Eden Creative Studio (Delaware LLC) (hereinafter referred to as the "Company") is a corporation established under the laws of the State of Delaware, USA. The Company values and protects users' personal information in compliance with the Act on Promotion of Information and Communications Network Utilization and Information Protection (hereinafter referred to as the "Information and Communications Network Act") and the Personal Information Protection Act of the Republic of Korea.

In providing global services, the Company complies with relevant laws such as the Personal Information Protection Act and the Information and Communications Network Act (hereinafter referred to as the 'Act'), as well as the 'Standards for Measures to Ensure Safety of Personal Information' and 'Standard Personal Information Protection Guidelines' notified by the Personal Information Protection Commission, in order to guarantee the rights of users in the Republic of Korea and promptly handle grievances. Accordingly, the Company establishes and discloses this 'Privacy Policy' in accordance with Article 30 of the Personal Information Protection Act as follows.

Article 1 (Purpose of Processing Personal Information)

The Company processes personal information for the following purposes. The personal information being processed will not be used for purposes other than the following, and if the purpose of use changes, necessary measures such as obtaining separate consent will be implemented.

① The Company does not collect sensitive personal information (race and ethnicity, ideology and creed, place of origin and domicile, political propensity and criminal records, health status and sexual life, etc.) that may infringe on basic human rights. Furthermore, in any case, the entered information will not be used for purposes other than those disclosed to users in advance and will not be leaked externally.

② The purposes for which the Company collects and uses users' personal information are as follows:

1. Member Registration and Management
   • Confirmation of intent to join, identification/authentication for service provision.
   • Age verification: Blocking access to harmful media for youth (NSFW) and restricting registration for those under 19.
   • Prevention of fraudulent service use (blocking multiple account creation, abusing, etc.).
   • Receiving customer inquiries and replying to results.
   • Conducting service satisfaction surveys.
2. Service Provision and Contract Fulfillment
   • Provision and operation of AI character creation and chatting services.
   • Payment and settlement for paid content.
3. Marketing and Advertising Utilization
   • Service improvement, provision of customized services, analysis of access frequency.

Article 2 (Items of Personal Information Collected)

The Company collects the minimum amount of information necessary to provide the service.

1. Upon Membership Registration (Required)

   • Email address (ID), password, nickname.
   • For SNS Simple Login: Social Identifier (Provider ID), Email.

2. During Service Use

   • Upon Report, relevant AI conversation information: Text entered by the user (Prompt), answers and images generated by AI.
   • Payment Information: Credit card information, payment records (processed through a payment agency).

3. Items Automatically Collected

   • IP address, access logs, service usage records, records of improper use.
   • Device Information: Device Unique Identifier (UUID), OS version, model name.

4. Retention and Usage Authority

   Collected Items	Purpose of Use	Retention and Usage Period
   Email	Member management, confirmation of intent to join and identity, receiving and replying to customer inquiries, service satisfaction survey, restriction of access for fraudulent users	3 months after withdrawal request (prevention of re-registration by fraudulent users)
   Card company name, partial card number, etc.	Payment and settlement of paid services, refund processing	Until membership withdrawal

Article 3 (Overseas Transfer and Entrustment of Personal Information)

As a Delaware corporation, all personal information is transmitted, stored, and processed on servers in the United States and overseas. The Company obtains consent for overseas transfer to protect the personal information of Korean users and manages it safely through vendors with global-level security.

• Users may refuse overseas transfer by contacting the Company's Chief Privacy Officer. However, if overseas transfer is refused, use of this Service based on U.S. servers will be impossible, and membership withdrawal processing may proceed.

Article 4 (Processing and Retention Period of Personal Information)