App Privacy Policy · Effective 2026-10-23

App Privacy Policy

Zenumaik Co., Ltd. (the "Company") operates the ChapterN app and processes personal information under Korea's Personal Information Protection Act. This Policy explains the information processed, its purposes and retention periods, the use of external providers, and how to exercise your rights. Acknowledging this Policy does not constitute consent to all processing. We obtain separate consent where required. Beyond confirming installations from ads, we provide information about app use after registration to advertising providers for advertising measurement only with separate optional consent (the "Consent to Processing Personal Data for Ad Measurement"); acknowledging this Policy or consenting to marketing communications does not replace it.

The separate Website Privacy Policy covers website browsing, web reading, launch-notification requests and web advertising tracking. This Policy applies to the app and app-account services.

1. Personal Information We Process

We receive information that users enter, or external sign-in and payment services provide, during registration, use, inquiries, and applications. Device, connection, and usage information is generated automatically when the Service is used.

Where verification is necessary for account protection, refunds, or infringement reports, we may receive the minimum additional transaction records and information needed to establish identity, age, legal-representative relationships, authority to act, payment authorization, or relevant rights. We explain the purpose and required information; unnecessary personal information may be redacted or replaced with alternative evidence. Supporting information follows the retention period of the relevant inquiry, refund, or dispute record. Information unnecessary for verification is not collected or is promptly deleted.

We do not request payment card numbers, Korean resident registration numbers, or precise location. Birth information that fails age verification is not stored. The app marketplace country or region signal used to select an age requirement is not stored as the Member's country of residence. Full bank account numbers used for direct refunds are deleted after transfer confirmation; necessary transaction evidence is retained.

2. Purposes and Legal Bases

Processing based on legitimate interests is limited to what is needed for service safety, improvement, specific rights disputes, the Company's internal advertising performance analysis, and confirming installations from ads, and is performed only where permitted after balancing users' rights. The Company's internal advertising performance analysis takes place only within the measurement and analytics tools the Company entrusts and is not provided to advertising providers, so it continues regardless of the consent below. Advertising performance measurement and ad-delivery optimization carried out by providing information to advertising providers helps those providers measure the results of ChapterN ads and show them to people likely to be interested; it is performed only if you agree to all three items of the "Consent to Processing Personal Data for Ad Measurement" (collection and use, provision to advertising providers, and international transfer). You can withdraw this consent at any time under 'Ad measurement consent' in the app settings (on devices that offer this setting) or through the contact channel in Section 8, and you can request suspension of installation confirmation from ads through the contact channel in Section 8 (Section 10). The Company does not collect device advertising identifiers or provide email addresses or phone numbers to advertising providers (no contact matching). Ad measurement consent is separate from consent to marketing communications and from acknowledging this Policy; neither replaces it.

3. AI Training and Automated Decisions

The Company does not use users' personal information to train generative AI models or send it to external generative AI while they read. During registration, we automatically compare the submitted birth year and month against the applicable minimum age. Because we do not collect the exact day of birth, in the year a user reaches the minimum age we confirm eligibility only after their birth month has passed. You may request an explanation or review through Section 8. Where statutory rights concerning automated decisions apply, we handle requests accordingly.

4. Third-Party Disclosure and Service Providers

We disclose personal information to third parties only with consent or another legal basis. We entrust the following operations to providers and use contracts and oversight to ensure that personal information is processed securely. Before disclosing information in response to a court or investigative authority, we verify the legal basis and scope and provide only the minimum necessary information. A request alone does not authorize disclosure.

For confirming installations from ads under Section 2, we disclose the following information to advertising providers through AppsFlyer.

If you agree to all three items of the "Consent to Processing Personal Data for Ad Measurement", we also disclose the following information to advertising providers through AppsFlyer and Firebase for the advertising performance measurement and ad-delivery optimization carried out by providing information to advertising providers in Section 2.

Under operating-system privacy standards, on some devices the Company does not provide user-level information to advertising providers regardless of consent, and measures advertising results only through aggregated information provided by the operating system. Advertising providers may link the information they receive with information they hold, and Meta and TikTok may also use it for personalized advertising under their own policies; their processing follows their own privacy policies. Each provider may delete information earlier under its own policies, and where the law requires retention it keeps the information for that period. Declining or withdrawing ad measurement consent, or requesting suspension of installation confirmation, does not affect your use of the Service (Section 10).

Google and Apple sign-in and marketplace payments used directly by users are also subject to those providers' privacy policies. The Company exchanges identifiers and verification information needed to confirm sign-ins and payments with those platforms.

When providing Ink delivery and consumption information for Apple's refund review, we obtain separate consent for that transaction. Declining does not prevent you from requesting a refund.

5. International Transfers

We explain below the legal bases applied to international transfers and the matters listed in Article 28-8(2) of Korea's Personal Information Protection Act (the information transferred; the country, timing, and method; the recipient and its contact; the purpose and retention period; and how to refuse, the procedure, and its effect).

• Outsourced processing and storage necessary to enter into or perform a contract with the user: disclosure under Article 28-8(1)(3)(a) of Korea's Personal Information Protection Act.
• Transfers to countries recognized by the Personal Information Protection Commission as providing equivalent protection: Article 28-8(1)(5), limited to EU/EEA transfers that fall within the scope of the equivalence recognition.
• Disclosures to advertising providers under ad measurement consent (Section 4): separate consent under Article 28-8(1)(1).

The legal basis for an international transfer is assessed separately from the collection and use bases in Section 2. Access by affiliates outside the EU/EEA and onward transfers to other countries must also meet the requirements and safeguards applicable to that access or transfer.

Primary Member and Content data is stored in Google Cloud's Seoul region in Korea. Where the Company directly receives aggregated advertising measurement information provided by the operating system, it receives that information in Google Cloud's Japan region and stores it in the Seoul region. Overseas diagnostic and push services use the global infrastructure described in Firebase's processing-location information and the facility-country lists linked there.

Storage and processing of information entrusted by the Company to AppsFlyer within the European Union, and the installation-confirmation disclosure to Meta Platforms Ireland Limited (Ireland) under Section 4, rely on the equivalence recognition under Article 28-8(1)(5) of Korea's Personal Information Protection Act. Affiliates in Israel, the United States, the United Kingdom, Germany, China, Hong Kong, India, and Japan may participate in support and maintenance. Provider roles and locations are listed in AppsFlyer’s subprocessor information.

You may contact admin@zenumaik.com to refuse international transfers or request suspension of processing. Refusing processing necessary for contract performance, such as authentication, may prevent use of the relevant account features. You can withdraw your consent to transfers for ad measurement with 'Ad measurement consent' in the app settings (on devices that offer this setting) or through the email above, and you can request refusal of transfers for confirming installations from ads through the email above; neither disadvantages your use of the Service. The Company applies safeguards such as encryption and access restrictions to international transfers.

6. Retention Periods

We promptly delete personal information when its purpose is fulfilled or a Member deletes their account. The following records are retained separately as required by law.

Other periods are as follows:

• Connection logs for security and incident response: up to 92 days.
• Abuse-prevention records: up to six months after account deletion.
• Reports: up to three years after closure; general inquiries: up to one year after closure. Linked general inquiries and reports are deleted upon account deletion, except for separately retained statutory records.
• Notification and delivery records: up to one year.
• User-level GA4 analytics records: up to 14 months
• Aggregated advertising measurement information provided by the operating system that the Company receives directly: automatic deletion begins 14 months after receipt. Information processed by AppsFlyer follows the AppsFlyer periods below.
• AppsFlyer user-level measurement information: up to 24 months. Aggregated information that cannot identify individuals: up to 25 months.
• Crashlytics crash and diagnostic information: held for 90 days before the deletion process begins.
• Operational backups managed by the Company: up to 14 days. Residual information in external services, such as Firebase authentication and messaging, follows those services' deletion procedures; removal from live and backup systems may take up to 180 days after a deletion request.
• Ad measurement consent and withdrawal records: until account deletion.
• Internal identifier and deletion time used to prevent recreation of a deleted account: retained only for that purpose while the Service operates.

Marketing information follows the periods in the Marketing Communications Consent. Use under ad measurement consent lasts until you withdraw consent or delete your account; information recorded in measurement tools follows the GA4 and AppsFlyer periods above, and information received by advertising providers follows their retention periods in Section 4 (see the "Consent to Processing Personal Data for Ad Measurement"). Statistics that no longer identify individuals may be retained separately.

7. Deletion Methods

Electronic files are deleted using methods that make recovery difficult. Statutory records are kept separately with restricted access and deleted when their retention period ends. Backups are used only for recovery, and previously received deletion requests are reapplied when data is restored.

8. Your Rights and How to Exercise Them

You may request access, correction, deletion, suspension of processing, withdrawal of consent, and account deletion. Requests may also be made by a legal representative or authorized agent. Where provided by law, you may exercise rights concerning data portability or automated decisions.

• Account information and deletion: [My > Account settings] or the account deletion guide.
• Marketing withdrawal: [My > Settings > Notifications].
• Withdrawing ad measurement consent: 'Ad measurement consent' in the app settings or admin@zenumaik.com.
• Suspending installation confirmation from ads: admin@zenumaik.com.
• Other requests: admin@zenumaik.com.

We may request the minimum information needed to verify that the requester is the individual concerned or a lawful representative. For representatives, we verify the authorization or legal-representative relationship. Unnecessary personal information may be redacted or replaced with alternative evidence. Requests and supporting information are used to handle the relevant rights request.

Access, correction, deletion, suspension, and other requests are handled under the conditions and deadlines prescribed by applicable law. Requests may be limited in whole or part where the law permits, including statutory retention duties or protection of another person's life, physical safety, property, or other rights. Suspension may also be limited as permitted by law where it would prevent contract performance and the user has not clearly expressed an intention to terminate the contract. If a request is limited or refused, we explain the grounds and reasons; you may object through the same contact channel.

We do not impose unjustified disadvantages for refusing optional consent or exercising your rights. However, stopping processing strictly necessary for a feature, such as authentication or payment, may prevent us from providing that feature; we explain the impact where applicable. Withdrawal of marketing consent is handled separately from requests concerning service analytics or advertising measurement.

9. Registration Age

Registration is for users aged 15 or older, or 18 or older through Indonesian app storefronts. We do not offer parental-consent registration below the minimum age. If a user is found to be below the minimum age, their account and personal information are deleted, except for records retained separately for refunds and statutory duties.

10. Automatic Collection and Advertising Measurement

Service Analytics and Advertising Measurement

Automatic-collection tools in the app, such as Firebase Analytics, Crashlytics, and AppsFlyer, collect the device and app information and app usage records in Section 1 while you use the app, and the Company uses them for usage statistics, error analysis, and its internal advertising performance analysis. AppsFlyer performs measurement, analysis, and fraud prevention on the Company's behalf. This information is disclosed to advertising providers under Section 4 only to the extent needed to confirm installations from ads and, if you consent to ad measurement, within the scope of that consent. Installation and referral-source information may also be used to take users who installed the app from an ad straight to the advertised work. Under operating-system privacy standards, on some devices advertising results are processed only in aggregated form regardless of consent.

Rewarded Ads

The app offers rewarded ads that users can watch to shorten the wait before a Chapter can be opened for free. For this, Google LLC collects IP addresses, device information and identifiers, and ad use records directly through its ad SDK in the app (Google AdMob), and may use them to serve and measure ads and to prevent fraud, as described in the Google Privacy Policy.

How to Refuse

You can withdraw or give ad measurement consent again under 'Ad measurement consent' in the app settings (on devices that offer this setting), and on any device you can also request withdrawal at any time through the contact channel in Section 8. Consent and withdrawal are recorded on your Member account. You can request suspension of processing of automatically collected information, including installation confirmation from ads, through the contact channel in Section 8. Declining or withdrawing consent does not stop the Company's internal measurement and analysis that is not provided to advertising providers (including advertising performance analysis) or aggregated advertising measurement, and does not affect your use of the Service. Information Google collects directly for rewarded ads is processed separately from this consent.

11. Security Measures

We limit access to personal information to people who need it for their duties and apply necessary safeguards, including access controls, encryption, access-log management, and security updates. If a personal information breach occurs, we notify users and competent authorities as required by law.

12. Privacy Officer and Contact

• Company: Zenumaik Co., Ltd. (주식회사 제누마이크)
• Representative, privacy officer, and access-request contact: Hyesu Jeon (전혜수)
• Address: Unit K381, Room 703, 7F, Academy Plaza, 9 Gangnamseo-ro, Giheung-gu, Yongin-si, Gyeonggi-do, Republic of Korea (Gugal-dong)
• Telephone: +82-10-2597-3423
• Email: admin@zenumaik.com

For Korean privacy complaints, contact the Privacy Infringement Report Center at 118. For mediation, contact the Personal Information Dispute Mediation Committee at 1833-6972.

13. Policy Changes

When this Policy changes, we announce the effective date and key changes. Processing that requires new consent begins only after that consent is obtained.

Effective Date

This Policy takes effect on October 23, 2026.