Privacy Policy

In order to protect the freedom and rights of data subjects (users) who use the company's services (including the official website upstage.ai, Upstage Console console.upstage.ai, AI Space space.upstage.ai, Upstage Studio studio.upstage.ai, Education edu.upstage.ai, etc., collectively referred to as 'Upstage Service'), the company complies with the Personal Information Protection Act and related laws, and processes personal information lawfully and manages it securely.

In compliance with Article 30 of the Personal Information Protection Act, Upstage establishes and discloses the following privacy policy to inform information subjects of the procedures and standards for processing personal information and to handle grievances promptly and smoothly.

Disclaimer: Governing law

So, as you know, the laws and regulations of the Republic of Korea have formulated this privacy policy. While it applies to our global operations, the policy is primarily governed by South Korean legal standards and practices. Users outside of South Korea should be aware that the policy might reference legal concepts and frameworks specific to South Korea, which may differ from local laws.

‍

1. Purpose, items, and retention period of personal information processing

The Company processes personal information for the following purposes. It obtains the data subject's consent for processing their personal information items by Article 15 Paragraph 1 Clause 1 and Article 22 Paragraph 1 Clause 7 of the Personal Information Protection Act. If the purpose of use changes, the Company will take necessary measures such as obtaining separate consent under Article 18 of the Personal Information Protection Act.

A. Membership registration and management: Until the member withdraws
However, in the following cases, until the end of the relevant reason

• If there is an ongoing investigation or inquiry due to a violation of related laws, until the end of the investigation or inquiry
• If there is a remaining debt or credit relationship due to the service use until the settlement of the debt or credit relationship

B. Provision of goods or services: Until the completion of the supply of goods or services and the payment and settlement of fees
C. Non-member services: Information collected through non-member services will be retained for one year and deleted thereafter in accordance with our Privacy Policy.

• However, if a non-member requests deletion through a personal information access request, it will be deleted without delay.

However, in the following cases, until the end of the relevant period

• Records related to transactions, such as labeling and advertising, contract details, and fulfillment, pursuant to Article 6 of the Act on Consumer Protection in Electronic Commerce, etc.
  
  • Records on display and advertisement: 6 months
  • Records on contract or withdrawal of the offer, payment of the price, and supply of goods, etc.: 5 years
  • Records on consumer complaints or dispute resolution: 3 years
• Retention of communication data in accordance with Article 15-2, Paragraph 2 of the Communications Secrets Protection Act:
  
  • Service usage records, access logs, access IP addresses: 3 months

2.  Children’s Privacy

a. We do not intend for our websites or online services to be used by anyone under the age of 18. We do not knowingly collect, sell, or share information of individuals under the age of 18.  If you are a parent or guardian and believe we may have collected information about your child, please contact us immediately as described in this Policy's “10. Chief Privacy Officer and Personal Information Disclosure Claim” section. For more information, please see our Terms of Use.

b. However, Upstage Education (edu.upstage.ai) permits membership registration and service use only by residents of the Republic of Korea aged 14 or older.

3.  Entrustment of personal information processing

a. The Company entrusts the following personal information processing tasks to external service providers for efficient personal information management.

b. When entering into a contract for entrustment, the Company shall specify the matters concerning the prohibition of personal information processing other than the purpose of performing the entrusted tasks, technical and administrative protection measures, restrictions on re-entrustment, management, and supervision of the trustee, and liability for damages in the contract or other documents by Article 26 of the Personal Information Protection Act, and shall supervise the trustee to ensure that the personal information is processed safely.

c. By Article 26, paragraph 6 of the Personal Information Protection Act, the trustee shall obtain the consent of the Company when re-entrusting the personal information processing tasks entrusted by the Company.

d. If the content of the entrusted tasks or the trustee changes, we will disclose it immediately through this Privacy Policy.

e. If we entrust personal information processing tasks overseas, we will inform you in '4. Transfer of Personal Information Overseas'.

4. Personal data transfer abroad

The company provides and outsources overseas services, such as service provision, marketing, and customer management services.

5.  Procedure and method of destroying personal information

a. The Company shall destroy personal information without delay when it is no longer necessary to retain the personal information, such as when the retention period of personal information expires or when the purpose of processing is achieved.

b. Even if the retention period of personal information has expired or the purpose of processing has been achieved, if it is necessary to preserve personal information under other statutes, the Company shall transfer it to a separate database (DB) or store it in a separate storage place.

c. The procedure and method of destroying personal information are as follows.

• Destruction procedure

The company selects personal information for which the destruction reason has occurred and destroys the personal information according to internal regulations.

• Destruction method

The company destroys personal information recorded and stored in electronic files, making reproducing the record impossible. It also shreds the personal information recorded and stores it in paper documents.

6. Rights, obligations, and exercise methods of the information subject and the legal representative

a. The information subject may exercise the following rights against the company at any time.
※ For the exercise of rights by minor users and their legal guardians, please refer to Section 2 (Processing of children’s personal information).

b. The exercise of rights may be made by written, e-mail, facsimile, etc., to the company by Article 41 (1) of the Enforcement Decree of the Personal Information Protection Act, and the company will take action without delay.

c. The exercise of rights may be made through a representative, such as a legal representative or a person entrusted with the exercise of rights. In this case, a power of attorney by the attached Form 11 of the "Enforcement Decree of the Personal Information Protection Act" must be submitted.

d. The right to request the disclosure of personal information and the right to request the correction, deletion, and suspension of processing may be limited by Article 35 (4) and Article 37 (2) of the Personal Information Protection Act.

e. The company may refuse to delete personal information if specified as the collection subject in other statutes.

f. The company verifies whether the person who has requested the disclosure is the person who has asked for the disclosure or a legitimate representative.

7. Measures to ensure the safety of personal information

The company is taking the following measures to ensure the safety of personal information.

• Administrative measures: Establishment and implementation of internal management plans, operation of dedicated organizations, and regular employee education
• Technical measures: Management of access rights to personal information processing systems, installation of access control systems, encryption of personal information, Installation and updating of security programs
• Physical measures: Access control of computer centers, etc.

8. Installation and operation of personal information automatic collection devices, and refusal

a. The Company uses Google Analytics, MS Clarity, and LinkedIn in accordance with Article 15, Paragraph 1, Subparagraph 1 (Consent) of the Personal Information Protection Act. Information on service users is collected through each tool, and in this case, only non-identifiable information that cannot identify individual users is collected.

• Google Analytics: Install the blocking browser add-on (https://tools.google.com/dlpage/gaoptout) or [Installation, operation, and rejection of cookies] below
• MS Clarity: [Installation, operation, and rejection of cookies] below
• LinkedIn: [Installation, operation, and rejection of cookies] below

b. Cookies are small pieces of information sent to the user's computer browser by the server (HTTPS)

used to operate the website and are stored on the hard disk of the user's PC.

• Purpose of use of cookies: This information is used to understand each service visited by the user, including the types of visits and usage, search terms, and whether a secure connection was used to provide optimized information to the user.
• Refusal of cookie installation and operation: In Chrome, you can refuse cookie storage through the web browser's right side (⋮) > Settings menu > Privacy and security > Cookies and other site data or a new secret window (or new InPrivate window).
• If you refuse cookie storage, there may be restrictions on using some services, such as logging in.

9. Additional use·provision judgment criteria

a. The company may use and provide personal information without the consent of the information subject by Article 15 (3) and Article 17 (4) of the 「Personal Information Protection Act」 and Article 14-2 of the Enforcement Decree of the 「Personal Information Protection Act」.

b. Accordingly, the company has considered the following matters to use and provide additional information without the consent of the information subject.

• Whether the purpose of using and providing personal information is related to the original purpose of collection
• Whether there is a predictability of additional use and provision in light of the circumstances in which personal information is collected, or the processing practices
• Whether the additional use and provision of personal information unreasonably infringes the interests of the information subject
• Whether necessary measures have been taken to ensure safety, such as pseudonymization or cryptography

10.   Chief Privacy Officer and Personal Information Disclosure Claim

a. The company has designated a Chief Privacy Officer responsible for managing personal information and handling complaints and remedies related to processing personal data.

b. The information subject may request the disclosure of personal information under Article 35 of the "Personal Information Protection Act" to the department below. The company will make every effort to ensure that the request for the disclosure of personal information is processed promptly.

c. The information subject may inquire about all matters related to protecting personal information, such as complaints and remedies, by contacting the Chief Privacy Officer and the department in charge. The company will respond to the information subject's inquiry quickly.

11. Methods of Exercising Rights

a. The company is committed to protecting the information subject's right to self-determination and is making efforts to provide counseling and remedies for personal information infringement. If you need to report or consult, please contact the department below.

b. The information subject may apply for dispute resolution or consultation with the Personal Information Dispute Mediation Committee, the Korea Internet & Security Agency, etc., for remedies for personal information infringement. Please contact agencies for other reports on personal information infringement, consultations, etc.

• Personal Information Dispute Mediation Committee: +82 1833-6972 (www.kopico.go.kr)
• Personal Information Infringement Reporting Center: +82 118 (privacy.kisa.or.kr)
• Supreme Prosecutors' Office: +82 1301 (www.spo.go.kr)
• National Police Agency: +82 182 (ecrm.police.go.kr)

c. If the information subject has suffered damage due to the disposition or non-action of the head of the public institution regarding the request for the exercise of rights under Article 35 (Access to Personal Information), Article 36 (Correction, Deletion, etc. of Personal Information), and Article 37 (Suspension of Processing of Personal Information) of the Personal Information Protection Act, he/she may file an administrative appeal by the Administrative Appeals Act.

• Central Administrative Appeals Commission: +82 110 (www.simpan.go.kr)

12. Changes to the Privacy Policy

a. This Privacy Policy will take effect on May. 01, 2026.

b. The previous Upstage Console Privacy Policy can be found at the link below.

• 2026. 04. 01 ~ 2026. 04. 30 (click)
• 2025. 12. 18 ~ 2026. 03. 31 (Click)
• 2025. 09. 16 ~ 2025. 12. 17 (Click)
• 2025. 05. 29 ~ 2025. 09. 15 (Click)
• 2025. 03. 08 ~ 2025. 05. 28 (Click)
• 2024. 12. 19 ~ 2025. 03. 07 (Click)
• 2024. 11. 29 ~ 2024. 12. 18 (Click)
• 2024. 09. 26 ~ 2024. 11. 28 (Click)
• 2024. 08. 01 ~ 2024. 09. 25 (Click)
• 2024. 07. 12 ~ 2024. 07. 31 (Click)
• 2024. 03. 13 ~ 2024.  07. 11 (Click)
• 2024. 02. 28 ~ 2024. 03. 12 (Click)
• 2023. 12. 20 ~ 2024. 02. 28 (Click)
• 2023. 11. 01 ~ 2023. 12. 19
• 2023. 06. 30 ~ 2023. 10. 31

Privacy Policy — U.S. Supplemental Provisions

This U.S. Supplement (“U.S. Supplement”) serves to augment the Privacy Policy (“Basic Policy”) of Upstage, Inc. (“Upstage,” “the Company,” “We”). This U.S. Supplement is applicable to U.S. residents and furnishes supplementary disclosures in adherence to relevant U.S. state privacy legislation, including the California Consumer Privacy Act (as amended by the California Privacy Rights Act, collectively referred to as the “CCPA”). Should any inconsistency arise between this U.S. Supplement and the Basic Policy, this U.S. Supplement shall take precedence for U.S. residents.

Specific disclosures are mandated by U.S. state privacy laws. The following table provides additional information on the categories of personal information collected by the Company and the methods by which such information is used and disclosed. For comprehensive details on the personal information collected by the Company, kindly consult Article 1 of the Basic Policy; for information on the outsourcing of personal information processing, please refer to Article 3 of the Basic Policy; and for details on overseas transfer, please consult Article 4 of the Basic Policy.

1. Personal Information Category

2. Sale and sharing of personal information

The Company does not “sell” personal information or “share” personal information for contextual behavioral advertising as defined by applicable state privacy laws. Furthermore, the Company does not process sensitive personal information to infer consumer characteristics. The Company maintains and uses anonymized information in an anonymized form and does not attempt to re-identify such information except where permitted by law.

3. Data usage for AI model training

The Company may use input and output data to improve AI models and services in accordance with the Basic Policy. For details on what data is used, how it is processed, and how settings are managed, please refer to the relevant provisions of the Basic Policy.

4. Your rights under U.S. state privacy laws

Depending on your place of residence and applicable exceptions, you may have the following privacy rights with respect to personal information:

• Right to know about the processing of personal information (including the right to access personal information in a portable format)
• Right to request the deletion of personal information
• Right to request the correction of inaccurate personal information
• Right to refuse the “sale” of personal information and “sharing” for cross-contextual behavioral advertising.
• Right to restrict the use and disclosure of sensitive personal information.
• Right not to be retaliated against in connection with the exercise of personal information protection rights.

5. How to exercise your rights

The privacy rights specified in this clause may be exercised in the following ways:

• Send an email to infosec@upstage.ai
• Submit a request via the support menu on get.support.upstage.ai
• For recruitment application data, contact joinstage@upstage.ai

Identity Verification. To protect your personal information from unauthorized access, alteration, or deletion, the Company may verify your identity before processing a request. If you do not have an account or if fraudulent activity is suspected, additional personal information may be requested.

Agents. If you submit a request through an authorized agent, the Company may require proof of that agent's authorization. Even when using an agent, you may still be required to verify your identity yourself.

The Company responds to verified consumer requests within 45 days. If additional time is required (up to an additional 45 days), we will notify you in writing of the reason and the extension period.

6. Appeals

Depending on your place of residence, you may have the right to object to the Company’s decision regarding your request to exercise your rights. To object, please send a request to infosec@upstage.ai with the subject line “Objection to Privacy Rights.” The Company will respond to objections within the period required by applicable law.

7. “Do not track.”

Some web browsers send “Do Not Track” (DNT) signals to websites. Since no unified industry standard has been established, we do not currently respond to DNT signals. However, if Global Privacy Control (GPC) signals are available and recognized under applicable state laws, we treat them as valid denial requests.

8. Child privacy protection

The Company's services are not intended for individuals under the age of 18. We do not intentionally collect personal information from children under this age. If you believe that a child's personal information has been collected, please contact infosec@upstage.ai immediately.

9. Changes to the U.S. Supplemental Provisions

The Company may update these U.S. Supplemental Provisions from time to time to reflect changes in practice or applicable laws. In the event of material changes, the Company will post an updated version on the Website with a new effective date.

10. Contact

If you have any questions regarding these U.S. Supplements or wish to exercise your rights, please contact us at the following:

Upstage Co., Ltd.
Unit 815, Korea Science & Technology Center Building 2,22 Teheran-ro 7-gil, Gangnam-gu, Seoul 06130, Republic of Korea
Email: infosec@upstage.ai
Recruitment Inquiries: joinstage@upstage.ai

Privacy Policy — Supplementary Provisions for the European Economic Area (EEA), the United Kingdom, and Switzerland

These Supplementary Provisions for the European Economic Area, the United Kingdom, and Switzerland (hereinafter referred to as the “EU Supplementary Provisions”) supplement Upstage Co., Ltd.’s Privacy Policy (hereinafter referred to as the “Basic Policy”). It applies to individuals located in the EEA, the United Kingdom, and Switzerland. In the event of any conflict between these Provisions and the Basic Policy, these Provisions shall prevail.

Please refer to Article 1 of the Basic Policy for specific items of personal information collected, Article 3 for entrusted processing, and Article 4 for international transfer.

1. Data controller

Upstage Co., Ltd. is the data controller that processes your personal information in connection with our services.

Unit 815, Korea Science & Technology Center Building 2,22 Teheran-ro 7-gil, Gangnam-gu, Seoul 06130, Republic of Korea
Email: infosec@upstage.ai

2. Legal basis for personal information processing

We process only where there is a valid legal basis in accordance with the GDPR and UK GDPR. Please refer to Article 1 of the Basic Policy for specific items collected.

3. Your rights under GDPR

If located in the EEA, the United Kingdom, or Switzerland, you have the following rights:

• Right of access (Article 15 of the GDPR) — To verify whether personal data has been processed and to request a copy
• Right of rectification (Article 16 of the GDPR) — To correct inaccurate or incomplete data
• Right of erasure (Article 17 of the GDPR) — To request the deletion of personal data under certain conditions
• Right to limit processing (Article 18 of the GDPR) — To limit processing under certain circumstances.
• Right of data portability (Article 20 of the GDPR) — To receive data in a structured, machine-readable format
• Right to object (Article 21 of the GDPR) — To object to processing based on legitimate interests or direct marketing.
• Right regarding automated decision-making (Article 22 of the GDPR) — To request human intervention regarding automated decisions with legal or material impact
• Right to withdraw consent (Article 7, Paragraph 3 of the GDPR) — To withdraw at any time; processing prior to withdrawal is not affected.
• Right to file a complaint (Article 77 of the GDPR) — To file a complaint with the relevant regional supervisory authority (UK: ICO, Switzerland: FDPIC)

Exercise your rights: Contact infosec@upstage.ai. Response within 1 month, extendable up to 2 months.

4. Overseas data transfer

Your personal information may be transferred to the Republic of Korea and other countries outside the EEA, the UK, and Switzerland. Please refer to Articles 3 and 4 of the Basic Policy for the full list and locations of recipients. Transfers rely on the following mechanisms:

• The Republic of Korea received an EU Adequacy Decision from the European Commission in December 2021. Accordingly, the transfer of personal data from the EEA to the Republic of Korea may be carried out without additional safeguards.
• Standard Contractual Clause (SCC) (Article 46, Paragraph 2 (c) of the GDPR)
• UK Annex on International Data Transfer regarding the SCC
• Copies of applicable safeguards or related information may be provided upon request.

Request a copy of protective measures: infosec@upstage.ai

5. Data retention

We retain data only for the period necessary to fulfill the purpose of collection. Please refer to Article 1 of the Basic Policy for specific retention periods.

6. Automated decision-making and profiling

The Company currently does not make automated decisions with legal or similarly material impact as defined in Article 22 of the GDPR. We will update this provision and provide appropriate safeguards in the event of future changes.

7. Child privacy protection

We do not target individuals under the age of 18. We do not intentionally collect personal information from children under that age without the consent of a valid parent or legal representative. If you believe that a child's personal data has been collected, please contact infosec@upstage.ai.

8. DPO

Jeffrey / Email: infosec@upstage.ai

9. Cookies

We use cookies and tracking technologies, such as Microsoft Clarity and Google Analytics. In accordance with the GDPR and ePrivacy Directive, we obtain consent before installing non-essential cookies. You can manage this through the cookie consent banner or your browser settings. Please refer to our Basic Policy for more details.

10. Changes to the EU supplementary provisions

In the event of significant changes, we will post an updated version on the website along with the new effective date and provide additional notice if necessary.

11. Contact

If you have any questions regarding these U.S. Supplements or wish to exercise your rights, please contact us at the following:

Upstage Co., Ltd.
Unit 815, Korea Science & Technology Center Building 2,22 Teheran-ro 7-gil, Gangnam-gu, Seoul 06130, Republic of Korea
Email: infosec@upstage.ai
Recruitment Inquiries: joinstage@upstage.ai