Privacy Policy

Spaceblue Inc. ((주) 스페이스블루, the "Company") complies with the Personal Information Protection Act and other applicable laws in providing Endue, its AI agent platform (the "Service"), and maintains this Policy to protect users' personal data.

1. Personal Data We Collect and How

2. Purposes of Processing

1. Identifying members, handling sign-up and account closure, account management
2. Providing Service features such as agent conversations, Routines, Connectors and Artifacts
3. Billing, payment and refund processing, usage management
4. Preventing abuse, responding to security incidents, investigating breaches of the Terms
5. Diagnosing errors, improving service quality, analyzing usage statistics
6. Communicating with users, including notices, and meeting legal obligations

3. AI Models and User Content

1. The Company does not use users' conversation Input or Output to train AI models.
2. AI responses in the Service are generated by third-party model providers such as Anthropic and OpenAI, reached through OpenRouter. In that process, the conversation Input needed to generate the response (including attached files) is transmitted to the provider.
3. As a rule, model providers do not use data submitted through their APIs to train their own models (per each provider's API data usage policy), and destroy it after limited retention for purposes such as abuse detection. The specifics follow each provider's policy.
4. Where a user registers their own API key (BYOK) to call a model, processing of that call's data is governed by the agreement and policies between the user and the key issuer. Registered keys are stored encrypted (AES-GCM) and are never shown in plaintext in any screen or response.

4. Retention and Use Period

1. As a rule, the Company destroys personal data without delay when a member closes their account. Users may also delete content such as conversations and Artifacts directly within the Service before then.
2. The following data is retained for the periods stated below.

5. Provision to Third Parties

1. The Company does not provide users' personal data to third parties, except where the user has separately consented or where there is a legal basis.
2. Transmissions the user directs themselves — sending messages to external services through Connectors or channels, publishing an Artifact by link and the like — are processed at the user's request, and the transmitted information is then handled under the policies of that external service.

6. Entrustment of Processing and Overseas Transfer

The Company entrusts the processing of personal data as set out below. Because the processors are located outside Korea, personal data is transferred overseas. Transfers take place over the network at the time the Service is used.

A user who does not want their personal data transferred overseas may stop using the Service and close their account. These transfers are essential to providing the Service, and the Service cannot be provided without them.

7. Destruction of Personal Data

1. The Company destroys personal data without delay once the retention period has passed or the purpose of processing has been achieved.
2. Electronic files are deleted by means that make them unrecoverable, and printed materials are shredded or incinerated.
3. Information that must be retained under applicable law is stored separately and destroyed once the period has passed.

8. Rights of Data Subjects and How to Exercise Them

1. Users may at any time request access to, correction of, deletion of, or suspension of processing of their personal data.
2. Most data — conversations, Artifacts, memories, Connector integrations and the like — can be reviewed and deleted directly in the Service's settings screens; other requests can be made by email to the privacy officer below. The Company will act within the statutory period and inform the user of the result.
3. Rights may also be exercised through a legal representative or an authorized agent.
4. Deletion requests may be restricted for information the law requires to be retained; in that case the Company will explain the reason.

9. Cookies and Other Automatic Collection

1. The Service uses cookies and browser storage to keep users signed in (SSO session cookie and session hint), to save interface preferences (such as theme), and for usage analytics (Google Analytics).
2. Users may refuse or delete cookies in their browser settings. Refusing the session cookie makes features that require sign-in unusable.

10. Security Measures

1. Encryption in transit (TLS) and encrypted storage of sensitive values such as authentication tokens and API keys
2. Least-privilege access rights with access control, and retention and review of access logs
3. Operation of incident response procedures and regular security reviews

11. Children Under 14

The Service is intended for users aged 14 or older, and the Company does not collect personal data from children under 14. If the Company learns that such data has been collected, it will be destroyed without delay.

12. Privacy Officer

• Privacy officer: the representative of Spaceblue Inc.
• Contact: [email protected]

Reports and consultations about privacy infringement may also be directed to the Personal Information Infringement Report Center (118, privacy.kisa.or.kr), the Personal Information Dispute Mediation Committee (1833-6972, kopico.go.kr), the Supreme Prosecutors' Office (1301) or the National Police Agency (182).

13. Changes to This Policy

Where this Policy is supplemented, removed or amended, the Company will announce the change within the Service at least 7 days before it takes effect, or at least 30 days in advance where the change materially affects users' rights.

Addendum

This Policy takes effect on 2026-08-17.

The Korean text of this Policy is the original. In the event of any discrepancy between the Korean and English versions, the Korean version prevails.