Privacy Policy

Effective 2026-10-13

This is a translation. In case of any discrepancy, the Korean version prevails.

Overview

FraxGen Inc. (the "Company") complies with the Korean Personal Information Protection Act and, where they apply to you, the EU General Data Protection Regulation (GDPR) and the California Consumer Privacy Act as amended by the CPRA. This policy explains what we process, why, on what legal basis and for how long, and the rights you have. Where these laws differ, we follow the stricter standard.

1. Controller and Contact

• Controller: FraxGen Inc., Republic of Korea, business registration no. 665-81-03972 • Privacy officer: JoonHwi Kim (representative) · ceo@ingkm.com • You can also reach us through the contact page.

2. Personal Data We Process

• Account: your Google account email, name (display name) and Google account identifier, received from Google when you sign up or sign in. • What you upload or enter: audio files, AI prompts, score edits, share descriptions and cover images, posts, comments, playlists, reports, and contact messages (email and content). • Usage records: conversion and creation history, point and credit history, check-ins, plays and likes, sharing and receiving history. • Payments: product, amount, currency and country of purchase, subscription status, and Paddle transaction identifiers. Card numbers and other payment details are handled by Paddle directly; we never receive them. • Connection data: IP address and browser information (User-Agent) at sign-in, and cookies (section 7). • Sign-up source: where you came from when you signed up — the utm values in the link, the referring site’s domain, and the first page you opened. We do not collect sensitive data (such as health or political opinions) or national identification numbers.

3. Purposes and Legal Bases

• Sign-up, sign-in and account management; providing conversion, AI creation, editing, sharing and other features — performance of a contract (PIPA Art. 15(1)(4); GDPR Art. 6(1)(b)) • Payments, refunds, tax and keeping transaction records — performance of a contract and legal obligation (Korean e-commerce law; GDPR Art. 6(1)(c)) • Preventing abuse, security, managing free limits and handling outages — our legitimate interests (PIPA Art. 15(1)(6); GDPR Art. 6(1)(f)) • Answering enquiries and handling infringement notices — contract, legitimate interests and legal obligation • Improving the Service with usage statistics that do not identify you, and sign-up and usage statistics by traffic source — legitimate interests We do not process data for advertising or marketing, do not profile you, and make no automated decisions that have legal or similarly significant effects on you. If we ever need to rely on consent, we will ask separately and you can withdraw it at any time.

4. AI Processing

Audio and prompts you submit are processed by AI models running on servers the Company operates itself in Korea; they are not sent to outside AI providers. We do not use your Content to train AI models, and will tell you in advance and ask for separate consent if that ever changes.

5. Retention and Deletion

• Account data: until you close your account; your email and name are anonymised immediately when you do. • Audio, outputs and published content: until you delete them or close your account. Deleted items become inaccessible immediately and are erased from storage within about an hour. • Sign-in records (IP and browser information): erased 7 days after your sign-in session ends (30 days after last use). • Sign-up source: for as long as the account exists; anonymised with the account when you close it. • Notifications: 90 days. • Records of contracts and withdrawals, payments and supply: 5 years (Korean e-commerce law). • Records of consumer complaints and disputes, including contact messages: 3 years (Korean e-commerce law). Records kept by law remain after you close your account but are anonymised so they no longer identify you. Electronic files are deleted so they cannot be recovered.

6. Disclosures, International Transfers and Processors

We do not sell personal data, and we disclose it to no one other than those listed below, except where required by law. • Paddle.com Market Limited (United Kingdom) — as merchant of record, handles payment, tax, refunds and fraud prevention. Data: email, country, product purchased and your member identifier. When and how: transmitted over the network when you pay. Retention: under Paddle’s privacy policy. Basis: transfer necessary to perform the contract (PIPA Art. 17 and Art. 28-8(1)(3)). If you do not pay, nothing is disclosed, but you cannot buy paid products. • Google LLC (United States) — sign-in authentication. We only receive your email, name and identifier from Google and send Google no other data. • Your data is stored on the Company’s own servers in Korea. We currently use no processors to handle personal data on our behalf; if that changes, we will list them here. • Users in the EU, EEA and UK: the Republic of Korea is covered by an EU Commission adequacy decision, and the UK is covered by an EU adequacy decision; transfers to the Company and to Paddle rely on these.

7. Cookies and Browser Storage

We use only cookies that are strictly necessary for the Service. We use no advertising, analytics or tracking cookies and no third-party tracking scripts. • m2s_rt — keeps you signed in (30 days after last use) • m2s_hint — shows whether you are signed in (30 days after last use) • m2s_oauth — security check during Google sign-in (10 minutes) • m2s_locale — your chosen language (1 year) Your play queue, display settings and unsaved edits are kept in browser storage (localStorage) on your device only. You can clear or block these in your browser, but blocking the necessary cookies prevents sign-in. Visits arriving from other sites or utm links are counted without cookies or device storage, only as daily totals per traffic source. We do not record who visited.

8. Your Rights

• You may request access to, correction, deletion, restriction or portability (in a machine-readable format) of your personal data, object to processing, withdraw consent, and refuse automated decisions. • You can close your account yourself in settings; for anything else, use the contact page or write to ceo@ingkm.com. A legal guardian or an authorised agent may also make requests for you. • After verifying your identity, we respond without delay and within 10 days at the latest. If we need longer, we will tell you why and when to expect a reply. • We will not discriminate against you for exercising your rights.

9. What Closing Your Account Does

Closing your account immediately anonymises your email and display name and disconnects the sign-in link. Your uploaded audio, conversions, published scores and the comments on those scores are deleted with it. There is no grace period and it cannot be undone. Remaining points and credits are forfeited. Payment and ledger records are kept as described in section 5 but, once anonymised, no longer identify you.

10. Notice for California Residents (CCPA/CPRA)

• Categories collected in the past 12 months: identifiers (email, name, account identifier, IP address), commercial information (purchase records), internet activity (sign-in and usage records), audio and electronic information (uploaded audio), and user content. Sources: you, Google and Paddle. Purposes: as in section 3. • Categories disclosed for a business purpose: identifiers and commercial information, to Paddle (payment processing). • We do not sell personal information or share it for cross-context behavioural advertising, including that of anyone under 16. We do not collect or use sensitive personal information. We honour Global Privacy Control signals. • California residents have the right to know, delete and correct, to opt out of sale or sharing, to limit the use of sensitive personal information, and not to be discriminated against, and may exercise them as described in section 8.

11. Children

You must be at least 16 to sign up, and we do not knowingly collect personal data from anyone under 16. If we learn we have, we delete it without delay.

12. Security

We encrypt all connections (HTTPS), never receive passwords (Google sign-in), store sign-in tokens only as hashes rather than in readable form, and keep access to personal data to a minimum. If we become aware of a personal data breach, we will notify you and the relevant authorities within 72 hours and act to limit the harm.

13. Complaints

For advice or remedies regarding a privacy violation, you can contact: • Personal Information Dispute Mediation Committee: +82-1833-6972 (www.kopico.go.kr) • Personal Information Infringement Report Center: 118 (privacy.kisa.or.kr) • Supreme Prosecutors’ Office: 1301 (www.spo.go.kr) • Korean National Police Agency: 182 (ecrm.police.go.kr) Users in the EU, EEA or UK may complain to the data protection authority in their country; California residents may contact the California Privacy Protection Agency or the state Attorney General.

14. Changes to This Policy

We announce changes on the Service at least 7 days before they take effect, and at least 30 days before — with individual notice to members — for changes that materially affect your rights. Previous versions are available on request.