Privacy Policy

Effective Date: October 15, 2026 | Revised: October 15, 2026

FLOAT Co., Ltd. (hereinafter "Company") complies with the Personal Information Protection Act and related laws. This Privacy Policy is established and disclosed to safely protect personal information collected in the process of using the INTA service (hereinafter "Service").

1. Purposes of Collection and Use of Personal Information

The Company collects and uses personal information for the following purposes.

1) Service Provision and Operation

• Member registration and account management
• User authentication through social login (Google, Apple)
• Saju analysis and customized schedule and recommendation provision
• Recommendation of optimal time slots based on biorhythm and lifestyle patterns
• Provision of ADHD-customized guides
• Energy analysis based on health data (sleep, heart rate, activity)
• Energy budget adjustment and schedule intensity control through menstrual cycle integration
• Provision of AI Dongja counseling and task counseling
• Goal setting and progress tracking
• Integrated schedule management through calendar synchronization
• Provision of gamification features such as trophies, quests, and points
• Provision of tarot and fortune cookie content
• Customer support and inquiry response
• App error diagnosis and performance improvement

2) Service Improvement and Analysis

• Service usage statistics analysis and quality improvement
• Enhancement of personalized content and recommendation algorithms
• Data analysis for new feature development

3) Compliance with Legal Obligations and Security

• Compliance with data retention obligations under applicable laws
• Prevention of fraudulent use and security enhancement

2. Items of Personal Information Collected

3. Automatically Generated (Derived) Information

Based on birth information and lifestyle patterns provided by users, the Company automatically generates and analyzes the following information. This information is used solely for the purpose of providing customized services.

• Saju Analysis Results: Day Master, major Five Elements, Favorable Element, energy season, Saju energy type
• Zodiac Information: Zodiac sign, zodiac element
• Biorhythm: Physical, emotional, and intellectual biorhythm scores
• Daily Report: Saju interpretation summary, favorable time periods, caution time periods, recommended task blocks, completion rate, focus time statistics
• AI Recommendation: Customized recommendations in sleep, focus, physical, and psychological domains
• Energy Budget: Daily energy score and hourly energy change based on sleep quality, biorhythm, Saju coefficient, weather, menstrual cycle, and other factors
• Menstrual Cycle-Based Adjustment: Automatic adjustment values for energy budget and schedule intensity when menstrual/PMS period is detected

4. Methods of Collection of Personal Information

• Direct input by users during registration and onboarding process
• Auto-collection through social login providers (Google, Apple)
• Auto-generation during service use (work session recording, biorhythm calculation, etc.)
• Health data collection through Apple HealthKit and watchOS (upon user consent)
• Schedule synchronization through device calendar access (upon user consent)
• Direct user response during ADHD survey participation
• Direct user response during menstrual cycle information input
• Generation through AI Dongja and task counseling conversation process
• Collection through in-app purchase process via store
• Auto-collection upon app error occurrence (device information, error logs)

5. Retention and Destruction of Personal Information

1) Retention Period

Personal information will be destroyed without undue delay after the purpose of collection and use is achieved. However, if retention is required for a certain period under applicable laws, such information will be separately stored.

2) Destruction Procedures and Methods

• Electronic Files: Permanent deletion in an unrecoverable manner
• Paper Documents: Shredding or incineration
• Copies remaining in system backups kept for disaster recovery are automatically deleted within 30 days after the original is deleted.

6. Handling of Sensitive Information

According to Article 23 of the Personal Information Protection Act, the Company collects and uses the following sensitive information only after obtaining separate consent.

Users have the right to decline provision of sensitive information. If declined, features utilizing such sensitive information (energy analysis, menstrual cycle integration, ADHD guides) may be restricted, but other service use is not affected. Sensitive information is encrypted and stored on the server and is not provided to advertisers, marketers, or third-party data brokers.

7. International Transfer of Personal Information

The Company transfers personal information to processors located overseas for service provision as follows. Users have the right to refuse international transfer, and some service features may be restricted upon refusal.

User data for this service is primarily stored in the AWS Japan (Osaka) region. Data processing in the United States (OpenAI, Anthropic, Google AI, Cloudflare, FAL.AI, etc.) occurs only for AI content generation, CDN, and auxiliary infrastructure purposes, with the original data repository in the Japan region.

In addition, to ensure service stability (in preparation for outages), user data may be stored in duplicate (replicated) in the AWS Republic of Korea (Seoul) region. The retention period and destruction of duplicated data are the same as for the original data.

8. Provision of Personal Information to Third Parties

Company's Usage Rights

The Company may use personal information in de-identified form for Service improvement, data analysis, AI model training, and other purposes. De-identification means removing metadata (generation time, model, user ID, nickname). Marketing display of facial photos requires separate consent.

Third-Party Disclosure Principles

The Company does not disclose personal information to third parties without user consent as a general principle. However, exceptions include the following:

• When users have provided prior consent
• When investigation or inquiry requests are made by relevant authorities for investigative purposes by law
• When processed into a form that cannot identify specific individuals for purposes such as statistics creation or academic research

9. Entrustment of Personal Information Processing

The Company entrusts personal information processing tasks to the following for smooth service provision.

Entrustment contracts include necessary provisions for personal information protection, and the Company manages and supervises entrusted companies to ensure they do not use personal information for purposes other than entrusted tasks.

10. User Rights and Exercise Methods

Users (or their legal representatives) may exercise the following rights at any time.

• Right to Request Access to Personal Information: Users may request access to personal information being collected and used.
• Right to Request Correction and Deletion of Personal Information: Users may request correction or deletion of inaccurate or incomplete information.
• Right to Request Processing Suspension of Personal Information: Users may request suspension of personal information processing.
• Withdrawal of Consent and Member Withdrawal: Users may request consent withdrawal and member withdrawal through app settings or email ([email protected]).

Rights may be exercised through written communication, email, or other means, and the Company will take action without undue delay. Upon member withdrawal, personal information will be destroyed without delay after the retention period specified by applicable laws has elapsed.

11. Marketing Information Reception Consent

The Company operates push notifications in two types as follows.

• Service Notifications (Required): Notifications directly related to service use such as task reminders, recommendation work notifications, energy change notifications, and check-ins. Consent is obtained upon registration and can be blocked in device notification settings.
• Marketing Notifications (Optional): Announcements of new features, events, promotions, updates, etc. Separate consent can be given or withdrawn upon registration or in app settings. Service use is not restricted even if declined.

Marketing notifications will not be sent during evening hours (9 PM to 8 AM) in accordance with information and communication network law, and are only sent when prior consent has been obtained.

12. Advertising Processing Policy

The Company currently does not expose external advertisements within the INTA service. If advertisements are introduced in the future, the following matters will be disclosed in advance and separate consent will be obtained before processing.

• Whether advertising identifiers (IDFA / Android Advertising ID) are collected and used, and the purpose
• Whether personalized advertisements are provided and how to refuse (guidance on "Limit Ad Tracking" / "Reset Advertising ID" in device settings)
• List of advertising partners and data sharing items

Upon introduction of advertising, this policy will be amended and separate notice will be provided through in-app announcements 30 days before implementation. Marketing consent and advertising consent are operated separately, and service use is not restricted even if advertising consent is not provided.

13. Rights Regarding Automated Decision Making

INTA uses automated algorithms to provide recommendations in the following areas.

• Schedule recommendation (automatic task placement by time slot)
• Energy budget calculation and automatic schedule intensity adjustment
• Execution difficulty evaluation and minimum viable action (MVA) generation
• AI Dongja and task counseling response generation
• Personalized learning of recommendation algorithms

According to Article 37-2 of the Personal Information Protection Act, users have the following rights.

• Right to Request Explanation: Users may request explanation of the criteria and procedures for automated decision making.
• Right to Object: Users may object to the results of automated decision making and request human review.
• Right to Refuse: Users may refuse the application of automated decision making and manage schedules manually (disable recommendation features in app settings).

Rights may be exercised by requesting at [email protected], and the Company will provide notification of processing results within 30 days.

14. Measures to Ensure Safety of Personal Information

The Company takes the following measures to ensure the safety of personal information.

• Administrative Measures: Establishment and implementation of internal management plans for personal information protection, minimization of employees handling personal information and training
• Technical Measures: Encryption of personal information (SSL/TLS in transmission, encryption at storage), server-side encryption storage of sensitive information (birth information, menstrual cycle, ADHD profile, AI counseling content, etc.), construction of hacking prevention systems, operation of access control systems
• Physical Measures: Access control to computer rooms and data storage facilities

15. Operation of Cookies and Automatic Collection Devices

The Company may automatically collect the following information during service use.

• IP address, access date and time, service usage records
• Device information (OS version, device model, unique identifier)
• App usage statistics and error logs

Users may refuse auto-collection through device settings, but service use may be restricted in such cases.

16. Personal Information of Children Under Age 14

The Company does not collect personal information of children under age 14. If it is confirmed that a user is under age 14, the account and personal information will be immediately deleted.

17. Personal Information Protection Manager

The Company designates a personal information protection manager as follows to handle complaints related to user personal information protection and provide relief for damages.

18. Personal Information Violation Remediation Agencies

For reports and counseling regarding personal information violations, you may contact the following agencies.

• Personal Information Violation Report Center (privacy.kisa.or.kr / 118)
• Supreme Prosecutor's Office Cybercrime Division (spo.go.kr / 1301)
• National Police Agency Cybercrime Division (ecrm.police.go.kr / 182)

19. Amendment of Privacy Policy

This Privacy Policy may be amended due to changes in laws, policies, or services. Upon amendment, notice will be provided through in-app announcements or service screens 7 days before implementation. In case of material changes to user rights, notice will be provided 30 days in advance.

This Privacy Policy is effective as of October 15, 2026.