Artificial Intelligence (AI) Service Operating Policy

Article 1 (Data Governance and Confidentiality)

The Company places the highest priority on the Client's intellectual property rights and data security, and complies with applicable laws.

1. Data Ownership

All intellectual property rights in the prompts, source code, databases, documents, and other materials that the Client inputs into the AI Services (hereinafter "Input Data"), as well as the outputs generated by the AI system in response thereto (hereinafter "Output Data"), belong, as a rule, to the Client.

2. Prohibition on Use for Retraining

The Company does not use any data input by the Client to further enhance, adjust the weights of, or retrain its AI models. However, statistical information that has been fully de-identified and aggregated so that no individual or Client can be identified (for example, average response time, error rate, and token usage) does not constitute retraining data and may be used solely for the purpose of improving service operations, in order to monitor service quality and ensure system stability.

Stored data is protected using industry-standard encryption technologies such as AES-256, and data in transit is protected using TLS-based encryption. In addition, once the purpose of service provision has ended, data is securely deleted or de-identified in accordance with applicable laws and the Company's internal data retention policy.

(※ Related legislation: Article 21 of the Personal Information Protection Act (Destruction of Personal Information))

3. Real-Time De-identification of Domestic and Overseas Personally Identifiable Information (PII) and Global Regulatory Compliance

Where, in the course of processing by the AI Services, the Company detects not only personal information and unique identifying information under the Korean Personal Information Protection Act but also personally identifiable information (PII) as defined by the laws and standards of other countries, it applies available technical safeguards to de-identify (mask) such information before transmitting it to the language model.

This includes the PII rules under U.S. federal government and NIST guidelines, as well as the definition of personal data under the European GDPR, and the Company applies technical and administrative safeguards to reduce the Client's risk of violating global regulations.

The specific technical specifications applied to PII de-identification (detection methods, masking scope, processing flow, etc.) are provided in a separate technical document upon the Client's request.

(※ Related regulations: Article 29 of the Korean Personal Information Protection Act, U.S. NIST SP 800-122 (Guide to Protecting the Confidentiality of PII), and Article 4(1) of the European GDPR (definition of personal data))

4. Rigorous Isolation of PolyBot Sessions and Conversation Memory

When providing the AI chatbot solution (PolyBot), each of the Client's conversation sessions and the context memory used are loaded and processed in logically isolated, independent areas within a multi-tenancy environment.

To prevent any commingling of memory or data interference with other Clients or other sessions, the Company applies logical isolation, access controls, and other technical and administrative safeguards. Upon termination of the relevant conversation session or termination of the contract, the stored real-time memory data is securely deleted or de-identified in accordance with applicable laws and the Company's internal data retention policy.

5. Control of Sensitive Information and Recommended Filtering

Notwithstanding the Company's real-time de-identification (masking) and memory isolation measures, the Client must fulfill its own management and oversight obligations to ensure that its authenticated users do not excessively input corporate confidential information, non-public financial data, or third parties' trade secrets.

6. Notice Regarding Third-Party AI Model Providers

The Company may use the language models or APIs of third-party AI model providers (hereinafter "AI Sub-processors") to provide the AI Services. In such cases, the Company secures, through its contracts with the AI Sub-processors, the prohibition on using the Client's data for retraining as well as data security and confidentiality obligations, and, where there is a change of AI Sub-processor, provides prior written notice to the Client.

Article 2 (Technical Limitations and Disclaimers)

Because these AI Services are based on generative language models and machine-learning algorithms, the following technical limitations exist.

1. Disclaimer Regarding the Accuracy of Output (Hallucination)

Due to the nature of AI technology, Output Data may contain some inaccurate or biased information, or hallucination phenomena that differ from fact (hereinafter "Hallucination").

These Services are a solution intended to assist with work and for reference purposes, and the Company does not warrant the completeness or commercial suitability of the Output Data.

2. Responsibility for Final Decision-Making

All responsibility for the Client's final management decisions and business actions in legal, financial, human resources, and other matters, taken on the basis of Output Data generated using the AI Services, lies with the Client.

(※ Related legislation: application by analogy of the business-judgment principle under Article 399 of the Commercial Act (Company's Liability for Damages) and Article 401-2, etc.)

3. Disclaimer Regarding Infringement of Third-Party Rights

The Company applies reasonable technical measures to ensure that Output Data from the AI system does not infringe the patent, copyright, trademark, or other rights of third parties.

However, due to the nature of generative AI, the Company does not warrant the accuracy or completeness of all results or the non-infringement of third-party rights.

In particular, the Company is not liable for disputes arising from the unlawfulness of, or rights infringement by, the Input Data provided by the Client itself, and is exempt from liability absent the Company's intent or gross negligence.

Article 3 (Acceptable Use Policy and Infrastructure Protection)

The Client must not use the AI Services in a manner that impairs the stability of the Company's systems or violates applicable laws.

1. Prohibition on System Circumvention and Reverse Engineering

Prompt injection intended to disable the AI safety filtering system established by the Company, jailbreak attempts, and reverse engineering intended to extract the solution's source code are prohibited.

(※ Related legislation: Article 2 of the Unfair Competition Prevention and Trade Secret Protection Act (Definitions))

2. Prohibition on Overloading Infrastructure

When using the API integration and PolyBot, using automated crawlers or scripts that have not been agreed in advance to place a serious load on the Company's AI infrastructure and server operating environment is prohibited.

(※ Related legislation: Article 48 of the Act on Promotion of Information and Communications Network Utilization and Information Protection, Etc. (Prohibition of Acts Infringing an Information and Communications Network))

3. Prohibition on Generating Illegal or Harmful Content

Using the solution for unlawful acts is prohibited, including producing works that defame others such as deepfakes, inducing the infringement of third-party intellectual property rights, developing malicious code, and generating scripts for the purpose of fraud or phishing.

4. Measures Upon Violation

Where the Company becomes aware of a violation of this Article, it will take action in accordance with the following staged procedure.

• (1) Notice to Cure: The Company notifies the Client in writing (including by email) of the violation and the corrective actions required.
• (2) Cure Period: The Client must cure the violation within 14 business days from the date of receipt of the notice to cure.
• (3) Restriction of Service Use: If the Client fails to cure the violation within the cure period, the Company may restrict the use of all or part of the AI Services.
• (4) Termination of the License Agreement: If the violation persists even after the restriction of service use, the Company may terminate the license agreement.

However, where a violation of paragraphs 1 through 3 of this Article poses an urgent and serious threat to the security of the Company's infrastructure, the Company may immediately restrict or block service use without granting the cure period under the above procedure, and will notify the Client without delay afterward.

Article 4 (Global AI Transparency and Responsible Use)

In order to support Clients conducting global business, such as through PolyGlot and PolyBot, the Company endeavors to operate its AI Services responsibly, taking into account international AI regulatory trends and relevant standards.

1. Ensuring AI System Transparency

Where the Client integrates a solution such as PolyBot into its own customer-facing services (such as a B2C chatbot), the Client must clearly inform end users that the service is powered by an artificial intelligence system.

(※ Related legislation: Article 52 of the EU AI Act (Transparency Obligations for Certain AI Systems))

2. Response to Automated Decisions

Where an end user of the Client refuses AI-based consultation and requests interaction with a human agent (opt-out), the Client must provide an alternative procedure to handle such requests.

The Company supports the APIs and technical environment for this purpose. The provision of the basic opt-out API is supported at no additional cost, while the costs incurred in the Client's own operations, such as assigning human agents, are borne by the Client. Where additional technical customization is required beyond this, it is governed by a separate agreement between the two parties.

(※ Related legislation: Article 37 of the Personal Information Protection Act, Article 22 of the European GDPR)

3. Compliance with Regulations on General-Purpose AI Models (GPAI)

The Company continuously monitors and responds to applicable global AI regulatory requirements in the course of providing the AI Services, including the provisions on General-Purpose AI Models (GPAI) under the EU AI Act. Where third-party AI models are used, the Company verifies within a reasonable scope whether the relevant model provider is fulfilling its applicable regulatory obligations, and endeavors to provide the Client with the necessary transparency information.

Article 5 (Service Availability and Maintenance)

The Company exercises commercially reasonable technical and administrative efforts to provide stable and continuous AI Services.

All or part of the Services may be temporarily restricted or suspended in any of the following cases.

• Where system inspection, maintenance, feature improvement, or security updates are required
• Where causes beyond the Company's reasonable control arise, such as natural disasters, power outages, communication failures, or failures of upstream providers and cloud services
• Where unavoidable measures are required for urgent security responses or to ensure service stability
• Where service restrictions arise pursuant to applicable laws or the order of a government authority

Where a separate Service Level Agreement (SLA) has been concluded, that agreement applies first.

Article 6 (Relationship with Other Policies)

This Policy applies together with the Company's Terms of Service, Privacy Policy, Cookie Policy, and Artificial Intelligence (AI) Ethics Policy.

Where the content of this Policy conflicts with that of another policy, priority is determined by applying the following criteria.

• Matters concerning the collection, use, retention, and transfer of personal information: the Privacy Policy prevails
• Matters concerning the use of cookies and similar technologies: the Cookie Policy prevails
• Matters concerning service use, contracts, liability, and disclaimers: the Terms of Service prevails
• AI service operating principles, data processing, and acceptable use policy: this Policy prevails
• AI ethics principles and the direction of responsible AI operations: refer to the Artificial Intelligence (AI) Ethics Policy

Article 7 (Changes to the Policy and Notice)

Where this Policy is changed, the Company will announce the reasons for, and content of, the change, together with the effective date, on its website and within the Services at least 30 days before the effective date. However, where there is an urgent reason, such as a mandatory change resulting from an amendment to applicable law, the Company may give notice at least 7 days before the effective date.

Previous versions of the Policy are retained so that they can be reviewed via the website.

If the Client does not agree to the changed Policy, the Client may terminate the service use agreement. If the Client continues to use the Services after the effective date of the changed Policy, the Client is deemed to have agreed to the changed Policy.

Supplementary Provisions

This Operating Policy takes effect on July 3, 2026.