1. Purpose of Personal Information Processing

KATCHUP Inc. ("Company") processes personal information for the following purposes. Personal information being processed will not be used for purposes other than those listed below, and if the purpose of use changes, the Company will take necessary measures such as obtaining separate consent.

• Membership Registration and Management: Identity verification for membership-based service use, maintenance and management of membership status, prevention of fraudulent service use
• Service Provision: Student-company matching service, campaign information, recruitment information
• Application and Payment Management: Event/project application receipt, RSVP confirmation, payment status management, refunds, dispute handling, and applicant communication
• Private Resume Builder: Uploading a resume at the student's request, extracting its text, saving user edits, and generating a downloadable PDF; creating or revising an AI-assisted draft only after separate optional Resume AI consent
• Resume Career Opportunities (Optional): Recording the student's separate choices about resume use and personalized career recommendation notifications. Only after optional consent may KATCHUP use current and future saved resume content and selected career interests internally to match career opportunities, until consent withdrawal or account deletion. If this permission is missing when the student enables personalized recommendation notifications, we ask for explicit resume-use consent in the same flow. Turning these notifications off keeps the resume-use permission; withdrawing resume-use permission also turns these notifications off. Resume-use permission is managed in Account settings and personalized recommendation notifications in Notification Settings. Saving these preferences does not itself initiate matching or share a resume. Resume AI permission, general hiring/marketing consent, Job Alerts, and notification channel settings remain separate and are not changed by these choices.
• Apple, Google, NAVER, and External Service Integrations: Optional Sign in with Apple or Google Sign-In, Google Sheets Sync selected by event/project operators, Google Docs or Sheets created by authorized administrators in a service-result workspace, Google Maps and Places and NAVER Maps used for event locations, and related account connection management
• Marketing and Advertising: Development of new services and provision of customized services, provision of event information, hiring information, participation opportunities, and promotional communications by email or push notification where the user has opted in

2. Personal Information Collected

※ Application form collection items vary depending on the event/project operator's settings, and applicants can review the collection items before submitting their application.

3. Retention Period of Personal Information

The Company processes and retains personal information within the retention/use period required by law or consented to by the data subject when collecting personal information.

• Member Information: Until account deletion is completed. Login identities, ordinary contact/profile details, and private account data are erased, sessions lose access, and uploaded files are queued for removal. Information needed to complete an existing payment, refund, or reward settlement may be retained separately. A non-sign-in account reference and required transaction records may remain for the retention purposes below.
• Private Resume Builder Data: Until the student deletes the resume or withdraws membership. The source PDF and saved draft remain private from company and club members. Optional internal career-opportunity use requires the separate consent described above; any future company sharing requires the student's separate confirmation of the recipient company and specific resume.
• Resume AI Consent: The consent decision and notice record are retained until account deletion. Withdrawing AI consent stops new AI transfers and does not itself delete saved resumes.
• Resume Career Opportunity Preference: The resume-use decision, decision time, notice version, source, personalized recommendation notification setting, notification opt-in/opt-out times, and notification notice version are retained together in the account's preference record until account deletion to remember the student's choices. Withdrawing resume-use permission stops the permitted matching use of saved resume content and career interests and turns personalized recommendation notifications off. Turning only these notifications off does not withdraw resume-use permission. Neither action deletes private saved resumes.
• Apple Login Information: The linked Apple identifier and encrypted refresh credentials are retained while the account uses Apple login. Temporary login/signup records are removed after completion or cleanup following their expiry. On account deletion, encrypted credentials and delivery status needed to revoke Apple authorization may be retained separately while revocation is retried, then erased when revocation completes.
• iOS App Usage Revocation Records: Minimal transaction-level revocation records remain separate from KATCHUP accounts to continue honoring the revocation for that app download. Account deletion does not remove these records. Raw signed transactions and age information are not retained in these records.
• Notification Endpoints: Until the user disconnects the device/browser, the endpoint is confirmed invalid, or membership is withdrawn. When account-level push delivery is turned off, the endpoint is retained in an inactive state for reconnection and security purposes and is not used to send notifications.
• Optional Hiring/Marketing Consent Records: Until consent withdrawal or membership withdrawal; decision history may be retained for the period necessary to demonstrate legal compliance or resolve disputes
• Google Workspace Connection and Result Metadata: Until the user disconnects the Google account, deletes the connection or related KATCHUP result entry, or withdraws membership, unless retention is required for legal compliance or dispute handling. Removing a KATCHUP entry does not delete the Google file itself; the connected account holder must manage or delete that file in Google Drive.
• Records After Account Deletion: Personal application answers, private resumes, verification uploads, notification endpoints, and personal preferences are removed. Required paid RSVP, course-payment, refund, and reward accounting records may remain with ordinary account profile data removed; only contact/payment information needed for an outstanding settlement is retained separately. Account deletion does not forfeit a reward balance or end existing settlement/refund obligations. Shared records and files already exported by operators to external services are not automatically deleted by account deletion.
• Contract or Cancellation Records: 5 years (E-Commerce Act)
• Payment and Goods Supply Records: 5 years (E-Commerce Act)
• Consumer Complaint or Dispute Resolution Records: 3 years (E-Commerce Act)
• Website Visit Records: 3 months (Communications Privacy Act)

4. Provision of Personal Information to Third Parties

The Company processes personal information of data subjects only within the scope specified in Article 1 (Purpose of Personal Information Processing), and provides personal information to third parties only when the data subject consents or when special legal provisions apply, in accordance with Articles 17 and 18 of the Personal Information Protection Act.

• Provision to Company Members: When a student applies to a company's recruitment posting, profile information is provided to the company.
• Provision to Club Members: When a student applies to an event or project posted by a club, the information entered or attached in the application (name, email, school, major, year, GPA, attached files, and responses to additional questions specified by the operator) is provided to the club operating the event/project and to club members granted joint editing privileges, for review and contact purposes.
• Information Access by Company Members: Company Members may access the profiles and application information of students who apply to their postings.
• Provision to Student Members: Information about the publisher (club or company) of events/projects/recruitments to which a student has applied is displayed to the student.
• Private Resume Builder: Uploading a resume or saving a career-opportunity preference does not automatically provide it to company or club members. Internal career-opportunity consent does not authorize company sharing; the student must separately confirm the recipient company and specific resume before any future company sharing. A separate application requires the student's own action and any applicable notice or consent.
• External Sharing by Operators (Share Links): Event and project operators may create and send read-only Share Links to share applicant lists and application contents with external collaborators (e.g., evaluators, joint operating team members).
  • Operators may optionally set a 6-digit password on the Share Link, and may regenerate or deactivate the link at any time to immediately block access.
  • The scope, recipients, and security level of information provided through Share Links are determined by the relevant event/project operator, and the Company provides this functionality as a platform provider.
  • Applicants are deemed to have consented at the time of application submission to the operator's review, management, and external sharing of such information.

5. External Services, Processors, and Connected Account Data

The Company uses external service providers only to provide and operate user-facing Service features.

• Google Sign-In: When a user chooses Google Sign-In, the Company receives basic Google account information such as email, name, profile image, and Google account identifier to create or authenticate the KATCHUP account.
• Sign in with Apple: When the user chooses Apple login or explicitly connects Apple in Account settings, Apple verifies the Apple account and shares an account identifier, verified email or private relay address, and name when available. KATCHUP exchanges the authorization code with Apple and stores refresh credentials encrypted to maintain the connection and revoke authorization on account deletion. Apple processes the sign-in and revocation requests under its own privacy policy. Apple login alone does not establish student status: KATCHUP applies its school email/domain checks or requests separate school-verification documents for personal or relay addresses. Connecting Apple to an existing account requires signing in to that KATCHUP account first.
• iOS Age Assurance: Age ranges and regulatory-applicability information provided by iOS are used on the device for applicable age-related permission flows. This check does not send a date of birth, identity document, or age range to KATCHUP servers. The server receives an Apple-signed app-download transaction solely to verify app-usage consent revocation; it does not store the raw signed transaction or associate the revocation record with an age range or student account. This feature does not impose a blanket age-18 restriction on job information.
• Google Workspace Features: When an operator connects Google, the Company uses the granted Google Sheets and Google Drive file permissions to create, select, open, and update Sheets requested for event/project submissions and to create or open Google Docs and Sheets requested in a service-result workspace. Live Google files remain governed by the connected account's Google sharing settings. Removing a KATCHUP result entry or Google connection does not automatically delete the corresponding file from Google Drive. The Company does not sell Google user data, use it for advertising, or transfer it except as necessary to provide these visible Google Workspace features, comply with law, or protect security.
• Google Maps, Places, and Routes: Web event and project pages, including the inline Google map shown inside the native iOS app, may load Google Maps, and editors may use Google Places. If a user explicitly selects “Preview route,” the browser or native location bridge sends the current location directly to Google to calculate and display the requested Drive, Transit, or Walk route inside KATCHUP; changing the travel mode can request another calculation. Google may also receive technical information such as the user’s IP address under Google’s privacy terms. The current coordinates are not sent to KATCHUP servers, and KATCHUP does not store or log them or access location in the background. A destination-only Google Maps link remains available when an in-page preview cannot be completed.
• NAVER Maps and Driving Preview: For campaign sessions explicitly saved as located in Korea, web event and project pages and the inline Korean map in the native iOS app may load the NAVER Maps JavaScript API. Destination coordinates, map requests, and technical information such as the user’s IP address may be processed by NAVER under its terms, and NAVER’s required map attribution remains visible. Neither the web page nor the native app’s inline NAVER map sends the current location for route calculation until the user explicitly selects “Preview route.” For an in-page driving preview, the page sends the current coordinates to KATCHUP, which transiently forwards them to NAVER only to calculate and return that requested route. KATCHUP does not store or log those coordinates and does not access location in the background. Transit and walking options make no additional current-location request and do not send the current coordinates to KATCHUP servers. On the web, if a valid Korean current location from the explicit preview is no more than five minutes old when the user clicks NAVER Maps, the page constructs a one-time external NAVER Maps request with that starting point while the stored link remains destination-only; otherwise NAVER Maps opens with the destination only and the user can choose a starting point there. In the native iOS app, the NAVER Maps button sends only the destination and selected travel mode to the NAVER Maps app; NAVER obtains the starting point under its own location permission. NAVER processes the requested destination, starting point, and route data under its terms. The inline NAVER Drive preview uses the transient KATCHUP flow described above, while NAVER Transit and Walk directions continue in external NAVER Maps.
• Payment Providers: Online payment processing may be handled by Toss Payments or another payment service provider. The Company stores payment status and transaction references needed to confirm the RSVP, but detailed card or payment instrument information is processed by the payment provider according to its own policies.
• Optional Resume AI Consent: Agreeing to the required sign-up Terms and Privacy Policy does not authorize an AI transfer. Before sending Resume Builder information to OpenAI, KATCHUP requests separate optional consent identifying the provider, information sent, and purpose. Declining consent does not prevent account registration or general Service use.
• School Document Review: Authorized KATCHUP administrators review uploaded student IDs and supporting academic documents to verify school affiliation. These verification documents are not sent to AI providers for analysis or automatic approval.
• OpenAI Initial Resume Draft: After optional consent, when a signed-in student requests AI generation, bounded text extracted from the uploaded PDF, the selected resume goal, and limited account context (name, email, university, major, expected graduation, and GPA where available) are sent to OpenAI's API to create a structured draft. The source PDF file itself is not sent through this flow.
• OpenAI Resume Revisions: With optional consent, when the student submits a request in the Resume Builder chat, the selected workspace's current saved resume, selected resume goal, latest instruction, and a bounded reference of up to six recent instruction-and-response pairs from that same workspace are sent to OpenAI's API. The uploaded PDF and conversations from other Resume workspaces are not included. A proposal remains private and does not replace the saved resume unless the student applies it.
• Selected Text and Missing Information: For an AI edit of selected text, KATCHUP sends the relevant field/selected text, minimal related entry context, the editing instruction, and selected resume goal. For an AI review of missing information, KATCHUP sends the questions and answers the student supplied for that review. These limited requests do not include the entire resume or chat history.
• AI Processing Controls: Resume AI requests use store: false and may include a hashed account safety identifier for abuse prevention. This setting does not guarantee zero retention by OpenAI; processing remains subject to its API data controls and applicable terms. Users can withdraw Resume AI consent in MY → Settings → Account settings. Withdrawal stops new AI transfers, but cannot recall a request already transmitted. Manual editing and downloading of saved resumes remain available.
• Email, Push, Hosting, Storage, and CDN Providers: The Company may use infrastructure providers to send emails and push notifications, host the Service, store uploaded files, deliver images/files, and maintain security and reliability.
• Users may withdraw optional hiring information or marketing consent and disable account-level push delivery directly in Notification Settings. Browser and app notification permission can also be revoked in the relevant browser or operating-system settings. Withdrawal does not disable essential in-service notices or Job Alerts that the user has chosen to keep active inside KATCHUP.
• Users may disconnect Google Workspace features where the Service provides a disconnect function, may manage connected app access from their Google account settings, and must manage or delete Google files themselves in Google Drive.

6. Destruction of Personal Information

The Company destroys personal information without delay when it becomes unnecessary, such as when the retention period has elapsed or the processing purpose has been achieved.

• Electronic File Format: Deletion using technical methods that prevent recovery and reproduction
• Paper Documents: Shredded with a shredder or incinerated

7. Rights and Obligations of Data Subjects

Data subjects may exercise the following personal information protection rights against the Company at any time:

• Request to access personal information
• Request to correct errors
• Request for deletion
• Request to suspend processing

Users can start account deletion from MY → Settings → Account settings → Delete account in the app or on the web. Deletion is confirmed after an identity check. Shared club, event, and course records used by other members may remain with the deleted account detached. Deletion does not itself cancel a paid application or issue a refund; required transaction records remain subject to the retention periods above. Rights may also be exercised through written documents or email, and the Company will take action without delay.

8. Measures to Ensure the Security of Personal Information

The Company takes the following measures to ensure the security of personal information:

• Administrative Measures: Establishment and implementation of internal management plans, regular employee training
• Technical Measures: Access privilege management for personal information processing systems, installation of access control systems, encryption of unique identification information, installation of security programs
• Physical Measures: Access control to computer rooms, document storage rooms, etc.

9. Personal Information Protection Officer

Data subjects may direct all inquiries, complaints, and remedy requests related to personal information protection arising from the use of the Service to the Personal Information Protection Officer.

10. Remedies for Rights Violations

Data subjects may apply for dispute resolution or consultation to the following organizations to seek remedies for personal information violations:

• Personal Information Dispute Mediation Committee: 1833-6972 (www.kopico.go.kr)
• Personal Information Infringement Reporting Center: 118 (privacy.kisa.or.kr)
• Supreme Prosecutors' Office: 1301 (www.spo.go.kr)
• National Police Agency: 182 (ecrm.cyber.go.kr)