ShoColla

Privacy Policy

Announcement Date: 1st April 2026 Effective Date: 1st April 2026

Privacy Policy

This Privacy Policy explains how Smartlink Communications, Inc. collects, uses, stores, shares, and protects personal information in connection with ShoColla.

1. Company Information

Legal Name: Smartlink Communications, Inc. Korean Name: (주)스마트링크 커뮤니케이션즈 Representative Director: Daesung Kim Business Registration No.: 526-88-00117 General Contact: david@smartlink.io Support: support@smartlink.io Address: 177, Jeongjail-ro, Bundang-gu, Seongnam-si, Gyeonggi-do, Republic of Korea Phone: +82 1040901708

2. Purposes of Processing Personal Information

The Company processes personal information for the following purposes:

• account registration, identity verification, login, and account management • campaign creation, campaign participation, submission review, performance verification, and reward processing • grant, use, deduction, redemption, refund, and payment processing for Colla • provision of products or services through the ShoColla Store • customer support, inquiry handling, notices, and dispute resolution • fraud prevention, security review, and operational stability • service improvement, analytics, and feature development • compliance with legal obligations • marketing communications and event notices, where consent is required

3. Categories of Personal Information We Collect

We may collect the following categories of personal information.

[3.1 Account and Profile Information] • email address • password in encrypted form • name or nickname • phone number • country or region • login identifier • profile photo, bio, and preference information where provided

[3.2 Campaign Organizer Information] • campaign name • Official Audio URL or related link • artist, brand, affiliation, or contact information • campaign terms, descriptions, and budget information • inquiry and response history

[3.3 Creator Participation Information] • social account names, handles, channels, or account links • submitted video URLs or post links • participation and submission history • publicly available performance information

[3.4 Review and Analytics Information] • views, likes, comments, and shares • posting date and post status • public profile information • hashtags, captions, and information visible on public pages • data lawfully available through integrations or public sources

[3.5 Payment, Redemption, and Settlement Information] • payment records • account holder name, bank name, and bank account number • refund information • identity verification information • tax-related information • account standing and settlement review records

[3.6 ShoColla Store Information] • order information • purchase or usage history • recipient name, contact information, and address where delivery is required • records relating to products, benefits, or event access

[3.7 Automatically Collected and Support Information] • inquiry details and attachments • IP address • cookies • device information • operating system and app version • browser information • access logs • usage history

4. Retention of Personal Information

  1. The Company will delete personal information without undue delay once the processing purpose has been achieved.
  2. However, the Company may retain certain information for the following periods:
  • account information: until account deletion, provided that information may be retained longer where needed for dispute resolution, pending settlement, or fraud prevention
  • records on labeling and advertising: 6 months
  • records on contracts or withdrawal/cancellation: 5 years
  • records on payments and supply of goods or services: 5 years
  • records on consumer complaints or dispute handling: 3 years
  • access records and similar legally required logs: 3 months

5. Sharing of Personal Information

The Company does not provide personal information to third parties except in the following cases:

• where the user has consented • where required by law • where requested by a lawful authority • where limited sharing is necessary to provide campaign functions or ShoColla Store functions

[5.1 Information That May Be Shared with Campaign Organizers] • recipient: the relevant Campaign Organizer • purpose: submission review, reward decisions, and dispute handling • items: Creator nickname, profile information, social account link or handle, submitted content link, public metrics, and necessary inquiry history

[5.2 Information That May Be Shared with Creators] • recipient: the relevant participating Creator • purpose: campaign participation and performance • items: campaign description, Official Audio URL, reward conditions, public organizer information, and necessary inquiry history

[5.3 Information That May Be Shared for ShoColla Store Fulfillment] • recipient: logistics, shipping, event operations, or benefit fulfillment partners • purpose: product delivery, event operation, and provision of purchased benefits • items: name or nickname, contact information, shipping address, order details, and other minimum necessary information

6. Processors and Service Providers

The Company may entrust certain personal information processing activities to third-party service providers for efficient service operation.

• cloud infrastructure provider: AWS (Amazon Web Services), MongoDB Atlas, Firebase • payment processor: Apple Inc., Google LLC • push notification provider: FCM (Firebase Cloud Messaging, Google LLC) • analytics provider: Firebase (Google LLC), Google Analytics (Google LLC) • customer support provider: N/A • logistics or event operations partner: N/A

The Company will manage and supervise such service providers in accordance with applicable law.

7. International Transfers

The Company may transfer personal information to servers or service providers located outside the user's country. Where required by applicable law, the Company will provide notice or obtain consent regarding international transfers.

Examples: • recipient: AWS (Amazon Web Services), Firebase (Google LLC), Google Analytics (Google LLC) • country: United States • items transferred: account information, usage history, device information, campaign data, and other necessary information • purpose: data storage, service operation, analytics, and messaging • retention period: until the processing purpose is achieved or the relevant contract ends

8. Destruction of Personal Information

  1. The Company will destroy personal information once the retention period expires or the processing purpose is achieved.
  2. Electronic records will be deleted using technical methods that prevent recovery.
  3. Paper records will be shredded or incinerated.

9. User Rights

  1. Users may request access to, correction of, deletion of, suspension of processing of, or withdrawal of consent regarding their personal information.
  2. For children under the legally applicable age, a parent or legal guardian may exercise such rights where permitted by law.
  3. Requests may be submitted through customer support or the privacy contact identified below.
  4. Requests may be restricted where retention is required by law or where another person's rights may be affected.

10. Security Measures

The Company implements reasonable safeguards to protect personal information, including:

• access restriction and access control • encryption of passwords and appropriate authentication information • encryption in transmission where appropriate • operation of security tools • retention and integrity protection of access logs • internal management plans and procedures • employee training

11. Cookies and Similar Technologies

The Company may use cookies, SDKs, and analytics tools. Users may refuse cookie storage through browser or device settings, although some features may be limited as a result.

12. Children

The Company does not knowingly collect personal information from children under the applicable legal age without required parental or guardian consent. Certain Service features, including Colla redemption or access to specific Store items, may be subject to additional age restrictions under Company policy or applicable law.

13. Privacy Contact

Privacy Officer: David Kim Title: Director Privacy Contact Email: support@smartlink.io General Contact: david@smartlink.io Support: support@smartlink.io Address: 177, Jeongjail-ro, Bundang-gu, Seongnam-si, Gyeonggi-do, Republic of Korea Phone: +82 1040901708

14. Language

  1. This Privacy Policy may be provided in both Korean and English.
  2. In the event of any inconsistency, conflict, or discrepancy between the Korean version and the English version, the Korean version shall prevail.
  3. However, mandatory laws of the data subject's country of residence or the country where the Service is provided may prevail to the extent applicable.

This Policy shall take effect on 1st April 2026.