QueryPie Privacy Policy (Jan 15, 2026)

CHEQUER Global, Inc. and our owned subsidiary, QueryPie, Inc.(hereinafter referred to as "Company"), are committed to protecting the rights and interests of our users by complying with the personal information protection regulations and by setting personal information processing policies in accordance with relevant laws and regulations. Company will protect the valuable personal information of the user, so that the user can safely use the service. Company will inform users of the purpose and manner of using the personal information provided by the users and the actions taken to protect that personal information. This policy applies to internet-related services (including mobile web / apps) provided by the Company's sites.

Effective from Jan 15, 2026

Article 1. Purpose of collection and use of personal information

The personal information from registered users will be used for the following purposes only, and if the purpose of use changes, necessary measures will be taken, such as obtaining a separate consent in accordance with Article 18 of the Personal Information Protection Act:

Article 2. Retention and usage period of personal information

When Company collects personal information with aforementioned purposes, the company retains and uses the personal information for three years.

In addition, personal information is retained and used within its retention and usage period in accordance with the law or within the period agreed upon when collecting personal information from the information subject.

Collected personal information is processed in accordance with the purpose of use notified at the time of collection and is not used for any other purposes.

Article 3. Provision & Entrustment of Personal Information

1. Company entrusts the following external services to provide convenient and better services and process personal information:

• Entrustment of personal information - Cloud Service (SaaS)

• Entrustment of personal information - Partners

2. When concluding a contract to process personal information other than the use of cloud services, the Company will specify in contracts to prohibit processing of personal information for purposes other than the purpose of performing the entrusted operations in accordance with Article 26 of the Personal Information Protection Act, to implement technical and managerial protection measures, to limit re-entrustment, to manage and supervise the trustee, and to mention about liability issues such as compensation for damages. The Company will also supervise whether the trustee handles personal information safely.
3. In accordance with Article 26, Paragraph 6 of the Personal Information Protection Act, if the trustee re-entrusts the company with the processing of personal information, the trustee must obtain the company's consent.
4. If the details of the entrusted operations or the trustee changes, the Company will disclose it through updating this privacy policy without a delay.

Article 4. Rights and obligations of information subjects and legal representatives and methods of exercising them

1. The information subject can exercise his/her rights, such as requesting the company to view, correct, delete, or suspend processing of one’s personal information at any time.
2. The exercise of rights pursuant to Paragraph 1 may be made to the Company via phone, e-mail, etc. in accordance with Article 41, Paragraph 1 of the Enforcement Decree of the Personal Information Protection Act, and the Company will take action without delay.

[Processing Department]

3. The exercise of rights under Paragraph 1 may be done through a 3rd-party agent, such as the information subject's legal representative or a person authorized to do so. In this case, you must submit a power of attorney in the form of Annex No. 11 of the “Enforcement Rules to Personal Information Protection Act (No. 2020-7)”.
4. Requests to view and suspend personal information processing may limit the information subject's rights pursuant to Article 35, Paragraph 4 and Article 37, Paragraph 2 of the Personal Information Protection Act.
5. Requests for correction or deletion of personal information cannot be requested if the personal information is specified as the subject of collection in other laws and regulations.
6. The Company verifies whether the person making the request with the information subject's rights, such as a request for viewing, a request for correction or deletion, or a request for suspension of processing, is the right person or a legitimate agent.

Article 5. Personal information collected and collection methods

1. The company processes the following personal information items to provide services such as content usage, promotion applications, Become a partner applications requests offered on the website.

• Method of collection
• When personal information is directly entered and consent for collection is provided through the content gating form, promotion application form, partner application form, or the Schedule a Demo page on the website.
• Personal information collected

2. The company processes the following personal information items to review suitable talent recruitment.

• Method of collection
• When applying for a job at the Company through a recruitment management site (Wanted)
• Personal information collected

3. The company processes the following personal information items for Marketing & Event.

• Method of collection
• When consent for marketing use is given through the gating form on the website
• When participating in surveys via the Salesforce Form for emergency events, prize draws, or similar purposes
• Upon user consent to notifications about new and beta service launches
• Personal information collected

4. The Company processes the following personal information items for the QueryPie AIP Service.

• Methods of Personal Information Collection for QueryPie AIP Service
• When a user signs up for the service through the QueryPie AIP membership registration page.
• Collection of user behavior information during QueryPie AIP usage.
• Details of Personal Information Collection and Use

Article 6. Procedures and methods of destroying personal information

1. Based on Article 2 of the Personal Information Processing Policy, the Company destroys the personal information it holds without delay when it becomes unnecessary due to the elapse of the period or achievement of the purpose of processing. However, if personal information must be preserved for a certain period of time in accordance with other laws, it will be destroyed after the retention period has elapsed.

[Related Laws]

2. The procedures and methods for destroying personal information are as follows:
3. Destruction Procedure:

• The Company selects personal information that may require destruction and destroys personal information in a safe manner in accordance with internal procedures approved by the Chief Privacy Officer.

2. Destruction Method:

• Digital personal information is deleted using secure and irreversible technical measures. Personal information printed on paper will be shredded by paper shredder or be incinerated.

Article 7. Company's information protection efforts

The Company is taking the following measures to ensure the safety of personal information.

1. Conduct regular self-audits

• The Company conducts regular self-audits to ensure stability in handling personal information.

2. Minimization and training of employees handling personal information

• The Company is implementing measures to manage personal information by designating and limiting employees in charge of handling personal information.

3. Establishment and implementation of internal management plan

• To ensure safe processing of personal information, the Company has established and implemented an internal management plan.

4. Technical measures against attacks and hacking

• In order to prevent leakage and damage of personal information due to hacking or computer viruses, the Company installs security programs, periodically updates and inspects them, and installs systems in areas where access from the outside must be controlled, and monitors and blocks them technically and physically.

5. Encryption of personal information

• User's personal information is encrypted and stored and managed, so only the user can know it. Separate security features such as encrypting or locking files and transmission data are used for important data.

6. Management of access record storage and prevention of forgery and falsification

• The Company stores and manages access records to the personal information processing system for at least two years, and it uses security features to prevent access records from being forged, altered, stolen, or lost.

7. Restrictions on access to personal information

• Necessary measures are taken to control access to personal information by granting, changing, and revoking access rights to the database system that processes personal information, and unauthorized access from outside is being controlled using an intrusion prevention system.

8. Use of lock for document security

• Documents and auxiliary storage media containing personal information are stored in a safe place with a lock.

9. Access control for unauthorized persons

• The Company has a separate physical storage location where personal information is stored and has established and operated access control procedures for it.

Article 8. Installation, operation and rejection of cookies

Definition and Purpose of Cookies

Our company uses cookies to provide personalized services to users and to ensure the smooth operation of our website. Cookies are small pieces of data that may be stored on a user's browser or device, enabling multilingual support, tracking visit history, and more. Additionally, cookies are utilized for purposes such as website performance analysis, providing personalized content and advertisements, and maintaining security. We comply with applicable laws (e.g., GDPR, ePrivacy Directive), and users can manage or reject cookie settings directly.

Types and Purposes of Cookies Collected

We use the following types of cookies, each serving specific purposes:

• Strictly Necessary Cookies
• Purpose: Essential for ensuring the basic functionality of the website.
• Features: Operate without user consent and are indispensable for website use.
• Functional Cookies
• Purpose: Enhance user experience and provide personalized features, such as multilingual settings.
• Features: Non-essential cookies that require user consent.
• Analytics/Performance Cookies
• Purpose: To analyze website visitor traffic and optimize performance, including user behavior analysis on QueryPie AIP and QueryPie Community Edition.
• Google Analytics (QueryPie AIP, QueryPie Community & Enterprise Edition), DataDog (QueryPie AIP)
• Features: Non-essential cookies that require user consent.
• Marketing Cookies
• Purpose: To plan and execute effective advertising, we identify whether users accessed our site through specific advertisements and measure the performance of those campaigns. For example, Google Ads
• Features: Non-essential cookies that require user consent. The company does not use the collected marketing cookie information to identify specific individuals.

Cookie Consent Procedure

To use non-essential cookies, such as functional cookies and analytics/performance cookies, the company obtains prior consent from users. Consent is gathered through a cookie banner displayed during the user’s first visit to the website, offering the following options:

• [Allow All Cookies]
• [Allow Strictly Necessary Cookies Only]
• [Manage Cookie Settings] – Individual cookie settings [Consent]

How to Change or Reject Cookie Settings

Users can change or reject cookie settings at any time. The following explains how to refuse cookie storage through browser settings:

• Allow/Block Cookies in Web Browsers
• Chrome: Select the "⁝" menu at the top right > New Incognito window (shortcut: Ctrl+Shift+N)
• Edge: Select the "…" menu at the top right > New InPrivate window (shortcut: Ctrl+Shift+N)
• Allow/Block Cookies in Mobile Browsers.
• Chrome: Tap the "⁝" menu at the top right > New incognito tab
• Safari: Device Settings > Safari > Advanced > Block All Cookies
• Samsung Internet: Tap the Tabs icon at the bottom > Turn on Secret mode > Start

Cookie Retention Period

The storage duration of each cookie depends on its purpose:

• Strictly Necessary Cookies: Deleted upon session termination.
• Non-Essential Cookies: Stored for the period specified at the time of user consent (e.g., two years).

Article 9. Chief Privacy Officer

The Company is responsible for the overall management of personal information processing and has designated a personal information protection manager as follows to handle complaints from information subjects related to personal information processing and to provide damage remedies.

• E-Mail Address: legal@querypie.com

Personal Information Manager

• Name: Jake Im
• Position: Chief Privacy Officer (CPO)

Article 10. Request to view personal information

The information subject may request access to one’s personal information pursuant to Article 35 of the Personal Information Protection Act to the department below. In addition, the company will strive to promptly process the information subject's request to view one’s personal information.

[Processing Department]

Article 11. Method of redress for infringement of rights

In order to receive relief from personal information infringement, the information subject may apply for dispute resolution or consultation to the Personal Information Dispute Mediation Committee, Personal Information Infringement Report Center, or relevant. For other personal information infringement reports and consultations, please contact the organizations below.

[Organizations in Korea]

1. Personal Information Dispute Mediation Committee: (without area code) 1833-6972 (www.kopico.go.kr)
2. Personal Information Infringement Reporting Center: (without area code) 118 (privacy.kisa.or.kr)
3. Supreme Prosecutors' Office: (without area code) 1301 (www.spo.go.kr)
4. National Police Agency: (without area code) 182 (ecrm.cyber.go.kr)

A person whose rights or interests have been infringed upon due to a disposition or omission by the head of a public institution in response to requests under Article 35 (view of personal information), Article 36 (correction/deletion of personal information), and Article 37 (suspension of processing of personal information, etc.) of the Personal Information Protection Act may request an administrative trial in accordance with the Administrative Appeals Act.

※ For more information about administrative trials, please refer to the Central Administrative Appeals Commission’s website (www.simpan.go.kr)

Article 12. Crossborder transfer/storage of personal information

The personal information of the information subject is managed using a cloud service with a server based in the United States. However, no other tasks other than the storage of information for customer management are entrusted, and the company is responsible for preventing information leaks and managing access rights.

※ Legal Basis for Overseas Transfer: Article 28-8 (1) 3 (a) of the Personal Information Protection Act (Entrustment or storage of overseas processing for contract fulfillment)

1. Personal information items transferred/stored overseas: Customer information collected for purposes such as accessing content on the company website; using product promotion services; submitting inquiries via Contact Us; participating in marketing campaigns or events; and using the AIP service.

2. Country where personal information is transferred/stored: United States & Japan
3. Date and method of transfer/storage:

• Stored in SaaS when using content services, applying for promotions, Contact Us on the website.
• SaaS Cloud Storage upon QueryPie AIP Service Membership Registration
• Stored in the SaaS cloud upon agreeing to PR & Marketing.
• Stored in the SaaS cloud when submitting requests via the Customer Portal application link.
• Stored in the SaaS cloud upon payment for AIP subscriptions and recharges.
• Stored in AWS (Tokyo Region) when using the QueryPie AIP service.

4. Name of corporation to which personal information is transferred and stored

• Homepage Contents : Salesforce(https://www.salesforce.com/)
• QueryPie AIP Membership Registration : Auth0(https://auth0.com/)
• QueryPie AIP User Behavior Information : DataDog(https://www.datadoghq.com/)
• QueryPie AIP Report to Bug : Atlassian Jira(https://www.atlassian.com/)
• Customer Service Processing and Operation: Atlassian Jira (https://www.atlassian.com/)
• Marketing/Event : Salesforce(https://www.salesforce.com/)
• QueryPie AIP Payment : Stripe(https://stripe.com/)
• QueryPie AIP Service Usage History : AWS(https://amazon.com)

5. Purpose of personal information transfer

• Use of content, Promotion, Become a Partner application : Salesforce (SaaS)
• Marketing/Event : Salesforce(SaaS)
• Customer Service Processing and Operation : Atlassian Jira (SaaS)
• QueryPie AIP : QueryPie AIP SaaS Service Provision, Behavior Information Analysis and Performance Improvement, Error Reporting
• QueryPie AIP Payment : Stripe (SaaS)
• Using the QueryPie AIP Service : AWS(Tokyo Region)

6. Personal information retention period: Until personal information is destroyed in accordance with Article 6 of the Privacy Policy.
7. Method, Procedure, and Effects of Refusing the Transfer of Personal Information

• Email to Request Refusal of Overseas Transfer of Personal Information : legal@querypie.com
• When a refusal request is made via the email address provided above, any personal information transferred overseas will be immediately destroyed. However, this may result in restrictions on accessing content, customer support services, and receiving newsletters associated with marketing information.

The Company uses cloud services after carefully reviewing the information protection and personal information protection compliance status of the cloud service provider, and the cloud service provider does not have access to the Company's customer personal information.

Article 13. Privacy rights under California, the EU, and other jurisdictions

We are committed to respecting and protecting your privacy rights in accordance with applicable laws and regulations, including but not limited to the California Consumer Privacy Act (CCPA) and the EU General Data Protection Regulation (GDPR). Below is a summary of your rights and the procedures to exercise them:

California Consumer Privacy Act (CCPA)

If you are a resident of California, you have the following rights under the CCPA:

• Right to Know: You can request information about the categories and specific pieces of personal information we collect, use, disclose, and sell.
• Right to Delete: You can request the deletion of your personal information, subject to certain exceptions.
• Right to Opt-Out of Sale: You can opt out of the sale of your personal information to third parties.
• Right to Non-Discrimination: You have the right not to be discriminated against for exercising your CCPA rights.

To exercise your rights under the CCPA:

• Submit a request via email at legal@querypie.com

We will verify your identity before processing your request and respond within the timeframes outlined in the CCPA.

General Data Protection Regulation (GDPR)

If you are located in the European Union (EU) or European Economic Area (EEA), you have the following rights under the GDPR:

• Right of Access: You can request a copy of your personal data and details about how it is processed.
• Right to Rectification: You can request the correction of inaccurate or incomplete personal data.
• Right to Erasure ("Right to be Forgotten"): You have the right to request the erasure of your personal data in certain circumstances.
• Right to Restrict Processing: You can request a limitation on the processing of your personal data under certain conditions.
• Right to Data Portability: You can request a copy of your personal data in a machine-readable format or its transfer to another provider.
• Right to Object: You can object to the processing of your personal data for direct marketing or other purposes.
• Right to Withdraw Consent: You can withdraw your consent for data processing at any time, where the processing is based on consent.
• Right to Lodge a Complaint: You have the right to lodge a complaint with your local data protection authority if you believe your rights have been violated.

To exercise your rights under the GDPR:

• Submit a request via email at legal@querypie.com

We will process your request in accordance with applicable laws and ensure the security and confidentiality of your personal data throughout the process.

Article 14. Provisions regarding the Collection and Analysis of User Behavior Information

The Company collects and analyzes user behavior information for the purposes of improving the quality of the QueryPie AIP service, enhancing user experience, ensuring service stability, and providing technical support. Through the user's voluntary error reporting function (Report to Bug), the Company may process the following information:

1. Purpose and Items of Collection

We collect and store the following user behavior information to improve the quality of the QueryPie AIP SaaS Service, handle user error reports, enhance user experience, ensure service stability, and perform statistical analysis.

• Items Collected: User identification ID, in-service action event logs (like page navigation and feature usage history), error information, and prompt input history (stored in a de-identified format).
• Collection Method: This information includes logs automatically generated during service use and prompts directly entered by the user.
• Datadog Session Identifier(datadog-session-id)
• Session Replay Link(datadog-session-replay-url)
• Page URL at the time of error occurrence
• User-Provided Error Summary(issue-summary)
• User information, such as name and email
• AI Conversation Content(chat, conversationId, messageId)
• Information on the Currently Used Screen and Tools(tool, integrations)

2. Collection Tools and External Service Providers

Collected information may be processed and stored in an encrypted format using the following external analytics tools:

• Datadog: For user behavior logs and performance monitoring.
• LiteLLM: For recording AI prompt usage logs and analyzing responses.

※ Collection of user behavior data is mandatory. If you decline, your use of the QueryPie AIP service will be restricted.

3. Retention Period and Destruction

Behavioral information is retained for one year from the time of collection. It's immediately destroyed once the retention period expires or the processing purpose has been fulfilled. However, if there's a legal requirement for separate retention, the information will be kept for that period before being destroyed.

Additionally, collected information can be transmitted to our internal issue management system (Jira), used by the Company's technical support team upon the user's request, and is accessible only to authorized internal personnel.

Article 15. Amendment to the Privacy Policy

If there is any addition, deletion or modification of the contents of the privacy policy, the Company shall notify users through a notice on the website or the Privacy Policy page.

• Announcement date: Jan 15, 2026
• Effective date: Jan 15, 2026