Nugem Studio Co., Ltd. (the "Company") values the personal information of its users and complies with the Personal Information Protection Act ("PIPA") and other applicable laws of the Republic of Korea. This Privacy Policy explains what personal information is collected on nugemstudio.com (the "Site"), how it is used, and how it is protected.

1. Purpose of Processing Personal Information

The Company processes personal information for the following purposes. Personal information will not be used for any purpose other than those listed below, and should the purpose of use change, the Company will take necessary measures, including obtaining separate consent where required.

• Analyzing Site usage statistics and improving the service
• Responding to inquiries
• Preventing fraudulent use and maintaining Site security

2. Period of Processing and Retention of Personal Information

① The Company processes and retains personal information within the retention and use period required by law, or the period consented to by the data subject at the time of collection.

• Automatically collected access data (Google Analytics): processed according to Google Analytics’ own data retention policy; the Company does not separately retain the raw logs.
• Information collected via inquiries: deleted without delay once the inquiry has been resolved, unless retention is required by applicable law, in which case it is retained for the legally required period.

② The destruction procedure and method are as follows.

• Destruction procedure: Personal information such as an email address collected for an inquiry is deleted by the responsible staff member as soon as its purpose has been fulfilled, without being moved to a separate database.
• Destruction method: Personal information recorded and stored in electronic file form is permanently deleted using technical methods that prevent the record from being reproduced. The Company does not separately create or retain paper documents containing personal information.

3. Provision of Personal Information to Third Parties

The Company processes personal information only within the scope specified in Article 1 (Purpose of Processing) above, and does not provide personal information to third parties except where the data subject has consented, or where required under Articles 17 and 18 of PIPA.

4. Outsourcing of Personal Information Processing

The Company outsources the following personal information processing task for the purpose of analyzing Site usage statistics, and, in accordance with Article 26 of PIPA, has specified in its agreement with the processor the matters necessary to ensure that personal information is processed safely.

• Processor: Google LLC (Google Analytics)
• Task outsourced: Analysis of website visit statistics

5. International Transfer of Personal Information

The Company transfers personal information overseas as follows for the purpose of analyzing Site usage statistics.

• Items transferred: IP address, browser and device information, pages visited, visit timestamps, and cookie identifiers automatically collected
• Destination country: United States
• Timing and method of transfer: Transmitted in real time over the network at the moment a user accesses the Site
• Recipient: Google LLC (Google Analytics)
• Recipient’s purpose of use and retention period: Used solely to analyze website visit statistics, and retained according to Google’s own data retention policy
• How to refuse the transfer, procedure, and effect of refusal: You may refuse the international transfer of your information by disabling cookies in your browser settings or by installing the Google Analytics Opt-out Browser Add-on (tools.google.com/dlpage/gaoptout). Refusing does not restrict your use of any other content on the Site, but your visit will not be reflected in the statistical analysis.

For further details, please refer to Google’s Privacy Policy at policies.google.com/privacy.

6. Criteria for Additional Use or Provision of Personal Information

The Company does not engage in additional use or provision of personal information under Article 15(3) or Article 17(4) of PIPA without the data subject’s consent, and does not use or provide to third parties personal information for any purpose other than the purpose originally collected.

7. Items of Personal Information Processed

The Site does not require account registration. The Company collects and processes the following items of personal information.

• Automatically collected items (upon visiting the Site): IP address, browser and device information, pages visited, visit timestamps, cookies
• Items collected via inquiries: email address, content of the inquiry
• Job applications: The "Apply" button on job listings links to external recruiting platforms such as gamejob.co.kr. The Company does not directly collect résumés or other personal information entered on those platforms; their own privacy policies apply.

8. Rights and Obligations of Data Subjects and Legal Representatives, and How to Exercise Them

① Data subjects may exercise their rights to access, correct, delete, or suspend the processing of their personal information with the Company at any time.

② These rights may be exercised using the email or phone contact listed under "15. Personal Information Protection Officer" below, and the Company will act on such requests without delay.

③ These rights may also be exercised through a legal representative or an authorized agent, in which case a power of attorney must be submitted.

④ The Company does not offer its services to, and does not separately collect personal information from, children under the age of 14. If it is discovered that personal information of a child under 14 has been collected, it will be destroyed without delay.

⑤ A data subject’s right to request access to or suspension of processing of their personal information may be restricted under Article 35(4), Article 37(2), and other relevant provisions of PIPA.

9. Measures to Ensure the Security of Personal Information

In accordance with Article 29 of PIPA, the Company takes the following administrative, technical, and physical measures necessary to ensure the security of personal information.

a. Administrative measures

• Limiting the number of staff with access to personal information to the minimum necessary, and providing them with training on personal information protection.
• Establishing and implementing an internal management plan for the safe processing of personal information.

b. Technical measures

• Managing access permissions to personal information processing systems to control access by unauthorized persons.
• Applying encrypted communication (SSL/TLS) to the Site’s communication channels.
• Installing security software and periodically updating and inspecting it to prevent leakage of personal information due to hacking or similar incidents.

c. Physical measures

• The Company does not operate its own server room or data storage facility; the Site and its data are operated through cloud infrastructure providers such as Vercel and Sanity, which manage their data centers under their own physical access control and security policies.

10. Operation of Cookies and How to Refuse Them

The Company may use cookies to provide a personalized experience and to analyze visit statistics. You may configure your web browser to accept all cookies, to be prompted each time a cookie is saved, or to refuse the storage of all cookies. Refusing cookies, however, may cause difficulty in using some features of the Site.

11. Processing of Sensitive Information

The Company does not collect, process, or disclose sensitive information under PIPA, such as information concerning ideology, belief, trade union or political party membership, political views, health, or sex life.

12. Processing of Pseudonymized Information

The Company does not process pseudonymized information for purposes such as statistical compilation, scientific research, or archiving in the public interest.

13. Automated Decision-Making

The Company does not use a fully automated system employing artificial intelligence technology to make decisions that have a significant effect on the rights or obligations of data subjects.

14. Collection, Use, Provision, and Refusal of Third-Party Behavioral Information for Online Customized Advertising

The Google Analytics used by the Company is used solely to analyze Site visit statistics, and is not used to serve customized advertising or to provide users’ behavioral information to third parties. You may refuse the collection of behavioral information by changing your browser’s cookie settings or by installing the Google Analytics Opt-out Browser Add-on (tools.google.com/dlpage/gaoptout).

15. Personal Information Protection Officer

The Company has designated the following Personal Information Protection Officer, who is responsible overall for personal information processing and handles complaints and remedies related to it:

• Name: Sangbin Han (CEO)
• Email: nugem@nugemstudio.com
• Phone: +82 70-4460-5660

Data subjects may direct any inquiries, complaints, or requests for remedy regarding personal information protection arising from use of the Site to the Personal Information Protection Officer above, and the Company will respond and act on such inquiries without delay.

16. Domestic Representative

As the Company is a corporation with a registered address in the Republic of Korea, it does not fall under the category of businesses required to designate a domestic representative under Article 31-2 of PIPA.

17. Remedies for Infringement of Rights

Data subjects may apply for dispute resolution or consultation with the following organizations to seek remedy for infringement of personal information. These organizations are independent of the Company; please contact them if you are not satisfied with the Company’s handling of a complaint or need further assistance.

• Personal Information Dispute Mediation Committee: 1833-6972 (www.kopico.go.kr)
• Privacy Infringement Report Center: 118 (privacy.kisa.or.kr)
• Supreme Prosecutors’ Office: 1301 (www.spo.go.kr)
• National Police Agency: 182 (ecrm.police.go.kr)

18. Privacy Policies for Individual Games

Each game the Company operates (such as TBH: Task Bar Hero) is provided through the Steam platform, and the privacy policy governing game accounts, server data, and related information is provided separately on each game’s Steam page or in-game client. Some games are co-developed with Tesseract Studio, and personal data processing for those games is governed by the applicable game-specific policy.

19. Changes to This Privacy Policy

This Privacy Policy was first established on July 31, 2026, and was revised on August 3, 2026, effective as of that date. Should its content be added to, deleted, or amended due to changes in law, policy, or security technology, notice will be given through an announcement on the Site at least 7 days before the change takes effect.