Privacy Policy

1. General

Vernam ("we," "us," or "the Company") operates vernam.co.kr and related subdomains (the "Site"). This Privacy Policy explains what personal information we collect through the Site, why we collect it, how we use and share it, and the rights you have regarding your information.

This policy is written to reflect the requirements of:

• The General Data Protection Regulation (EU 2016/679, "GDPR")
• The Personal Information Protection Act of South Korea ("PIPA")
• The Act on the Protection of Personal Information of Japan ("APPI")

2. Information We Collect

2.1 Information you provide directly

When	What we collect
Submitting the Early Access form	Email address, company name
Submitting the Contact form	Name, company name, email address, inquiry type, message

2.2 Information collected automatically

When you visit the Site, we automatically collect basic access logs (timestamp, pages visited, referrer URL) and device information (device type, browser, operating system, screen resolution).

We use Cloudflare Web Analytics for this purpose. The service does not use cookies and anonymizes IP addresses on collection. The data is retained only in a form that cannot identify individuals.

3. Purposes and Legal Bases

Purpose	Data	Legal Basis (GDPR)	Retention
Sending Early Access updates	Email, company name	Consent (Art. 6(1)(a))	Until consent withdrawal, or up to 3 years
Responding to inquiries	Name, company, email, message	Consent / pre-contractual (Art. 6(1)(a), (b))	1 year after the inquiry is resolved
Site analytics and improvement	Anonymized access logs	Legitimate interest (Art. 6(1)(f))	No specific retention (anonymized)
Compliance with legal obligations	Processing records	Legal obligation (Art. 6(1)(c))	As required by applicable law

4. Processors and Third Parties

We engage the following processors to provide our service:

Processor	Purpose	Location
Cloudflare, Inc.	Site hosting, CDN, security, analytics	United States · Global
Resend	Transactional email delivery	United States

We do not sell personal information, and we do not share it with third parties other than the processors listed above. We may disclose information only when:

• You have given separate, specific consent
• Required by law, or in response to a lawful request from a competent authority

5. International Transfers

The processors listed above are headquartered in the United States, and the data we entrust to them may be processed in the U.S. or through their global infrastructure.

• Categories transferred: All items listed in Section 2
• Destinations: United States, and the processor's global edge network
• Method: In real time during Site use, via secure channels (TLS 1.2 or higher)
• Safeguards: GDPR Standard Contractual Clauses (SCCs); your explicit consent
• Retention: As stated in Section 3

6. Your Rights

6.1 Common rights

You may exercise the following rights at any time:

• Access to the personal information we hold about you and how we process it
• Correction or deletion of inaccurate or unnecessary information
• Suspension or restriction of processing
• Withdrawal of consent (where processing is based on consent)

6.2 Additional rights for EU residents (GDPR)

• Right to restriction of processing (Art. 18)
• Right to data portability (Art. 20) — receive your data in a structured, commonly used format
• Right to object to automated decision-making (Art. 22). We do not perform automated decision-making on the Site.
• Right to lodge a complaint with a supervisory authority (Art. 77) in your country of residence or the relevant EU member state

6.3 Residents of Japan

You may exercise rights of disclosure, correction, suspension of use, and erasure under APPI.

6.4 How to exercise your rights

Send requests to privacy@vernam.co.kr. We will respond within 10 days under PIPA, one month under GDPR, and within a reasonable period under APPI.

7. Cookies and Similar Technologies

We do not use cookies for analytics or advertising. We may use cookies strictly necessary for the Site's functionality; even then, such cookies do not store personally identifiable information.

8. Security

• Encryption in transit: All communications use HTTPS (TLS 1.2 or higher).
• Access control: Access to personal information is limited to the minimum personnel required to operate the service.
• Security headers: HSTS, X-Content-Type-Options, Content-Security-Policy, and similar headers are applied.
• Incident response: In the event of a personal data breach, we will notify affected individuals and regulators as required by applicable law.

9. Children's Privacy

We do not knowingly collect personal information from children under 14 (PIPA) or under 16 (GDPR). If you are below the applicable age, please do not use the Site's forms. If we become aware that we have collected such information without proper consent, we will delete it promptly.

10. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in law, technology, or our practices. We will notify you of material changes through the Site in advance. The updated policy becomes effective when posted on the Site.

11. Contact

• Data Protection Officer: KIM DAEWON
• Privacy inquiries: privacy@vernam.co.kr

EU residents may also lodge complaints with the data protection authority of their country of residence. Korean residents may contact the Personal Information Protection Commission (privacy.go.kr).

---

This Privacy Policy is effective as of 2026-06-01. Previous versions, if any, are retained and available upon request.