Privacy Policy

Paragraph 1BallalinBiz Inc. (hereinafter 'the Company') complies with the Personal Information Protection Act of Korea and other relevant laws and processes users' personal information lawfully and securely.

Paragraph 2The Company processes personal information for the following purposes.

1. 1.
   Sign up, log in, member identification and account management
2. 2.
   Providing BD professional competency assessments and business status assessments
3. 3.
   Analyzing assessment responses, generating AI-based results, providing recommended content and issuing reports
4. 4.
   Checking assessment progress and viewing and sharing results requested by users
5. 5.
   Operating Lounge, posts, comments, program applications and related services
6. 6.
   Processing orders, payments, cancellations and refunds for paid services
7. 7.
   Responding to customer inquiries, improving service quality, security and preventing fraudulent use
8. 8.
   Fulfilling legal obligations and responding to disputes

Paragraph 3If the purpose of processing changes, the Company will take necessary measures in accordance with relevant laws.

Paragraph 1The Company may process the following information depending on service features. The actual items processed vary depending on the features used by the user and the information directly provided.

1. 1.
   Sign up and account management

   1. a.Account identifier, email address and authentication-related information
   2. b.Name, profile and other account information entered by the user
   3. c.Information received from the authentication provider when using social login
2. 2.
   Assessments and report provision

   1. a.Assessment responses, selected options, and input information related to business and company status
   2. b.Assessment session identifier, assessment results, recommendation results and report data
   3. c.Information necessary for using assessment progress, result viewing and sharing features
   4. d.Uploaded files and analysis results when the user uses the file analysis feature
   5. e.Additional information directly entered by the user during the assessment or consultation process
3. 3.
   Paid services and payment

   1. a.Order number, payment identification information, payment amount, payment date and time, and payment status
   2. b.Transaction information necessary for processing cancellation and refund requests
   3. c.Transaction processing results transmitted by the payment service provider
   4. d.Whether the Company directly stores detailed information of payment methods such as card numbers depends on the actual payment integration method. If such information is processed only by the payment service provider, it is distinguished from information directly collected by the Company.
4. 4.
   Posts, programs and customer inquiries

   1. a.Posts, comments, application content and materials attached by the user
   2. b.Information necessary for program application and operation
   3. c.Inquiry content, responses and processing history
5. 5.
   Service use and security

   1. a.Access date and time, service usage records and access logs
   2. b.IP address, browser and device-related information
   3. c.Error records, security records and information necessary to prevent fraudulent use

Paragraph 2The Company collects and uses only the items processed in the actual service and does not arbitrarily collect sensitive information or unique identification information (such as resident registration numbers) without legal grounds or separate consent. Users should be careful not to enter unnecessary personal information in assessment responses or uploaded files.

Paragraph 1The Company processes personal information based on grounds permitted by applicable laws, including performance of service contracts, handling user requests, fulfillment of legal obligations, legitimate interests, and user consent.

Paragraph 2When consent is required for processing personal information during sign-up, assessment application, provision of assessment results, or use of paid services, the Company provides notice on the relevant screen of the processing purpose, items, retention period, the right to refuse consent, and any disadvantages of refusal, and obtains the necessary consent.

Paragraph 3When obtaining consent for collection and use during the assessment process, the Company ensures that the consent content displayed on the actual screen matches this Privacy Policy. When required consent and optional consent are distinguished, the purpose and items of each are separately indicated.

Paragraph 4Users may refuse consent. However, if users refuse the processing of information that is essential for providing the service, use of the relevant function may be restricted. The Company does not unnecessarily restrict service use solely on the grounds of refusal to provide optional information or optional consent.

Paragraph 5When separate consent or notice is required, such as when the Company provides personal information to third parties or transfers it overseas, the Company will provide separate notice in accordance with the applicable legal requirements.

Paragraph 1The Company may provide assessment results, analysis, recommendations, and reports based on assessment responses and company status information entered by users.

Paragraph 2To provide AI analysis features, some of the input information may be transmitted to AI models or external service providers. When information is actually transmitted to external services, the Company verifies the items transmitted, processing purpose, processing entity, and whether overseas transfer occurs, and takes measures in accordance with applicable laws.

Paragraph 3The Company processes information to the extent necessary to provide assessment services, and AI analysis results may vary depending on the input information and characteristics of the model. AI analysis results do not constitute professional legal, financial, or business advice or a guarantee of specific outcomes.

Paragraph 4The Company manages development and maintenance tools separately from AI analysis services for actual users. The Company manages access permissions and usage procedures to prevent unnecessary transmission of actual users' personal information or operational data to development tools.

Paragraph 1The Company deletes personal information without delay once the processing purpose is achieved. However, information that must be retained under applicable laws is stored separately for the relevant period.

1. 1.
   Member account information: until account deletion. However, information required for legal retention obligations or dispute resolution may be retained for the relevant period.
2. 2.
   Assessment responses, assessment results, and reports: retained for the period necessary for providing assessment services, viewing results, handling user inquiries, and other retention purposes separately indicated.
3. 3.
   Assessment application and consent records: retained for the period necessary to verify consent and respond to disputes. If there is a separate retention period under applicable laws, that period applies.
4. 4.
   Payment and contract-related records: retained for the period specified in applicable laws such as the Act on Consumer Protection in Electronic Commerce, Etc. of Korea.
5. 5.
   Consumer complaint and dispute resolution records: retained for the period specified in applicable laws.
6. 6.
   Access logs and security logs: retained for the period necessary in accordance with applicable laws and security purposes.
7. 7.
   Posts and comments: processed in consideration of user deletion requests, service operation policies, and the rights of other users.

Paragraph 2E-commerce-related records are stored separately according to legal retention requirements. The retention periods applicable to records related to contracts and withdrawal of offers, records related to payment and supply of goods, and records of consumer complaints and dispute resolution follow the respective statutory standards.

Paragraph 3Personal information not subject to legal retention obligations is deleted in accordance with relevant procedures once the processing purpose is achieved or a valid deletion request is received.

Paragraph 1The Company does not, in principle, provide users' personal information to third parties. However, the Company may provide such information when there is a lawful basis, such as when users have given prior consent or when there are special provisions in laws and regulations.

Paragraph 2When providing personal information to third parties in connection with program applications, business matching, or services linked with external organizations, the Company verifies the actual provision relationship and provides notice of the recipient, purpose of provision, items provided, retention period, and matters concerning the right to refuse consent in accordance with applicable laws and regulations.

Paragraph 3When an external service merely processes personal information on the Company's instructions as a processor, the Company distinguishes this from provision to third parties and discloses it as entrustment of processing in Article 7.

Paragraph 4Posts, comments, and author display information that users publish on the Service, such as in the Lounge, are visible to other users through the Service. Because published information can be viewed or collected by other users or third parties, users should check the visibility of their content before posting.

Paragraph 1The Company may entrust part of its personal information processing operations to external service providers (processors) for service operation. The Company manages and supervises the processors' handling of personal information and protective measures in accordance with entrustment contracts and applicable laws and regulations.

Paragraph 2When using related functions in the current service configuration, the following vendors may be involved in personal information processing.

1. 1.
   Supabase: Provision of authentication, database, and related platform functions actually in use
2. 2.
   Amazon Web Services (AWS): Provision and operation of database and cloud infrastructure
3. 3.
   Toss Payments: Payment authorization for paid services, transaction confirmation, and cancellation/refund processing
4. 4.
   Other email, notification, or file processing services: Delivery and processing operations of such services when used

Paragraph 1The Company's database infrastructure is located in the AWS Asia Pacific (Sydney) region (ap-southeast-2). Accordingly, personal information stored in that region may be processed and stored in Australia, a country outside the Republic of Korea.

Paragraph 2The Company verifies the legal basis and procedures required by applicable laws and regulations for personal information processing involving cross-border transfer, and obtains separate consent or provides statutory notice when necessary.

Paragraph 3The actual details of cross-border transfer are specifically managed by verifying the following matters.

1. 1.
   Recipient: AWS-related entities and Supabase-related entities according to the actual contract and service configuration
2. 2.
   Destination country: Australia for the AWS Sydney region. Whether transfer occurs to other countries is verified according to the processing location and settings of each service
3. 3.
   Items transferred: Personal information stored in or transmitted to the relevant database and external services
4. 4.
   Purpose of transfer: Database operation, authentication, backup, security, and service provision
5. 5.
   Method and timing of transfer: Storage and transmission via network during service use and processing during service operation
6. 6.
   Retention and use period: According to the retention period of the relevant personal information and the actual storage and deletion policies of each processor

Paragraph 4Supabase indicates that even if core project data is stored in the selected region, account information, operational logs, support operations, and some service information may be processed in other regions.

Paragraph 5The Company does not assume that all data is processed only within Australia merely because the AWS region is set to Sydney. The Company maintains and updates this article by verifying the actual configuration of backups, logs, support access, CDN, and other external services.

Paragraph 1The Company may use development tools such as Anthropic's Claude Code for software development and maintenance of the service. Claude Code is a tool that assists development work, and its use itself is not the same as GritBD Hub's AI analysis service for users.

Paragraph 2The Company ensures that developers do not unnecessarily enter or expose personal information, assessment responses, reports, authentication information, or confidential information from the production database in Claude Code. When data is needed for development or error analysis, anonymized or pseudonymized data is used to the extent possible.

Paragraph 3When personal information is transmitted to external development tools during the development process, the Company verifies the actual account type, settings, processing conditions, retention period, and whether cross-border transfer occurs for such tools, and takes necessary measures under applicable laws.

Paragraph 4When the Anthropic API or other external AI models are used to analyze user data in the actual service, the Company separately identifies the model provider, reviews whether it constitutes entrustment of processing, provision to third parties, or cross-border transfer and the items processed, and updates this Policy accordingly.

Paragraph 1The Company destroys personal information without delay when it becomes unnecessary due to expiration of the retention period or achievement of the processing purpose. Information subject to legal retention obligations may be stored separately from other personal information.

1. 1.
   Electronic files: deleted in a manner that makes recovery or reproduction difficult
2. 2.
   Paper documents: destroyed by appropriate methods such as shredding or incineration
3. 3.
   Backup data and logs: destroyed in accordance with the retention and deletion policies of the relevant system and legal obligations

Paragraph 2Data stored in external services or backup systems is managed by verifying the actual deletion and retention policies of those services. Even when a deletion request is made, information subject to legal retention obligations may be destroyed after the relevant period has elapsed.

Paragraph 1Users may request access, correction, deletion, suspension of processing, and withdrawal of consent regarding their personal information in accordance with applicable laws.

Paragraph 2Users may directly modify or delete information through functions provided in the service, and if such functions are not provided, they may make requests through the contact information in Article 16.

Paragraph 3After verifying the identity of the requester and their legitimate authority, the Company processes requests in accordance with the procedures and timeframes set forth in applicable laws. When there is a legal retention obligation or when protection of other users' rights is necessary, deletion and other actions may be restricted to that extent.

Paragraph 1The Company implements technical and administrative safeguards in accordance with applicable laws to prevent loss, theft, leakage, forgery, alteration, or damage of personal information.

1. 1.
   Minimization of access rights to personal information and management of account permissions
2. 2.
   Secure management of confidential information such as passwords, API keys, and database credentials
3. 3.
   Management of access logs and security records
4. 4.
   Access control for databases and service systems
5. 5.
   Security updates and vulnerability checks for services and dependencies
6. 6.
   Operation of response procedures in the event of incidents such as personal information leakage

Paragraph 2The safeguards actually implemented are operated according to the service configuration and risks associated with personal information processing, and the Company improves safeguards as necessary.

Paragraph 1The Company may use cookies or similar technologies to maintain login status, ensure security, manage user settings, and operate the service.

Paragraph 2In addition, the Company collects users' visit records using the following web log analysis tools to analyze service usage and improve service quality.

1. 1.
   Google Analytics 4 (provided by Google LLC)

   1. a.Items collected: visited pages, visit date and time, duration, referral source, service feature usage events (assessment start, step completion, report generation, etc.), device/browser/operating system information, approximate location information based on IP address, cookie identifiers
   2. b.Purpose of use: analysis of service usage statistics such as number of visitors and usage paths
   3. c.Cookies used: _ga, cookies beginning with _ga_
   4. d.Retention period: up to 14 months according to Google Analytics data retention settings
2. 2.
   Microsoft Clarity (provided by Microsoft Corporation)

   1. a.Items collected: screen usage records such as clicks, scrolling, and mouse movements; session replay data; visited pages; device/browser information; cookie identifiers
   2. b.Purpose of use: screen usability analysis and service error improvement
   3. c.Cookies used: _clck, _clsk, CLID, MUID, etc.
   4. d.Retention period: screen usage records 13 months, session replay data 30 days
   5. e.Microsoft Clarity records the user's screen usage in a replayable format. The Company configures the service so that content entered by users is not recorded.
3. 3.
   Meta Pixel (provided by Meta Platforms, Inc.)

   1. a.Information collected: visited pages, service usage events, device and browser information, IP address, cookie identifiers
   2. b.Purpose of use: measuring advertising performance and setting advertising targets
   3. c.Retention period: subject to Meta's data retention policy

Paragraph 3Information collected by the above tools is transmitted to and processed on servers operated by each provider, and such servers may be located outside of Korea.

Paragraph 4If the Company introduces additional analytics tools, this policy will be revised and announced before such introduction.

Paragraph 5Users may restrict or delete cookies through their web browser settings. However, blocking cookies may prevent some features, such as login, from functioning properly.

Paragraph 6Users may refuse or limit personalized advertising through the ad preferences of their Meta account, the tracking prevention features of their browser, or the ad tracking limitation settings of their mobile device.

Paragraph 1When the Company processes personal information of children under 14 years of age, it obtains consent from their legal representatives and conducts necessary verification procedures in accordance with applicable laws.

Paragraph 2Depending on the service's target audience and registration policy, the Company may restrict children's use or operate separate procedures.

Paragraph 1When the Company is entrusted with and performs the processing of personal information of participants in programs operated by public institutions, universities, or similar entities (hereinafter 'contracting institutions') pursuant to contracts concluded with such institutions, the contract concluded with the contracting institution and the personal information processing details provided by the contracting institution shall take precedence in the processing of such personal information.

Paragraph 2In such cases, the following matters shall be governed by the terms set forth in the applicable contract.

1. 1.
   Items of personal information collected and used, and purposes of processing
2. 2.
   Items of information transmitted to external AI services (including APIs) for AI analysis, whether such transmission occurs, and conditions thereof
3. 3.
   Retention period for personal information, submitted materials, and derivative data such as analysis results
4. 4.
   Procedures for deletion, methods of deletion, and confirmation of deletion results after contract termination or achievement of processing purposes
5. 5.
   Scope of access rights and viewing permissions for personal information and submitted materials

Paragraph 3The Company processes entrusted personal information and submitted materials only within the scope of purposes specified in the contract and, unless otherwise provided in the contract, does not use them for training or fine-tuning AI models of the Company or third parties.

Paragraph 4The Company does not re-entrust the processing of entrusted personal information to third parties unless specified in the contract or consented to by the contracting institution.

Paragraph 5Matters not specified in the contract shall be governed by this policy. If the content of this policy differs from the contract, the content more favorable to the data subject shall apply in accordance with applicable laws.

Paragraph 6Specific details of personal information processing for each program will be separately provided by the contracting institution or the Company at the time of program participation.

Paragraph 1The Company provides the following contact information to oversee matters related to the processing of personal information and to handle inquiries and complaints from users regarding personal information.

1. 1.
   Company name: BallalinBiz Inc.
2. 2.
   Representative: Hong Seok-won
3. 3.
   Address: Room 608, Dongtan 2 Incubating Center, 57 Dongtan Cheomdan-saneop 1-ro, Hwaseong-si, Gyeonggi-do, Republic of Korea
4. 4.
   Email: info@gritbd.ai
5. 5.
   Business registration number (Korea): 551-87-02851
6. 6.
   Mail-order sales registration number: 2026-화성동탄-1306
7. 7.
   Personal Information Protection Officer: Song Ji-beom

Paragraph 2Users may submit requests for access, correction, or deletion of personal information, requests for suspension of processing, and inquiries regarding personal information to the above email address.

Users may contact the following organizations if they need consultation or remedies regarding personal information infringement.

1. 1.
   Personal Information Infringement Report Center: 118 (no area code)
2. 2.
   Personal Information Dispute Mediation Committee: 1833-6972 (no area code)
3. 3.
   National Police Agency Cybercrime Report System: 182 (no area code)

Paragraph 1This Privacy Policy takes effect on December 4, 2026.

Paragraph 2If service features, data processing locations, processors, or applicable laws change, the Company will review the changes, revise the Privacy Policy, and notify users of the changes and the effective date in accordance with applicable laws and the Company's operating procedures.

Revision History

1. 1.
   October 21, 2026 announcement (effective November 21, 2026): Privacy Policy revision
2. 2.
   October 22, 2026 correction (effective November 21, 2026): Removed internal review language from Articles 5, 7, and 8 and corrected Japanese version wording; no changes to personal information processing
3. 3.
   November 4, 2026 announcement (effective December 4, 2026): Introduction added, notice on public posts added to Article 6 and personalized advertising opt-out methods added to Article 13; article and paragraph numbering format updated