GAJA Privacy Policy

MajorMap Co., Ltd. (the "Company") values users' personal data and complies with applicable laws, including Indonesia's Personal Data Protection Law (Law No. 27 of 2022, UU PDP) and the Personal Information Protection Act of the Republic of Korea. Through this Privacy Policy, the Company explains for what purposes your personal data is collected and used, how it is protected, and what rights you can exercise.

This Privacy Policy applies to the GAJA mobile application (the "Service").

• Effective date: October 13, 2026
• Version: 1.7

This English version is a translation provided for convenience. If it differs from the Korean version, the Korean version prevails.

Article 1 (Age Restriction)

① The Service may be used only by persons aged 18 or older.

② By agreeing to the Terms and Conditions and this Privacy Policy on the Service's start screen, users confirm that they are 18 or older. The Company does not separately ask for or store dates of birth or ages.

③ If the Company learns that a user under 18 has used the Service by misstating their age, the Company will destroy the account and related personal data without delay. The user or their legal guardian may request destruction at min@majormap.net.

Article 2 (Personal Data Collected and How It Is Collected)

The Company collects the following data at the guest stage (using the Service without creating an account) and at the member stage.

1. Guest stage (before creating an account)

Collection begins when the user agrees on the Service's start screen.

Guest-stage data is also personal data. Although the Company does not collect your name or email address, the guest identifier makes it possible to distinguish and link the records to a specific user, so the Company treats and protects this data as personal data.

2. Member stage (signing in with Google or Apple)

Learning features are available only to members. Therefore, the learning data above is not collected at the guest stage, and the 30-day rule in Article 4(1) does not apply to it.

Viewing your learning status does not collect any additional data. The screen where you check your own learning progress and accuracy rate calculates and shows the items above.

The Company does not store passwords. Sign-in takes place through Google or Apple, and of the information the sign-in provider passes on, only the account identifier and email address are stored. Your display name is not taken from your Google or Apple account; you enter it yourself in the app.

3. How data is collected

• Information you enter or select yourself while using the Service
• Information generated and collected automatically when the app runs (app and device information, request logs, guest identifier), and app error information (section 5) and app usage information (section 6) in release apps using Firebase authentication
• Information received through Firebase Authentication from the sign-in provider you choose (Google or Apple)

4. Information not collected

The Company does not collect the following information.

• Microphone access and voice recordings — listening questions are playback only, and there is no pronunciation assessment feature
• Personal details such as date of birth, gender, or ID numbers (the display name on your profile is chosen by you)
• Payment or card information
• Location information
• Contacts and device storage — the app reads only the photo you choose yourself as your profile photo
• Advertising identifiers

5. App error information

In release apps using Firebase authentication, GAJA automatically collects error reports to improve service stability. There is no separate optional collection item at sign-up or collection switch in settings. Collection choices stored by older versions do not control collection in the new version. The following information is collected when the app stops or an error occurs.

• Error information: the type of error and the call history (stack trace), the app state at that moment, device model, operating system version, app version, and a record of app actions just before the error (short markers such as action names and error types)
• Account distinguishing value: the first 16 characters of the SHA-256 hash of the account's unique ID (UID). The original UID, email address, and name are not sent, and the value is cleared when you sign out.
• Information sent along with it: the error reporting tool's installation identifier, the times the app was opened and closed (to separate usage sessions), and the IP address used to determine the country

The app filters this information so that names, email addresses, learning answers, content returned by the server, web addresses, and sign-in tokens are not included.

6. App usage information

In release apps using Firebase authentication, GAJA automatically collects usage statistics and screen recordings from sampled sessions to improve service stability and learning flows. There is no separate optional collection item at sign-up or collection switch in settings. Collection choices stored by older versions do not control collection in the new version. Existing replay sampling is retained.

• Usage records: actions in the app and records of screens and elements on them being shown (name and time) (for example opening a screen, a card or notice being shown, starting or finishing the level test or a lesson, tapping a button), and the numbers or fixed values that go with them (chapter, stage and lesson numbers, level, a range of correct-answer rate, sign-in method, screen or element name)
• How screens are used: in some sessions, the layout of app screens and taps and swipes are recorded in a form that can be replayed. Text in input fields, names, email addresses and profile photos are hidden in the recording.
• Device and app information: a random device identifier created by the app, a session number, operating system type, app version, app language, the country from the device's region setting, the device's time zone (offset from UTC) and the local hour and weekday
• Profile information: the nationality and learning goal the user chose, and the Korean level set by the level test
• Account distinguishing value: the same account distinguishing value as in section 5 of this Article.

Learning answers, names, email addresses, typed text, location information and advertising identifiers are not included in app usage information, and no IP address is sent with it.

Article 3 (Purposes of Processing and Collection Methods)

The Company uses the collected personal data only for the following purposes, and obtains separate consent if a purpose changes.

App error information is not used for advertising, personalized advertising, marketing, or user behavior analysis.

App usage information is not used for advertising, personalized advertising or marketing, and is not combined with information from other companies.

Article 4 (Retention and Use Period)

1. Guest-stage data

Kept for 30 days from the date of collection. After 30 days, the guest identifier and device information are deleted so that the data becomes statistical information that cannot identify a specific individual. This is done periodically in batches.

• The converted statistical information is kept indefinitely to verify the accuracy of test questions.
• After conversion, a specific user's records can no longer be found, so deletion requests cannot be fulfilled.
• You can delete the records yourself at any time before 30 days pass, using the method in Article 8.

2. Member-stage data

Kept until you delete your account, and destroyed when you delete it. However, if laws require certain information to be kept, it is stored separately for the required period.

Request logs are kept for 30 days from the day they are recorded (for both guests and members). After account deletion, database backups (up to 7 days), request logs (up to 30 days), and copies of the profile photo left in storage and the content delivery network (up to 7 days) may remain until they are deleted automatically, and they are not used for any other purpose.

App error information enters deletion 90 days after collection, according to the standard published by Google, which operates the error reporting tool. Even if you delete your account, information already sent disappears only after this period, and it is not used for any other purpose in the meantime.

App usage information is deleted one year after collection, and records of how screens are used are deleted 30 days after collection. If you delete your account, the Company promptly asks the analytics provider to delete that account's app usage information, and the provider deletes it within 30 days of receiving the request.

3. Destruction procedure and method

• Personal data whose retention period has passed or whose processing purpose has been achieved is destroyed. Destruction may be carried out periodically in batches.
• Electronic files are deleted in a way that cannot be recovered.
• For guest-stage data, removing identifying information as described in Article 4(1) may take the place of destruction.

Article 5 (Provision of Personal Data to Third Parties)

The Company does not provide users' personal data to third parties, except in the following cases.

• When the user has consented in advance
• When investigative authorities or others request it through lawful procedures under the law

Information shown to other users — You take part in the weekly ranking automatically, and appear in an event ranking only for events you join. Other users in the same ranking group or event can see your display name, profile photo (if you uploaded one), rank, score, progress, and accuracy rate. Your email address and nationality are not shown. Your profile photo is delivered from an address with a random name that does not reveal your account, and anyone who receives that address can view the photo. You can change your display name and profile photo at any time in "My info"; if you delete the photo, other users also see a default image.

Article 6 (Outsourcing of Personal Data Processing)

The Company outsources personal data processing as follows to provide the Service.

The Company sets out matters concerning the safe management of personal data in its outsourcing contracts. If the outsourced tasks or processors change, the Company will announce it through this Privacy Policy.

Article 7 (Cross-border Transfer of Personal Data)

1. Where data is stored

Databases and files (including profile photos) are stored on servers in the Indonesia (Jakarta) region. However, request logs are stored in Google Cloud's logging service, whose location is "global", and media files may be temporarily copied to Google cache servers worldwide for faster downloads.

2. Data transferred abroad

Personal data is transferred outside Indonesia in the following cases.

Transfers for sign-in and notifications happen when the user starts as a guest, chooses that sign-in method, or agrees to receive notifications. Request logs and cache copies happen each time the app communicates with the server. App error information and app usage information are collected automatically in release apps using Firebase authentication, as described in Article 2.

3. Access from the Republic of Korea

The Company is a corporation located in the Republic of Korea. To operate the Service, respond to outages, and handle user inquiries, it accesses personal data on the Jakarta region servers from Korea. Access rights are granted only to the minimum number of staff necessary for their work.

4. Refusing transfers

You can refuse cross-border transfers. However, because the transfers above are essential to providing the Service, refusing may restrict the corresponding sign-in method or use of the Service.

Article 8 (Users' Rights and How to Exercise Them)

You can exercise the following rights at any time.

1. The right to request access to your personal data
2. The right to request correction if there is an error
3. The right to request deletion
4. The right to request suspension of processing
5. The right to withdraw consent you have given

The Company processes received requests without delay. However, requests to correct personal data are processed within 72 hours of receipt in accordance with applicable laws.

Requests you can make yourself on the in-app settings screen (access, deletion, account deletion) are processed as soon as you carry them out, and no separate reply is sent.

1. How members exercise their rights

You can do this yourself on the in-app settings screen, or send a request to min@majormap.net.

• Access: My page (display name, profile photo, email address, nationality, goal level, level). For other information, send a request to min@majormap.net
• Deleting your account: My page → Delete account. You can also request account and associated data deletion at min@majormap.net without reinstalling the app.
• App error information is collected automatically as described in Article 2. Requests to access, delete or suspend processing can be sent to min@majormap.net.
• App usage information is collected automatically as described in Article 2. There is no separate collection switch in settings, and choices stored by older versions do not control collection in the new version.
• When you delete your account, personal data collected at the member stage is destroyed without delay.

2. How guests exercise their rights

At the guest stage there is no account, so identity cannot be verified. Rights can therefore be exercised only on the device concerned. Guests can edit names/photos, participate in weekly/event rankings, choose notifications and use the inbox. System and marketing push each require the relevant receiving choice, OS permission and a valid registered device. Neither is enabled automatically. Choices are changed in My page → Notification settings. Service notices continue to appear in the inbox under the existing policy. Linking a guest to a new member account retains records and notification choices. Signing into an existing member account uses that account's records without combining guest XP or event records.

• Deletion request: In-app Settings → "Delete my test records"
• Withdrawing consent: handled in the same way as deletion above
• App error information is collected automatically as described in Article 2. Requests to access, delete or suspend processing can be sent to min@majormap.net.
• App usage information is collected automatically as described in Article 2. There is no separate collection switch in settings, and choices stored by older versions do not control collection in the new version.

Please note the following limits on exercising guest rights.

• If you delete and reinstall the app, a new guest identifier is created, so previously collected records cannot be found and deleted.
• Records cannot be deleted from a different device.
• Records you have not deleted have their identifying information removed under Article 4(1) 30 days after collection, after which deletion requests cannot be fulfilled.

If you are concerned about these limits, create an account after completing the test. You can then check and delete your records through your account at any time.

Article 9 (Measures to Ensure the Security of Personal Data)

The Company takes the following measures to keep personal data secure.

• Limiting the staff who can access personal data to the minimum necessary for their work, and managing access rights
• Using encrypted communication (TLS) when sending and receiving personal data
• Keeping records of system administration activities and server requests
• Informing staff who process personal data of their protection obligations

Article 10 (Sending Notifications and Opting Out)

① The Company sends system notifications (study reminders) and marketing notifications (announcements and promotions) only when the user has consented to each.

② To send notifications, the Company collects the device's notification token and time zone, and uses them only to send notifications at an appropriate time. Notification tokens are processed through the notification delivery systems provided by Apple and Google.

③ Consent to receive notifications is given in the following two steps.

• Turning on "Consent to receive system notifications" or "Consent to receive marketing notifications" in the app's "Notification settings"
• Allowing the notification permission request shown by the device's operating system

④ You can refuse notifications in the following ways.

• Turn them off in In-app Settings → "Notification settings"
• Block them in the notification settings of the device's operating system

⑤ Not consenting to or withdrawing consent to notifications does not restrict the use of other features of the Service.

⑥ Marketing notifications are sent only to users who have separately agreed to receive them, and this consent can be turned off at any time, independently of study reminders.

⑦ Notification tokens are destroyed without delay when you delete your account or turn off notifications.

⑧ Notifications sent are also kept in the in-app inbox and are deleted automatically after 90 days.

Article 11 (Automatic Collection of Personal Data)

Each time the app communicates with the server, the Company automatically records request logs (IP address, app type and version, request address and time, request result, internal user number) for service security and error response. No external advertising tools are used. App error information is sent to the error reporting tool (Firebase Crashlytics), and app usage information to the analytics tool (Amplitude), automatically in release apps using Firebase authentication (Article 2(5) and (6)).

• The items collected automatically and their purposes are listed in Articles 2 and 3.
• The Company does not collect advertising identifiers and does not provide personalized advertising.
• You can stop automatic collection by deleting the app.
• There is no separate optional collection item at sign-up or collection switch in settings for app error information.
• There is no separate optional collection item at sign-up or collection switch in settings for app usage information. Collection choices stored by older versions do not control collection in the new version.

Article 12 (Privacy Officer and Contact)

The Company has designated the following privacy officer, who is responsible overall for personal data processing.

You can send inquiries, complaints, and requests for remedies related to personal data protection to the contact above, and the Company will respond within a reasonable period.

Article 13 (Remedies for Infringement of Rights)

To obtain remedies for damage caused by an infringement of personal data, you can report to or seek advice from the following organizations.

Indonesia

• Ministry of Communication and Digital Affairs (Kementerian Komunikasi dan Digital, Komdigi) — Directorate General of Digital Space Supervision
• Until a separate personal data protection supervisory authority is established under the UU PDP, the Ministry of Communication and Digital Affairs handles related matters.
• Website: komdigi.go.id

Republic of Korea

• Personal Information Dispute Mediation Committee — kopico.go.kr / 1833-6972
• Personal Information Infringement Report Center — privacy.kisa.or.kr / 118

Article 14 (Changes to This Privacy Policy)

① If this Privacy Policy changes, the Company will announce the changes and their effective date through in-app notices.

② The notification method and consent procedure differ depending on the nature of the change.

The Company gives notice through in-app notices or by posting on the Service screens, and does not notify users individually.

③ Version 1.6 replaces prior wording premised on optional consent to, or withdrawal of, app error and usage information collection with the automatic collection described in Article 2. Notice and effective dates reflect actual public publication on October 9, 2026.

④ Version 1.7 changes the weekly and event rankings so that your profile photo is shown to other users (Articles 3 and 5). Notice and effective dates reflect actual public publication on October 13, 2026.

Addendum — Version 1.7 was published and takes effect on October 13, 2026.