Privacy Policy

Zerorder Inc. (hereinafter "Company") complies with the Personal Information Protection Act and related laws to lawfully process and securely manage personal information in order to protect the freedom and rights of data subjects. In accordance with Article 30 of the Personal Information Protection Act, we establish and disclose this Privacy Policy to guide data subjects through the procedures and standards of personal information processing and to promptly and smoothly handle related grievances.

Last Updated: February 3, 2026

1. Collection of Personal Information

1.1 Personal Information We Collect

The Company collects the following personal information to provide DoriDori services:

• Required Information: Name, email address, password, mobile phone number
• Baby Information: Date of birth, gender, torticollis diagnosis information
• Camera Data: Photos/videos of baby's head shape and posture (for AI analysis)
• Service Usage Information: Rehabilitation program performance records, progress data
• Community Activity: Posts and comment contents
• Automatically Collected Information: IP address, cookies, access logs, device information, app version

1.2 Collection Methods

• Direct input by users during registration and service usage
• Photo/video capture through mobile app camera function
• Automatic collection of information generated during service usage
• Collection through customer center inquiries and emails

2. Purpose of Collecting and Using Personal Information

The Company uses collected personal information for the following purposes:

• Service Provision: AI-based infant torticollis analysis, customized rehabilitation programs, progress tracking
• Member Management: Identity verification, membership service access, prevention of fraudulent use
• AI Technology Improvement: AI model training and improvement using photo/video data (anonymized)
• Community Operation: Supporting information sharing and communication among users
• Customer Support: Responding to inquiries through AI chatbot and customer center
• Service Improvement: New service development, statistical analysis, personalized service provision
• Marketing and Advertising: Event information, service announcements (with consent)

3. Retention and Use Period of Personal Information

In principle, the Company destroys personal information without delay after the purpose of collection and use has been achieved. However, information will be retained for the periods specified below:

• Upon Member Withdrawal: Member information is immediately destroyed. However, some information may be retained in accordance with relevant laws.
• Service Inactivity: Personal information of members who have not used the service for one year may be separately stored and destroyed.

Retention According to Related Laws

• Records on contracts or withdrawal of subscription: 5 years (E-Commerce Act)
• Records on payment and supply of goods: 5 years (E-Commerce Act)
• Records on consumer complaints or dispute resolution: 3 years (E-Commerce Act)
• Records on labeling/advertising: 6 months (E-Commerce Act)
• Service usage records, access logs: 3 months (Communications Secrets Protection Act)

4. Provision of Personal Information to Third Parties

In principle, the Company does not provide users' personal information to third parties. However, exceptions are made in the following cases:

• When users have given prior consent
• When required by law or requested by investigative agencies according to procedures and methods defined by law

5. Outsourcing of Personal Information Processing

The Company outsources personal information processing tasks to external specialized companies as follows:

* Outsourcing companies may change as services improve, and changes will be announced through this Privacy Policy.

6. Rights and Obligations of Data Subjects

Data subjects (users) may exercise the following rights at any time:

• Request to access personal information
• Request to correct errors in personal information
• Request to delete personal information
• Request to stop processing personal information

The exercise of these rights can be made to the Company in writing, by phone, email, etc., and the Company will take action without delay.

Rights may be exercised through a legal representative or an authorized agent. In this case, a power of attorney in accordance with Form No. 11 of the Enforcement Rules of the Personal Information Protection Act must be submitted.

7. Procedures and Methods for Destroying Personal Information

7.1 Destruction Procedures

Information entered by users is transferred to a separate DB (a separate file cabinet in the case of paper) after the purpose is achieved and stored for a certain period according to internal policies and reasons for information protection under other relevant laws (see retention and use period) before being destroyed.

7.2 Destruction Methods

• Electronic Files: Completely deleted using technical methods that make recovery and reproduction impossible
• Paper Documents: Destroyed by shredding or incineration

8. Installation, Operation, and Rejection of Automatic Personal Information Collection Devices

The Company uses 'cookies' that store and retrieve usage information from time to time to provide individualized customized services to users.

8.1 What are Cookies?

Cookies are small text files sent by servers used to operate websites to users' browsers and stored in users' device storage.

8.2 Purpose of Using Cookies

• Maintaining login sessions
• Providing user-customized services
• Analyzing service usage statistics
• Enhancing security

8.3 Installation, Operation, and Rejection of Cookies

Users have the choice regarding cookie installation. Through web browser options, you can allow all cookies, go through confirmation each time a cookie is saved, or refuse to save all cookies. However, refusing to install cookies may cause difficulties in service provision.

9. Personal Information Protection Officer

The Company designates a Personal Information Protection Officer to oversee personal information processing and handle complaints and remedy damages related to personal information processing for data subjects.

Data subjects may contact the Personal Information Protection Officer regarding any personal information protection-related inquiries, complaint handling, or damage remedy arising from the use of the Company's services. The Company will respond to and process data subject inquiries without delay.

10. Changes to Privacy Policy

When this Privacy Policy is added, deleted, or modified due to changes in laws, policies, or security technologies, we will notify the reasons and details of changes through the website at least 7 days before implementing the changed Privacy Policy.

However, for significant changes in user rights such as changes in collected personal information items or purposes of use, we will notify at least 30 days in advance and may obtain user consent again if necessary.

11. Measures to Ensure Safety of Personal Information

The Company takes the following measures to ensure the safety of personal information:

• Administrative Measures: Establishment and implementation of internal management plans, regular employee training
• Technical Measures: Access control to personal information processing systems, installation of access control systems, encryption of unique identification information, installation of security programs
• Physical Measures: Access control to computer rooms and document storage rooms