Privacy Policy

1. Scope and responsible organization
2. Information collected and its sources
3. Purposes and legal bases
4. User content and AI processing
5. Advertising, cookies, and choices
6. Recipients and disclosure purposes
7. International transfers
8. Retention, deletion, and security
9. Children, teenagers, and age checks
10. Creator and monetization information
11. Rights requests and automated systems
12. Changes to this Policy
13. Regional protections
14. Contact

1. Scope and responsible organization

STGN Inc. (“STGN”, “we”, “us”, or “our”) operates and provides the apps, websites, games, video and playable feeds, AI chatbots, content creation tools, and related services that link to this Policy (the “Services”). STGN is the controller, business, or personal information handling business operator responsible for the processing described here. This Policy explains collection, use, disclosure, retention, and your choices. It applies to live services and expressly identified tests; internal evaluation does not change our responsibility to users.

This single Policy includes creator and monetization processing, service providers and international transfers, and regional provisions for the Republic of Korea, EEA, United Kingdom, United States, and Japan. A provision applies only to the relevant feature and where the applicable law covers the processing. Regional protections prevail over conflicting general wording. A clearly identified feature notice may give additional details, but does not reduce mandatory rights or expand the permissions in our Terms of Service.

Contact STGN at support@stgn.io or 144-ho, 4F, 171, Garak-ro, Songpa-gu, Seoul, Republic of Korea. Where required, additional operator, privacy officer, or regional representative information will be made available through a clearly identified privacy contact page or notice accessible from the relevant Service. Reading this Policy or using the Services does not itself give consent to processing that requires separate consent.

2. Information collected and its sources

The categories below depend on the Service and the features used. We collect information from you, automatically from your device and activity, and from stores, login providers, payment or verification providers, advertising and analytics partners, other users, rights holders, public sources, and authorities as relevant. We distinguish required and optional information at collection; declining required information may prevent the requested feature, while declining optional processing does not by itself prevent core access.

Uploads, prompts, and reports may contain information about other people. Provide it only if you have authority and a lawful basis. We do not intentionally request sensitive personal information or government identifiers for ordinary gameplay or viewing. Identity documents, sensitive information, or access to a microphone, camera, or photo library will require the relevant feature notice, permission, and legal basis. Device permission alone does not replace legally required consent.

3. Purposes and legal bases

We use information to deliver and secure the requested Services, authenticate users, save progress, host content, provide AI responses, support users, administer purchases and refunds, personalize content, operate advertising, measure performance, evaluate features, prevent abuse, respond to reports, and comply with law. Optional marketing, monetization, and AI training apply only as described below. We do not use a testing purpose as permission for unrelated processing.

For other regions we use the grounds available under local law, including consent, necessary contract processing, or statutory exceptions. A GDPR legitimate-interest label is not used as a substitute for consent or another basis required elsewhere. We limit new purposes to compatible uses or obtain additional authorization and give notice where required.

4. User content and AI processing

Content becomes public only when you deliberately publish it or the feature clearly identifies the audience before submission. Private conversations, non-public prompts, reference files, and drafts are not public merely because an AI feature processes them. Public content and profiles may be copied, shared, or indexed by others. Deleting your copy may not remove copies lawfully retained by other people.

AI features process relevant inputs, conversation history, character settings, outputs, and feedback to provide responses or editing. Selected memory may support continuity where enabled; the feature notice explains available review and deletion controls and retention. Automated safety checks and limited review by authorized personnel may examine public and private content for safety, security, abuse, rights claims, support, and troubleshooting. Access is restricted by role and need.

Consistent with our Terms of Service, using your content for advertising or promotion outside the Services, or for AI model training or fine-tuning, requires separate permission. Private conversations will not be made public or used in those ways without that permission. We will explain the proposed data, purposes, recipients, retention, choices, and any limits on withdrawal before the separate use. Ordinary feature delivery, safety testing, and service evaluation do not by themselves authorize training or fine-tuning.

External AI providers receive only information relevant to the selected feature. Where required, we identify the provider, processing locations, retention, and applicable training restrictions in a notice available before you use the relevant AI feature. We will not authorize provider training beyond your permission and applicable law. If a feature intentionally processes health data, biometric identifiers, or other specially protected information, we will identify the necessary additional legal condition and obtain any required explicit or separate consent before that processing.

5. Advertising, cookies, and choices

We and enabled partners may use cookies, SDKs, local storage, and device or advertising identifiers for authentication, preferences, analytics, security, contextual advertising, personalized advertising, and attribution. Where required, the applicable cookie, SDK, or collection notice identifies the enabled partners, purposes, information, and duration. Non-essential technologies requiring consent will remain disabled until consent is obtained. Consent may be withdrawn as easily as it is given through available settings or by contacting us.

Where personalized advertising is enabled, limited identifiers, online activity, approximate location, and advertising-interest inferences may be disclosed to advertising partners. Some US laws treat this as sale or sharing even without monetary payment. We do not sell personal information for money or sell or share sensitive information for targeted advertising. We do not use private AI conversations or sensitive information to target ads.

Use Privacy Choices or Do Not Sell or Share My Personal Information controls where available, or email support@stgn.io, to exercise applicable opt-outs. We honor legally required universal opt-out signals, including Global Privacy Control, for the browser or device and for a known account where required. An opt-out does not require creating an account. Device and browser controls may further limit identifiers and cookies; contextual ads may continue. We do not treat legacy Do Not Track signals as a substitute for legally recognized opt-out signals.

We apply legally required restrictions on advertising to minors. Where the law requires prior authorization for sale, sharing, or targeted advertising involving a minor, that processing will not occur without it; where prohibited, it will not occur. Known minors will not receive profiling-based advertising where prohibited. Optional marketing messages provide an unsubscribe route; essential service and security messages may still be sent.

6. Recipients and disclosure purposes

Service providers process relevant data on our instructions for hosting, storage, content delivery, login, analytics, crash reporting, AI, moderation, support, security, communications, payments, verification, and tax administration. We require appropriate confidentiality, security, purpose limitations, deletion, and other processor terms and supervise entrusted providers as required. No listed category is a blanket authorization to disclose all data to every provider.

Stores, payment providers, social login providers, and some advertising partners may independently determine aspects of their processing. They receive the data needed for the requested transaction, login, or enabled advertising activity, subject to required notice, consent, and opt-outs. Where required, the relevant collection or feature notice identifies the recipients and explains whether they act on our behalf or for their own purposes.

Other users see information you make public. Rights holders or reporting parties may receive limited information necessary to handle a claim or appeal, with notice or safeguards required by law. Professional advisers, courts, authorities, or other parties may receive information for lawful requests, legal claims, audits, or urgent safety needs. A buyer or successor may receive relevant information during a corporate transaction with lawful safeguards and required notice or consent. Each disclosure requires a valid legal basis and any applicable notice or authorization.

7. International transfers

STGN is based in the Republic of Korea. Information may be processed in Korea and, only where actually used, other countries where our providers operate. Overseas storage, remote access, and onward disclosure may also constitute a transfer. Before a transfer, we provide any legally required information about the recipient and contact, destination, data, purpose, timing and method, retention, transfer basis and safeguards, and any available refusal method and consequences through a Service notice or other legally permitted notice method. We do not presume that data is stored in a particular country merely because a provider operates there.

For EEA and UK data, an applicable adequacy decision may support a transfer to Korea only within its scope. Other transfers require a valid mechanism, such as relevant Standard Contractual Clauses, a UK Addendum or International Data Transfer Agreement, and any necessary transfer assessment and supplementary safeguards. You may request a copy or description of relevant safeguards with confidential details appropriately redacted.

For Korean and Japanese users, separate transfer consent or another valid statutory mechanism will be used as described in Section 13. We provide legally required destination and recipient information before relying on consent or another disclosure-based route. Optional overseas AI or advertising processing may be declined through the relevant controls, with the corresponding optional feature unavailable; the specific effects must be explained before the choice.

8. Retention, deletion, and security

We retain each category only as long as necessary for its stated purpose and applicable legal obligations. Account data generally lasts through the account relationship; public content through its availability; AI conversations and memory through the stated feature period or deletion choice. Support, security, moderation, and appeal records last for a proportionate resolution, security, and claims period. Transaction, creator payout, and tax records last for applicable statutory periods. Where applicable law requires a specific period or additional detail, we provide it in the relevant collection or feature notice before the processing begins.

When the purpose ends or a valid deletion request applies, we delete or irreversibly anonymize eligible data without undue delay, subject to lawful exceptions. Required records are separated or access-restricted and used only for the retained purpose. Electronic data is deleted using methods designed to prevent recovery; paper records are shredded or securely destroyed. Backups are isolated from ordinary use and expire through their defined cycle, subject to lawful preservation. Pseudonymized data remains protected as personal data; we do not treat it as anonymous merely because direct identifiers have been removed.

Account closure, inactivity, or test resets do not automatically erase payment, legal, or security records. Conversely, a need to retain a transaction record does not justify retaining every conversation or upload. We minimize identity-document retention and use verification status rather than full copies where feasible. Truly anonymous or de-identified information may be retained only under applicable safeguards, without attempting re-identification except where legally permitted.

We use organizational, technical, and physical measures designed to protect information, including access controls, authentication, logging, encryption where appropriate, staff confidentiality and training, vendor supervision, incident response, and security testing. No system is completely secure. We will assess incidents and provide notifications required by applicable law.

9. Children, teenagers, and age checks

The general minimum age is 13. A higher minimum age stated for a game, service, feature, or content, or required by law, applies. The AI Chatbot Service requires age 18 or older, or a higher applicable minimum. Guardian consent does not allow a user below the applicable service minimum to gain access.

Service eligibility and consent to personal data processing are separate. In Korea, where consent is the processing basis for a child under 14, we obtain and verify legal guardian consent. In the EEA, parental authorization is required for consent-based processing of an online service offered directly to a child below the national digital-consent age, which ranges from 13 to 16; the UK threshold is 13. Other local rules may require additional authorization. We use age-appropriate notices, data minimization, safer privacy defaults, and advertising restrictions as required.

We may process age information and proportionate verification evidence, with the method, provider, and retention disclosed before collection. We do not knowingly collect information from an ineligible child except as necessary and lawful to assess age, obtain required authorization, secure the Service, or address the matter. If we learn of unauthorized child data, we restrict the relevant processing or access and delete or otherwise handle it as required. Parents and guardians may contact support@stgn.io to request review, access, or deletion where entitled. US COPPA protections apply where legally required despite an age gate.

10. Creator and monetization information

This Section applies only where STGN separately approves a creator or monetization program. Uploading content does not by itself enroll you or authorize identity, tax, or payout collection. The enrollment notice identifies required fields, eligibility, verification providers, and payment arrangements. Participation normally requires the applicable age of majority; a lawful guardian or legal-entity arrangement must be expressly described if offered.

We use creator identity, contract, content, advertising settings, valid audience activity, payment, and tax data to assess eligibility, verify rights, calculate agreed payments, prevent invalid traffic, issue statements, manage withholding, resolve disputes, and administer appeals. Drafts, private conversations, identity documents, banking, and tax records are not public program fields. Advertisers receive aggregated reporting unless identifiable disclosure is separately explained and has a valid basis. Failure to supply necessary verification or payment details may prevent enrollment or payout. Retention and international transfers follow Sections 7 and 8 and any applicable enrollment notice; closure does not erase legally required settlement or tax records.

11. Rights requests and automated systems

Depending on applicable law, you may access or obtain a copy, correct, delete, restrict, or object to processing; receive portable data; withdraw consent; opt out of sale, sharing, targeted advertising, or certain profiling; and request safeguards for qualifying automated decisions. Withdrawal does not affect prior lawful processing. We will not unlawfully discriminate against you for exercising a right.

Use account settings to manage eligible profile, content, memory, and deletion choices, or email support@stgn.io with the Service, account identifier, and requested action. Avoid sending identity documents unless requested through a suitable channel. We verify requests proportionately and use verification data only for that purpose and related security. Authorized agents or guardians may act where permitted, subject to evidence of authority. We explain lawful limits or refusals and available appeals. Opt-outs are not subject to identity verification beyond what applicable law allows.

We use automated systems for recommendations, fraud and safety signals, moderation, and advertising measurement. Material restrictions and payment decisions include appropriate human review and appeal where required. If a feature makes a solely automated decision producing legal or similarly significant effects, we will identify it, explain relevant logic and consequences, establish a lawful basis, and provide applicable human intervention and challenge rights. A general reference to AI does not waive those rights.

12. Changes to this Policy

We publish the current Policy and effective date through the Services and provide legally required advance or additional notice for material changes. A new purpose, provider, or transfer will receive any required notice and consent before the processing begins. Updating this Policy does not itself authorize a use for which separate consent or permission is required.

13. Regional protections

Republic of Korea

Sections 2 and 3 identify categories and purposes; Sections 6 to 8 describe recipient categories, overseas transfers, and retention. Legally required particulars of entrusted processing, third-party provision, and overseas transfers are provided through the relevant Service disclosure or another method permitted by law. Where consent is required, collection and use, third-party provision, sensitive information, unique identifiers, and overseas transfer consents are distinguished as required. A refusal of optional consent does not block unrelated core services. The actual required and optional fields and detailed recipient disclosures must be provided at collection.

Overseas transfers may rely on separate consent or another basis permitted by the Personal Information Protection Act. Necessary entrusted processing or storage for a contract may rely on the statutory route requiring publication in this Policy or individual notice of the prescribed transfer details, where its conditions are met. That route is not a general exception for unrelated third-party provision or advertising. The applicable transfer notice identifies the route relied on where disclosure is required. We will not make a transfer until its legal conditions, including any required recipient disclosure or consent, are satisfied.

Where Korean e-commerce retention rules apply, contract or withdrawal records and payment or supply records are retained for five years; consumer complaints and dispute records for three years; and display or advertising records for six months. Other statutory retention applies only where relevant, with the applicable period and legal basis disclosed where required. We separate legally retained records from data otherwise due for deletion. Rights include access, correction, deletion, suspension, withdrawal, and applicable automated-decision rights, subject to legal exceptions. Privacy inquiries and rights requests are handled through our privacy contact at support@stgn.io. Additional privacy officer or department details required by law are made available through the relevant Service privacy contact notice. You may complain to the Personal Information Protection Commission or seek available dispute resolution without first complaining to us.

European Economic Area and United Kingdom

Section 3 specifies legal bases and the interests pursued. Sensitive data additionally requires an Article 9 condition where applicable, and criminal-offence data requires legal authorization. You may object to legitimate-interest processing and at any time to direct marketing. Rights in Section 11 apply subject to the GDPR or UK GDPR conditions. We normally respond within one month and may extend by up to two further months where lawful, notifying you of the extension and reasons within the original period. Where required, the identities and contact details of our EEA representative, UK representative, or data protection officer are published on a clearly identified privacy contact page or notice accessible from the relevant Service. You may complain to your competent supervisory authority, including where you live, work, or allege an infringement, or to the UK Information Commissioner. No prior complaint to STGN is required.

United States

Where applicable state privacy laws cover STGN and the processing, Sections 2, 3, 5, 6, and 8 provide notice of categories, sources, purposes, recipients, and retention. The matrix below identifies business recipient categories and the limited categories potentially sold or shared for targeted advertising when that feature is enabled. Where applicable law requires historical disclosure, information about actual collection, business disclosures, sale, and sharing during the preceding 12 months is provided in the applicable US privacy disclosure accessible from the Service. Features described here do not imply that the related processing occurred during that period.

Applicable rights may include confirmation, access to specific data or recipient information, correction, deletion, portability, opt-outs, limits on sensitive uses, and appeals. California access, correction, and deletion requests generally receive a response within 45 days, subject to a lawful notified extension of up to another 45 days; other requests follow their applicable deadlines. To appeal a refusal where available, email support@stgn.io with “Privacy Appeal” and the decision reference. We respond within the applicable state period and explain available regulator complaint routes. You may also request applicable California direct-marketing disclosure information. We do not offer financial incentives in exchange for personal information under this Policy; any future qualifying program requires its own notice. Sensitive or consumer health features require additional notice and authorization where applicable before launch.

Japan

STGN is the personal information handling business operator under the APPI; the business address is in Section 1. Any additional operator identification required by the APPI, including the representative’s name, is made available through a clearly identified privacy contact page or notice accessible from the relevant Service. We use information within the purposes in Section 3 and give required notice of any reasonably related purpose change. Special-care-required information requires prior consent unless an APPI exception applies. Provision to third parties requires consent or a statutory exception; entrusted processing is supervised and is not treated as blanket permission for independent use. No general joint-use arrangement applies. Any future joint use requires advance disclosure of the data, participants, purposes, and responsible operator details.

For a consent-based foreign third-party transfer, we provide the required information about the destination’s protection system and the recipient’s protective measures before consent. If relying on an APPI-equivalent recipient system, we ensure continued implementation and provide legally required information on request. Personally referable information, such as identifiers to be linked to identified data by a recipient, receives the applicable confirmation, consent, and record controls. You may request notice of purposes, disclosure of retained data and third-party provision records, correction, addition, deletion, suspension, erasure, or cessation of third-party provision where entitled. We verify authority, explain legally permitted refusals, and disclose any permissible reasonable fee in advance. Further security-control information may be requested where disclosure would not compromise security or others’ rights.

14. Contact

STGN Inc.

144-ho, 4F, 171, Garak-ro, Songpa-gu, Seoul, Republic of Korea

Privacy inquiries, rights requests, complaints, and appeals: support@stgn.io

This Privacy Policy is effective as of October 23, 2026.