1. Personal Data We Process and How We Collect It

The Company provides its service without account registration (no login) and collects only the minimum data necessary to provide the service.

a. Information you provide directly

b. Information generated automatically

• Device information: device model, OS version, app version, microphone hardware identifiers (for acoustic calibration)
• Usage records: access logs, service usage records, crash/error logs
• Non-identifying device identifier: an identifier generated by the App to accumulate reports and distinguish users (not account data)

c. How we collect

Through your input on the App's voice measurement and onboarding screens, and automatic generation/collection during use of the service.

※ Voice is recorded only when you explicitly start a recording by tapping the measurement button. Microphone permission is not used for any purpose other than measurement. You may revoke microphone permission at any time in your device settings; in that case the voice measurement feature will not be available.

2. Special Provisions on Voice Data

Given the sensitivity of voice data, the Company applies the following principles.

1. Purpose limitation: Voice recordings are used solely to measure and analyze vocal/acoustic characteristics, and are not used to identify or authenticate a specific individual (speaker recognition).
2. Processing: Recordings are transmitted to an analysis server and converted into acoustic values; the resulting values are stored to accumulate your reports.
3. Retention and deletion: Original voice recordings are automatically destroyed within 12 months after analysis, and without delay upon your deletion request. Measured values are retained to provide reports until you request deletion.
4. Separate consent for model training: If the Company wishes to use voice data to improve the service (e.g., training AI analysis models), it will obtain your prior opt-in consent separately. Declining does not restrict use of the core service, and you may withdraw your consent at any time.

※ The Company does not process voice data to identify a specific individual (speaker identification) and therefore does not treat it as biometric information under PIPA.

3. Purposes of Processing

• Voice measurement/analysis and generation and accumulation of result reports
• Providing, maintaining, and improving the service, and developing new features
• Improving measurement accuracy, including per-device/microphone calibration
• Responding to errors/abuse and ensuring service stability
• Complying with legal obligations and responding to user inquiries

The Company does not use personal data for purposes other than the above. If the purpose changes, the Company will take the necessary measures under PIPA, such as obtaining separate consent.

4. Retention Period

Where retention is required by law, data is kept for the period required by that law and then destroyed.

5. Provision to Third Parties

The Company does not provide users' personal data to third parties, except where specifically required by law or where an investigative authority makes a request in accordance with the procedures and methods prescribed by law.

6. Outsourcing of Processing

The Company outsources the following processing tasks to provide the service.

In accordance with Article 26 of PIPA, the Company specifies in its contracts the prohibition of processing beyond the outsourced purpose, technical and administrative safeguards, restrictions on sub-outsourcing, management and supervision of the processor, and liability for damages, and supervises the processor to ensure safe handling of personal data. Any change in the outsourced tasks or processor will be disclosed through this Policy without delay.

7. Cross-Border Transfer

The Company does not transfer users' personal data outside the Republic of Korea. The cloud infrastructure used by the Company (Amazon Web Services) is located in the Asia Pacific (Seoul) Region (ap-northeast-2), and users' personal data is stored and processed within the Republic of Korea.

If a cross-border transfer becomes necessary in the future, the Company will follow the procedures required by PIPA, including notifying you in advance of the recipient, destination country and transferred items, and obtaining your consent.

8. Destruction Procedure and Method

• Procedure: Personal data whose retention period has elapsed or whose purpose has been achieved is destroyed without delay.
• Method: Electronic files are permanently deleted in a manner that cannot be recovered; original voice files are completely removed from storage.

9. Rights of Data Subjects and Legal Representatives

1. You may at any time request access to, correction of, deletion of, or suspension of processing of your personal data, and may withdraw your consent.
2. You may exercise these rights via the in-app "Delete data" function or the contact details in Section 13, and the Company will act without delay.
3. Because the service does not require login, requests are processed to the extent your identity can be verified (e.g., the device identifier generated by the App).
4. You may also exercise these rights through a legal representative or a person you have authorized.
5. Deletion cannot be requested where other laws require the data to be retained.

10. Security Measures

• Encryption in transit (HTTPS/TLS)
• Minimized access rights and access control for voice/personal data
• Retention of processing records and management of access logs

11. Automatic Data Collection Tools

The Company may use cookies on the website (muzly.io) to the extent necessary to provide the service. You can refuse cookies through your web browser settings, although some features may then be limited.

The Company does not collect behavioral information for targeted advertising and does not track you across other companies' apps or websites.

12. Children's Data (Under 14)

As a rule, the Company does not collect personal data of children under 14. If it is found that such data has been collected, it will be destroyed without delay.

13. Data Protection Officer and Contact for Access Requests

The Company has designated the following Data Protection Officer, who is responsible for personal data processing, handling complaints and remedies, and receiving and processing access requests.

14. Remedies for Rights Infringement

You may contact the following bodies in the Republic of Korea for dispute resolution or consultation regarding infringement of personal data:

• Personal Information Dispute Mediation Committee (www.kopico.go.kr / 1833-6972)
• Privacy Infringement Report Center (privacy.kisa.or.kr / 118)
• Supreme Prosecutors' Office (www.spo.go.kr / 1301)
• Korean National Police Agency (ecrm.police.go.kr / 182)

15. Changes to This Policy

Any additions, deletions, or amendments to this Policy will be announced through the App or website at least 7 days before they take effect. Material changes affecting your rights will be announced at least 30 days in advance.

• Published: September 18, 2026
• Effective: September 18, 2026

Company Information