Privacy Policy

We collect personal data relating to you ("Personal Data") as follows:

We may use Personal Data for the following purposes:

• To provide, analyze, and maintain our Services (such as Kogito and Kumos), for example to answer your questions in Kogito
• To verify answers with other AI models and web sources when you ask for it
• To communicate with you, including to send you information about our Services and events, for example about updates, changes, improvements to the Services
• To improve and develop our Services and conduct research, for example to develop new product features
• To prevent fraud, illegal activity, or misuses of our Services, and to protect the security of our systems and Services
• To comply with legal obligations and to protect the rights, privacy, safety, or property of our users, KONEXIN, or third parties

We may also aggregate or de-identify Personal Data so that it no longer identifies you and use this information for the purposes described above, such as to analyze the way our Services are being used, to improve and add features to them, and to conduct research. We will maintain and use de-identified information in de-identified form and not attempt to reidentify the information, unless required by law.

We do not use your prompts, conversations or uploaded files to train AI models. They are sent to the provider of the AI model you choose (or that Kogito chooses for you) only to generate and verify answers. To improve the Services we use only aggregated statistics that do not identify you, such as how often each kind of question is asked.

We may disclose your Personal Data in the following circumstances:

• Processors and Service Providers - To provide the Services we use the processors named in "Processors" below, including the AI model providers named in "International transfers". Pursuant to our instructions, these parties will access, process, or store Personal Data only in the course of performing their duties to us.
• Business Transfers - If we are involved in strategic transactions, reorganization, bankruptcy, receivership, or transition of service to another provider (collectively, a "Transaction"), your Personal Data may be disclosed in the diligence process with counterparties and others assisting with the Transaction and transferred to a successor or affiliate as part of that Transaction along with other assets.
• Government Authorities or Other Third Parties - We may share your Personal Data, including information about your interaction with our Services, with government authorities, industry peers, or other third parties in compliance with the law (i) if required to do so to comply with a legal obligation, or in the good faith belief that such action is necessary to comply with a legal obligation, (ii) to protect and defend our rights or property, (iii) if we determine, in our sole discretion, that there is a violation of our terms, policies, or the law; (iv) to detect or prevent fraud or other illegal activity; (v) to protect the safety, security, and integrity of our products, employees, users, or the public, or (vi) to protect against legal liability.
• Affiliates - We may disclose Personal Data to our affiliates, meaning an entity that controls, is controlled by, or is under common control with KONEXIN. Our affiliates may use this Personal Data in a manner consistent with this Privacy Policy.

Kogito does not offer business or enterprise accounts managed by an administrator, and it has no feature for sharing your conversations with other users.

We use the following processors to provide the Services:

Our contracts require each processor to use personal data only to perform the service for us, to protect it with technical and organizational measures, and not to pass it on without our permission, and we supervise how they process it. We will update this list without delay when a processor or the processing entrusted changes.

To provide the Services we transfer personal data outside the Republic of Korea as follows. The transfer takes place over the network at the time you use the Services.

AI model providers by country (which ones answer depends on the model and plan): United States: OpenAI, Anthropic, Google, xAI, Perplexity, Ideogram, Recraft, Amazon Web Services (Amazon Bedrock); People's Republic of China: DeepSeek, Alibaba Cloud (Qwen), MiniMax, Moonshot AI, Zhipu AI (Z.ai); France: Mistral AI; Germany: Black Forest Labs; United Kingdom: Stability AI; Canada: Cohere. Upstage and NAVER Cloud are in the Republic of Korea, so sending to them is not an international transfer.

Kogito never chooses a model from a provider in the People's Republic of China for you. Personal data is transferred to those providers only when you choose such a model yourself, by naming it in your message or by selecting it in the model list; to refuse this transfer, do not choose those models. You can likewise avoid a transfer to any other AI model provider by choosing a model from another provider. Because the other transfers are necessary to provide the Services, if you do not want them you can stop using the Services or delete your account. These transfers rely on the providers' data processing terms for API customers and, for users in the European Union and the United Kingdom, on the safeguards those terms provide.

We use cookies that the Services need to work, such as keeping you signed in and remembering your language and display settings. We use Google Analytics cookies (through Google Tag Manager, with Google Consent Mode in basic mode) to understand how the Services are used only if you choose "Accept" in our cookie notice; before you accept, nothing from Google is loaded, and refusing does not limit the Services. You can change your choice at any time under "Cookie settings" at the bottom of every page, and you can block or delete cookies in your browser settings, although some features such as staying signed in need the essential cookies. The table below lists each cookie, its purpose and how long it lasts.

Cookieless visit counting: to know how many people visit the company website and Kogito and how they move through it (for example how many see the pricing page or the cookie notice and what they choose), we also count visits on our own servers, without cookies and without sending anything to third parties. This counting works whether or not you accept cookies. For each page view or event our server keeps only daily totals: the date, the website, a page category (such as home or pricing), the language, a coarse device type (mobile, tablet or desktop) and the kind of event. To count unique visitors per day, the server combines your IP address and browser user agent with a random secret that is replaced every day (UTC) and keeps only the resulting one-way code. The IP address and user agent are not stored, the previous day's secret is deleted so codes from different days cannot be linked, and the codes are deleted after the day ends, leaving only the daily totals. Nothing is stored on your device, and the totals do not identify you. Obvious automated visitors (bots) are not counted.

We'll retain your Personal Data for only as long as we need in order to provide our Services to you, or for other legitimate business purposes such as resolving disputes, safety and security reasons, or complying with our legal obligations.

You can delete your account at any time under Settings > Data. When you delete your account, we delete your account information, conversations, projects and uploaded files without delay, except records we must keep by law for the following periods:

• Records of contracts or withdrawal of subscriptions: 5 years (Korean Act on the Consumer Protection in Electronic Commerce)
• Records of payment and supply of goods and services: 5 years (same Act)
• Records of consumer complaints or dispute resolution: 3 years (same Act)
• Records of visits to the website (access logs): 3 months (Korean Protection of Communications Secrets Act)

Request counters used to prevent abuse (with IP and e-mail addresses) are deleted automatically, normally within 7 days. The daily visitor codes used for cookieless visit counting are deleted after the day ends; only daily totals remain. Guest accounts hold no name or e-mail address; a guest account that has been inactive for 90 days is deleted together with its conversations and files.

Electronic files are deleted in a way that cannot be restored, and paper documents are shredded or incinerated.

Depending on where you live, you may have certain statutory rights in relation to your Personal Data. For example, you may have the right to:

• Access your Personal Data and information relating to how it is processed.
• Delete your Personal Data from our records.
• Update or correct your Personal Data.
• Transfer your Personal Data to a third party (right to data portability).
• Restrict how we process your Personal Data.
• Withdraw your consent where we rely on consent as the legal basis for processing at any time.
• Object to how we process your Personal Data.
• Lodge a complaint with your local data protection authority.

You can exercise some of these rights through your KONEXIN account, for example by deleting your conversations or your account under Settings > Data. Requests to access, correct, delete or stop processing your data, including requests through an authorized agent, can be sent to our privacy officer (Kim Seongcheol, CEO) at support@konexin.co.kr.

A note about accuracy: Services like Kogito generate responses by reading a user's request and, in response, predicting the words most likely to appear next. In some cases, the words most likely to appear next may not be the most factually accurate. For this reason, you should not rely on the factual accuracy of output from our Services (such as Kogito and Kumos).

Where your Personal Data is processed and to whom it is transferred is described in "International transfers" above. While data protection law varies by country, we apply the protections described in this policy to your Personal Data regardless of where it is processed.

Our Services are not directed to, or intended for, anyone under 19, and we do not knowingly collect Personal Data from anyone under 19. We collect your date of birth to check your age; if it shows you are under 19 when you sign up, the sign-up does not proceed and the information you entered is not stored. If we learn that we have collected Personal Data from someone under 19, we delete it without delay.

We strive to protect personal information from loss, misuse or abuse, unauthorized access, disclosure, alteration or destruction, or other unlawful conduct. However, no Internet or email transmission is ever fully secure or error free. Therefore, you should take special care in deciding what information you provide to the Services. In addition, we are not responsible for circumvention of any privacy settings or security measures contained on the Service, or third-party websites.

Some U.S. state privacy laws require specific disclosures. The following table provides additional information about the categories of Personal Data we collect and how we use and disclose that information. You can read more about the Personal Data we collect and where we collect it from in "Personal Data we collect" above, how we use Personal Data in "How we use Personal Data" above, and how we retain Personal Data in "Retention and destruction" above.

Depending on where you live and subject to applicable exceptions, you may have the following privacy rights in relation to your Personal Data:

• The right to know information about our processing of your Personal Data, including the right to access your Personal Data, often in a portable format;
• The right to request deletion of your Personal Data;
• The right to correct your Personal Data; and
• The right to be free from discrimination relating to the exercise of any of your privacy rights.

We don't "sell" Personal Data or "share" Personal Data for cross-contextual behavioral advertising, and we do not process Personal Data for "targeted advertising" purposes (as those terms are defined under state privacy laws). We also don't process sensitive Personal Data for the purposes of inferring characteristics about a consumer.

We may update this Privacy Policy from time to time. When we do, we will publish an updated version and effective date on this page, unless another type of notice is required by applicable law.

Privacy officer: Kim Seongcheol, CEO, Konexin Co., Ltd., e-mail support@konexin.co.kr.

Address: 2F, Unit 2, Sinchon Station, 30 Sinchon-yeok-ro, Seodaemun-gu, Seoul, Republic of Korea.

If you have any questions or concerns about this Privacy Policy or your Personal Data, please contact us at the e-mail address above.