VEXI Privacy Policy ("itsweb")

Version: 1.0
Effective Date: July 19, 2026

Note on Languages: This English version is provided for the convenience of international users. In the event of any inconsistency between the Korean and English versions, the Korean version prevails. This Privacy Policy is prepared in accordance with the Personal Information Protection Act of the Republic of Korea ("PIPA") and related regulations.

VEXI ("Company", "we", "us") is committed to protecting the personal information of our users. This Privacy Policy explains how we collect, use, store, share, and protect your personal information when you use the "itsweb" AI website creation service (itsweb.ai, "Service").

1. Purposes of Processing Personal Information

We process personal information for the following purposes only. We will not use your information for any purpose not listed below, and will obtain separate consent if a new purpose arises.

1. Account management: User identification, preventing unauthorized use, maintaining records for dispute resolution
2. Service delivery: AI-based website content generation, preview, deployment (hosting), project and version management
3. Payment and billing: Processing paid subscriptions, handling refunds, maintaining payment records
4. Customer support: Handling inquiries and complaints, delivering notices
5. Public content display: Displaying financial account information, contact details, and other information entered by the user on deployed websites, as intended by the user for their visitors

2. Categories of Personal Information Processed

2.1 At registration

Registration is completed via email magic link or OAuth (Kakao / Google). We collect:

• Required: Email address
• Via OAuth: Email address and provider-specific identifier (issued by Kakao or Google)

2.2 Information you enter while using the Service

The nature of the Service requires you to input information to be displayed on your website. All such input is voluntary and at your discretion.

• Name, phone number, address, business location, and other information you choose to display on your website
• Uploaded images (stored on AWS S3)
• Financial account information (account holder name, bank name, account number): Entered voluntarily by users of any website type — business sites, portfolios, wedding invitations, event pages, etc. — for purposes such as payment instructions, donation requests, or gift money collection

Financial account information is not required by the Company. You enter this information voluntarily so that it is displayed publicly on your published website. See Section 9 for important details about public exposure.

2.3 At payment

The Company does not collect or store card or bank account numbers. Payment is processed by Toss Payments (a Korean payment gateway regulated by the Financial Services Commission). We only retain the result of payment processing: subscription status, billing period, and plan type.

2.4 Information automatically generated during use

• Access logs, IP address
• Cookies (used by Supabase Auth to maintain your login session)
• Browser type, device information, and service usage history

2.5 Consent records

When you agree to these Terms and this Privacy Policy, we record: the timestamp of agreement, the document version agreed to, your IP address, and your browser User-Agent string.

3. Retention Periods

Upon account deletion, we promptly delete your account, associated projects, uploaded images, and deployed websites. Subscription (billing key) cancellation with Toss Payments may require additional processing time.

4. Provision of Personal Information to Third Parties

We do not provide your personal information to third parties beyond the scope disclosed in this Policy. Exceptions apply only where:

1. You have given explicit, separate consent
2. Required by applicable law or law enforcement acting under applicable legal procedures

Content you publish on your deployed website (including financial account information, contact details, and other entered information) is publicly accessible via the URL. This is an intended result of your use of the Service and does not constitute a "third-party disclosure" by the Company. See Section 9 for details.

5. Delegation of Personal Information Processing

We delegate certain personal information processing operations to the following processors. We take contractual and operational steps to ensure these processors maintain appropriate security and comply with applicable law.

International Transfers: Processors based outside the Republic of Korea (Supabase, AWS, Vercel, Anthropic, Moonshot AI) may store and process your data outside Korea. We take steps to ensure each processor maintains security standards required by applicable law. If processors change, this Policy will be updated accordingly.

6. Your Rights as a Data Subject

You have the right to:

1. Access your personal information held by us
2. Correct inaccurate personal information
3. Delete your information (via account deletion at /account or by contacting us)
4. Suspend processing of your personal information

To exercise these rights, visit /account or contact us at contact@itsweb.ai. We will act on your request without undue delay. If correction or deletion is requested, we will not use or share the data until the request is fulfilled.

7. Cookies and Automatic Data Collection

The Service uses cookies for authentication and session management (Supabase Auth). You may disable cookies through your browser settings; however, doing so will prevent you from logging in and using the Service.

We do not use tracking cookies for advertising purposes.

8. Destruction of Personal Information

When personal information is no longer necessary (purpose fulfilled, retention period expired, or upon your request), we destroy it without delay:

• Electronic files: Deleted using technical methods that prevent recovery
• Paper records (if any): Shredded or incinerated

9. Special Notice on Financial Account Information in Published Content

1. The Service allows you to enter financial account information (account holder name, bank name, account number), contact details, and other personal information for direct display on your published website. This applies to all website types — business sites, portfolios, wedding invitations, event pages, and any other format. This is a core feature of the Service designed to allow users to communicate payment instructions, donation requests, event information, or contact details to visitors.
2. Once your site is deployed, this information is published publicly on a URL accessible to anyone on the internet, without restriction on who can view it or for how long (until you delete the project or your account).
3. Before entering any third party's financial account information, contact details, or other personal information, you must confirm that:
   • You have obtained the explicit consent of the individuals concerned; and
   • The individuals understand and consent to their information being publicly visible on the internet.
4. The Company does not verify the accuracy of the information entered or whether proper consent has been obtained. Any legal liability arising from the input or publication of third-party information rests solely with the user who entered it. For the related provisions, see Articles 10 and 13 of the Terms of Service.

10. Security Measures

We take the following measures to protect your personal information:

1. Administrative: Minimizing the number of personnel with access to personal information; training on data protection
2. Technical: Access control management; TLS/HTTPS encryption for data in transit; token-based authentication; leveraging the security infrastructure of our processors (Supabase, AWS)
3. Note on publicly displayed content: Financial account information, contact details, and other information entered by users for public display on their websites are stored in plain text in our database and displayed in plain text on the deployed public page, as that is the intended purpose of the feature. Users must fully understand this before entering such information (see Section 9).

11. Privacy Officer

For any inquiries, complaints, or requests regarding your personal information:

12. Remedies for Rights Violations

If you believe your personal information rights have been violated, you may contact the following authorities (Republic of Korea):

• Personal Information Dispute Mediation Committee: 1833-6972 / privacy.kr
• Korea Internet & Security Agency (KISA) Privacy Report Center: 118 / privacy.go.kr
• Supreme Prosecutors' Office Cyber Investigation Division: 1301 / spo.go.kr
• National Police Agency Cyber Bureau: 182 / ecrm.cyber.go.kr

13. Business Information

Supplementary Provisions

This Privacy Policy is effective from July 19, 2026.