D3 Co., Ltd. (“Company”) regards users’ personal information as important in providing the Limzy service (“Service”) and complies with the Personal Information Protection Act and other applicable laws. The Company discloses the following matters concerning the processing of personal information, including the purposes of processing, items of personal information processed, retention periods, provision to third parties and entrustment of processing, cross-border transfers, and processing of personal information in connection with generative AI features.
1. Purposes of processing personal information
The Company processes the minimum personal information necessary for the following purposes. Personal information being processed is not used for any purpose other than those stated below, and if a purpose of use changes, the Company will take measures required under applicable law.
① Account registration and account management
• Account registration and user identification • Verification of identity or affiliation • Member account management • Conclusion and performance of the service use agreement • Prevention of fraudulent registration and unauthorized use • Account withdrawal processing
② Ad account connection and ad operations
• Connecting external ad accounts such as Google Ads, Meta Ads, LinkedIn Ads, Naver Search Ads, and TikTok Ads • Identification of ad accounts and advertisers • Creation, modification, viewing, duplication, termination, and status management of campaigns • Registration of advertising materials and ad delivery • Management of ad budgets, bidding, and targeting settings • Collection and analysis of ad performance data • Automated ad operations and optimization
③ Generative AI and AI-based features
• Generation of ad images, copy, and other advertising content • Modification, recommendation, and analysis of advertising content • Recommendation of ad budgets and operating strategies • Ad performance prediction and optimization • Detection of content and advertising policy risks • Error analysis and quality improvement of AI features
④ Service operations and quality improvement
• Analysis of Service usage • Identification of Service outages and errors • Ensuring system stability and security • Development of new features and improvement of existing features • Improvement of user experience and Service quality
⑤ Customer support and dispute handling
• Receipt and handling of user inquiries • Confirmation of user requests • Handling of Service outages and complaints • Handling of infringement reports • Response to disputes and grievances
⑥ Payment and contract management
If paid services are provided, personal information may be processed for the following purposes. • Payment of service fees • Management of payment and transaction records • Issuance of tax invoices and supporting documents • Handling of refunds and payment-related inquiries • Contract and settlement management
⑦ Security and prevention of unauthorized use
• Detection of abnormal access or Service use • Prevention of account theft and unauthorized use • Prevention of and response to security incidents • Management of access records and material activity logs
2. Items of personal information processed and collection methods
The Company may process the following personal information in order to provide the Service.
① Account registration and account management
Items processed • Email address • Name • Contact details (where collected) • Company name and affiliation information • Account identifiers • Registration date and account status Collection methods • Account registration • Direct input by the user • Invitation of members at the company or organization level
② External accounts and ad account connection
If a user connects an external advertising or authentication service, the following information may be processed. Items processed • User or account identifiers of the external service • Ad account ID • Advertiser account ID • Business or Organization account identifiers • OAuth authentication information • Access Token • Refresh Token • OAuth permission scopes • Ad account name and account status • Campaign and ad operations information • Ad performance information The Company processes such information only within the scope of APIs provided by the external service and the permissions approved by the user.
③ Use of AI features
Information that may be processed • Prompts entered by the user • Advertising copy • Product names and product information • Images or photos uploaded by the user • Brand names and logos • Advertising content • AI-generated images and other AI-generated outputs • History of content generation, modification, and approval • Records of AI feature use If a user directly enters a person’s photograph, name, or other information that can identify an individual into an AI feature, such information may constitute personal information. Before entering their own or a third party’s personal information into an AI feature, users shall confirm that they have lawful authority to process that information. The Company recommends that users not enter personal information or sensitive information that is not necessary for generating AI content—such as resident registration numbers, passport numbers, financial account information, authentication information, or health information—into prompts or images.
④ Information automatically generated during use of the Service
The following information may be automatically generated and collected in the course of using the Service. • IP address • Date and time of access • Service usage records • Login records • Access logs • Browser type and version • Operating system information • Device and network-related information • Error and outage records • Security-related records
⑤ Payment-related information
If a user uses a paid service, the following information may be processed. • Type of payment method • Payment amount • Date and time of payment • Payment status • Payment identifiers such as transaction numbers • Business information necessary for tax invoices and settlement If payment is made through an external payment service provider, the Company in principle does not directly store full credit card numbers, payment passwords, or other information that is not necessary to provide the Service.
3. Processing and retention period of personal information
The Company retains personal information for the period necessary to achieve the purposes of processing and, when those purposes have been achieved, destroys it without delay except where applicable law requires separate retention.
① Member and account information
Retained until account withdrawal or termination of the use agreement. However, information necessary to prevent unauthorized use, handle disputes, or fulfill obligations under applicable law may be retained separately for the period required for those purposes.
② Ad account connection information
In principle, retained until the ad account is disconnected, the member withdraws, or use of the related service ends. Authentication information such as OAuth tokens is retained only for the period necessary for service connection and, when the connection is released or the purpose of use ends, is deleted or invalidated by a secure method.
③ AI generation and content-related information
Prompts, uploaded content, AI-generated outputs, and generation, modification, and approval history may be processed while the relevant content is stored in the Service or while the use agreement remains in effect. If the user deletes the content or the purpose of use ends, the Company deletes it except where retention is necessary under applicable law or for legitimate dispute handling.
④ Customer inquiry and dispute-related information
After an inquiry has been handled, such information may be retained for the period necessary for dispute handling and Service quality management.
⑤ Retention required by law
If applicable law requires information or transaction records to be retained for a specified period, the Company retains the relevant information separately for that period. The Company takes measures such as segregation or access restriction so that information subject to mandatory retention is not used for other purposes.
4. Provision of personal information to third parties
In principle, the Company processes users’ personal information within the scope of the purposes stated in this Privacy Policy and does not arbitrarily provide users’ personal information to third parties. However, the Company may provide personal information to third parties to the extent permitted by applicable law in any of the following cases: 1. Where the user has given prior consent to provision to a third party 2. Where permitted by applicable law for the conclusion and performance of the service use agreement 3. Where a special provision of law exists or it is necessary to comply with a legal obligation 4. Where permitted by applicable law, including where necessary for the life, body, or property interests of the data subject or a third party If the Company provides personal information to a third party with the user’s separate consent, it will inform the user of the following: • The recipient of the personal information • The recipient’s purpose of use • The items of personal information provided • The recipient’s retention and use period • The right to refuse consent and, if any, disadvantages resulting from refusal If there are third parties to whom the Company regularly provides personal information, the Company will disclose that status through the Service or this Privacy Policy.
5. Entrustment of personal information processing
The Company may entrust part of its personal information processing to external specialists in order to provide the Service smoothly. When entrusting processing of personal information, the Company reflects in the relevant contracts the matters required for the protection of personal information under applicable law and supervises whether the processor handles personal information securely. Processors used by the Company may include the following types: • Cloud infrastructure and data storage services • Email and notification services • Payment and settlement services • Customer support services • Generative AI and AI API services • System monitoring and error analysis services
Actual processors and entrusted tasks
The names of processors actually used in the Service and the tasks entrusted to them are disclosed through this Privacy Policy or a separate page on the status of entrusted processing. If a processor or an entrusted task changes, the Company will disclose the change through this Privacy Policy or the relevant disclosure page.
6. Cross-border transfer of personal information
In the course of using global services such as cloud infrastructure, advertising platforms, generative AI, email, and system monitoring, the Company may process or store personal information necessary to provide the Service in countries other than the Republic of Korea, or transfer it to businesses in those countries. When transferring personal information abroad, the Company does so on a lawful basis recognized under the Personal Information Protection Act and other applicable laws and takes safety measures necessary to protect personal information. If a cross-border transfer occurs, the Company will disclose the following through this Privacy Policy or a separate cross-border transfer status page, or notify users by a method required under applicable law: • Items of personal information transferred • Countries to which personal information is transferred • Timing and method of transfer • Name and contact details of the recipient • The recipient’s purpose of use • Retention and use period of the personal information • Legal basis for the cross-border transfer • Where refusal is available, the method of refusal and the effect of refusal The Company manages matters necessary to ensure the security of personal information and to protect the rights of data subjects with the overseas recipient by contract or an equivalent method. If a cross-border transfer of personal information occurs through overseas cloud, AI services, advertising platforms, or similar services used by Limzy, the Company will accurately state the actual business names, destination countries, items of personal information, retention periods, and related details in a separate status disclosure.
7. Processing of personal information in connection with generative AI features
① Provision of AI features
The Company may provide generative AI features for the generation, editing, recommendation, and analysis of ad images, copy, and other advertising content. AI features may be provided using technologies developed by the Company or models, APIs, and related technologies of external AI service providers.
② Information that may be transmitted to AI services
In the course of using AI features, the following information may be transmitted to AI processing systems: • Prompts entered by the user • Advertising copy • Product- and brand-related information • Uploaded images • Logos • Advertising materials provided by the user • Other input information necessary for AI generation If such information includes content that can identify an individual, personal information may be processed.
③ Restriction on entering unnecessary personal information
When using AI features, users must not enter personal information, sensitive information, unique identifiers, financial information, account passwords, authentication information, or other information that is not necessary to generate advertisements. Where necessary, the Company may apply technical and administrative measures to detect or restrict the input of personal information or high-risk information.
④ Use of external AI services
If the Company uses an external AI service provider, it will endeavor to transmit user input information to that provider only to the extent necessary to provide the Service, and will manage the information so that it is processed securely in accordance with applicable law and the contract with that provider. If entrustment of processing or a cross-border transfer of personal information occurs in the course of providing an external AI service, the Company will disclose those matters in this Privacy Policy.
⑤ Use for AI model training
The Company does not use a user’s personal information or content entered into AI features to train the Company’s general-purpose AI models without the user’s separate consent or a lawful basis under applicable law. If the Company intends to use user data or AI-generated content for a purpose distinct from the original purpose of providing the Service, such as training or fine-tuning a new AI model, it will follow notice, consent, and other procedures required under applicable law. When selecting or operating external AI service providers, the Company also reviews contractual terms, API settings, and data processing policies so that user data transmitted to provide the Service is not arbitrarily used to train the provider’s general-purpose AI models.
⑥ AI generation and approval records
The Company may retain records of the generation, modification, review, and approval of AI content to the extent necessary for Service stability, handling user requests, security, verification of ad delivery history, response to infringement claims, and dispute handling.
8. Installation, operation, and refusal of automatic collection devices
The Company may use cookies or similar technologies for analysis of the Service environment, maintaining login status, security, and user convenience. A cookie is a small amount of information stored in the user’s browser, and users may allow or refuse the storage of cookies through their web browser settings. If cookie storage is refused, some features of the Service, such as remaining logged in, may be limited. If the Company uses an external analytics tool for analysis of Service usage or provision of personalized services, it will separately provide, to the extent required by applicable law, information on the data collected through that tool, the purposes of use, and how to refuse.
9. Rights and obligations of data subjects and how to exercise them
Users may exercise the following rights with respect to their personal information as provided under applicable law: 1. Request to confirm whether personal information is processed and to access it 2. Request to correct or delete personal information 3. Request to suspend processing of personal information 4. Withdrawal of consent to collection, use, or provision of personal information 5. Request for account withdrawal and account deletion 6. Other rights relating to personal information recognized under applicable law Users may exercise their rights through account settings in the Service or through the Company’s privacy contact point. Users may exercise their rights through a legal representative or a duly authorized agent, and the Company may, where necessary, request materials to verify the identity of the user or the authority of the agent. Upon receiving a request, the Company will handle it in accordance with the period and procedures prescribed by applicable law. However, exercise of some rights may be restricted where there are grounds under applicable law, including where another law requires collection or retention of the relevant personal information.
10. Destruction of personal information
If the retention period of personal information has elapsed, the purpose of processing has been achieved, or the personal information otherwise becomes unnecessary, the Company destroys the relevant personal information without delay, except where applicable law requires separate retention.
① Electronic files
Deleted by a secure method so that they cannot be recovered or restored.
② Paper documents
Destroyed by shredding or incineration.
③ Where separate retention is required
Personal information that must be retained for a specified period under other laws is stored separately from other personal information or is subject to necessary measures such as restriction of access.
11. Measures to ensure the security of personal information
The Company implements administrative, technical, and physical safeguards required under applicable law to prevent loss, theft, leakage, forgery, alteration, or damage of personal information.
① Administrative measures
• Operation of an internal management system for personal information protection • Minimization of access rights to personal information • Management and supervision of persons who handle personal information • Education relating to personal information protection and security • Management and supervision of personal information processors
② Technical measures
• Management of access rights to personal information • Secure handling of authentication information such as passwords • Encryption of important personal information and authentication information • Encryption of data in transit • Storage and review of personal information access records • Detection of abnormal access and intrusion • Management of system vulnerabilities and security updates • Access restriction and protection for important authentication information such as OAuth tokens
③ Physical measures
If there is a place where personal information is physically stored, the Company applies necessary safeguards such as access control to that place.
12. Requests for disclosure of personal information by government authorities
If the Company receives a request for personal information from a government authority, law enforcement agency, court, or other authorized body based on applicable law, it confirms the legal basis and lawfulness of the request and provides only the minimum personal information necessary to the extent permitted by applicable law. Where permitted by applicable law, the Company may request additional confirmation or review of requests that are excessive or whose legal basis is unclear.
13. Children’s personal information
The Service is in principle provided to businesses or users who perform advertising work and is not intended for children under 14 years of age. The Company does not knowingly collect personal information of children under 14 years of age. If the Company comes to process personal information of a child under 14 years of age, it will comply with the consent of a legal representative and other protective procedures required under applicable law.
14. Automated processing
To improve the efficiency of advertising operations, the Company may provide AI-based recommendations, budget recommendations, ad performance analysis, automatic pausing and resuming of ads, and other automation features. These features in principle relate to ad campaigns and advertising operations. If the Company comes to provide a feature that constitutes an automated decision giving rise to a separate duty to guarantee rights under applicable law, it will inform users of the criteria and procedures of that decision and of the rights they may exercise, in accordance with applicable law.
15. Privacy officer and inquiries
The Company operates a contact point to protect users’ personal information and to handle inquiries, complaints, and requests for relief relating to personal information.
Privacy contact
• Company: D3 Co., Ltd. • Service: Limzy • Email: tech@d3company.co.kr Users may contact the above for privacy-related inquiries arising from use of the Service, requests for access, correction, deletion, or suspension of processing, and other matters relating to personal information. The Company will respond to and handle users’ privacy-related inquiries and requests in good faith. If consultation or dispute resolution regarding a personal information infringement is needed, users may seek assistance from relevant authorities such as the Personal Information Protection Commission, the Personal Information Infringement Report Center, and the Personal Information Dispute Mediation Committee.
16. Changes to this Privacy Policy
The Company may change this Privacy Policy due to changes in applicable law, the Service, or the manner of processing personal information. If this Privacy Policy is changed, the Company will disclose the changed contents and the effective date through the Service or a website operated by the Company. If a change has a material effect on users’ rights, the Company may separately notify users in the manner and for the period prescribed by applicable law. The Company may maintain a change history so that users can review previous versions of this Privacy Policy.
Supplementary Provisions
This Privacy Policy takes effect on April 21, 2026.