182 (within Korea) · ecrm.police.go.kr

Article 15 (Changes to This Privacy Policy)

(1) If any content of this Privacy Policy is added, deleted or modified, the Company will give notice through the Service website starting 7 days before the effective date. However, if a change significantly affects the rights of data subjects, the Company will give notice starting 30 days before the effective date. The Company discloses a comparison of the content before and after the change, and previous versions of this Privacy Policy are available on the Service website.

(2) This Privacy Policy is based on the Korean version, and versions of this Privacy Policy provided in other languages are translations provided for reference. If there is any discrepancy between the Korean version and a translation, the Korean version prevails.

Addenda

This Privacy Policy takes effect on October 23, 2026.

Back to top