Newtonne Inc. Gravitonne Privacy Policy

This is an English translation of the Korean original (version v2.2-2026-10-03, effective October 3, 2026). If there is any inconsistency between the Korean and English versions, the Korean version prevails to the extent permitted by applicable law.

Newtonne Inc. (the "Company") has established this Privacy Policy in accordance with the Personal Information Protection Act to protect users' personal information and to handle related grievances promptly. This Privacy Policy applies to the Gravitonne pages on gravitonne.newtonne.io (the home page, the free Trial application, My application, the consent screen, and this Privacy Policy and the Terms of Use) and to the Gravitonne MCP access address (gravitonne.newtonne.io/mcp). Other services on the same domain are governed by their own privacy policies.

Contents

1. Purposes of Processing
2. Items Processed and Legal Grounds for Processing
3. Period of Retention and Use
4. Destruction Procedures and Methods
5. Provision to Third Parties
6. Entrustment of Processing
7. Transfer Overseas
8. Users' Rights and How to Exercise Them
9. Measures to Ensure Safety
10. Cookies and Other Automatic Collection Devices
11. Information on the Generative AI Service
12. Children Under the Age of 14
13. Department in Charge of Privacy and Grievance Handling
14. Remedies for Infringement of Rights and Interests
15. Changes to the Privacy Policy

---

1. Purposes of Processing

The Company processes personal information for the following purposes. If a purpose changes, the Company takes the measures required by law, such as obtaining separate consent.

2. Items Processed and Legal Grounds for Processing

The Company processes only the minimum personal information necessary for the purposes of processing.

• Query information is processed to generate answers. For users who have not given optional consent to use for AI training, query information is not stored in the Company's database after the answer is generated.
• The Company does not receive the entire conversation between users and their AI apps or the answers that the AI apps ultimately display; these are governed by the policies of the AI service chosen by the user.
• The Company does not collect sensitive information or unique identification information (such as resident registration numbers). The Company advises users not to enter such information in their questions.
• Refusing optional consent causes no disadvantage in Trial application, approval or use. Optional items not consented to at the time of application can also be consented to later on My application until the application is withdrawn, and consent can be withdrawn at any time. Consent given later applies from that time (for AI training, only questions asked after consent are stored), and the Company records the dates and times of consent and withdrawal and the document version.
• Correction records are used only for the same purposes as the application information (deciding whether to approve, confirming application details, handling disputes), and are destroyed together with the application information when the application is withdrawn.
• The information received from Google when signing in to My application (name, email, profile photo URL) is used only for identity verification and keeping the user signed in; it is kept only in the browser's sign-in cookie (§10) and is not stored in the Company's database.
• Website visit statistics: To improve the website and to see which promotional links lead to applications (usage statistics as part of service operation, §1), the Company uses the visit analytics of its website hosting provider Vercel (Vercel Web Analytics).
  • The data concerned are the address of the landing, application, Privacy Policy and Terms of Use pages visited (query parameters other than utm_* removed), the entry path (referrer and promotional link tag), the country and region estimated from the access IP address, the type of device, operating system and browser, and page interaction events (location of the apply-button click, first input in the application form, click of the apply button, time-spent tier per landing page section, language switches) with their date and time. My application and the consent screen, which are used after signing in, are not covered.
  • Vercel estimates the location and creates a visitor identifier that lasts only 24 hours from the IP address and browser information of the access request, and does not keep the IP address in the statistics records. No cookies or advertising identifiers are used. Names, email addresses, input content and application numbers are not sent.
  • The Company views only aggregated figures of one day or longer on Vercel's dashboard and does not compare or link them with application information. These statistics are kept separate from the personal information processed with consent above, are used only as statistics that do not identify individuals, and are not used for advertising.
  • The first entry path (link source) is kept in the session storage of the user's browser tab and is erased when the tab is closed (§10).

3. Period of Retention and Use

• "End of use" means when the user requests to stop (including withdrawing the application or stopping use on My application), when the Company revokes use under the Terms of Use, or when the service ends.
• Records retained after end of use or withdrawal are kept without consent under Article 15(1)6 of the Personal Information Protection Act (justifiable interests of the personal information controller) to check for duplicate applications and reapplications, check for fraudulent use and handle disputes. All other personal information is destroyed without delay upon the end of use or withdrawal of consent. However, backups for disaster recovery (§4) and internal notifications (Slack; names and emails excluded; 1 year from the date of posting) are deleted when their respective periods end.
• When an application is withdrawn or use ends, optional consents are also recorded as withdrawn, and the retained records are not used for interview or survey contact or for notice emails.
• If a person reapplies with the same application email, the staff in charge use these records to check the outcome of the previous application and take it into account when deciding whether to approve. The mere fact that the person withdrew on their own is not treated unfavorably, and the previous application information and optional consents are not reused. Reapplying does not extend the retention period of these records.

4. Destruction Procedures and Methods

1. Personal information whose retention period has expired or whose purpose of processing has been achieved is destroyed without delay.
2. Electronic files are deleted from databases and storage. Personal information is not kept in paper documents.
3. Database backups for disaster recovery are kept in the Republic of Korea (AWS Seoul Region) and are deleted after approximately 150 days. Information destroyed in the service database may remain in backups during this period, and when a backup is used for recovery, information that has already been destroyed is deleted again.
4. Data already reflected in AI model training is difficult to reverse from the trained model. If consent is withdrawn, the data is not used for subsequent training.

5. Provision to Third Parties

The Company does not provide users' personal information to third parties. However, an exception applies where laws and regulations have special provisions.

6. Entrustment of Processing

The Company entrusts personal information processing tasks as follows to provide the service.

Overseas entrusted parties are listed in Section 7. Through contracts with entrusted parties (including data processing agreements), the Company stipulates the prohibition of processing beyond the entrusted tasks, safety measures, restrictions on re-entrustment, management and supervision, liability for damages and other matters, and manages whether entrusted parties process personal information safely. If an entrusted party or entrusted task changes, the Company gives notice through this Privacy Policy.

7. Transfer Overseas

To provide the Trial service, the Company entrusts personal information processing tasks to overseas businesses as set out below (overseas entrustment of processing and storage). The legal grounds for the transfer overseas are as follows.

1. Users who consented to the transfer overseas on the application form or the consent screen on or after October 1, 2026: Article 28-8(1)1 of the Personal Information Protection Act (separate consent)
2. Accounts that consented before October 1, 2026 and continue to use the service (in-house accounts): subparagraph 3(a) of the same paragraph (entrustment of processing and storage for the performance of a contract, disclosed in this Privacy Policy). Existing use by external users ends on September 30, 2026, and they consent under subparagraph 1 when they reapply.
3. Customer consultation information: subparagraph 3(a) of the same paragraph
4. Access records of website visitors who have not applied (Vercel): entrustment of processing needed to display web pages and receive applications, under subparagraph 3(a) of the same paragraph (disclosed in this Privacy Policy)

Transmissions over external network segments are encrypted (TLS: encryption in transit).

• Under commercial contracts, the AI model and embedding providers used by the Company (Amazon Bedrock, Anthropic, OpenAI) do not use the inputs and outputs they receive to train their own AI models.
• The information received through Google sign-in (name, email, Google account identifier, profile photo URL) is received from Google because the user consents to linking their Google account; the Company does not entrust its processing to Google.
• Users who wish to refuse the transfer overseas may do so by not applying or, if they are already using the Trial, by stopping use on My application (/en/trial/me) or by requesting to stop use via the contact email. Since answers cannot be generated and the website cannot be used without the transfer overseas, users who refuse cannot use the Trial.

8. Users' Rights and How to Exercise Them

1. Users may at any time request access to, correction or deletion of, or suspension of processing of their personal information, and may withdraw consent.
2. Requests can be made on My application (/en/trial/me) or by the contact email (gravitonne@newtonne.io). On My application, after verifying their identity by signing in with a Google account that has the same email as the application email, users can immediately access and correct their application details (name, organization name, team name, job/role, purpose of application) and processing status, change optional consents, and withdraw the application or stop use. Because the application email is the value used for sign-in and identity verification, it cannot be changed on My application. If it was entered incorrectly or needs to be changed, users can request a correction by the contact email, or withdraw the application and reapply with a new email. Requests to access, correct or delete other personal information, such as account information, service usage records, query information and correction records, and requests from users who cannot sign in with Google using the application email, can be made by the contact email. For a request made by the contact email, the Company checks whether it was sent from the application email and, if necessary, sends a confirmation email to the application email to verify identity, then takes action within 10 days of receiving the request and notifies the user of the result. If, in accordance with laws and regulations, the Company restricts, postpones or refuses access, or does not comply with a request for correction, deletion or suspension of processing, it also notifies the user of the reason and how to file an objection. An objection may be filed to the same contact email (gravitonne@newtonne.io) within 30 days of receiving the result, and the Company reviews the matter again and notifies the user of the result within 10 days of receiving the objection.
3. Consent to use for AI training can be withdrawn immediately by unchecking it on My application or the consent screen (/en/consent). Upon withdrawal, subsequent questions are not stored, and originals being kept are deleted without delay (if requested by email, they are deleted within 3 business days from the date of the request; in backups, they are deleted after about 150 days).
4. Consent to interview and survey requests can be withdrawn on My application, on the consent screen, through the 'Do not contact me' link in request emails, or by the contact email.
5. If a user withdraws required consent (including withdrawing the application or stopping use on My application) or requests deletion, Trial use ends. The application information (including correction records) and, if the application had been approved, the account information, account usage information, service usage records and AI training data are destroyed immediately, and other personal information is destroyed without delay, except for the records retained under §3. Even after stopping use or withdrawing the application, the user can reapply with the same application email, and approval is decided anew under Article 4 of the Terms of Use.
6. Rights may also be exercised through a legal representative or a person who has been delegated authority. In this case, a power of attorney must be submitted.

9. Measures to Ensure Safety

The Company takes the following measures to process personal information safely.

1. Administrative measures: The Company keeps the number of employees who handle personal information to a minimum, and operates internal rules under which original questions and answers are accessed only by designated staff and only when necessary for work. Access rights to the internal repository holding the customer operations list are also limited to personnel who need them for their work.
2. Technical measures: Transmissions over external network segments are encrypted (TLS), and access to servers and databases is limited to authorized staff. Service access rights are granted only to Google accounts with approved emails (for Company employees, Company accounts). My application can be viewed and edited only when signed in with Google using the same email as the application email.
3. Physical measures: Servers and data are operated in data centers of a cloud service provider (AWS) equipped with security facilities.

10. Cookies and Other Automatic Collection Devices

1. The Company uses the following cookies to keep users signed in and for security. A cookie is a small file that a website stores in the user's browser.

2. The Company does not use cookies for advertising or visit analytics on Gravitonne pages. For website visit statistics (§2), the Company installs and operates the Vercel visit analytics script. To count which link led visitors to the apply button, it also keeps the first entry path (link source, e.g. utm:linkedin:2026-10-public, ref:linkedin.com, direct) in the browser tab's session storage (gv_src). This value is used only in that tab and is erased when the tab is closed. If a 'Do Not Track' request or GPC (Global Privacy Control) is turned on in the browser, visit statistics are not sent, and not sending them does not affect applying for or using the Trial.
   • Chrome: Settings > Privacy and security > Third-party cookies > 'Send a "Do not track" request with your browsing traffic'
   • Edge: Settings > Privacy, search, and services > Send 'Do Not Track' requests
   • Firefox: Settings > Privacy & Security > Website Privacy Preferences > 'Tell websites not to sell or share my data'
   • Safari does not have this setting.
3. Users can refuse the storage of cookies in their web browser settings. If they refuse, features that require sign-in cannot be used.
   • Chrome: Settings > Privacy and security > Third-party cookies
   • Safari: Settings > Privacy > Block all cookies
   • Edge: Settings > Cookies and site permissions

11. Information on the Generative AI Service

1. Gravitonne is a generative AI service that helps professional users find and understand public materials about carbon markets and climate policy. Answers may contain errors or omissions, so please check the source documents shown as evidence in the answers.
2. Query information is transmitted to the AI model providers listed in Section 7 to generate answers. These providers do not use the data they receive to train their own models.
3. The Company stores only the query information of users who have given optional consent to use for AI training, and uses it for the development, training and evaluation of the Company's own AI models. If users do not consent, it is not stored.
4. Before using questions and answers for training, the Company's staff in charge review them and remove personally identifying information such as email addresses and phone numbers.
5. Users may refuse (withdraw) use for training at any time on My application, on the consent screen (/en/consent) or by the contact email. Parts already reflected in training are difficult to reverse.
6. Do not enter trade secrets, sensitive information or other people's personal information in questions.
7. Conversations between users and AI apps are governed by the policies of the AI service chosen by the user (e.g., Claude, ChatGPT).
8. Please report inappropriate or inaccurate answers to the contact email (gravitonne@newtonne.io).

12. Children Under the Age of 14

The Trial does not permit use by children under the age of 14, and the application screen states that only persons aged 14 or older may apply. If the Company becomes aware that personal information of a child under the age of 14 has been collected, it destroys the information without delay.

13. Department in Charge of Privacy and Grievance Handling

The following department is in charge of the Company's personal information protection tasks and the handling of related grievances.

Users may submit privacy-related inquiries and requests for grievance handling and remedies for damage to the contact above, and the Company responds to and handles them without delay.

14. Remedies for Infringement of Rights and Interests

Users who need to report or seek counseling about an infringement of personal information may contact the following organizations.

15. Changes to the Privacy Policy

1. This Privacy Policy was first posted on October 1, 2026 and took effect on the same day. It was amended to v2.1 on October 2, 2026, effective the same day. v2.1 is an amendment that enables users to access and correct their information, change optional consents and withdraw on My application, and sets out the processing required for this. Because it contains nothing unfavorable to users, such as adding purposes of processing or extending retention periods, the advance notice period under paragraph 2 was not applied. It was amended to v2.2 on October 3, 2026, effective the same day. v2.2 is an amendment that starts the use of website visit statistics (Vercel Web Analytics) and sets out how they are produced, what they cover, how long they can be viewed and how to opt out; collection of visit statistics begins after this amendment is posted. Because visit statistics are compiled without cookies, using an identifier that lasts only 24 hours, are not linked to application information and are used only as statistics that do not identify individuals, the items, purposes and retention periods of personal information processed with consent do not change. This amendment therefore takes effect from the date of posting under the proviso of paragraph 2.
2. If this Privacy Policy is changed hereafter, the Company gives notice on the website from 7 days before the change takes effect. However, changes that are not unfavorable to users, such as adding ways for users to exercise their rights, may take effect from the date of posting; in this case too, the Company gives notice of the content of and reasons for the change through the revision history and comparison table. Changes that are significant to users' rights, such as adding collected items or purposes, are announced from 30 days before they take effect and are also notified by application email, with a before-and-after comparison table. Where consent is required by law, consent is obtained again.
3. Previous versions can be found in the revision history below.

<a id="revision"></a>

Revision History

Major Changes from v2.1 (Comparison Table)

Major Changes from v2 (Comparison Table)

Major Changes from v1 (Comparison Table)

---

Company information

• Trade name: Newtonne Inc. (뉴톤 주식회사)
• Contact: gravitonne@newtonne.io