Privacy Policy

Effective date: October 23, 2026

SANDS Lab, Inc. (the “Company”) provides this Privacy Policy under Article 30 of the Korean Personal Information Protection Act (PIPA). It explains personal information processing and your rights for our corporate website (https://www.sandslab.io/) and public design guide (https://design.sandslab.io/). Processing under separate product or service contracts is described in the relevant service notices and agreements.

Article 1. Information processed with consent

We use inquiry information to identify the person contacting us, review and respond to product adoption, PoC, technical consultation, business/technical partnerships, corporate/IR inquiries and materials requests, and provide follow-up assistance. We retain inquiry history for follow-up and to verify how an inquiry was handled. Inquiry consent is not consent to promotional messages.

We collect information through the website form and emails you send. For email inquiries, we process the sender address, message and other information actually provided. Where separate consent is necessary, we provide the required notice and obtain that consent.

If you decline required collection/use consent, you cannot submit an online inquiry. Optional consent can be declined without disadvantage to inquiry handling; leave optional fields empty if you decline. Optional fields require separate optional consent. Overseas transfer consent is obtained separately under Article 4.

We do not request national identification numbers or other unique identifiers, health information or other sensitive information in the inquiry form. Do not include another person's personal information, passwords, API keys or confidential material you are not authorized to disclose. The website is not intended to collect information from children under 14. A legal guardian should contact the responsible team first if a child needs assistance.

Article 2. Information processed for operation and security

We process the minimum information needed to provide a secure website, diagnose errors, prevent unauthorized access and spam, and respond to security incidents. The legal basis is PIPA Article 15(1)(6): legitimate interests that clearly take precedence over the data subject's rights. Use is limited to the related security purpose, without advertising or user profiling.

An IP hash can still be associated with an inquiry and is protected as personal information. Records needed for security incident investigations or disputes are separated, access-restricted, retained for the necessary investigation/dispute period, and deleted when that purpose ends. If a specific statutory retention obligation arises, we separately retain the relevant information for the prescribed period and purpose. We do not automatically apply e-commerce transaction retention periods to ordinary inquiries.

Article 3. Third-party disclosure and processors

We do not sell personal information or disclose it to advertising businesses. Any disclosure for an independent third party's purposes requires an applicable legal basis or separate consent, with the recipient, purpose, information and period explained. The following businesses support our operations as processors; this differs from disclosure for their independent purposes.

We manage purpose restrictions, safeguards, subprocessors, return/deletion and responsibilities through service agreements and contractual arrangements, and review processor changes. Providers may use subprocessors for service operation and support; overseas processing is described below. The Company's three-year retention rule does not mean every cloud copy is automatically deleted at exactly that time. We manage deletion of messages, emails and backups together.

Article 4. Overseas transfers

Transfers are for outsourced processing and storage, based on separate consent under PIPA Article 28-8(1)(1). In addition to the inquiry record hosted on our Korean EC2 server, notification/email copies are transferred as follows.

1. Slack notifications

• Recipient/contact: Slack Technologies Limited (Ireland), Slack Technologies, LLC and service affiliates / privacy@slack.com.
• Countries: default storage is in the United States. Slack Technologies Limited in Ireland provides services to Korean customers. Published edge processing locations are United States, Australia, Germany, India, Ireland, Japan, Singapore, South Africa, United Kingdom, Brazil and Sweden. Support may additionally involve Argentina, Austria, Canada, France, Israel, Italy, Netherlands, Spain, Switzerland and Thailand; some processing also occurs in South Korea. These are possible processing locations, not a claim that every inquiry is stored in every country. Provider activities and locations are listed at https://slack.com/slack-subprocessors (published October 20, 2026).
• Information: name, company, phone, email, inquiry type/message and title, department or product interest provided with optional consent.
• Purpose, timing and method: notifying the responsible team, assigning and handling the inquiry through an HTTPS webhook after submission.
• Retention: up to 3 years after resolution, or earlier deletion of the message. Residual backup deletion follows the provider's deletion procedures.

2. Mailgun email delivery

• Recipient/contact: Mailgun Technologies, Inc. / DPO@sinch.com.
• Country: United States, the US region used by the Company.
• Information: the same inquiry information as the Slack notification, plus sender, recipient and reply email addresses.
• Purpose, timing and method: transmitting notification emails to the responsible team through an HTTPS API and email relay after submission.
• Retention: message content for 3 days under the current domain setting; delivery events for 30 days. The received email is subject to the Google retention rule below. Open/click tracking is disabled.

3. Google Workspace/Gmail correspondence

• Recipient/contact: Google LLC / 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA / https://support.google.com/policies/.
• Countries: we use the global service without a selected storage region, so processing is not limited to the United States. Google's published overseas operations/maintenance locations for Workspace Core Services are United States, Argentina, Australia, Belgium, Brazil, Canada, Chile, Denmark, Finland, France, Germany, Hong Kong, India, Ireland, Israel, Italy, Japan, Mexico, Netherlands, New Zealand, Poland, Singapore, Spain, Sweden, Switzerland, Taiwan and United Kingdom. Some processing also occurs in South Korea.
• Additional countries when access is separately authorized in a support request: Bulgaria, Colombia, El Salvador, Malaysia, Philippines, Romania and Sri Lanka. These are published possible processing locations, not a claim that each email is stored in every country. Provider names, activities and locations appear at https://workspace.google.com/terms/subprocessors/ (list published October 19, 2026).
• Information: inquiry details in notifications, sender/recipient addresses, inquiry messages and replies.
• Purpose, timing and method: email transmission and storage when notifications arrive and staff send or receive replies.
• Retention: up to 3 years after resolution, or earlier deletion of the email. Residual backup deletion follows the provider's deletion procedures.

4. Refusing or withdrawing consent

Leaving the overseas transfer checkbox unchecked prevents submission. Online inquiries currently depend on these notification/email services, so declining overseas transfers limits online submission. Public pages remain available without this consent. Call +82-2-704-7502 to discuss an inquiry method without overseas transfers. Direct email also uses overseas email services.

To withdraw consent, contact the Business Support Team at contact@sandslab.io or +82-2-704-7502. After verifying your identity, we stop subsequent transfers and address deletion of retained information and other necessary measures. Follow-up through the affected channel may be limited. Changes to transfer information, countries, recipients, purposes or periods require the applicable notice and renewed consent; publishing a new policy does not create retroactive consent for existing inquiries.

Article 5. Deletion

When retention expires, consent is withdrawn or information is otherwise unnecessary, the responsible team checks the data and any legal preservation requirements and deletes it without undue delay. Electronic information is deleted by methods that make recovery/reproduction difficult; paper is shredded or incinerated. Deletion includes the inquiry record, Slack messages, incoming/outgoing email and backups. Deletion from active systems and backups may occur at different times. Residual backups are restricted to recovery purposes and removed according to the relevant deletion cycle. Information subject to a statutory retention obligation is kept separately with restricted access.

Article 6. Your rights and representatives

You may request access, correction, deletion, restriction of processing, and withdrawal of collection/use or overseas transfer consent. Contact the team in Article 9 by email, phone, fax or in writing. Legal guardians and authorized representatives may act on your behalf. We verify only the information necessary to establish identity or authority.

We process requests and communicate results within the deadlines and procedures required by applicable law. If a legal exception prevents all or part of a request, we explain the reason and how to raise an objection. You do not need to consent to overseas transfers through the inquiry form to exercise your rights. Deletion of records subject to statutory retention may be restricted.

The website does not operate fully automated decision-making that significantly affects individuals. If spam or duplicate prevention blocks a legitimate inquiry, you can request review by the responsible team.

Article 7. Security measures

We limit access and personnel handling personal information, require administrator authentication, protect transmission, restrict direct external database access, maintain access records, and perform security updates/checks. Sensitive configuration, backups and incident evidence have restricted permissions. We manage processor safeguards and deletion procedures.

Article 8. Cookies, browser storage and external resources

We do not use advertising personalization cookies, advertising pixels, Google Analytics or reCAPTCHA. Inquiry protection uses ALTCHA running in the browser and on our servers. Verification values and connection information can reach our servers. Browser storage does not mean all information stays exclusively on your device.

The design guide may load fonts and interface resources from Google Fonts and jsDelivr. Those requests can transmit IP addresses, browser information and other connection data to the providers. External linked sites follow their own operators' policies. You can delete cookies/storage or restrict external requests through browser settings, which may affect display and preference features.

Article 9. Privacy contact

Contact this team for privacy inquiries, complaints, remedies, access and other rights requests, or withdrawal of consent.

Article 10. Independent remedies

These organizations independently provide reporting, consultation and dispute resolution services.

Article 11. Changes and previous policy

Publication and effective date: October 23, 2026.

This revision explains Mailgun notifications, actual data processing and retention, overseas transfers and separate consent, cookies/browser storage, rights requests and institutional links. The three-year retention period after inquiry resolution remains unchanged. The privacy contact is now the Business Support Team at the Company’s general email address, contact@sandslab.io.

We publish future changes and effective dates and obtain separate consent where required. Publication is not a substitute for individual consent.

Previous policies:

• October 23, 2026 revision, before the privacy contact change
• Privacy Policy effective September 21, 2026