QuizN Privacy Policy

Required items — Email address (for login ID, notices, password reset and other contact purposes). In registration and login methods that use a password, password authentication information is also processed, and passwords are stored by a one-way method that cannot be decrypted.

Optional items — Information voluntarily entered by the user, such as nickname and profile image.

Features — The Company does not require real-name verification for email accounts and does not restrict a single natural person from creating and using multiple email accounts. Information for real-name verification, such as name, mobile phone number, address and resident registration number, is not collected at the time of membership registration.

Because a Member's ID (email address) is used to identify the account in Linked Services, the function to change it directly on screen may be restricted. However, where correction of an email error, change of an unusable email address or account recovery is necessary, the Member may make a request to the Chief Privacy Officer or the customer center, and the Company will verify the Member's identity and the consistency of account security and linkage and inform the Member of the method of processing.

The Company processes the participation code (PIN number), scores, rankings and similar information generated when participating in a quiz. Access logs, IP addresses, cookies and service usage records may be automatically generated and collected for service stability, security and the prevention of fraudulent use. Even where there is no membership registration or entry of a real name, such information is protected as personal information where it can identify an individual in combination with other information, and it is not excluded from protection merely because it is described as "statistical information".

The Company does not directly store payment method information such as card numbers, and processes payments through Payletter Inc. The payment-related information held by the Company consists of the order number used for identification, the date and time of payment, the payment amount, the payment status (success or cancellation) and the IP address and access history used for payment error analysis and fraud detection. The information processed directly by Payletter and the information received and processed by the Company through linkage are distinguished for each payment method and explained on the payment screen and in the respective privacy policies.

Only the email address (an account provided by the institution's administrator or entered by the user) is collected as identification information based on the member account. No additional personal information such as name, school name, grade/class or mobile phone number is collected or stored, and even where necessary, processing is carried out as far as possible using information held by the institution itself.

• Direct entry by the user during membership registration and service use.
• Generation of information through the PG company linkage API during the payment process.
• Collection of information automatically generated during service use (access logs, IP, cookies, etc.).
• In Single Sign-On, the necessary items among the account information already held are transmitted, and the items transmitted and the purposes thereof are disclosed in Section 4. Records and additional information generated or collected while using a Linked Service are governed by the privacy policy of that service.

The Company processes, on a lawful basis, the minimum personal information necessary for the following purposes. Where processing requires consent, the Company informs the user of the purpose, items, retention period, right of refusal and any resulting disadvantage and obtains consent; where processing is carried out without consent, such as for the performance of a contract or compliance with a legal obligation, the applicable basis and items are disclosed separately from the matters for which consent is obtained. Where the purpose is changed or the information is used additionally, the Company also follows the requirements and procedures prescribed by the relevant laws.

• Email-based account creation and login authentication.
• Login authentication for and provision of Linked Services operated by the Company (SoftN Labs and the services registered on Labs).
• Provision of functions to create, save, edit and delete content such as Quizzes, Boards and Shows.
• Account management tasks such as account recovery (password reset).
• Delivery of notices, information on service failures and policy changes, and responses to customer inquiries.

• Analysis of service usage statistics, development of new features and improvement of UI/UX.
• Detection and prevention of abnormal use (bots, unauthorized access, service attacks, etc.).
• Stable service provision, such as server load balancing and failure response.

• Payment processing and handling of refunds and cancellations when paid services are used.
• Verification of payment details and responses to customer inquiries.
• Detection and blocking of fraudulent payments and response to payment-related disputes.

• Compliance with retention obligations prescribed by law (the Act on the Consumer Protection in Electronic Commerce, Etc., and others).
• Response to lawful requests from investigative agencies and supervisory authorities.

Information necessary for the performance of a contract, such as the provision of member services, account management and the payments and refunds requested by the user, is processed pursuant to Article 15, Paragraph 1, Item 4 of the 「Personal Information Protection Act」, and statutory retention and the performance of lawful legal obligations pursuant to Item 2 of the same Paragraph. Optional profile information is processed within the scope of consent under Item 1 of the same Paragraph. The transmission of account information through Single Sign-On constitutes internal use within the same personal information controller and is processed pursuant to Item 4 of the same Paragraph, and separate consent is obtained for matters requiring consent under the law. Where processing is carried out on the basis of legitimate interests for the purposes of security and the prevention of fraudulent use, the requirements of Item 6 of the same Paragraph concerning necessity, proportionality and the balancing against the rights of data subjects must be satisfied, and processing is not carried out merely because it has been recorded in an internal policy.

Pursuant to Article 21 of the 「Personal Information Protection Act」, the Company destroys personal information without delay once it becomes unnecessary. Unless there is a justifiable reason, destruction is completed within five (5) days from the date the purpose is achieved or the retention period expires. Information that must be retained under other laws is stored separately, distinguished by the information, legal basis and period, and is destroyed once the period ends. The method of destruction follows Article 16 of the Enforcement Decree of the same Act.

In order to retain information for a separate purpose after membership withdrawal or achievement of the processing purpose, there must be a lawful basis and necessity for that processing. The one-year retention policy for general service usage records is likewise applied only within the scope necessary for its purpose, and the information is destroyed without delay once the necessity ceases.

• Act on the Consumer Protection in Electronic Commerce, Etc., and its Enforcement Decree
  • Records on contracts or withdrawal of subscription: 5 years
  • Records on payment and the supply of goods, etc.: 5 years
  • Records on the handling of consumer complaints or disputes: 3 years
  • Records on labelling and advertising: 6 months (applied to the personal information concerned where personal information is included)
• Protection of Communications Secrets Act — Where the retention obligation under that Act applies to the Company and to the records concerned, internet log records, access location tracking data and similar records prescribed by law are retained for the statutory period (three (3) months for such records). This is distinguished from the internal retention period for general service usage records.
• Standards for Measures to Ensure the Safety of Personal Information — Records of persons who have accessed the personal information processing system (excluding the data subject's own access records) are retained for at least one (1) year. Where the system processes the personal information of 50,000 or more data subjects, processes unique identification information or sensitive information, or where the Company is a relevant telecommunications business operator or otherwise falls under the applicable requirements of Article 8, such records are retained for at least two (2) years.

Where the quiz participation records of non-members also constitute personal information, they are retained and destroyed in accordance with the purpose of processing and the notified retention period and are included within the scope of the exercise of rights. Where statistical or analytical results constitute anonymized information from which an individual cannot be identified, Item E below applies. The possibility of re-identifying individual records is assessed according to the actual data structure of the service.

Whether an individual can be identified is not determined solely by the presence of a name or of membership registration, but by reasonably considering the possibility of combination with other information and the time, cost and technology required. Anonymized information falling under Article 58-2 of the 「Personal Information Protection Act」 does not constitute personal information and may continue to be used for statistics and analysis. Pseudonymized information that can identify an individual when combined with additional information is distinguished from anonymized information and is processed in accordance with the relevant laws.

In principle, the Company does not provide users' personal information to third parties. However, exceptions are made in the following cases:

• Where the user has consented in advance.
• Where there is a basis in law, or where an investigative agency or supervisory authority makes a request in accordance with lawful procedures.
• The provision of anonymized information from which a specific individual cannot be identified is distinguished from the provision of personal information. Information does not become anonymized information merely through pseudonymization or the deletion of a name; where it constitutes personal information, a statutory basis for processing is required.

Even where an education office, school or institution has introduced the Service through a bulk purchase, the Company does not provide personal information individually to that institution without a lawful basis. When providing statistical or analytical results, the Company verifies whether individual teachers or students can be identified, and the provision of materials constituting personal information, or work that constitutes entrustment of processing by a school, is handled separately according to its purpose, items and legal basis and according to the respective roles of the Company and the institution.

The transmission of QuizN Account information to a Linked Service operated directly by the Company constitutes internal use within SoftN Inc. as the same personal information controller, and does not become provision to a third party under Article 17 of the 「Personal Information Protection Act」 merely because a separate domain is used. However, the Company must have the relevant purpose of use and a lawful basis for processing, and where information is transmitted to a service operated by a different legal entity, the provisions on provision to a third party or on entrustment of processing are applied separately according to the actual relationship.

So that users can know what information is transmitted to which service, the Company discloses the items transmitted through Single Sign-On and the purposes thereof as follows:

Users may discontinue the use of a Linked Service and request deletion of the information transmitted. Where a service offers its own registration, the registration conditions of that service apply. The use of essential services is not restricted solely on the ground that a user has refused the processing of optional items such as a nickname or profile image that are not necessary for service provision.

The Company entrusts personal information processing work to external specialist companies for the provision of the Service as set out below. Email sending is carried out by the Company itself and is explained separately from the external entrustees below.

When concluding an entrustment contract, the Company stipulates in writing, pursuant to Article 26 of the 「Personal Information Protection Act」, matters such as the purpose and scope of personal information processing, restrictions on re-entrustment, measures to ensure safety, management and supervision, and liability for damages, and supervises the entrustee's processing status. Where the entrustee or the content of the entrusted work changes, the Company discloses this through this Policy without delay.

Where an entrustee wishes to re-entrust the entrusted work to a third party, the prior consent of the Company must be obtained, and where re-entrustment takes place the Company discloses that fact and the sub-entrustee in this Policy.

The Company regularly inspects whether entrustees process personal information safely, and the Company bears liability for damage arising from an entrustee's violation of the law or of the entrustment contract.

The items, purposes and retention periods of personal information used for the Company's own email sending follow the provisions of this Policy governing the relevant processing work. Entrustment arising from the use of external cloud infrastructure is distinguished from the external entrustment of the email sending work itself.

Where personal information is provided overseas (including where it is made accessible), where its processing is entrusted overseas or where it is stored overseas, the Company shall have a lawful basis and protective measures pursuant to Article 28-8 of the 「Personal Information Protection Act」. Where a transfer actually takes place, the Company shall disclose or notify, in accordance with the law, the items transferred, the country, timing and method of transfer, the name and contact details of the recipient, the purpose of use and retention period, and the method, procedure and effect of refusing the transfer, and shall obtain separate consent where required.

• Users may at any time request access to, correction of, deletion of or suspension of the processing of their personal information.
• Members may directly view, modify or delete their information through the "My Info" or "Account Management" menus within the Service.
• Users may discontinue the use of a particular Linked Service while maintaining their QuizN Account and request deletion of the relevant information. In this case, only the account information transmitted to that service and the data created in that service are destroyed, and the QuizN Account and the information held by other services are retained.
• Users may withdraw their consent to the collection and use of personal information at any time; upon withdrawal of consent, the use of the Service may be restricted.

Requests may be made through email inquiry, the customer center, a web inquiry or similar means, and the Company takes the necessary measures without delay after verifying identity.

In the case of a child under the age of 14, the legal representative may request access to, correction of, deletion of or suspension of the processing of the child's personal information.

Where the Company makes an automated decision under Article 37-2 of the 「Personal Information Protection Act」 by processing personal information through a fully automated system, the user may request an explanation of the decision and a review of whether the opinions they have submitted have been reflected. Requests for explanation and review are not limited to cases that have a significant impact on rights or obligations.

Where an automated decision has a significant impact on a user's rights or obligations, the user may refuse that decision. However, where a statutory exception applies, such as a decision made pursuant to Article 15, Paragraph 1, Items 1, 2 or 4 of the same Act, the scope of the right of refusal may differ.

Unless there is a justifiable reason, the Company takes the necessary measures, such as not applying the decision, reprocessing with human intervention, or providing an explanation or reviewing whether opinions have been reflected. The Company informs the user of the result within thirty (30) days from the date of the request; where there is a justifiable reason why processing within that period is difficult, the Company informs the user of the reason and may extend the period twice, by up to thirty (30) days on each occasion. Where a request is refused, the Company informs the user of the reason without delay.

The Company discloses the fact, purpose and subject of such a decision, the main personal information, the criteria and procedures and the methods of exercising rights on the website or on the guidance screen of the relevant service. Rights may be exercised through the methods of exercise set out in this Section and through the contact details of the Chief Privacy Officer provided in this Policy.

The Company does not request identity verification information beyond the scope necessary for the exercise of rights. Exercise through an agent is also handled in accordance with the relevant laws. Where all or part of a request cannot be performed due to statutory retention obligations or similar reasons, the Company informs the user of the reason and the method of raising an objection. The use of essential services is not restricted solely on the ground that a user has withdrawn consent to the processing of optional information.

Users who are not logged in may also exercise rights such as access, correction, deletion and suspension of processing where the information processed by the Company constitutes their personal information. The Company reasonably verifies the relationship between the relevant data and the requester before processing the request, and where verification is difficult or a statutory ground for restriction exists, informs the user of the reason and of any available alternative method. Requests concerning anonymized information from which an individual cannot be identified are distinguished from requests concerning personal information.

Where personal information becomes unnecessary due to membership withdrawal, achievement of the processing purpose or expiry of the retention period, the Company destroys it without delay. Information that must be retained under the law is stored in a separate database and destroyed once the relevant period has elapsed. The timing and standards of destruction follow Section 3, Item A, and the method of destruction follows Article 16 of the Enforcement Decree of the 「Personal Information Protection Act」.

• Electronic files — Deleted using technical methods that make recovery impossible (overwriting, destruction of encryption keys, etc.).
• Paper documents — Shredded with a shredder or incinerated.
• Backup data — Personal information contained in backups is not excluded from the principle or scope of destruction. Where a ground for deletion arises, the information is destroyed without delay; general service use is blocked during processing, and measures are taken so that information already subject to deletion is not used again upon restoration. The retention period is not extended merely because the backup retention cycle has not yet elapsed. Where permanent deletion is significantly difficult due to technical characteristics, a method satisfying the statutory requirements, such as processing into irreversibly anonymized information under Article 16 of the Enforcement Decree of the 「Personal Information Protection Act」, is applied.

Pursuant to Article 29 of the 「Personal Information Protection Act」, the Company implements the following measures to ensure safety:

• Establishment and implementation of an internal management plan.
• Minimization of access rights to personal information and operation of an access control system.
• Encrypted storage of key information such as passwords and encryption of transmission channels.
• Installation and regular updating of security programs, and vulnerability checks.
• Access records of the personal information processing system (excluding the data subject's own access records) are retained for at least one (1) year and protected against forgery, alteration, theft and loss. Where the system processes the personal information of 50,000 or more individuals, processes unique identification information or sensitive information, or where the Company is a relevant telecommunications business operator or otherwise falls under any item of Article 8, Paragraph 1 of the 「Standards for Measures to Ensure the Safety of Personal Information」, such records are retained for at least two (2) years. The cycle, method and follow-up procedures for reviewing access records and download activity are established and implemented through the internal management plan.
• Physical access control (restricted access to server rooms, data storage rooms, etc.).
• Account information transmitted to Linked Services is encrypted in transit, and only the minimum items necessary for service provision are transmitted.

• Provision of convenience in using the Service (maintaining login status, etc.).
• Service improvement through analysis of usage patterns.

Users may allow or refuse the storage of cookies through browser settings. However, refusing cookies may restrict the use of some services.

[Web Browser Settings]

• Whale — Settings > Privacy > Delete browsing data
• Chrome — Settings > Privacy and security > Delete browsing data
• Edge — Settings > Cookies and site permissions > Manage and delete cookies and site data
• Safari — Settings > Privacy > Manage Website Data > enter the site name and select "Remove"

Menu names and locations may differ depending on the browser and operating system version.

[Mobile Browser Settings]

• Whale — Settings > Privacy and security > Delete browsing data
• Chrome — Settings > Privacy and security > Delete browsing data
• Safari — Device Settings > Safari > Advanced > Block All Cookies
• Samsung Internet — Settings > Browsing data > Delete browsing data

The Company does not require children under the age of 14 to carry out unnecessary individual membership registration or to enter real-name information. However, the rules on the protection of children's personal information also apply where non-member participation codes, nicknames, response records, access information and similar data constitute personal information. Where consent under the law is required for the processing of a child's personal information, the Company obtains the consent of the legal representative pursuant to Article 22-2 of the 「Personal Information Protection Act」 and verifies that consent has actually been given. Notices are provided in a format and in clear language that children can easily understand.

Users aged 14 and over may register for membership using only an email account, and real-name verification is not required. Game elements such as voting, ranking competition and live quizzes are designed so as not to induce the excessive provision of personal information.

Where a school, education office or institution uses the Service for classes or training, the Company minimizes the entry of students' real-name information and gives priority to methods using participation codes, nicknames and similar identifiers. Where such information constitutes personal information, the necessary protective measures are applied according to the respective processing purposes and legal bases of the school and the Company and according to whether processing is entrusted. The approval of a teacher or the internal guidelines of an educational institution alone do not substitute for the consent of a legal representative where such consent is required by law.

The Company takes overall responsibility for personal information processing and has designated a Chief Privacy Officer as set out below in order to handle complaints and provide damage relief for data subjects in relation to personal information processing.

• Name: Seo Doyeong / Position: Director
• Department receiving and handling the exercise of rights such as access to, correction of, deletion of and suspension of the processing of personal information: Development Team
• Telephone: 02-6925-6184
• Email: doyeong.seo@softn.kr

• Privacy Infringement Report Center (Korea Internet & Security Agency): 118 (no area code), privacy.kisa.or.kr
• Personal Information Dispute Mediation Committee: 1833-6972, www.kopico.go.kr
• Supreme Prosecutors' Office Cyber Investigation Division: 1301, www.spo.go.kr
• National Police Agency Cyber Investigation Bureau: 182 (no area code), ecrm.police.go.kr

This Privacy Policy applies from November 15, 2026.

Where the Company revises this Privacy Policy due to changes in the law or in the contents of the Service, it posts the contents of the revision and the effective date on the screen of this Policy from seven (7) days prior to the revision (thirty (30) days prior where a significant change affecting users arises).

The Company assigns a version to this Policy and operates a version history screen where the revision history and previous policies can be reviewed.

The disclosure of and notice of changes to the Privacy Policy are distinguished from consent to the collection and use of personal information. The mere fact that the Policy has been announced, or that a user has continued to use the Service, shall not be deemed approval of processing for which separate consent is required by law.

• First announced: December 1, 2019
• Partially revised: May 18, 2022
• Revised: January 15, 2026
• Revised: November 15, 2026 (reflecting matters relating to Linked Services and Single Sign-On, and the relevant laws)