ReSpec Privacy Policy

Potential Labs Inc. (the "Company") treats your personal data as its highest priority, in keeping with the trust you place in us when you upload your resume and other data. This Privacy Policy strictly complies with the Korean Personal Information Protection Act and other applicable laws, and explains transparently what data we collect, why, and how we protect it.

Article 1 (Personal Data Collected at Sign-up and Purposes)

The Company collects and uses the following minimum personal data to provide the Service.

How we collect personal data:

• Entered directly by the user on the Service screens, or uploaded as a file
• Where social login (Google/Kakao) is used, received from that provider for the items the user consented to
• Generated and collected automatically during use of the Service (see automatically collected items below)

Automatically collected items (cookies, etc.):

• Website visit records (access logs), IP address, cookies, visit date and time, and device and browser information may be generated and collected automatically.
• You may refuse cookie storage through your browser settings; doing so may limit your use of the Service.

※ Note on payment information: The Company does not itself store sensitive payment-method data such as card numbers. Payment gateways (PGs) process and retain such data under the Korean Electronic Financial Transactions Act and related laws.

Article 2 (Collection and Use for Marketing Purposes) (Optional)

(※ Declining the optional items does not disadvantage your use of the Service.)

Notice on advertising messages (Article 50 of the Korean Act on Promotion of Information and Communications Network Utilization and Information Protection)

• The Company does not send advertising messages without the recipient's prior consent.
• For electronic transmission media such as email, advertising messages are sent between 9:00 p.m. and 8:00 a.m. the following day only where separate night-time consent has been obtained.
• Advertising emails carry "(광고)" at the beginning of the subject line.
• Every advertising email includes instructions for opting out. Use the unsubscribe link in the message body. You may also withdraw consent through the settings within the Service or at privacy@potential-labs.com. Sending stops without delay.

Article 3 (Retention and Use Period)

Where retention is required under applicable law, the Company retains personal data for the periods set by that law:

• Website visit records (access logs): 3 months (Protection of Communications Secrets Act)
• Records on contracts or withdrawal of subscription: 5 years (Act on Consumer Protection in Electronic Commerce)
• Records on payment and supply of goods: 5 years (Act on Consumer Protection in Electronic Commerce)
• Records on consumer complaints or dispute resolution: 3 years (Act on Consumer Protection in Electronic Commerce)

Article 4 (Provision to Third Parties)

As a rule, the Company does not provide users' personal data to third parties. Data may be provided only in statutorily excepted cases, such as a lawful request for investigative purposes that meets the requirements of applicable law.

Article 5 (Outsourcing of Processing and Cross-Border Transfer)

To provide the Service smoothly, the Company outsources processing of personal data to the external providers below. Some of this work may involve transferring data outside Korea.

① AI analysis (cross-border transfer)

• Processor (transferee): Google LLC
• Scope of outsourced work (purpose of transfer): AI-based analysis of resume text and generation of feedback, and analysis of strength-discovery conversations and generation of strength reports, via API
• Personal data transferred: Text data within resume files, strength-discovery conversation content
• Country and time of transfer: The United States and other countries where Google servers are located / transmitted over the network at the time an AI feedback or strength-analysis request is made
• Retention and use period: The processor (Google) destroys the transmitted data immediately after returning the analysis result. Retention on the Company's servers follows the table in Article 1 above.

② Payment processing (domestic)

• Processors: Korea PortOne Inc. (PortOne — payment integration and checkout window), Korea Payment Networks Co., Ltd. (KPN — credit/debit card payment processing), Kakao Pay Corp. (simple payment), Toss Payments Co., Ltd. (domestic payment processing). For overseas payments, Paddle.com Market Limited.
• Scope of outsourced work: Approval, cancellation and refund of payments for paid services, and retention of payment information
• Personal data outsourced: Payment approval records, order numbers, payment-method information, payment email, phone number (where provided), etc.
• Retention and use period: Until the purpose of the outsourcing is fulfilled, or the period set by applicable law

③ Email delivery (cross-border transfer)

• Processor (transferee): Sendinblue SAS (trading as Brevo) — 17 rue Salneuve, 75017 Paris, France / Data Protection Officer: dpo@brevo.com

• Scope of outsourced work (purpose of transfer): Sending transaction-related service emails (sign-up and login verification codes, resume feedback completion notices, enquiry receipt notices) and advertising emails (service updates, events and benefits), and managing the recipient list according to marketing consent status and service usage stage

• Personal data transferred: Email address, marketing consent status, service usage stage and usage history — whether a resume has been registered, whether a job posting has been registered, whether a feedback report has been generated and viewed, whether a cover letter has been written, whether the free usage limit has been exhausted, whether payment has been made and the current plan, the scheduled expiry date of a paid pass, the sign-up date, and the last access date —, together with the information contained in the body of the emails sent — the resume file name and feedback summary (strengths and improvements), and the content of an enquiry where one is submitted

  ※ 'Service usage stage and usage history' is limited to yes/no indicators and dates. Resume text and the user's name or phone number are not transferred under this item.

• Country and time of transfer: France, Germany, Belgium and other countries where Brevo servers are located / transmitted over the network at the time an email is sent

• Retention and use period: Until the purpose of the outsourcing is fulfilled, or until marketing consent is withdrawn

※ Note on AI training data: The Company uses Google's enterprise API. Resume data uploaded by users and strength-discovery conversation content are never used to train external AI models.

Article 6 (Procedure and Method of Destruction)

Personal data is destroyed without delay once the retention period expires or the purpose of processing is fulfilled.

• Procedure: Personal data whose purpose has been fulfilled is destroyed immediately. Information that must be retained under applicable law is moved to a separate database, stored for the required period, and then destroyed.
• Method: Electronic files are permanently deleted using technical methods that make the records irrecoverable; paper documents are shredded or incinerated.

Article 7 (Installation, Operation and Refusal of Automatically Collected Information)

The Company uses "cookies" that store and periodically retrieve usage information in order to provide an optimized service.

• Purpose of cookies: Analyzing access frequency, visit duration and service usage records to provide personalized services (education and job recommendations, etc.).
• How to refuse cookies: Through your browser settings you may allow all cookies, be prompted each time a cookie is stored, or refuse all cookie storage.

Article 8 (Users' Rights)

You may exercise the following rights regarding your personal data at any time.

• Request access to, correction of, or deletion of your personal data
• Withdraw consent to the processing of personal data or to marketing use (account withdrawal)
• Contact: the settings menu within the Service, or privacy@potential-labs.com

Article 9 (Age Restriction)

Children under the age of 14 may not sign up for or use the Service.

Article 10 (Data Protection Officer and Responsible Department)

The Company designates the following department and officer for the protection of personal data.

• Department: Potential Labs Operations Team
• Data Protection Officer: Choonghwan Kim, CEO, Potential Labs
• Phone: 010-7940-5395
• Email: privacy@potential-labs.com

Article 11 (Measures to Ensure Security)

The Company takes the following measures to ensure the security of personal data.

• Administrative measures: Establishment and implementation of an internal management plan, regular employee training
• Technical measures: Minimizing access privileges to the personal data processing system and applying two-factor authentication, encrypting key data such as passwords, installing security software (antivirus, etc.) on work PCs and reviewing it periodically

Article 12 (Remedies for Infringement of Rights)

To obtain remedies for infringement of personal data rights, you may apply to the following bodies for dispute resolution or consultation.

• Personal Information Infringement Report Center: 118 (no area code) (privacy.kisa.or.kr)
• Personal Information Dispute Mediation Committee: 1833-6972 (no area code) (www.kopico.go.kr)
• Cybercrime Investigation Division, Supreme Prosecutors' Office: 1301 (no area code) (www.spo.go.kr)
• Cybercrime Report System, National Police Agency: 182 (no area code) (ecrm.cyber.go.kr)

Article 13 (Changes to this Privacy Policy)

1. This Privacy Policy applies from October 30, 2026.
2. This Privacy Policy may be amended in line with changes to laws, government guidance, or the Company's internal policies. Where there is an addition, deletion or correction, the Company will notify each user individually, at least 7 days before the change takes effect, via the email registered at sign-up.
3. However, where a change materially affects users' rights — such as changes to the collection and use of personal data, provision to third parties, or the outsourcing of processing and cross-border transfer — notice will be given by email at least 30 days in advance.
4. This English version is provided for convenience. In the event of any discrepancy between this English version and the Korean version, the Korean version prevails.