Privacy Policy

Version: 2026-09-01

Letsee, Inc. (the "Company") operates the web-based augmented reality (AR) SaaS platform (https://letsee.io and its subdomains, the "Platform") in compliance with the Personal Information Protection Act of the Republic of Korea and other applicable laws, and makes its best efforts to protect the personal information of data subjects. Through this Privacy Policy (this "Policy"), the Company informs you of the items of personal information it processes, the purposes of processing, retention periods, and the rights of data subjects.

This Policy applies to the following data subjects:

• Members: Persons who have agreed to the Terms of Service and entered into a use contract with the Company
• Visitors: Persons who, without registering as a Member, access and view or experience AR content distributed by a Member

Article 1 (Purposes of Processing Personal Information)

The Company processes personal information for the following purposes. Personal information will not be used for purposes other than those below; where the purpose changes, the Company will take necessary measures, such as obtaining separate consent, in accordance with applicable law.

1. Member registration and management: confirming intent to register, identifying and authenticating Members, maintaining and managing membership, preventing improper use, and delivering notices
2. Provision of the Service: providing AR content authoring and distribution services, managing workspaces and projects, and providing usage analytics
3. Billing and settlement: charging, processing, and refunding subscription fees for paid services, and issuing invoices
4. Customer support: handling inquiries and complaints, and delivering announcements
5. Service improvement: improving quality and developing new features through analysis of service usage records
6. Safe operation of the Service: preventing abuse and unauthorized access, metering Views, and maintaining system security

Article 2 (Items of Personal Information Processed and Collection Methods)

1. Members

• Payment method details such as credit card numbers are collected and processed directly by the payment processors (domestic: KG Inicis Co., Ltd.; international: Paddle), and the Company does not store them. The Company retains only a billing key (token) for recurring payments and transaction records.
• The Company does not collect personal information of children under 14 years of age.

2. Visitors

Notice regarding Visitors' camera feed, captures, and location information

• The camera feed used for AR experiences is processed only within the Visitor's device (browser) and is not transmitted to or stored on the Company's servers.
• Photos and videos (captures) taken by a Visitor during an AR experience are stored only on the Visitor's device and are not uploaded to the Company's servers.
• GPS coordinates used in AR content with location-based features are used only for determination within the Visitor's device (browser) and are not transmitted to or stored on the Company's servers.
• Access to the camera and location information occurs only when the Visitor grants permission in response to the browser's permission request, and such permission may be revoked at any time in the browser settings.

Article 3 (Processing and Retention Period of Personal Information)

1. The Company processes and retains personal information within the retention and use period prescribed by law or consented to by the data subject, and in principle destroys personal information without delay upon membership withdrawal.
2. However, the following information is retained for the periods specified by applicable law:
   • Records on contracts or withdrawal of offers: 5 years (Act on the Consumer Protection in Electronic Commerce)
   • Records on payment and supply of goods: 5 years (Act on the Consumer Protection in Electronic Commerce)
   • Records on consumer complaints or dispute resolution: 3 years (Act on the Consumer Protection in Electronic Commerce)
   • Records on labeling and advertising: 6 months (Act on the Consumer Protection in Electronic Commerce)
   • Books and supporting documents on transactions prescribed by tax law: 5 years (Framework Act on National Taxes, etc.)
   • Records on electronic financial transactions: 5 years (Electronic Financial Transactions Act)
   • Records on website visits (access logs): 3 months (Protection of Communications Secrets Act)
3. The minimum information necessary to prevent fraudulent registration or use may be retained until the resolution of the relevant dispute.

Article 4 (Provision of Personal Information to Third Parties)

The Company processes personal information only within the scope of the purposes set forth in Article 1, and does not provide personal information to third parties except with the consent of the data subject or where permitted under Articles 17 and 18 of the Personal Information Protection Act. The Company does not currently provide personal information of data subjects to any third party.

Article 5 (Entrustment of Personal Information Processing)

1. The Company entrusts the following personal information processing tasks for the smooth provision of the Service:

   Trustee	Entrusted task	Note
   Amazon Web Services, Inc.	Operation of service infrastructure and data storage	Processed within the Republic of Korea (Seoul region)
   MongoDB, Inc. (MongoDB Atlas)	Database hosting	Processed within the Republic of Korea (Seoul region)
   KG Inicis Co., Ltd. (via PortOne)	Domestic payment processing and recurring payment management

2. When entering into entrustment contracts, the Company specifies in documents such as contracts, in accordance with Article 26 of the Personal Information Protection Act, matters concerning the prohibition of processing personal information for purposes other than the entrusted task, technical and administrative protection measures, restrictions on re-entrustment, supervision of the trustee, and liability for damages, and supervises whether the trustee processes personal information safely.
3. Where the content of the entrusted task or the trustee changes, the Company will disclose it through this Policy without delay.

Article 6 (Cross-Border Transfer of Personal Information)

The Company transfers personal information overseas (entrusted processing/storage) as follows for the provision of the Service. Data subjects may refuse cross-border transfer by contacting the Chief Privacy Officer listed below; in such case, use of the relevant functions (customer support, international payments) may be restricted.

Article 7 (Destruction Procedure and Method of Personal Information)

1. The Company destroys personal information without delay when it becomes unnecessary, such as upon expiration of the retention period or achievement of the processing purpose.
2. Information that must be retained pursuant to law is moved to a separate database (DB) or stored in a different location.
3. Destruction method: information in electronic file format is deleted using technical methods that render recovery impossible, and paper documents are shredded or incinerated.

Article 8 (Rights and Obligations of Data Subjects and Legal Representatives, and Methods of Exercise)

1. Data subjects may at any time exercise their rights against the Company, including requests for access, correction, deletion, and suspension of processing of personal information.
2. Such rights may be exercised through the account settings screen within the Platform, or in writing or by email (contact@letsee.io), and the Company will take action without delay.
3. Rights may also be exercised through an agent, such as the data subject's legal representative or an authorized person. In such case, a power of attorney in the form prescribed by the applicable notification on personal information processing methods must be submitted.
4. Requests for access to and suspension of processing of personal information may be restricted pursuant to Article 35, Paragraph 4 and Article 37, Paragraph 2 of the Personal Information Protection Act.
5. Correction or deletion of personal information may not be requested where such personal information is specified as subject to collection under other laws.

Article 9 (Installation, Operation, and Refusal of Automatic Collection Devices)

1. The Company uses cookies to provide the Service.
2. Cookies are small pieces of information sent by the server operating the website to the user's browser and stored on the user's device. The Company uses cookies for the following purposes:
   • Maintaining login sessions (Members)
   • Determining duplicate visits for View metering and producing usage statistics (Visitors)
3. Users may refuse or delete cookies through their browser settings; however, refusing cookies may make it difficult to use some services, such as those requiring login.
4. The Company does not collect behavioral information for use in online targeted advertising.

Article 10 (Measures to Ensure the Security of Personal Information)

Pursuant to Article 29 of the Personal Information Protection Act, the Company takes the following measures to ensure security:

1. Administrative measures: establishing and implementing an internal management plan, and minimizing the number of personnel handling personal information
2. Technical measures: managing access rights to personal information processing systems, access control, one-way encryption of passwords, encryption in transit (HTTPS/TLS), and application of security programs
3. Physical measures: utilizing the physical access controls of cloud infrastructure providers

Article 11 (Chief Privacy Officer)

1. The Company designates the following Chief Privacy Officer to take overall responsibility for personal information processing and to handle complaints and remedy damages of data subjects related to personal information processing:
   • Chief Privacy Officer: Sangchul Ahn (CEO)
   • Phone: +82-2-566-9711
   • Email: contact@letsee.io
2. Data subjects may direct all inquiries, complaints, and requests for remedy regarding personal information protection arising from use of the Service to the Chief Privacy Officer. The Company will respond to and handle such inquiries without delay.

Article 12 (Remedies for Infringement of Rights)

Data subjects may apply for dispute resolution or consultation with the following organizations to obtain relief from personal information infringement (all contacts operate primarily in Korean):

• Personal Information Dispute Mediation Committee: 1833-6972 (www.kopico.go.kr)
• Personal Information Infringement Report Center (KISA): 118 (privacy.kisa.or.kr)
• Supreme Prosecutors' Office: 1301 (www.spo.go.kr)
• National Police Agency: 182 (ecrm.police.go.kr)

Article 13 (Changes to this Privacy Policy)

1. This Policy applies from September 1, 2026.
2. The Company may change this Policy in accordance with changes in laws, policies, or the Service, and will give advance notice of the effective date and details of changes through announcements on the Platform or by email.
3. This Policy is prepared in Korean and English. In the event of any discrepancy in interpretation between the two language versions, the Korean version shall prevail.

Business Information

• Company name: Letsee, Inc. (주식회사 렛시)
• Representative: Sangchul Ahn
• Address: 2F 209, SK V1 Tower, 64 Seonyudong 2-ro, Yeongdeungpo-gu, Seoul, Republic of Korea
• Phone: +82-2-566-9711
• Email: contact@letsee.io