UNBOXIN PRIVACY POLICY

Effective Date: 08 07, 2026 | Last Updated: 08 07, 2026

infini.show co., ltd. operates UNBOXIN for brand clients that use the Platform to run influencer seeding campaigns (each a separate legal entity, collectively "Brand Clients"). Our data infrastructure is primarily located in the Republic of Korea. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you access the Platform via web or mobile application. Brand Clients using the Platform are each separate legal entities from infini.show co., ltd. Where personal information is shared with Brand Clients for campaign administration purposes, such sharing constitutes third-party disclosure under applicable privacy laws and is subject to your consent as described in Section 3. As a general rule, the Company processes personal information in its capacity as an independent personal information processor in connection with membership registration, account management, platform operation, customer support, and point management. However, if a brand client receives and processes member information for a specific campaign based on its own purposes and judgment, that brand client shall process the personal information in its capacity as an independent personal information processor, and the responsibility for such processing lies with that brand client.

§ 1. Information We Collect — (a)–(f)

The Company collects only the minimum amount of personal information necessary to provide its services, and clearly indicates whether each field is required on the membership sign-up screen, campaign application screen, or in a separate notice. Even if you do not provide optional information, you may still be able to use the basic platform features; however, your ability to participate in certain campaigns, receive rewards, or use personalized recommendation features may be limited.

(a) Real name or alias, email address, phone number, IP address, device identifiers, social login credentials (Google, Apple), country of residence, preferred language. (b) Social media handle (Instagram, TikTok, X/Twitter), follower/following/post counts, engagement metrics (likes, comments, shares, views, saves, reach), media IDs and content performance statistics, authentication tokens (Instagram Graph API, TikTok for Developers API). (c) Mailing address (for physical product shipments; domestic fulfillment via Pumgo, international shipping via FedEx through Tongo), delivery instructions, Points transaction history and reward redemption records. (d) Browsing and interaction history within the Platform, click-through data, session duration, and device and browser information. (e) Post links (URLs) submitted by Members pointing to content published on Instagram, TikTok, and other social media platforms; campaign participation history and submission timestamps. The Company also retains screenshots and performance data of submitted posts as campaign evidence records. (f) We do NOT collect sensitive personal information such as racial or ethnic origin, political opinions, religious beliefs, genetic data, biometric data, health information, sexual orientation, or criminal history.

(g) Cookies and Tracking Technologies

We use cookies and similar tracking technologies. The Platform currently uses only the following types of cookies: (i) Essential cookies — required for login session maintenance and Platform functions, cannot be disabled; (ii) Language preference cookies — used to remember your preferred language setting. The Platform does not currently use analytics cookies (e.g., Google Analytics), marketing/advertising cookies, Meta Pixel, or TikTok Pixel. You can manage or withdraw their consent for non-essential cookies through your browser settings or the cookie settings tool that will be provided in the future. When introducing non-essential cookies, we will provide a prior consent banner or an equivalent opt-in mechanism in accordance with applicable laws and regulations.

§ 2. How We Use Your Information

To verify identity, manage accounts, confirm campaign eligibility, facilitate product shipment, track content performance using social media API data, calculate and award Platform Points, verify compliance with campaign deliverables, process Points redemptions and disburse rewards including Amazon Gift Cards, maintain transaction records, send administrative notices and campaign invitations, and send marketing communications (with prior consent where required by law).

Platform Improvement, Security, and Automated Matching

The Company may automatically analyze or recommend campaign suitability based on your country, language, number of followers, engagement metrics, past campaign history, and other factors. However, decisions that result in significant legal consequences—such as the final selection of campaign participants, the execution of a contract, account termination, or similar actions—are not made solely through automated processing; where necessary, a human representative will conduct a final review and make the decision. You may request an explanation or file an objection regarding these automated evaluations. If the Company introduces fully automated final selection in the future, you will be notified in advance.

§ 3. How We Share Your Information

We do not sell your personal information. We share information with: (1) Amazon Web Services, Inc. (Korea Region) — cloud hosting, storage, and email delivery; Pumgo — product storage and fulfillment/logistics (via BM Smile); FedEx (via Tongo) — international shipping; Apify Technologies s.r.o. — automated public SNS profile collection; Google LLC — email integration and address translation; ScreenshotOne — SNS post screenshot capture; Datadog, Inc. / Sentry — server monitoring and error tracking; Slack Technologies, LLC — internal operations notifications. Businesses that process personal information to support the Company’s operations—such as shipping, infrastructure management, messaging, customer support, and security monitoring—act as the Company’s agents and process personal information in accordance with the Company’s instructions. Gift card codes are purchased and issued directly by the Company; no third-party payment processor receives your personal information for this purpose. All service providers are contractually required to process your information only for the purposes disclosed. (2) Brand Clients using the Platform (each a separate legal entity from infini.show co., ltd.) for campaign administration purposes, on the basis of your consent as described in this Policy. If you apply for or participate in a specific brand campaign, the relevant brand company may receive your personal information to the extent necessary for campaign management, selection, review, shipping-related decisions, and post-campaign settlement; this constitutes a disclosure to a third party based on your separate consent. (3) Social media platform APIs (Instagram, TikTok) with your authorization. (4) A successor entity in connection with a business transfer. (5) Government authorities as required by applicable law.

§ 4. Data Retention

We retain personal information only for as long as necessary: (1) Account information — for the duration of membership plus one (1) year following account termination; (2) Campaign and content data — for the campaign period plus three (3) years for legal and dispute resolution purposes; (3) Financial records — as required by applicable tax and accounting laws (generally five (5) years in Korea); (4) Social media API data — for the applicable campaign period plus six (6) months. When we no longer have a legitimate business need, we will securely delete or anonymize your personal information.

Screenshots of campaign submissions, performance statistics, and review records may, in principle, be retained for a certain period after the campaign ends for the purposes of dispute resolution, settlement verification, and compliance audits. The retention period is determined in accordance with separate internal standards, taking into account the nature of the campaign, regulatory compliance requirements, and relevant laws and regulations; once the intended purposes have been fulfilled, the data is securely deleted or anonymized.

§ 5. Children's Privacy

The Platform is not directed at children under the age of thirteen (13). The company may implement age verification or consent verification procedures as necessary. We do not knowingly collect personal information from children under thirteen (13) in accordance with COPPA and applicable international laws. If we become aware that we have inadvertently collected such information, we will promptly delete it. Contact [privacy@infini.show] immediately if you believe your child has provided information without your consent.

§ 6. State-Specific Privacy Rights (U.S.)

California Residents (CCPA/CPRA): (1) Right to Know; (2) Right to Delete; (3) Right to Correct; (4) Right to Opt Out — We do not sell your personal information, and we do not share your personal information for cross-context behavioral advertising as those terms are defined under California law.; (5) Right to Non-Discrimination. Submit verifiable consumer requests to [privacy@infini.show]; we respond within forty-five (45) days. Other U.S. State Residents: Residents of Colorado, Connecticut, Virginia, Utah, and other states with applicable privacy laws may also have rights to access, correct, delete, and port their personal information, and to opt out of targeted advertising.

§ 7. Korean Customer Privacy (PIPA Supplement)

Our data infrastructure is primarily located in the Republic of Korea. We comply with the Personal Information Protection Act (개인정보 보호법, "PIPA") for all Members. Personal information collected from Members outside Korea will be transferred to and processed in Korea. By using the Platform, Members located outside Korea expressly consent to this transfer. We implement appropriate safeguards including Standard Contractual Clauses (SCC) where required.

Statutory Retention Periods (Korea)

Electronic commerce records — 5 years; Contract / subscription withdrawal records — 5 years; Consumer complaint / dispute records — 3 years; Tax-related evidentiary documents — 5 years; Website visit records — 3 months.

Outsourcing of Personal Information Processing

Sub-processors: Amazon Web Services, Inc. (Korea Region) — cloud hosting, storage, and email delivery (Republic of Korea); Pumgo — product storage and domestic fulfillment/logistics (Republic of Korea, via BM Smile); FedEx (via Tongo) — international shipping (United States / varies by delivery country); Apify Technologies s.r.o. — automated collection of public SNS profile information (Czech Republic); Google LLC — marketer email integration and address translation services (United States); ScreenshotOne — SNS post screenshot capture for campaign evidence records (United States); Datadog, Inc. / Sentry — server monitoring and error tracking, processes access IP and request logs (United States); Slack Technologies, LLC — internal operations notifications, may include member names in alert content (United States). Gift card codes are issued directly by the Company using a corporate card; no third-party payment processor is engaged for reward disbursement. When outsourcing processing, we implement appropriate contractual and technical safeguards in compliance with PIPA Article 26.

§ 8. EEA / GDPR Supplemental Disclosures

Lawful bases for processing: Contract Performance; Legitimate Interests; Legal Obligation; Consent (where required by law).

EEA data subject rights: (1) Right of Access; (2) Right to Rectification; (3) Right to Erasure; (4) Right to Restriction of Processing; (5) Right to Data Portability; (6) Right to Object; (7) Right to Withdraw Consent; (8) Right to Lodge a Complaint.

International Data Transfers from the EEA: Your personal information will be transferred to and processed in the Republic of Korea. The Republic of Korea has received an adequacy decision from the European Commission (2021), meaning such transfers are permitted without further safeguards. Where adequacy does not apply, transfers are carried out on the basis of Standard Contractual Clauses (SCCs) approved by the European Commission.

However, in cases where personal information is transferred to a trustee or service provider in a third country outside the Republic of Korea, we will apply Standard Contractual Clauses or other lawful transfer mechanisms recognized by relevant laws and regulations, and implement additional technical and organizational safeguards as necessary.

Data Breach Notification: We will notify the relevant supervisory authority within seventy-two (72) hours of a personal data breach and notify affected individuals without undue delay where required.

§ 8-2 (Supplementary Disclosure under Japan’s APPI)

Personal information of members located in Japan may be transferred to and stored in South Korea, the United States, or other countries. In accordance with the Japanese Act on the Protection of Personal Information (APPI), we take the necessary contractual and administrative measures to ensure that contractors or recipients continuously implement appropriate safeguards, and we will provide information regarding the destination country, the type of recipient, and the key safeguards upon a member’s request.

§ 9. Data Security

We implement appropriate technical and organizational security measures including: (1) Encryption of personal information in transit (TLS) and at rest; (2) Access controls and role-based authorization; (3) Regular security assessments and monitoring; (4) Employee training on data protection; (5) Incident response procedures. Despite these measures, no method of electronic transmission or storage is 100% secure. Contact [privacy@infini.show] immediately if you believe your information has been compromised.

§ 10. Contact Us

Upon receiving a request from a member to exercise their rights, the Company will respond within the timeframe specified by applicable laws and regulations. The Company may request information reasonably necessary to verify the identity of the person exercising their rights, and may charge a processing fee or limit the processing of requests that are manifestly repetitive or excessive, to the extent permitted by law.

For any questions about this Privacy Policy or to exercise your privacy rights, please contact:

infini.show co., ltd.

[47F, Parc1, 108, Yeoui-daero, Yeongdeungpo-gu, Seoul, South Korea]

Privacy inquiries: [cem@bmsmile.com]

CPO (Chief Privacy Officer): Kim Soo Min — [cem@bmsmile.com]

DPO (Data Protection Officer): Kim Soo Min — [cem@bmsmile.com]

PIPO (Korean PIPA Officer): Kim Soo Min — [cem@bmsmile.com]

§ 11. Modifications to This Privacy Policy

We reserve the right to update this Privacy Policy at any time. For material changes, we will provide at least thirty (30) days’ prior written notice by email to the address associated with your account. Non-material changes take effect upon updating the “Last Updated” date. Your continued use of the Services after the effective date of any modification constitutes your acceptance of the revised Policy.