In accordance with Article 30 of the Personal Information Protection Act, Coxwave Co., Ltd. (the "Company") establishes and discloses the following Privacy Policy to protect the personal information of data subjects and to quickly and smoothly handle related grievances.

This service ('edutap') is a B2B (business-to-business) based AI tutor solution, and the Company principally holds the status of a 'Data Processor (Trustee)' that processes the data of end-user students upon entrustment from the customer (enterprises and institutions). As a matter of principle, the Company does not collect Personally Identifiable Information (PII). Even when data integration is requested by a customer, the Company solely collects de-identified data from which sensitive personal information cannot be verified or tracked, and manages it by applying full encryption.

Article 1 (Purpose of Processing Personal Information)

The Company processes personal information for the following purposes. The personal information being processed will not be utilized for any purposes other than the following, and if the purpose of use is modified, the Company will implement necessary measures, such as obtaining separate consent in accordance with Article 18 of the Personal Information Protection Act.

• Service Provision (Entrusted Task): Provision of real-time 1:1 AI tutor Q&A functions for students within the customer's platform, analysis of user learning status data, and performance measurement (eduAlign)

• Service Improvement and AI Training: Enhancement of the AI model's context understanding and service quality (※ Strictly utilizing only de-identified/pseudonymized data so that individuals cannot be recognized)

• Security and Prevention of Fraudulent Use: System protection, such as blocking unauthorized access and defending against malicious traffic

Article 2 (Items of Personal Information Processed and Methods of Collection)

The Company does not request or collect direct identification information such as name, email, or mobile phone number to provide its B2B services. Even if there is a separate integration request from a customer, the Company restricts its processing solely to the encrypted information listed below so that individuals cannot be tracked at the source.

• Integration API Collection Items (Customer Entrusted Data): Encrypted (or hashed) user identification IDs transmitted from the customer's platform, identification information of the lecture/course being accessed, AI tutor Q&A chat texts, chat timestamps, and user feedback data

• Upon Google API Integration (Limited to Applicable Customers): Minimum data necessary for service integration, such as OAuth authentication tokens and Google Classroom class/assignment identification information

• Automatically Collected Items: Access IP information, access logs, service usage records, device and browser environment information

Article 3 (Processing and Retention Period of Personal Information)

① The Company processes and retains personal information within the personal information retention and usage period prescribed by law or the retention and usage period agreed upon when collecting personal information from the data subject (the entrustment contract period with the customer).

② Specific personal information processing and retention periods are as follows:

• Entrusted Data: Until the termination of the edutap service use agreement with the customer, or until the customer requests data destruction (e.g., via API delete call)

• Access Log Records under the Protection of Communications Secrets Act: 3 months

※ However, for AI model training purposes, anonymous data that has already been completely de-identified and merged cannot specify an individual, and thus is excluded from the subjects of destruction.

Article 4 (Provision of Personal Information to Third Parties)

The Company processes the data subject's personal information only within the scope specified in Article 1 (Purpose of Processing Personal Information) and provides personal information to third parties only when it falls under Articles 17 and 18 of the Personal Information Protection Act, such as with the consent of the data subject or special provisions of the law. (Currently, the Company does not provide personal information to third parties.)

Article 5 (Entrustment, Sub-entrustment, and Overseas Transfer of Personal Information Processing)

① To provide seamless services and advanced AI processing, the Company entrusts (or transfers overseas) data to external infrastructure and LLM (Large Language Model) providers as follows:

• Cloud Server Entrustment (AWS, etc.): Data storage and system infrastructure operation

• External AI Model API Integration (OpenAI, Anthropic, etc.): AI tutor answer generation (※ Only de-identified chat prompt data is transmitted, excluding identification information)

② When entering into entrustment and sub-entrustment contracts, the Company clearly defines matters concerning the prohibition of processing personal information outside the purpose of the entrusted task, technical and administrative protective measures, restriction on sub-entrustment, etc., and supervises whether the trustee processes personal information safely.

Article 6 (Rights and Obligations of Data Subjects and Legal Representatives, and Methods of Exercise)

① Data subjects (students) may exercise their rights to request access to, correction, deletion, and suspension of processing of their personal information at any time.

② Special Exception for the Trustee's Status: Because the Company is a trustee processing data upon entrustment from the customer (e.g., LMS operator), the exercise of the data subject's rights must, in principle, be conducted through the 'Customer, who is the Data Controller.' If the Company receives a request from the customer to exercise the data subject's rights (e.g., deletion request via API), the Company will process it without delay.

Article 7 (Procedures and Methods for Destroying Personal Information)

The Company destroys the relevant personal information without delay when the personal information becomes unnecessary, such as the expiration of the retention period or achievement of the processing purpose.

• Destruction Procedure: Data for which a cause for destruction has occurred is immediately destroyed in an irreversible manner.

• Destruction Method: Information in the form of electronic files is deleted using technical methods (e.g., Secure Erase) that prevent the records from being reproduced.

Article 8 (Measures to Ensure the Safety of Personal Information)

The Company takes the following measures to secure the safety of personal information:

1. Administrative measures: Establishment and implementation of an internal management plan, regular security training

2. Technical measures: Management of access rights to personal information processing systems, encryption of API communication sections (TLS/HTTPS applied), encrypted transmission and storage of user identification IDs, installation of security programs

3. Physical measures: All data and systems of this service are safely hosted in a professional cloud service environment. Therefore, direct physical access control and security measures for the data center (server room) are applied by entrusting them to the strict security control policies of the respective cloud infrastructure provider, while the Company implements rigorous logical access control and account management for the cloud infrastructure.

Article 9 (Google API User Data Policy - Special Provision)

When handling data obtained through Google APIs, such as Google Classroom, edutap strictly complies with the following:

• Data Use Limitation: Data accessed through Google APIs is used solely for the purpose of providing the core learning integration functions of edutap, and is never used for other purposes, including targeted advertising.

• Adherence to Limited Use: edutap's use and transfer to any other app of information received from Google APIs will strictly adhere to the Google API Services User Data Policy, including the 'Limited Use' requirements.

Article 10 (Privacy Officer and Remedies for Infringement of Rights)

The Company is responsible for overall personal information processing tasks, and has designated a Privacy Officer as follows to handle complaints and damage relief from data subjects related to personal information processing.

• Officer: Juwon Kim (CEO)

• Email: support@edutap.ai

Data subjects may apply for dispute resolution or consultation to the Personal Information Dispute Mediation Committee, Korea Internet & Security Agency (KISA) Personal Information Infringement Report Center, etc., to receive relief for damages caused by personal information infringement.

Article 11 (Amendment of the Privacy Policy)

This Privacy Policy shall apply from January 1, 2026. If there are additions, deletions, or corrections of modifications according to laws and policies, they will be notified through the website notice board from 7 days prior to the enforcement of the changes.