X Holdings Inc. (the ‘Company’) processes only the personal data necessary to provide theTent and related services.

The Company complies with applicable personal data protection laws of the Republic of Korea, including the Personal Information Protection Act, and destroys personal data without delay once its purpose has been fulfilled or its retention period has ended.

Accounts: OAuth provider identifiers, email addresses, names or nicknames, profile images, account status, and sign-in records. Purposes: member identification, maintaining sign-in sessions, account security, preventing misuse, and delivering notices.

AI generation: prompts, uploaded filenames, input images, videos and audio, references, generation settings, model names, TT deductions, job status, output URLs, thumbnails, and error logs. Purposes: processing generation requests, storing results, providing history, calculating costs, safety reviews, and resolving failures.

Payments and TT: payment identifiers, plans, payment, cancellation and refund records, TT grants, usage, balances and expiration dates, and subscription renewal and cancellation records. Purposes: providing paid services, settlement, refunds, TT management, and dispute resolution.

Support and partnership inquiries: names, email addresses, company names, inquiry details, attachments, and processing records. Purposes: responding to inquiries, reviewing partnerships, and handling legal disputes.

Automatically collected data: IP addresses, cookies, session IDs, device and browser information, access times, referrers, page navigation records, and security events. Purposes: maintaining sign-in sessions, security, failure analysis, service improvement, and preventing misuse.

Account information is retained until account withdrawal. However, the minimum information needed to prevent misuse, resolve disputes, or comply with laws may be retained for a separate period.

AI generation history and output information are retained until account withdrawal or a user's deletion request. Output files may be subject to a limited retention period following a separate notice due to storage policies, costs, or security reasons.

Records of contracts or withdrawal, payments, and the supply of goods or services may be retained for five years, and consumer complaint or dispute resolution records for three years, under the Act on the Consumer Protection in Electronic Commerce, etc.

Service access records may be retained for at least three months under applicable laws, including the Protection of Communications Secrets Act.

The Company does not disclose personal data to third parties except with the data subject's consent, on a legal basis, or where necessary to perform the service contract.

To provide services, the Company may entrust processing to Supabase (account database and storage), Vercel (hosting and deployment), Railway or equivalent cloud providers (server APIs), AI model processing providers (AI model processing), payment processors (payment authorization, cancellation and settlement), and email and customer support tool providers.

Through contracts or equivalent arrangements, the Company manages processors' data protection obligations, restrictions on processing for other purposes, safeguards, limits on subprocessing, management and supervision, and liability for damages.

The service uses global cloud infrastructure and AI model APIs. Personal data may therefore be transferred internationally during registration, sign-in, file uploads, generation requests, result storage, payments, and customer support.

Recipients include Supabase, Vercel, AI model processing providers, payment processors, and their subprocessors. Destination countries may include the United States, EU countries, Japan, Singapore, and other locations where these providers operate infrastructure.

Transferred data includes the account information, inputs, generation settings, job logs, outputs, payment identifiers, and inquiry information necessary to provide the service. Transfers use encrypted network transmission.

If you do not wish to allow international transfers, access to some functions, including external AI models, sign-in, payments, and file uploads, may be restricted.

Users may request access, correction, deletion, suspension of processing, withdrawal of consent, or account withdrawal through the account menu or privacy@thetent.ai.

After verifying identity, the Company processes requests in accordance with applicable laws. Deletion or suspension of processing may be restricted for information that must be retained by law, information needed for disputes, and minimum records of completed AI generation requests.

Where automated processing by an AI generation model significantly affects a user's rights or obligations, the user may request an explanation or express an objection. However, refusing the automated generation function itself may limit access to that function.

The service is generally not intended for children under 14. If processing a child's personal data is necessary, the Company verifies consent from the legal representative and processes only the minimum data required.

The Company implements administrative, technical, and physical safeguards, including access permission management, encryption, protection of data in transit, access log retention, abnormal access detection, least-privilege access, internal management plans, employee training, and processor reviews.

The Company is not liable for inadequate management of a user's device, compromised OAuth accounts, information disclosed by users, or third-party failures beyond the Company's reasonable control, except where the Company is liable under applicable law.

The Company may use cookies and similar technologies to maintain sign-in sessions, provide security, analyze service use, and improve features. Users may refuse or delete cookies through browser settings, but this may restrict some functions, including sign-in, payments, and history.

If the Company introduces behavioral data processing for personalized advertising or marketing, it will separately disclose the data collected, purposes, retention period, and opt-out methods, or obtain consent.

Privacy Officer: Eunjun Jung, X Holdings Inc., privacy@thetent.ai.

Personal data access requests and customer support: support@thetent.ai.

For advice or redress regarding personal data violations, users may contact the Personal Information Dispute Mediation Committee, the Personal Information Infringement Report Center (118), the Supreme Prosecutors' Office Cyber Investigation Division, the National Police Agency Cyber Investigation Bureau, or other relevant authorities.

This Privacy Policy takes effect on May 28, 2026. If the data processed, purposes, processors, international transfers, or retention periods change, the Company will provide notice through this page, service notices, email, or other appropriate means.