Article 1 (Purpose of Processing Personal Information)

The Company processes personal information for the following purposes: The personal information collected is not used for purposes other than those specified below. Should the purpose of use change, the Company will take necessary measures, such as obtaining separate consent in accordance with Article 18 of the [Personal Information Protection Act].

Article 2 (Personal Information Items Collected)

In accordance with the [Personal Information Protection Act], the Company collects and uses personal information to the minimum extent necessary to provide its services.

Article 3 (Handling of Personal Information of Children Under the Age of 14)

① When the Company needs to process the personal information of a child under the age of 14, it obtains consent from the child’s legal guardian. ② When obtaining such consent, the Company may request only the minimum necessary information from the child, such as the legal guardian’s name and contact details.

Article 4 (Retention and Processing Period of Personal Information)

① The Company retains and processes personal information within the period required by relevant laws or the period agreed upon by the data subject at the time of collection. ② The retention and processing periods for each category of personal information are as follows:

Article 5 (Procedures and Methods for Destroying Personal Information)

① The Company promptly destroys personal information when it is no longer necessary, such as upon expiration of the retention period or fulfillment of the processing purpose. ② In addition, personal information will be immediately deleted if: - The Company no longer needs to provide app experiences or services (e.g., when the information is deemed non-essential for functionality), - A linked Social Media account is deleted, - The third-party service linked to the account requests its removal, or - Deletion is required by laws or regulations. ③ Even if the retention period consented to by the data subject has expired or the purpose of processing has been achieved, if other laws require continued retention, the relevant information will be transferred to a separate database(DB) or stored in a different location. ※ For details on the items and legal basis of personal information retained under other laws, refer to Article 4 (Retention and Processing Period of Personal Information). ④ The procedures and methods of destroying personal information are as follows: 1. Destruction Procedure The Company retains and uses personal information only for the period agreed upon and notified to the user. Once the purpose of collection and use has been fulfilled, the retention period has expired, or the member has withdrawn from the service, the Company promptly destroys the relevant personal information. For users who withdraw from the service, personal information is temporarily retained for 14 days to allow account recovery and to protect potential victims of identity theft. After this period, the information is permanently deleted using an irrecoverable method. 2. Destruction Method Personal information stored in electronic file formats is permanently deleted using methods that ensure the data cannot be recovered. Personal information recorded or stored on paper is destroyed through shredding or incineration.

Article 6 (Provision of Personal Information to Third Parties)

① The Company processes personal information only within the scope specified in Article 1 (Purpose of Processing Personal Information), and provides it to third parties only with the data subject’s consent or in cases permitted by law, such as under Articles 17 and 18 of the Personal Information Protection Act. Except for such cases, personal information will not be shared with third parties. ② For the smooth provision of services, the Company may share personal information to the minimum necessary extent, with the data subject’s consent, in accordance with Article 17(1)(1) of the Personal Information Protection Act.

③ For information regarding the provision of personal information to overseas third parties, please refer to Article 8 (Transfer of Personal Information Overseas).

Article 7 (Outsourcing of Personal Information Processing)

① The Company outsources certain personal information processing tasks for efficient service operation. - None at present. ② When entering into an outsourcing agreement, the Company includes clauses in written contracts—pursuant to Article 26 of the Personal Information Protection Act—that prohibit the handling of personal information for purposes other than the contracted services, mandate technical and administrative safeguards, restrict subcontracting, require management and supervision of the contractor, and assign liability for damages. The Company also monitors whether the contractor is processing personal information securely. ③ In accordance with Article 26(6) of the Personal Information Protection Act, if a contractor further subcontracts the outsourced personal information processing tasks, they must obtain prior consent from the Company. ④ Any changes to the outsourced tasks or contractors will be promptly disclosed through this Privacy Policy. ⑤ For cases involving the outsourcing of personal information processing to entities outside of Korea, refer to Article 8 (Transfer of Personal Information Overseas).

Article 8 (Transfer of Personal Information Overseas)

To ensure stable game service operations, the Company may provide or outsource personal information processing to entities located outside of Korea. - None at present

Article 9 (Measures to Ensure the Security of Personal Information)

The Company takes the following measures to ensure the security and protection of personal information: ① Administrative Measures: Establishment and implementation of an internal management plan, training for employees and personnel handling personal information, operation of a dedicated personal information protection team ② Technical Measures: Access control for personal information processing systems, installation and regular updates of security software, deployment of access control systems, encryption of personally identifiable information (e.g., unique identification numbers) ③ Physical Measures: Access restrictions for data centers and storage rooms, implementation of entry and exit control procedures

Article 10 (Use of Automatic Data Collection Devices and Opt-Out Options)

[Use of Automatic Personal Information Collection Devices] ① The Company uses cookies to store and retrieve user information in order to provide personalized services and convenience. ② Cookies are small data files sent by the server used to operate the website, stored on the data subject’s PC or mobile device. ③ Users can manage their cookie settings through their browser options to allow or block cookies. However, blocking cookies may result in difficulty using some personalized services. [How to Enable/Disable Cookier] ▶ Enable or Disable Cookies by Browser - Microsoft Edge: See browser settings - Safari: See browser settings - FireFox: See browser settings - Chrome: See browser settings [Collection, Use, and Provision of Behavioral Information] ① The Company collects and uses behavioral information in an identifiable format using cookies to provide optimized services, benefits, and online targeted advertisements. ② Behavioral information is collected through the Company’s websites as follows:

③ To provide more precise benefits, the Company shares behavioral information with third-party partners as shown below:

④ The Company collects only the minimum behavioral information necessary for customized services and does not collect sensitive behavioral data (e.g., political views, beliefs, academic or medical records) that could infringe upon users’ rights or privacy. ⑤ To provide better services to users, the Company utilizes Google Analytics, a web analytics tool provided by Google. In this process, the Company uses only anonymized data that does not identify individual users. Users can opt out of Google Analytics by using the Google Analytics Opt-out Browser Add-on or by adjusting their browser’s cookie settings to reject cookies. For more information on how Google uses data, please refer to the following link: - How to uses data:Go to ⑥ The Company does not collect behavioral information from users under the age of 14 for targeted advertising, nor does it provide such ads to children. ⑦ Users can opt in or out of targeted advertising via browser settings. Note that blocking cookies may affect the use of certain services. ▶ Browser-Based Opt-Out of Targeted Advertising (1) Chrome - Click the three-dot menu (︙) at the top right corner of the Chrome browser, then click "Settings." - On the settings page, click "Privacy and security" on the left-hand menu, then click "Clear browsing data" to choose whether to delete your browsing history. - Likewise, under "Privacy and security," click "Third-party cookies" to choose whether to block third-party cookies. (2) Edge - Click the three-dot menu (…) at the top right corner of the Edge browser, then select "Settings." - On the settings page, click "Privacy, search, and services" from the left-hand menu, then adjust the "Tracking prevention" options, including whether to enable it and which level to apply. - You can also choose whether to "Always use 'Strict' tracking prevention when browsing InPrivate." ⑧ The Company collects and uses advertising identifiers on mobile devices to provide personalized services, benefits, and advertisements within the app. Data subjects may allow or block personalized ads by changing the settings on their mobile device. ▶ Managing Advertising Identifiers on Mobile Devices

※ Menus and methods may vary by OS version. ⑨ Inquiries Related to Behavioral Information ▶ Privacy Protection Department Department Name: Management Support Team Email :cs@storytaco.com

Article 11 (Rights and Obligations of Data Subjects and Their Legal Guardians, and Methods of Exercising Them)

① Data subjects may exercise their rights (hereinafter referred to as “rights exercise”) with respect to the Company at any time, including the rights to request access, correction, deletion, restriction of processing, withdrawal of consent, and data portability. ② Rights may be exercised by sending a request via email, in accordance with Article 41(1) of the Enforcement Decree of the Personal Information Protection Act, and the Company will respond without undue delay. - Data subjects can directly view, edit, or delete their personal information through the app or request access via the "StoryTaco Customer Support Center." - Consent to the collection and use of personal information may be withdrawn at any time by using the “Delete Account” feature. - If a request for correction or deletion of personal information due to errors is made, the Company will not use or provide the relevant information to third parties until the correction or deletion has been completed. ③ Rights may also be exercised through a legal representative or an authorized agent. In such cases, a power of attorney in the format prescribed in Form No. 11 of the Notification on the Method of Processing Personal Information must be submitted. ④ The right to access or restrict the processing of personal information may be limited in accordance with Articles 35(4) and 37(2) of the Personal Information Protection Act. ⑤ If the personal information is specified as mandatory to be collected under another law, a request for deletion of such data may not be accepted. ⑥ The Company will verify whether the person exercising the rights is the data subject or their legitimate representative. Data subjects must not infringe upon the privacy or personal information of themselves or others in violation of the Personal Information Protection Act or other related laws. ⑦ Data subjects may exercise their rights through the following department, and the Company will make every effort to ensure prompt handling of such requests: ▶ Department in Charge of Requests for Personal Information Access and Processing Department Name: Management Support Team Email:cs@storytaco.com

Article 12 (Personal Information Protection Officer)

① The Company designates the following Personal Information Protection Officer who is responsible for overseeing all tasks related to personal information processing, and for handling complaints and providing remedies related to personal data: ▶ Personal Information Protection Officer Name: Shin Sol-ip Position: Head of Management Support Email:cs@storytaco.com ▶ Department in Charge of Personal Information Protection Department Name: Management Support Team Email:cs@storytaco.com ② Data subjects may contact the Personal Information Protection Officer or the responsible department regarding any inquiries, complaints, or requests for remedies related to personal data that arise while using the Company's services (or business operations). The Company will respond and handle such matters without delay.

Article 13 (Remedies for Infringement of Rights and Interests)

① If a data subject suffers harm due to a personal information violation, they may seek dispute resolution or consultation through the Personal Information Dispute Mediation Committee, the Korea Internet & Security Agency (KISA) Personal Information Infringement Report Center, or other relevant institutions. For reporting or consultation on personal information infringement, please contact one of the organizations below: ▶ Personal Information Infringement Report Center: 118 (no area code) / privacy.kisa.or.kr ▶ Personal Information Dispute Mediation Committee: 1833-6972 (no area code) / www.kopico.go.kr ▶ Supreme Prosecutors’ Office: 1301 (no area code) / www.spo.go.kr ▶ Korean National Police Agency (Cyber Bureau): 182 (no area code) / https://ecrm.cyber.go.kr ② If a data subject’s rights or interests are infringed due to an action or inaction by a public institution in response to a request under Articles 35 (Access), 36 (Correction/Deletion), or 37 (Suspension of Processing) of the Personal Information Protection Act, they may file an administrative appeal in accordance with the Administrative Appeals Act. ▶ Central Administrative Appeals Commission: 110 (no area code) / www.simpan.go.kr ③ The Company is committed to protecting the data subject’s right to self-determination of personal information and to providing support and remedies in the event of any privacy violation. For reports or consultation, please contact the department below: ▶ Customer Support for Personal Information Protection Inquiries and Reports Department Name: Management Support Team Email:cs@storytaco.com

Article 14 (Miscellaneous)

The Company may provide links to other companies' websites or resources. However, the Company has no control over external sites or materials and therefore cannot be held responsible for, nor does it guarantee, the usefulness, accuracy, legality, or reliability of services or information provided by such third parties. If you click on a link included on the Company’s website and are redirected to another site, please note that the privacy policy of that site is independent of the Company. We recommend reviewing the privacy policy of the newly visited site.

Article 15 (Changes to the Privacy Policy)

This Privacy Policy is effective as of March 31, 2025.

Date of Revision and Enforcement: March 31, 2025