Privacy Policy

This is an English translation for convenience. The Korean version prevails; if the two differ, the Korean version applies.

BzEngage (the "Company") operates the BzAnalytics cloud service (the "Service", https://bzanalytics.co). The Company complies with the Personal Information Protection Act of Korea and other applicable laws and sets out this privacy policy to protect users' personal information.

• Effective date: October 1, 2026
• This policy applies only to the cloud service the Company operates itself. For BzAnalytics installed and operated by a customer on its own servers (on-premise), that customer is the personal information controller and the customer's own privacy policy applies.

1. The two kinds of personal information the Company processes

The Company processes personal information in the following two capacities.

1. Member information (the Company as controller): information of the customer staff who sign up for and use the Service ("Members"). Sections 2 to 4 of this policy apply.
2. Analytics data (the Company as processor): usage records of the visitors and users of a customer's service ("End Users"), collected by the BzAnalytics collection code the customer installs on its own website, app or server. The customer is the personal information controller of this data, and the Company processes it on the customer's behalf. Section 5 applies; End Users exercise their rights with the customer concerned.

2. Purposes of processing member information

The Company does not use member information for any other purpose. If a purpose changes, the Company obtains separate consent under Article 18 of the Personal Information Protection Act. The Company does not use member information for advertising or marketing.

3. Member information processed and how it is collected

4. Retention and destruction of member information

1. Member information is destroyed without delay when a Member deletes the account, or anonymized so that no individual can be identified even when combined with other information. The following information, however, is kept for the period shown and then destroyed.

   Information	Retention period	Basis
   Sign-in sessions	2 hours after the last activity	Service security
   Audit records (action, time, IP address)	2 years	Responding to security incidents, Article 29 (safety measures) of the Personal Information Protection Act
   Customer inquiries	1 year after receipt	Keeping the inquiry history
   Records of contracts and withdrawal of offers, payment and supply of goods	5 years	Act on the Consumer Protection in Electronic Commerce
   Tax invoices and other transaction records	5 years	Framework Act on National Taxes, Value-Added Tax Act
   Records of consumer complaints and dispute handling	3 years	Same Act
   Access records (sign-in records)	At least 3 months	Protection of Communications Secrets Act

2. How it is destroyed: electronic files are deleted in a way that cannot be recovered, and information left in backups is deleted when the backup retention cycle ends. Paper documents are shredded or incinerated.

5. Analytics data (processing on behalf of customers)

1. Items processed: the following information sent by the collection code a customer installs.
   • Visit and usage records: page path or screen name, event name and properties, time of occurrence, revenue value, referral source (domain of the referring site), campaign values (UTM)
   • Environment: country (determined from the IP address), browser, operating system and device type, screen size, language, app platform, app version and OS version
   • Visitor identifier: an irreversible hash value made as described in item 2 below
2. Information the Company does not store: the End User's original IP address and original browser information (User-Agent) are used only to determine the country and browser type and to calculate the visitor hash, and are not stored. Advertising identifiers (IDFA, AAID) and device names are not collected.
3. Visitor identification: the customer chooses the method per workspace; the default is "daily".
   • Daily (default): the hash is made with a random value created anew each day, and that value is discarded two days later. Once the date changes, the same person cannot be recognized again.
   • Persistent: can be turned on only when the customer has a consent process in place. A random identifier stored in the End User's browser or app is hashed with a per-workspace secret, so the same browser or the same app installation is recognized across days.
   • Identified: in addition to the persistent method, a user ID the customer sends (such as a member number) is hashed the same way, so the same user is recognized across devices.
   • Under every method, the original identifier and the user ID are not stored. If the browser's "Do Not Track" (DNT) or GPC signal is on, or before consent is given, no persistent identifier is created.
4. Masking of personal information: if formats such as email addresses, phone numbers or resident registration numbers appear in page addresses or event properties, they are masked before storage.
5. Retention period: data is deleted automatically every day once the retention period set by the customer (at most 395 days on the Service) has passed. When the customer deletes a source or organization, or the contract ends, the data is deleted without delay.
6. End Users' rights: requests such as access or deletion should be made to the customer concerned. At the customer's request, the Company provides features to export or delete a specific visitor's data.

6. Provision of personal information to third parties

The Company does not provide member information or analytics data to third parties, except where the data subject has given separate consent or a law specifically provides otherwise (such as a lawful request from an investigative authority).

7. Entrustment of personal information processing

The Company entrusts the processing of personal information as follows in order to provide the Service. Under Article 26 of the Personal Information Protection Act, the entrustment contracts set out the prohibition of processing outside the entrusted work, safety measures, restrictions on re-entrustment, management and supervision, and liability for damages, and the Company supervises whether the trustees process personal information safely.

The AI analytics features (answers to natural-language questions, summaries, recommendations) are not entrusted. They work only with an API key the customer has registered for its own workspace, and their processing is governed by the contract between the customer and Anthropic, PBC (USA). The Company only passes on the requests at the customer's instruction. What is sent is limited to aggregated values or masked text according to the transfer policy the customer sets; raw events, personal information, identifiers and event property values are not sent. A workspace without a registered key calls no external AI and provides rule-based results. Details are in section 8.

8. Transfer of personal information abroad

The Company does not transfer member information or analytics data abroad. Service infrastructure and email (Amazon Web Services) and customer inquiry emails (Microsoft 365) are all processed and stored in the Republic of Korea. If the Company needs to transfer personal information abroad, it will give notice in advance and obtain any required consent under Article 28-8 of the Personal Information Protection Act.

When a customer registers an AI key for a workspace. When a customer registers its own Anthropic API key for a workspace and uses the AI analytics features, the content those features need is sent, at the customer's instruction and through the customer's account, to Anthropic, PBC (USA). The customer makes this transmission under the contract between the customer and Anthropic; the Company only passes it on at the customer's instruction. The customer itself puts in place the notice, consent and other procedures this transmission requires.

• Items sent: aggregated values (numbers, metric and dimension names) that passed the transfer policy the customer sets and, where that policy allows, question text with personal-data patterns masked. Personal information, identifiers such as visitor identifiers, IP addresses and browser information, and event property values are not sent.
• Recipient and country: Anthropic, PBC (USA), through the customer's account registered by the customer.
• Purpose: providing the AI analytics features (answers to natural-language questions, summaries, recommendations)
• Time and method: sent over an encrypted network (HTTPS) each time an AI analytics feature is used
• Retention period: as set by the contract between the customer and Anthropic and by Anthropic's data retention policy.
• How to stop: delete the AI key in the workspace settings, or set the AI data protection policy of the organization or workspace to "Off". External AI is then not called, and rule-based results are provided.

9. Cookies and other automatic collection

1. The Service uses only the cookies strictly needed to keep you signed in and for security (preventing forged requests). It does not use advertising or tracking cookies.
2. You can refuse cookies in your browser settings, but then you cannot use features that require signing in.
3. To analyze visits to the Company website (bzanalytics.co), the Company uses its own BzAnalytics with the "daily" method, which leaves no identifier in cookies or browser storage.

10. Rights of data subjects and how to exercise them

1. Members may at any time request access to, correction, deletion or suspension of processing of their personal information, or withdraw consent.
2. You can do this yourself in the Service (account settings) or request it through the contact details in section 11 below. The Company acts without delay (within 10 days) and informs you of the result.
3. You may make a request through a representative; in that case a power of attorney must be submitted.
4. Information that a law requires to be kept (the table in section 4) cannot be deleted on request during that period.
5. End Users of analytics data exercise their rights with the customer concerned (section 5).

11. Privacy officer and contact

12. Measures to ensure the safety of personal information

The Company takes the following measures under Article 29 of the Personal Information Protection Act.

• Administrative measures: establishing and carrying out an internal management plan, minimizing and training the staff who handle personal information
• Technical measures:
  • One-way encryption of passwords; encryption of two-step verification secrets and integration secrets
  • Encryption in transit (HTTPS)
  • Role-based access control
  • Audit records that can detect forgery and alteration
  • Automatic masking of personal information formats
  • No storage of original IP addresses and User-Agents of analytics data
• Physical measures: data is stored in access-controlled cloud data centers (AWS Seoul Region)

13. Remedies for infringement of rights

To seek a remedy for an infringement of personal information, you may apply for dispute resolution or counseling to the following bodies.

• Personal Information Dispute Mediation Committee: (no area code) 1833-6972, www.kopico.go.kr
• Personal Information Infringement Report Center (Korea Internet & Security Agency): (no area code) 118, privacy.kisa.or.kr
• Supreme Prosecutors' Office: (no area code) 1301, www.spo.go.kr
• Korean National Police Agency: (no area code) 182, ecrm.police.go.kr

14. Changes to this privacy policy

When this privacy policy changes, the Company gives notice in the Service and on this page from 7 days before the effective date (30 days before for changes important to users' rights). Previous versions can be viewed under "Previous versions" on this page.

• Announcement date: September 24, 2026
• Effective date: October 1, 2026

Business information: BzEngage | CEO Myungjoo Han | Business registration number 123-45-67890 | 6F Noon Square, 14 Myeongdong-gil, Jung-gu, Seoul | admin@bzanalytics.co