Privacy Policy v1.3

3R Innovation Co., Ltd. (hereinafter the "Company"), which provides the entire Moment (Moment Lumina) service (hereinafter the "Service"), complies with the Personal Information Protection Act (PIPA) and related laws and regulations, lawfully processing and safely managing personal information. Accordingly, pursuant to Article 30 of the Personal Information Protection Act (PIPA), the Company establishes and discloses this Privacy Policy as follows, in order to inform data subjects of the procedures and standards concerning the processing and protection of personal information, and to enable prompt and smooth handling of related grievances.

◻ Purpose of Processing Personal Information The Company processes personal information for the following purposes. Personal information being processed will not be used for purposes other than the following, and if the purpose of use changes, the Company will take necessary measures, such as obtaining separate consent, pursuant to Article 18 of the Personal Information Protection Act. ⦁ Use for member management, provision and improvement of the Service, development of new services, etc. • Identity verification, personal identification, confirmation of intent to join, and identity/age verification in connection with the use of membership services • Verification of whether the legal representative's consent has been obtained when collecting personal information of a child under the age of 14, and identity verification when the legal representative exercises their rights ※ When collecting personal information of a child under the age of 14, the Company must obtain the consent of the legal representative pursuant to the Personal Information Protection Act. Accordingly, the Company obtains the legal representative's consent at the time personal information of a child under the age of 14 is collected, and in this process verifies the legal representative through the legal representative's name, email, or the identity verification method used in the relevant country. The legal representative's information collected at this time is linked via an encrypted parent-child identification number and is not recorded or stored. • Provision of interpretive messages through analysis of the Child's digital behavioral data (including sensor data) • Providing functions such as notifying acquaintances of activity records (sharing), and searching for and registering Users (children) • Delivery of content (detailed reports, newsletters, etc.), and payment, settlement, and history of fees when using paid services • Accrual and use of tier/reward/point status through community services (posts, comments, etc.) • Prevention of and sanctions against acts that interfere with the smooth operation of the Service (including account theft and fraudulent use) • Use in marketing, including personalized content recommendations and events, advertising, etc., through demographic characteristics and inference of a User's interests, preferences, and tendencies • Use in statistical research for child development and attention analysis • Development of new services, improvement of Service functions, provision of personalized services, and establishment of a Service environment for privacy protection • Statistics on Service usage records, access frequency, and use of the Service • Compliance with the Terms of Use and legal obligations, and response to retention/provision requirements under applicable laws • Preservation of records for dispute mediation, and handling of complaints and other grievances • Delivery of notices

⦁ The Company may provide personalized reports based on a User's usage pattern data. However, automated analysis and profiling do not replace legal or medical judgment and are not accorded any legal effect. Furthermore, such analysis and profiling may not be used as evidentiary material of any kind in connection therewith, and the Company bears no legal liability whatsoever for a User's arbitrary use of results that is inconsistent with the purpose of providing/processing this Service.

◻ Items of Personal Information Processed At the time of membership registration or in the course of using the Service, the Company collects and processes the minimum personal information necessary to provide the Service through the website or individual applications or programs. The minimum information strictly necessary for the provision of the Service is collected as a required item, and information additionally collected to provide other specialized services is collected as an optional item with separate consent; use of the Service is not restricted even if a User does not consent to the optional items. However, if a User refuses or withdraws consent to the collection of certain personal information, use of some or all functions of the Service may be restricted.

⦁ Operation of membership services • Required items: nickname (name), password, age group, linkage information for a parent account for users under the age of 14 (encrypted user verification value) • Optional items: email ※ A User may freely set a nickname (name) unrelated to their real name, and such nickname is operated so that it alone cannot directly identify a specific individual. ※ The Company may collect an email address for purposes such as password reset, delivery of important notices, and identity verification. (For users under the age of 14, the email address of the user themselves or of the legal representative is additionally collected.) If an email address is not provided, functions such as password recovery and receipt of notices via email may be restricted, but this does not affect the use of the core functions of the Service. The primary reason an email address is required is for security purposes. Moment uses the email address to authenticate the legitimacy of an account, and the email address may be changed at any time. The Company stores email addresses and passwords using secure encryption (e.g., one-way hashing) and does not retain the original text. The encrypted information cannot be used to recover an email address or to contact the customer, and is used solely for authentication purposes for identity verification.

⦁ Information that may be automatically generated and collected in the course of using the Service • Device information (device model name, OS version, browser information, unique device identification value) • IP address, access records, cookies • Sensor data (screen usage time, frequency of app switching, touch patterns, movement/posture data, sound, etc.) • Purpose of collection: data analyzing the User's emotion, concentration, and engagement • Retention period: until the app/web session ends ※ Data analyzing emotion, concentration, and engagement, which is derived based on logs of digital behavioral data (e.g., de-identified behavioral records such as app usage patterns, screen transitions, touch responses, etc.) generated while the User is using the Service, is statistically processed so that a specific individual cannot be directly identified. This is not information collected for the purpose of identifying a specific individual through their physical, physiological, or behavioral characteristics.

⦁ Use of device permissions The Company may use the following device permissions to provide the Service. Access permissions that have been consented to may be withdrawn at any time through the User's device settings menu. However, if a User refuses or withdraws consent to a permission designated as required for a given service in the Terms of Use, use of some or all functions of the Service may be restricted. • Accessibility permission: collection of app usage pattern data (e.g., whether there is touch input, whether there is app switching, etc.) • Usage Stats: app usage time and timing, and switching records by device • Notification Access: checking and analyzing device notification information • Location: collection of the device's location information for analysis of concentration patterns and provision of personalized reports • Display over other apps: display of visual elements for immediate feedback or notifications • Files and media: uploading of image content • Camera: taking photos within the Service • Exclusion from battery optimization

⦁ Personal information not collected The Company never collects the following sensitive information and personal content: • Keyboard input values (the text content itself) • Camera-captured images (faces) and photo/video recordings • Contacts/address book, chats, messages, call content (body text), or voice recordings • Precise GPS location information • Sensitive information such as a child's academic records or psychological assessment data

⦁ When using paid services Users may purchase paid services (e.g., report usage passes, subscription services, etc.), and may select their preferred payment method from among the payment means provided. • Payment method: in-app payment (Google, Apple) • Information provided at the time of payment: purchased item and quantity, payment information (card company, approval number, payment date/time), refund processing information (if necessary, bank name, account number, account holder's name, email) ※ To process a User's purchases, receipts, and other financial transactions, and to allow the User to access and view the history of their payment and transaction information, the Company collects and stores such information.

⦁ When using the community Users may freely use the community provided within the Service, and the Company may monitor whether use complies with the Terms of Use and community operating policies. • Content of posts/comments, attached images/video materials, activity history If the Company determines that content does not comply with the Terms of Use and policies, such as inappropriate content or content containing personal information, the Company retains the authority to modify or remove it.

◻ Matters Concerning the Processing of Personal Information of Children Under the Age of 14 ⦁ Where consent is required for the Company to process personal information of a child under the age of 14, the Company obtains such consent from the child's legal representative. ⦁ When obtaining the legal representative's consent regarding the processing of personal information of a child under the age of 14, the Company may request minimal information from the child, such as the legal representative's name and email, and confirms the consent by having the legal representative indicate their consent on the website or application on which the consent content is posted, and by notifying the legal representative via email that their indication of consent has been confirmed. ⦁ The legal representative's right to withdraw consent: the legal representative may withdraw consent at any time, and upon withdrawal of consent, the relevant child's personal information will be immediately destroyed. ⦁ Special protective measures when processing children's personal information: enhanced security measures beyond those applicable to adults are applied to children's personal information, and use for marketing purposes is prohibited.

◻ Period of Processing and Retention of Personal Information ⦁ The Company processes and retains personal information within the period of retention and use of personal information prescribed by applicable laws, or the period consented to by the User at the time personal information is collected. In principle, once the purpose of collecting and using personal information has been achieved or a User requests deletion of their personal information, the Company destroys such personal information without delay. ⦁ However, where retention is necessary pursuant to relevant laws and regulations, the Company retains personal information for the period prescribed by such laws and regulations, as follows: • Records concerning contracts or withdrawal of subscription, etc.: 5 years (Act on the Consumer Protection in Electronic Commerce) • Records concerning payment and supply of goods, etc.: 5 years (Act on the Consumer Protection in Electronic Commerce) • Records concerning consumer complaints or dispute handling: 3 years (Act on the Consumer Protection in Electronic Commerce) • Access records (logs) related to Service use: 3 months (Protection of Communications Secrets Act) • Records for preventing re-registration after membership withdrawal and for handling complaints: 30 days (the Company's internal policy) • Where a separate retention rule applies under foreign laws (e.g., the Children's Online Privacy Protection Act (COPPA), the California Consumer Privacy Act (CCPA), the General Data Protection Regulation (GDPR), etc.): such rule shall govern.

⦁ Pursuant to Article 39-6 of the Personal Information Protection Act, the Company takes the following measures to protect the personal information of Users who have had no record of using the Service for 12 months (1 year) or more, based on their last login (hereinafter "dormant Users"): • 30 days before conversion to dormant User status, the Company notifies the User by email, text message, etc. of the fact that personal information will be destroyed or separately stored, the expiration date of the validity period, and the items of personal information to be destroyed. • Personal information of a dormant User whose validity period has arrived is destroyed, or is separately stored and managed apart from other Users' personal information. • However, if the User is using a paid service or has an unresolved inquiry pending, conversion to dormant status is deferred until such matter is completed. ⦁ If a User requests deletion of their own personal information, the Company immediately destroys such personal information, unless the Company is obligated to retain it pursuant to relevant laws and regulations and this Policy.

1. Retention period of Service operation data ⦁ The Company retains Service operation data as follows, for the purpose of providing the Service and analyzing a User's long-term usage patterns.

| Category | Retention Period | | --- | --- | | Digital usage behavioral data | 2 years from the date of collection | | Analysis results based on behavioral data | 3 years from the date of generation | | Daily reports | 3 years from the date of generation | | Weekly reports | 5 years from the date of generation | | Monthly reports | 5 years from the date of generation |

⦁ Data whose retention period has elapsed may be deleted by a method that renders it unrecoverable, or converted into and retained as de-identified information for statistical purposes.

⦁ Upon membership withdrawal or a request to delete a child, the Company deletes the relevant information without delay, except for information required to be retained under relevant laws and regulations.

◻ Matters Concerning the Provision of Personal Information to Third Parties ⦁ Current status of provision to third parties: the Company currently does not provide Users' personal information to third parties. If the provision of personal information to third parties becomes necessary in the future, the Company will obtain prior consent in accordance with relevant laws and regulations, or will clearly disclose the legal basis therefor. ⦁ The Company does not provide personal information to outside parties without a User's prior consent. However, within the scope reasonably related to the purpose of collection, the Company may use personal information or provide it to third parties without a User's consent, in accordance with relevant laws and regulations. ⦁ In doing so, the Company comprehensively considers whether there is relevance to the originally intended purpose of collection, whether the additional use or provision of personal information is foreseeable in light of the circumstances of collection or processing practices, whether it unduly infringes on the User's interests, and whether measures necessary to ensure safety, such as pseudonymization or encryption, have been taken. ⦁ The Company may process personal information it has collected by pseudonymizing it so that a specific individual cannot be identified, for purposes such as compiling statistics or scientific research. In such cases, the pseudonymized information is stored and managed separately from the additional information needed for re-identification, so that re-identification is not possible, and necessary technical and administrative protective measures are taken.

◻ Matters Concerning Outsourcing of Personal Information Processing ⦁ The Company may outsource part of its personal information processing operations to outside parties where necessary for the provision of the Service. The Company restricts the outsourced company from processing personal information for purposes other than the outsourced task, and manages and supervises the outsourced company's compliance with laws and regulations related to personal information protection (Article 26 of the Personal Information Protection Act), including the application of technical and administrative protective measures and restrictions on re-outsourcing. • Payment processing: Google, Apple (in-app payment) • Text message/email delivery: Aligo (02-511-4560)

◻ Matters Concerning Overseas Transfer of Personal Information ⦁ The Company may use overseas servers (e.g., AWS, GCP — located in the United States) to provide the Service, in which case personal information may be transferred overseas. ⦁ In the event of an overseas transfer, the Company will give prior notice of the destination country, purpose, timing, and retention period of the transfer, and obtain consent. Users may refuse the overseas transfer of their personal information through customer service or in-Service settings, and if a User refuses such transfer, use of a service that necessarily involves the overseas transfer of personal information may be restricted. ⦁ Upon withdrawal of consent to an overseas transfer, the Company will cease the overseas transmission of the relevant data within 72 hours.

◻ Procedures and Methods for Destruction of Personal Information ⦁ When the purpose of collection and use has been achieved, or a ground for destruction such as membership withdrawal has arisen, the Company determines the method of destruction in consideration of the form of the personal information and destroys it without delay. In the case of electronic files, the Company safely deletes the information so that it cannot be recovered or reproduced; in the case of records, printed materials, documents, etc., the Company destroys them by shredding or incineration. ⦁ Information that is retained for a certain period before destruction is as follows: • Retained for up to 1 year from the date of withdrawal, then destroyed • The email address used for the withdrawal notice is retained in encrypted form for sending guidance emails and responding to CS inquiries • Records of fraudulent use of the Service • Records of reports of rights infringement and harmful information are retained for 5 years, then destroyed • Encrypted user verification values (CI), card receipt items, and detailed transaction records are retained for 1 year from the date of withdrawal, then destroyed

⦁ When destroying personal information, the Company internally records and manages the date and time of destruction, the person responsible, and the method of destruction, and retains such records for 3 years.

◻ Matters Concerning Measures to Ensure the Safety of Personal Information The Company takes the following measures to ensure the safety of personal information. ⦁ Encryption of Users' personal information. The Company transmits Users' personal information through encrypted communication channels, and stores important information such as passwords in encrypted form. ⦁ Establishment of technical measures against hacking, etc. The Company installs security programs and periodically updates and inspects them to prevent Users' personal information from being leaked or damaged by hacking, viruses, etc. The Company installs systems in areas where external access is controlled, and technically and physically monitors and blocks such access. ⦁ Minimization of the number of persons with access to personal information. The Company limits to a minimum the number of executives and employees who process personal information. The Company also has established systematic standards for the creation and modification of passwords for personal information processing systems and for the authority to access such systems. ⦁ Regular training for personal information handlers on the protection of Users' personal information. The Company conducts regular training on the duties and security of personal information protection for all personal information handlers who process personal information. ⦁ Documents and auxiliary storage media containing personal information are stored in a safe location equipped with a locking device.

◻ Matters Concerning Automatic Personal Information Collection Devices (Installation, Operation, and Refusal) The Company uses "cookies" that store and periodically retrieve usage information, in order to provide individualized services and convenience to data subjects. ⦁ What is a cookie? A cookie is a small amount of information sent by the server used to operate a website to a data subject's browser; it is stored on the data subject's computer or mobile device, and is automatically transmitted from the data subject's browser back to the server when the website is accessed. ⦁ Purpose of use The Company uses cookies, which store and periodically retrieve a User's information, in order to provide individualized and customized services. When a User visits the Service's website, the website server reads the cookie stored on the User's device to maintain the User's preference settings and provide a customized service. Cookies help the User access and conveniently use the website as configured whenever the User visits it. Cookies are also used to provide customized information, such as optimized advertisements, based on the User's website visit history and usage patterns. ⦁ Refusal of cookie collection A User has the option of whether to install cookies, and may allow or refuse cookies through the cookie settings accessed via the path "Settings > Privacy and Security > Cookies and Other Site Data" at the top of the web browser. However, if a User refuses to install cookies, use of the website may become inconvenient, and use of some services that require login may become difficult.

Allowing/blocking cookies in a web browser Chrome: Browser Settings > Privacy and Security > Clear Browsing Data Edge: Browser Settings > Cookies and Site Permissions > Manage and Delete Cookies and Site Data

Allowing/blocking cookies in a mobile browser Chrome: Mobile Browser Settings > Privacy and Security > Clear Browsing Data Safari: Mobile Device Settings > Safari > Advanced > Block All Cookies Samsung Internet: Mobile Browser Settings > Browsing Data > Clear Browsing Data Identification information in mobile apps: Mobile apps may use a unique identification value generated when the app is installed, instead of cookies. A User may reset this identification value by deleting and reinstalling the app, and may use the ad-tracking limitation feature in the device settings.

◻ Matters Concerning the Rights and Obligations of Data Subjects and Legal Representatives and Methods of Exercising Them ⦁ A data subject may at any time request the Company to access, transmit, correct, delete, or suspend the processing of, and to withdraw consent to, their personal information (hereinafter "exercise of rights"). ⦁ The exercise of rights of a child under the age of 14 must be made directly by the legal representative; a data subject who is a minor aged 14 or older may exercise rights with respect to their own personal information either personally or through a legal representative. ⦁ The exercise of rights may be made to the Company in writing, by telephone, by email, via the internet, etc., pursuant to Article 41(1) of the Enforcement Decree of the Personal Information Protection Act, and the Company will take action thereon without delay. ⦁ A data subject's right to request access to, and suspension of processing of, their personal information may be restricted pursuant to Article 35(4) and Article 37(2) of the Personal Information Protection Act. ⦁ Where other laws specify that certain personal information is subject to collection, deletion of such personal information may not be requested. ⦁ A data subject may exercise their rights to the department below. The Company will respond within 10 days from the date the request to exercise rights is received from the data subject (without delay in the case of a request for transmission). Department for receiving and handling requests to exercise personal information rights Department: Platform Team Address: 401 Tips Town, 99 Daehak-ro, Yuseong-gu, Daejeon Contact: moment-care@momentlumina.com

◻ Privacy Officer (Data Protection Officer) and Grievance Handling Department ⦁ The Company designates a Privacy Officer (Data Protection Officer) and a grievance handling department to handle Users' inquiries and complaints regarding personal information. Privacy Officer (Data Protection Officer) and Grievance Handling Department Officer: Privacy Officer, DPO Address: 401 Tips Town, 99 Daehak-ro, Yuseong-gu, Daejeon Contact: moment-care@momentlumina.com

⦁ A data subject may apply to the Personal Information Dispute Mediation Committee, the Korea Internet & Security Agency's Personal Information Infringement Report Center, etc., for dispute resolution or consultation in order to obtain relief for infringement of personal information. For other reports of, or consultation regarding, personal information infringement, please contact the institutions below. • Personal Information Dispute Mediation Committee: 1833-6972 (no area code) (www.kopico.go.kr) • Personal Information Infringement Report Center: 118 (no area code) (privacy.kisa.or.kr) • Supreme Prosecutors' Office: 1301 (no area code) (www.spo.go.kr) • National Police Agency: 182 (no area code) (ecrm.cyber.go.kr)

◻ Notice of Obligation to Give Prior Notice of Amendments, etc. The Company may amend this Privacy Policy to reflect changes in laws and regulations or in the Service, among other purposes. If this Privacy Policy is amended, the Company will give prior notice of the changes at least 7 days in advance. However, where a material change to Users' rights occurs, the Company will give notice at least 30 days in advance.

⦁ Date of announcement: May 27, 2026 ⦁ Effective date: June 1, 2026