Winging Builder Privacy Policy

Article 1 (Purpose)

The purpose of this Privacy Policy is to establish standards for the safe processing and protection of users’ personal information in connection with the Winging Builder service provided by the Company, in accordance with the Personal Information Protection Act and other relevant laws.
Through this Policy, the Company clarifies the purposes of collection and use of personal information, items and methods of collection, retention and use period, third-party provision and outsourcing matters, users’ rights and the methods to exercise them, and security measures. The Company respects users’ rights and processes only the minimum personal information necessary.

Article 2 (Definitions)

1. “User” refers to any individual who uses the Winging Builder service and is classified as follows:
   1. Enterprise User: An individual entrepreneur or corporation that subscribes to Winging Builder and creates/manages AI agents.
   2. Website Visitor: A general user who accesses the website or application built by an Enterprise User and interacts with an AI agent.
2. Unless otherwise specified, “User” shall include both Enterprise Users and Website Visitors.

Article 3 (Items of Personal Information Collected)

[Enterprise Users]

• Required: Name, email, phone number, company name
• Optional: Department, position, website address, etc.

• Automatically collected: Access logs, IP address, browser information, etc
• User-provided: Uploaded or input documents, URLs, conversation content, etc

Article 4 (Methods of Collection)

[Enterprise Users]

• Direct input during sign-up
• System logs generated during service use.
• Customer support, inquiries, and event participation.

• Inputs during interactions with AI agents
• Automatically collected logs while using the website
• Pop-ups/forms (e.g., email, phone number)

Article 5 (Purposes of Use of Personal Information)

[Enterprise Users]

• Membership management (sign-up, authentication, notifications, etc.)
• Service provision and operation: AI agent building, data processing, technical support.
• Billing management: Subscription payment, tax invoice issuance, etc.
• Marketing: Feature updates, event notifications.

• Consultations and information provision via AI agents
• Storage and retrieval of consultation history
• Handling of visitor inquiries
• Transmission to the relevant enterprise for follow-up purposes (with prior consent)

Article 6 (Retention and Use Period of Personal Information)

[Enterprise Users]

• Retained during the service usage period and deleted immediately upon withdrawal.
• However, certain items are retained for the statutory period:
  1. Contract/withdrawal of subscription: 5 years
  2. Payment records: 5 years
  3. Dispute resolution: 3 years

• Conversation history and input data are retained for up to 1 year for AI service quality improvement and support purposes, and may be deleted earlier upon enterprise request.
• Retained separately if legally required.

Article 7 (Provision of Personal Information to Third Parties)

The Company does not provide personal information to external parties except in the following cases:

1. When prior consent is obtained from the user
2. When required by law or requested by investigative authorities
3. When website visitor information is provided to the relevant Builder client enterprise (with prior consent)

Article 8 (Outsourcing of Personal Information Processing)

[Common]

Article 9 (Procedures and Methods of Personal Information Destruction)

[Common]

• Destruction procedures: Personal information is stored for a certain period after the purpose of collection/use has been achieved, in accordance with internal policies or laws, and is then destroyed.
• Destruction methods:
  1. Electronic files: Permanently deleted using technical methods to prevent recovery
  2. Printed documents: Shredded or incinerated

• Conversation history and input information are destroyed within 1 year of retention, and may be deleted earlier upon enterprise request.

Article 10 (User Responsibility and Prohibition of Uploading Sensitive Information)

The Company notifies users of their responsibility regarding sensitive personal information. If a user uploads sensitive personal information without deletion or masking, the user shall bear full responsibility, and the Company shall not be liable. Prohibited sensitive information includes, but is not limited to:

• Beliefs, political opinions, union/party membership, health/sexual life, genetic/biometric data, criminal records, etc.
• Resident registration numbers, foreigner registration numbers, passport numbers, driver’s license numbers, etc.
• Bank account numbers, credit card numbers, passwords, security card/OTP numbers, etc.
• Scanned copies of ID cards (resident registration card, driver’s license, passport, etc.)
• Medical/health-related information (diagnosis, medical history, prescriptions, disability registration, etc.)

• Conversation history and input information are destroyed within 1 year of retention, and may be deleted earlier upon enterprise request.

Article 11 (Users’ Rights and How to Exercise Them)

Users may exercise the following rights regarding their personal information at any time:

• Request to access, correct, or delete personal information
• Request to suspend processing or withdraw consent

Article 12 (Measures to Ensure Security of Personal Information)

The Company implements the following measures to protect personal information:

• Encrypted storage
• Minimization and monitoring of access rights
• Intrusion prevention and server security enhancement
• Anti-tampering measures for logs

Article 13 (Personal Information Protection Officer)

• Name: Jeong-Eun Ha
• Title: Personal Information Protection Officer
• Contact: +82-31-781-6900
• Email: jeha@wilcon.co.kr

Article 14 (Changes to the Privacy Policy)

This Policy may be revised due to changes in laws or service policies. Any changes will be notified via the service interface or the official website.

Article 15 (Procedure for Reporting Rights Infringement)

• If a User believes that their personal information has been infringed, they may report the infringement to the Company.
• Reports of rights infringement may be submitted to the Customer Center or by email (support@wilcon.ai), and the Company shall promptly verify the facts and take necessary action without delay.
• When a report of rights infringement is received, the Company shall notify the reporting party of the outcome of the handling process.

Article 16 (Effective Date)

This Privacy Policy shall take effect as of May 1, 2025.