Privacy Policy

circuscompany (the "Company") complies with the Personal Information Protection Act and other applicable laws and regulations to protect the freedoms and rights of data subjects, and processes personal information lawfully and securely. In accordance with Article 30 of the Personal Information Protection Act, the Company hereby establishes and discloses this Privacy Policy to inform data subjects of the procedures and standards governing the processing of personal information and to ensure that related concerns are handled promptly and effectively.

① This Policy applies to all of the following services operated by the Company (collectively, the "Services").

1. WAGZAK(wagzak.io) — An educational content service, including websites, mobile apps, and related services for WAGZAK JUMP (3D and AR interactive learning), WAGZAK Play (game-based learning), WAGZAK ZemiNa (free analog learning), and WAGZAK T-Hub (teacher community)
2. Ssaktane(ssaktane.com) — An AI-powered recommendation platform for government support programs and bidding opportunities
3. Quiga(quiga.io) — A global quiz and thinking game platform
4. CIRCUS Website(circuscompany.com) — Company information and inquiry submission

② Service-specific differences in the categories of information collected, purposes of use, retention periods, and other matters are set forth in the annexes at the end of this Policy (A: WAGZAK, B: Ssaktane, C: Quiga, D: CIRCUS Website). If an annex differs from the main provisions, the annex takes precedence for the applicable service.

The Company processes personal information for the following purposes. Personal information will not be used for any purpose other than those stated below. If a purpose changes, the Company will take all necessary measures.

1. Membership registration and management — registration, identity verification and authentication, membership maintenance and management, and prevention of unauthorized use
2. Service delivery and improvement — content delivery, personalized content and recommendations, profile maintenance, and service quality analysis and improvement
3. Paid service payments — payment of subscription fees and other charges, and refund processing
4. Customer inquiry handling — reviewing and responding to inquiries, and improving the Services
5. Compliance with legal obligations

Detailed purposes for each service are set forth in the applicable annex.

① The following information may be collected automatically when you use the Services.

• IP address, browser type, operating system
• Access date and time, service usage records
• Cookies (for session management and service delivery)

② The categories of personal information collected by each service are set forth in the applicable annex.

③ The Company collects personal information through the following methods: information entered directly by the data subject during registration and use of the Services, connection to external accounts such as social login, and automatic collection during use of the Services.

① As a general rule, the Company retains and uses personal information until membership withdrawal (account deletion).

② Where retention is required by applicable law, the information will be retained for the period prescribed by that law.

• Records concerning contracts or cancellation of orders, and records concerning payment and the supply of goods or services: 5 years (Act on the Consumer Protection in Electronic Commerce, Etc.)
• Records concerning consumer complaints or dispute resolution: 3 years (Act on the Consumer Protection in Electronic Commerce, Etc.)

③ Certain information may be retained longer to the extent permitted by applicable law where necessary to provide the Services, comply with legal obligations, or resolve disputes. Anonymized data may be retained for research and service improvement.

④ Detailed retention periods for each service, including accelerated deletion of children's personal information, are set forth in the applicable annex.

1. The Company destroys personal information without delay when its retention period expires or its processing purpose has been fulfilled.
2. Where retention is required by another law, the information is separated and stored in a separate database.
3. Electronic files are permanently deleted using methods that prevent recovery, while paper documents are shredded or incinerated.

① As a general rule, the Company does not provide personal information to third parties and does not sell personal information. The Company also does not share personal information with third parties for advertising purposes.

② Exceptions apply in the following cases.

1. Where the data subject has given consent
2. Where required by law or requested by an investigative authority

① The Company outsources personal information processing as follows to ensure smooth delivery of the Services.

② When entering into outsourcing agreements, the Company specifies measures for secure processing in the agreement pursuant to Article 26 of the Personal Information Protection Act and manages and supervises service providers to ensure that personal information is processed securely. Personal information of child users is not shared with advertising networks.

① The Company is headquartered in the Republic of Korea and processes data in the Republic of Korea. When users access the Services, their personal information may be transferred to and processed in the Republic of Korea.

② The Company implements appropriate safeguards in compliance with the EU General Data Protection Regulation (GDPR) and other applicable international data protection laws.

③ Some service providers used by the Company may operate servers outside the Republic of Korea. In such cases, the Company will separately disclose details of the cross-border transfer, including the recipient, country, categories of information, timing, and method, and complete all required procedures pursuant to Article 28-8 of the Personal Information Protection Act and other applicable laws.

① Data subjects may exercise the following rights with the Company at any time.

1. Request access to and confirmation of personal information
2. Request correction (amendment)
3. Request deletion
4. Request restriction of processing and object to processing
5. Request portability (export) of personal information
6. Withdraw consent

② Rights may be exercised through the account settings menu of each service or in writing or by email (like@cscom.io), and the Company will respond without delay.

③ Rights may also be exercised through a legal representative or an authorized agent.

① The Company takes special care to protect the personal information of child users.

1. Creating an account for a child under 14 (in the Republic of Korea) or under 13 (in jurisdictions where COPPA applies) requires the consent of a legal representative (parent or guardian).
2. Child users are not shown personalized advertising.
3. Child users' profiles are set to private.
4. Only the minimum personal information necessary to operate the Services is collected from child users.
5. Third-party behavioral tracking and third-party analytics are disabled for child users.
6. Legal representatives may request access to, correction of, or deletion of their child's personal information at any time.

② The Company complies with the U.S. Children's Online Privacy Protection Act (COPPA), the child-related provisions of the EU General Data Protection Regulation (GDPR), and the Republic of Korea's Personal Information Protection Act.

③ Service-specific child protection measures, including limits on collection and accelerated deletion, are set forth in the applicable annex.

1. The Company uses cookies to keep users signed in, remember language preferences, manage sessions, and provide the Services.
2. Some Services use Google Analytics to analyze how users interact with the website. Google Analytics uses first-party cookies to track user interactions and provides reports that do not identify individual visitors. (See each annex for the applicable scope — Quiga uses essential cookies only and does not use tracking or advertising cookies.)
3. Data subjects may reject cookies through their web browser settings. However, rejecting cookies may limit access to certain features, including login.

The Company takes the following measures to safeguard personal information.

• Administrative measures: Establishing an internal management plan, employee training, and regular security audits
• Technical measures: Access authorization management, access control systems, encryption of personal information (in transit and at rest), HTTPS communications, CSRF protection, and secure authentication
• Physical measures: Server security management and access control
• Payment information: Payments are processed through PCI DSS-certified third-party payment processors, and the Company does not directly store sensitive payment information such as card numbers.

Chief Privacy Officer
Name: Sunwook Park
Title: Chief Executive Officer
Email: like@cscom.io

Privacy Inquiries
Email: like@cscom.io

Data subjects may use the contact information above for any privacy-related inquiries, complaints, or requests for remedy arising from their use of the Company's Services. The Company will respond promptly and in good faith.

Data subjects may contact the following organizations for remedies or counseling concerning personal information infringements.

• Personal Information Dispute Mediation Committee: (without area code) 1833-6972 (www.kopico.go.kr)
• Personal Information Infringement Report Center: (without area code) 118 (privacy.kisa.or.kr)
• Supreme Prosecutors' Office: (without area code) 1301 (www.spo.go.kr)
• Korean National Police Agency: (without area code) 182 (ecrm.police.go.kr)

① The Company may update this Policy to reflect changes in its information processing practices. For material changes, the Company will post a notice on the website at least 7 days before the changes take effect and display the date of the latest revision at the top of this Policy.

② The privacy policies previously applied separately to each service (WAGZAK revision dated 2026-02-06, Ssaktane version effective 2026-03-10, and Quiga version effective 2026-03-10) are superseded upon the effective date of this consolidated Policy. Any change in applicability will be announced in advance as required by applicable law.

A-1 Scope

WAGZAK websites, mobile apps, and related services — including WAGZAK JUMP, WAGZAK Play, WAGZAK ZemiNa, and WAGZAK T-Hub.

A-2 Information Collected

A-3 Purposes of Use

Service delivery and improvement, profile maintenance, personalized learning content, and customer service.

A-4 Retention Period

Until account deletion. Information may be retained longer where necessary for service delivery, legal obligations, or dispute resolution. Anonymized data may be retained indefinitely for research and service improvement.

A-5 Outsourcing and Sharing

Hosting: Amazon Web Services, Google Cloud / Payments: Paddle / Analytics: Google Analytics / Speech recognition: Google, Apple, AWS / Customer support: Customer support service providers.

A-6 Child Protection

Article 10 of the General Provisions applies in full (consent of a legal representative for children under 14, no personalized advertising, private profiles, minimum collection, disabled third-party tracking and analytics, and the legal representative's right to request access, correction, and deletion). Compliance with COPPA, the GDPR's child-related provisions, and the Republic of Korea's Personal Information Protection Act.

A-7 Cross-Border Transfers and Other Matters

Article 8 of the General Provisions applies (processing in the Republic of Korea and GDPR compliance). WAGZAK Services may contain links to third-party websites, and this Policy does not apply to linked external sites. Responses to browser "Do Not Track" settings are governed by applicable laws and international standards.

B-1 Scope

An AI-powered recommendation platform for government support programs and bidding opportunities (a B2B service for corporate users).

B-2 Processing Purposes, Information Collected, and Retention Periods

B-3 Outsourcing

Paddle.com Market Limited — Payment processing (subscription and mineral payment processing, Merchant of Record).

B-4 Special Notes

As a corporate service, Ssaktane processes corporate profile information, including business registration numbers and revenue. Any information within the profile that can identify an individual, such as the representative's name, is protected under this Policy. Because Ssaktane is not intended for children, the special provisions for children in Article 10 of the General Provisions do not apply.

C-1 Scope

A global quiz and thinking game platform (available in 51 languages).

C-2 Information Collected

C-3 Purposes of Use

Game delivery and improvement, performance analysis and display, personalized recommendations, parental controls, and service update notifications.

C-4 Retention Period

Retained while the account is active. Removed within 30 days of account deletion. Children's personal information is removed within 48 hours in accordance with COPPA requirements.

C-5 Sharing and Outsourcing

Personal information is not sold or shared with advertisers. It is provided only to essential service providers (hosting and payment processors) under strict data protection agreements.

C-6 Cookies

Essential cookies only. No tracking or advertising cookies.

C-7 Child Protection

Full compliance with COPPA. Parental consent is required, personal contact information is not collected, and the accelerated 48-hour deletion period in C-4 applies.

C-8 Exercising Rights

Users may request access, correction, deletion, export, restriction of processing, or object to processing through Account Settings › Privacy and Data or by email (like@cscom.io).

D-1 Scope

The corporate website and Contact inquiry submissions.

D-2 Information Collected and Purpose

When an inquiry is submitted: inquiry type, name, organization (optional), email, and inquiry details — used solely to review and respond to the inquiry. Submissions are forwarded to the Company's email and are not stored in a separate member database.

D-3 Retention Period

Inquiry details are delivered to the responsible team member by email and are not stored in a separate database. Forwarded emails are retained after the inquiry is resolved for the period required by applicable law (3 years for consumer consultation records under the Act on the Consumer Protection in Electronic Commerce, Etc.) and are then destroyed.