Japan Privacy Supplement

1. Personal Information Handling Business Operator

2. Categories of personal information

We handle the categories described in the Global Privacy Policy, including account and profile information, device and log information, game and viewing activity, UGC, AI prompts and conversations, advertising information, purchases, creator identity and payout data, and support or enforcement records. The categories actually processed depend on the Service and features used.

3. Purposes of use

We use personal information only within the purposes stated below or another purpose separately notified to you.

• Create, authenticate, maintain and recover accounts and provide requested Services.
• Provide games, video and playable content, recommendations, AI chat, community and support features.
• Process purchases, subscriptions, refunds, rewards, creator revenue, payments, tax and accounting records.
• Provide and measure contextual or personalized advertising, administer creator advertising settings and prevent invalid traffic.
• Review content, process reports and rights claims, protect users, prevent fraud and enforce terms and policies.
• Analyze performance, troubleshoot errors, improve features and maintain security.
• Communicate service notices and, with any required consent, promotional information.
• Comply with law, respond to authorities and establish, exercise or defend legal claims.

If we change a purpose of use, we will do so only within a scope reasonably related to the original purpose and provide notice as required by the Act on the Protection of Personal Information (the “APPI”).

4. Sensitive and personally referable information

We obtain any consent required by the APPI before acquiring special-care-required personal information, subject to statutory exceptions.

Advertising identifiers, cookie identifiers and similar information may constitute personally referable information. When such information is provided to a third party that is expected to link it to identifiable personal data, we follow applicable confirmation, consent and record-keeping requirements.

5. Provision to third parties

We do not provide personal data to a third party without prior consent except where permitted by the APPI, such as where required by law or necessary to protect life, body or property and consent is difficult to obtain.

Entrusting processing to a service provider, succession in a business transfer and qualifying joint use are handled according to the APPI. We exercise necessary and appropriate supervision over service providers entrusted with personal data.

6. Provision to foreign third parties and cross-border processing

Supercent is located in the Republic of Korea, and providers supporting cloud hosting, AI, advertising, analytics, payment, creator payout, identity verification or customer support may be located outside Japan.

When consent is required to provide personal data to a foreign third party, we provide information required by the APPI about the foreign country’s personal information protection system and the recipient’s protective measures. Where we rely on a recipient that has established a system conforming to APPI-equivalent measures, we take steps to ensure continued implementation and provide information upon request as required by law.

The Service Providers, Third-Party Disclosures and International Transfers (the “Schedule”) identifies the relevant categories of recipients, countries, purposes and safeguards. Some providers act only as entrusted processors, while app stores, payment providers, social login providers and advertising partners may independently determine certain processing under their own privacy notices.

7. Advertising and analytics

We use identifiers and SDKs for authentication, analytics, advertising and fraud prevention. Recipients and their purposes are identified in the Schedule. Applicable privacy choices may be exercised through Service controls or help@supercent.io.

8. Security control measures

We take necessary and appropriate measures to prevent leakage, loss or damage and otherwise manage personal data securely. Measures include the following.

• A basic policy and internal rules for handling personal data, including responsibilities and incident reporting.
• Organizational controls, access authorization, employee training and confidentiality obligations.
• Technical controls such as authentication, access restrictions, logging, encryption where appropriate, vulnerability management and malware protection.
• Physical controls for offices, devices, media and paper records.
• Vendor due diligence, contractual safeguards and supervision of entrusted service providers.
• Assessment of foreign legal and operational environments where personal data is handled outside Japan.

Further information about the applicable security control measures is available at help@supercent.io, except information whose disclosure would compromise security or other protected interests.

9. Retained personal data and records of third-party provision

Subject to the APPI, you may request notification of the purpose of use, disclosure of retained personal data, disclosure of records concerning provision to third parties, correction, addition, deletion, suspension of use, erasure, or cessation of third-party provision. We will respond after verifying identity and may refuse a request where permitted by law, in which case we will provide the reason where required.

10. How to submit a request

• Submit requests for registered or guest accounts through available Service controls or help@supercent.io, identifying the Service and requested action.
• We verify identity, respond without delay as required by law, and explain a refusal where required. Retention and deletion criteria are described in the Global Privacy Policy.
• If a representative submits a request, we may require proportionate evidence of authority and identity.

11. Complaints and inquiries

For complaints, consultations or requests relating to personal information, contact us at help@supercent.io or use the privacy request mechanism in the relevant Service.