Privacy Policy

Contents

1. Article 1. Purposes of Processing Personal Information
2. Article 2. Categories of Personal Information, Collection Methods, and Retention and Use Periods
3. Article 3. Provision of Personal Information to Third Parties
4. Article 4. Entrustment of Personal Information Processing
5. Article 5. Overseas Transfer of Personal Information
6. Article 5-2. Processing of AI Skill Evaluation Data (Including Information on Pseudonymized Data Processing)
7. Article 6. Procedures and Methods for Destroying Personal Information
8. Article 7. Rights and Obligations of Data Subjects and Legal Representatives, and How to Exercise Them
9. Article 8. Installation and Operation of Automated Personal Information Collection Devices, and How to Opt Out
10. Article 9. Behavioral Information Collected by Third Parties
11. Article 10. Measures to Ensure the Security of Personal Information
12. Article 11. Personal Information Protection Officer and Department
13. Article 12. Remedies for Infringements of Rights and Interests
14. Article 13. Notice of Changes to the Privacy Policy

Article 1. Purposes of Processing Personal Information

The Company collects and processes the minimum personal information necessary for the following purposes. Personal information being processed will not be used for any purpose other than those listed below. If a purpose of use changes, the Company will take necessary measures, such as obtaining separate consent, under Article 18 of the Personal Information Protection Act (「개인정보 보호법」).

1. Platform Membership and Service Administration
   We process information to confirm intent to register; identify and authenticate users for membership services; maintain and manage membership; verify identity; prevent misuse of the Service; determine whether a person is under 14; and provide notices and notifications related to Service use, handle complaints, and retain records for dispute resolution.
2. Handling Inquiries and Complaints
   We process information to verify the identity of the person making an inquiry, confirm its contents, contact and notify them during fact-finding, and communicate the outcome of our handling.
3. Providing Goods or Services
   We process information to facilitate the sale and purchase of Skills (digital products such as AI agents, CLI tools, and prompt packages), provide content, send invoices, process and settle payments, pay Creator earnings, and collect receivables. We also run Skills and AI models on tasks submitted by Users through Arena (Skill Match), compare and provide the results, and aggregate User selections to rank Skill performance. This information is processed for these purposes.
4. Skill Registration, Review, and Automated Product Information Generation
   We inspect Creator-uploaded Skill packages for credentials or personal information and notify the uploader; automatically generate buyer-facing notices, tags, and descriptions; and assist with sales approval reviews. In this process, the contents of files in the package are processed to assist with sales approval. During this process, file contents included in the package are transmitted outside Korea to overseas AI providers as described in Article 5.
5. Marketing and Advertising
   We process information to develop new services; provide personalized information services; provide event and promotional information and opportunities to participate; provide services and serve advertisements based on demographic characteristics; verify Service effectiveness; track access frequency; and conduct statistics and surveys about Members’ use of the Service.
6. Service Improvement and Development of New Services
   In addition to providing existing services, we process personal information to strengthen features and improve the User experience based on Service usage records, demographic analysis, and User interests. Artificial intelligence (AI) technology may be used in this process, including automated analysis, summarization, or classification of information that a User enters or generates while using the Service.
7. Processing AI Skill Evaluation Data
   We process tasks and instructions submitted by Users in Arena (Skill Match), evaluation results, and usage records to evaluate AI Skill and model performance, compile statistics, conduct scientific research (including industrial research), train AI Skills and models, and improve the Service. Before providing these materials outside the Company, we pseudonymize them under Article 28-2 of the Personal Information Protection Act (「개인정보 보호법」). Pseudonymized evaluation data may be provided for a fee to domestic and overseas AI model and Skill research and development organizations. Details are in Article 5-2.

Article 2. Categories of Personal Information, Collection Methods, and Retention and Use Periods

1. The Company collects and uses only the minimum information necessary to provide the Service. It does not collect information that could clearly infringe a data subject’s rights, interests, or privacy, such as beliefs, political views, criminal records, or other social activity history.
2. With the data subject’s consent under Article 15(1)(1) and Article 22(1)(7) of the Personal Information Protection Act (「개인정보 보호법」), or on a statutory basis, the Company processes personal information as follows. Even after the stated retention and use period expires, information identified in Article 6 is stored in a separate database for the period specified there and then destroyed without delay.

3. For data subjects who consent to receiving promotional information, the Company reconfirms consent every 2 years from the consent date under Article 62-3 of the Enforcement Decree of the Act on Promotion of Information and Communications Network Utilization and Information Protection (「정보통신망 이용촉진 및 정보보호 등에 관한 법률 시행령」). At reconfirmation, we provide the sender’s name, the fact and date of consent, and how to indicate whether consent should continue or be withdrawn. If the data subject does not respond separately, the existing consent remains in effect.
4. The Company instructs Users not to enter personal information in areas of the Service where it is not needed. If a User enters personal information that the Company did not request while using the Service, the Company processes it with necessary safeguards under this Policy to the extent unavoidable in the ordinary provision of the Service.
5. The following information may be automatically generated and collected while the Service is used.
   • Service usage records, access date and time, IP address, and records of misuse
   • Device information (OS version, UDID, browser information), cookies, and advertising ID
   • Anonymous telemetry generated when a Skill is installed or run (error codes and execution environment)
6. When collecting personal information, the Company classifies the minimum information necessary to provide the Service as “required items” and other personal information as “optional items.” The Company will not refuse to provide the Service because a User does not provide information beyond the required items.

Article 3. Provision of Personal Information to Third Parties

1. The Company processes personal information only within the scope stated in Article 1 and does not provide it to third parties except with the data subject’s consent or as permitted under Articles 17 and 18 of the Personal Information Protection Act (「개인정보 보호법」).
2. Under Article 17(4) of the Personal Information Protection Act (「개인정보 보호법」), taking into account the matters under Article 14-2 of its Enforcement Decree (「개인정보 보호법 시행령」), the Company additionally provides personal information as follows without the data subject’s consent. Some provided items may be masked (*).

The additional provision above takes the following into account.

• The personal information provided is related to its original collection purpose: facilitating Skill transactions.
• Data subjects can reasonably expect that their nickname and similar information may be disclosed to the other party during a transaction.
• The Company takes security measures to minimize exposure of personal information, including by providing nicknames.

Provision of Pseudonymized Evaluation Data

Separately from the provisions above, the Company pseudonymizes Arena evaluation data under Article 28-2 of the Personal Information Protection Act (「개인정보 보호법」) and provides it as follows. This provision may be for consideration.. Details of processing and how to refuse are described in Article 5-2.

Article 4. Entrustment of Personal Information Processing

To process personal information smoothly, the Company entrusts processing tasks as follows.

1. When entering into an entrustment agreement, the Company specifies in a written document matters required under Article 26 of the Personal Information Protection Act (「개인정보 보호법」), including prohibiting use of personal information outside the entrusted purpose, protective measures, restrictions on further entrustment, supervision of service providers, and liability for damages, and supervises the providers’ safe handling of personal information.
2. If the entrusted tasks or service providers change, the Company will disclose the change promptly through this Policy.
3. Entrustment of personal information processing outside Korea is described in Article 5.

Article 5. Overseas Transfer of Personal Information

Under Article 28-8(1)(3) of the Personal Information Protection Act (「개인정보 보호법」) (entrustment or storage of personal information processing), the Company transfers personal information overseas as follows.

Users may refuse overseas transfers of their personal information by contacting the Company’s Personal Information Protection Officer or responsible department. If a User refuses an overseas transfer, the Company excludes that User’s personal information from overseas transfers. However, use of Service features that require overseas transfers of personal information, such as payment and AI response generation, may be restricted.

Overseas Provision of Pseudonymized Evaluation Data

Separately from the entrustment and storage above, the Company may pseudonymize Arena evaluation data and provide it for a fee to overseas AI model and Skill research and development organizations. Because this is a provision, not entrustment or storage, Article 28-8(1)(3) does not apply. Article 28-8 is not among the provisions excluded by Article 28-7 of the Personal Information Protection Act (「개인정보 보호법」); pseudonymization alone therefore does not exempt the transfer from the overseas transfer rules. Accordingly, the Company provides the information required by Article 28-8(2) of the same Act below and makes overseas transfers only when the requirements of paragraph 1(1) (separate consent of the data subject) are met or the transferred information is no longer identifiable as personal information under Article 58-2 of the same Act. Details and how to refuse are described in Article 5-2.

This transfer may be refused using the method in Article 5-2(8). Refusal does not restrict use of the Service, including Arena.

Article 5-2. Processing of AI Skill Evaluation Data

1. The Company processes the following records left by Users in Arena (Skill Match) as Evaluation Data
   • Tasks and instructions submitted by Users to Arena
   • Evaluation results showing which output was selected and identifiers of the Skills and models being compared
   • Usage records from the comparison process, including the order and time in which outputs appeared and the time spent waiting for responses
   • Reasons for an evaluation entered optionally by the User
   • Evaluator occupation, area of expertise, and language information provided optionally by the User
2. The Company uses the Evaluation Data in paragraph 1 to compare and rank Skill and model performance internally, and pseudonymizes it under Article 28-2 of the Personal Information Protection Act (「개인정보 보호법」) before providing it outside the Company. Pseudonymized Evaluation Data does not contain information that identifies an individual, such as Member identifiers, names, email addresses, or contact details. Additional information used for pseudonymization is stored separately with restricted access.
3. Because tasks, instructions, and evaluation reasons are free-text fields, before providing them outside the Company we detect and remove or replace expressions that could identify an individual, such as names, contact information, or account names. However, Users must not enter personal information or another person’s confidential information in tasks, instructions, or evaluation reasons, as required by Article 14-3(6) of the Terms of Service.
4. Pseudonymized Evaluation Data is used for the following purposes.
   • Evaluating and comparing the quality and performance of AI Skills and models
   • Compiling statistics and conducting scientific research (including industrial research)
   • Training AI Skills and models
   • Service Improvement and Development of New Services
5. Under Article 28-2(1) of the Personal Information Protection Act (「개인정보 보호법」), the Company provides pseudonymized Evaluation Data to domestic and overseas organizations that research and develop AI models and Skills, within the purposes set out in paragraph 4. Under paragraph 2 of the same Article, the Company does not provide information that could be used to identify an individual, and does not provide Evaluation Data in an identifiable state for a fee. Provision agreements prohibit re-identification, re-provision, and use outside the purpose, and require security measures. The name and contact details of each recipient organization are disclosed in this Policy before provision begins. This provision may be for consideration..
6. If the provision in paragraph 5 is made overseas, the Company provides the information required by Article 28-8(2) of the Personal Information Protection Act (「개인정보 보호법」) in the table below and transfers information overseas only in either of the following cases. Article 28-8(1)(3), which covers entrustment and storage, does not apply to this provision.
   1. The data subject has given separate consent to the overseas transfer under Article 28-8(1)(1) of the Personal Information Protection Act (「개인정보 보호법」).
   2. The information to be transferred is no longer personal information because, even taking time, cost, technology, and other factors reasonably into account, the individual can no longer be identified using other information under Article 58-2 of the Personal Information Protection Act (「개인정보 보호법」).

7. Evaluation Data is continually used to compare over time which results particular Skills and models produce for particular tasks and is retained after membership withdrawal under Article 6(4). Pseudonymized Evaluation Data is destroyed without delay when the purpose in paragraph 4 is fulfilled or the provision agreement ends. Additional information used for pseudonymization is stored separately immediately after pseudonymization and destroyed when its purpose is fulfilled.
8. Users may refuse external provision of Evaluation Data at any time or withdraw a previously stated choice. You may request this through the customer support contact in paragraph 6 of Article 7 ( team@skills.ag) or through one-to-one inquiries on the Skillshop website. The Company will promptly exclude that User’s Evaluation Data from provision under paragraphs 5 and 6. No separate Service setting is needed; a request is sufficient, and refusing does not restrict use of the Service, including Arena. However, data already provided before the refusal will be recalled to the extent provided for in the recipient’s agreement.
9. Processing under this Article is based on this Policy, to which the User consents at registration. The scope of the license for Evaluation Data is set out in Article 14-3 of the Terms of Service. If this Article changes, the Company will provide advance notice under Article 13. Use of the Service after the announced effective date constitutes consent to the changes.
10. This Article also contains information about pseudonymized data processing under Article 30(1)(4-2) of the Personal Information Protection Act (「개인정보 보호법」), as follows.
    • Purpose of processing pseudonymized data: paragraph 4
    • Processing period for pseudonymized data: paragraph 7
    • Provision of pseudonymized data to third parties: paragraphs 5 and 6
    • Entrustment of pseudonymized data processing: none
    • Personal information items subject to pseudonymization: paragraph 1
    • Security measures for pseudonymized information under Article 28-4 of the Personal Information Protection Act (「개인정보 보호법」) are as follows.
      • Administrative measures: Establishing and implementing an internal management plan for pseudonymized information; regular training for personnel responsible for pseudonymization; and preparing and retaining processing records under Article 28-4(3)
      • Technical measures: Storing pseudonymized information separately from additional information; promptly destroying additional information when it is no longer needed; separating access permissions for pseudonymized and additional information; installing access control systems; retaining and reviewing processing and access logs; and installing security software
      • Physical measures: Controlling access to server rooms, archives, and other locations where pseudonymized information is stored

Article 6. Procedures and Methods for Destroying Personal Information

As a rule, the Company destroys Members’ personal information without delay once the purposes of its collection and use have been achieved. If personal information must be retained under internal policies or other laws after the data subject’s consented retention period expires or the processing purpose is achieved, it is moved to a separate database or stored in a different location.

1. Destruction Procedure
   After the purpose is achieved, information entered by a Member is moved to a separate database and retained for a period required by internal policies and applicable law, then destroyed. Personal information moved to a separate database is not used for another purpose unless required by law.
2. Destruction Deadline
   If a retention period expires, personal information is destroyed within 5 days of its end date. If it becomes unnecessary because the processing purpose has been achieved or the Service has ended, it is destroyed within 5 days after that fact is recognized. AI processing outputs created by the Company from information Users enter or generate while using the Service (such as summaries, classifications, or recommendations) are retained and destroyed under the same standards as the source information.
3. Destruction Method
   Electronic files are destroyed using technical methods that prevent records from being reproduced. Paper documents are shredded or incinerated.
4. Exception for Arena (Skill Match) Records
   Prompts entered by Users in Arena, attached reference images, outputs generated from executions, and match vote records are continually used as performance comparison data showing which results particular Skills and models produce for particular tasks. They are therefore retained without destruction after membership withdrawal. The Member identifier of the person who requested the match is retained with these records. To request deletion of Arena records, contact the Personal Information Protection Officer under Article 7.

Retention under Internal Policies

Retention under Applicable Laws

Handling Accounts Inactive for an Extended Period

1. If a Member does not use the Service for 5 consecutive years, the Company destroys that Member’s personal information without delay once 5 years have passed since the last use.
2. Even if a Member has not used the Service for 5 years, personal information for an account in any of the following situations is not destroyed.
   • The account has an ongoing transaction or is subject to a penalty.
   • The account has Creator earnings that have not been finally settled.

Article 7. Rights and Obligations of Data Subjects and Legal Representatives, and How to Exercise Them

1. Data subjects should enter accurate and current personal information to prevent unexpected incidents. Data subjects are responsible for incidents caused by inaccurate information. Entering false information, including misusing another person’s information, may result in loss of membership.
2. Data subjects should take care to prevent disclosure of personal information such as IDs and passwords, and may not transfer or lend personal information or account information to a third party.
3. Data subjects must comply with laws concerning personal information, including the Act on Promotion of Information and Communications Network Utilization and Information Protection (「정보통신망 이용촉진 및 정보보호 등에 관한 법률」) and the Personal Information Protection Act (「개인정보 보호법」).
4. Data subjects may at any time exercise rights to access, correct, delete, or suspend processing of personal information, or withdraw consent. These rights may be restricted in the following cases under Article 35(4) and Article 37(2) of the Personal Information Protection Act (「개인정보 보호법」).
   • Access is prohibited or restricted by law.
   • Access could harm another person’s life or body, or unfairly infringe another person’s property or other interests.
   • Suspending processing would make it difficult to perform the contract, such as by preventing the Company from providing a service agreed with the data subject, and the data subject has not clearly indicated an intent to terminate that contract (applies only to suspension of processing).
5. Data subjects may view and My Page → Account Settingstheir registered personal information in update. They may also request membership withdrawal (deletion of information and suspension of processing) from the same menu. However, some or all of the Service may become unavailable.
6. For smooth communication about exercising your rights, contact us through the details below, and we will act without delay.

7. Data subjects may exercise their rights through a representative, such as a legal representative or an authorized agent. In that case, they must submit documentation proving legal representative status or a power of attorney and personal information access request using Form 11 in the Notice on Methods of Processing Personal Information (「개인정보 처리 방법에 관한 고시」).
8. As a rule, the Company does not collect personal information from children under 14, whose information requires a legal representative’s consent. If it exceptionally needs to collect such information, it guarantees the legal rights of the child’s legal representative, including rights to access, correct, or delete the child’s information and request suspension of its processing.

Article 8. Installation and Operation of Automated Personal Information Collection Devices and How to Opt Out

1. The Company collects and uses behavioral information to provide data subjects with optimized personalized services and benefits, including online personalized advertising, while they use the Service.
2. The Company collects behavioral information as follows.

3. To provide personalized services, the Company uses cookies and local storage that save usage information and retrieve it from time to time. Cookies are small pieces of information sent by the server operating the website to a data subject’s browser, stored on the User’s computer or mobile device, and automatically transmitted when the User accesses the website.
4. Data subjects may allow or block cookies in their browser settings. Blocking them may make personalized services difficult to use.
   • Chrome: Top-right ⋮ in the browser → Settings → Privacy and security → Cookies and other site data
   • Safari: Settings → Safari → Block All Cookies
   • Edge: Top-right … → Settings → Cookies and site permissions
5. Data subjects may refuse this collection by deleting information stored in local storage through their browser settings.

Article 9. Behavioral Information Collected by Third Parties

1. When data subjects visit or use the Company’s website or app, the Company allows third parties to collect information using automated collection devices, including third-party cookies and advertising identifiers, to support Service use, advertising, and marketing.
2. Third parties collect behavioral information from the Company’s website and app as follows.
   • Advertising businesses and platforms: Google LLC (Google Ads), Meta Platforms, Inc. (Facebook/Instagram), Kakao Corp. (주식회사 카카오), and NAVER Corporation (네이버 주식회사)
   • Collection method: Automatic collection when a User visits the Company’s website or launches its app (using JavaScript and SDKs)
   • Items collected: Website/app visit history, search history, purchase history, advertising identifiers, browser and device information
   • Purpose of collection: Serving personalized ads and analyzing website/app usage statistics
3. Separately from the automated collection above, the Company directly transmits purchase or free-acquisition completions and Skill sales approvals from its servers to Meta Platforms, Inc. This transmission is not blocked by browser cookie settings. Items transmitted and how to refuse are described in Article 5.
4. Data subjects may allow or block personalized advertising in the app by changing mobile device settings.
   • Android: Settings → Google → Ads → Reset or delete advertising ID
   • iOS: Settings → Privacy & Security → Tracking → Change app tracking permissions
5. Data subjects may allow or block online personalized advertising across the board by changing their web browser’s cookie settings. Changing cookie settings may affect some Service features, such as automatic website login.

Article 10. Measures to Ensure the Security of Personal Information

Under Article 29 of the Personal Information Protection Act (「개인정보 보호법」), the Company limits the number of people who handle personal information and raises awareness of its importance through technical and administrative measures.

1. Technical Measures

• Members’ passwords are stored using one-way encryption (such as bcrypt) and can be accessed or changed only by the Member who knows the password.
• Important data is protected using encryption or locking features. Databases and backups are encrypted when stored.
• Personal information is securely transmitted over networks using cryptographic protocols such as SSL/TLS.
• The Company operates intrusion prevention and detection systems and vulnerability analysis tools to protect against external attacks such as hacking.
• Anti-virus software is updated regularly to prevent harm from computer viruses.

2. Administrative Measures

• Access to Members’ personal information is limited to the minimum number of people, as follows.
  • Personnel who conduct marketing directly to Members
  • Personnel responsible for personal information protection, including the Personal Information Protection Officer and staff
  • Other personnel who must handle personal information to perform their work
• The Company provides regular in-house and external training to employees who handle personal information.
• The Company uses security pledges at hiring to prevent information leaks caused by people and has internal procedures to audit employee compliance.
• The Company is not responsible for personal information issues caused by a Member’s own error or that do not arise from the Company’s fault. Each Member must appropriately manage their own ID and password.
• If personal information is lost, disclosed, altered, or damaged because of an internal administrator’s mistake or a technical management incident, the Company will promptly notify affected persons and take appropriate remedial and compensatory measures.

Article 11. Personal Information Protection Officer and Department

The Company designates the following Personal Information Protection Officer to oversee personal information processing and handle data subjects’ complaints and remedies related to personal information processing.

Personal Information Protection Officer

Personal Information Protection Department

For any privacy-related questions, complaints, or requests for remedies arising from use of the Service, customers may contact the Personal Information Protection Officer or department. The Company will respond to and address inquiries without delay.

Article 12. Remedies for Infringements of Rights and Interests

The Company works to protect data subjects’ right to control their personal information and to provide consultation and remedies for personal information infringements. For reports or consultation, contact the department in Article 11.

For remedies for personal information infringements, data subjects may apply for dispute resolution or consultation with the Personal Information Dispute Mediation Committee, the Korea Internet & Security Agency’s Personal Information Infringement Report Center, or other organizations. For other reports or consultation about personal information infringements, contact the organizations below.

• Personal Information Infringement Report Center: 118 (no area code) / https://privacy.kisa.or.kr
• Personal Information Dispute Mediation Committee: 1833-6972 (no area code) / https://kopico.go.kr
• Supreme Prosecutors’ Office: 1301 (no area code) / https://spo.go.kr
• Korean National Police Agency: 182 (no area code) / https://ecrm.police.go.kr

Article 13. Notice of Changes to the Privacy Policy

1. This Privacy Policy applies from its effective date. The Company will provide advance notice of amendments through Service notices or similar channels.
2. However, if an amendment is material and may affect customers’ rights or obligations, the Company will provide notice at least 30 days in advance.