Eggplant Privacy Policy

1.Personal Information Collected

The Company collects and uses only the minimum information necessary to provide the Service.

1) When signing up and creating an account

• Nickname
• Password (stored with one-way encryption; even the Company cannot know the original)
• Service country (Korea/Japan/Philippines) and selected area (neighborhood)
• Device identifier (UUID or equivalent app identification information)
• Date and time of sign-up and access records
• Authentication tokens and session identifiers
• (Optional) Quantarium wallet address — if wallet verification is carried out at the time of sign-up

2) Step 1: wallet verification

• Quantarium wallet address
• Records of the small verification transfer (amount transferred, transaction hash, date and time of transfer and confirmation)

3) Step 2: mobile phone verification (once the feature is launched)

• Mobile phone number (limited to Korean, Japanese and Philippine mobile phone numbers)
• Hash value used to check for duplicate verification, and date and time of verification

Mobile phone numbers are encrypted using AES-256 and stored separately from general member information, and are not displayed on Service screens or disclosed to other users. SMS verification of mobile phones is carried out through Google Firebase Authentication.

4) Information generated while using the Service

• Information related to item listings and transactions
• Information related to reports and blocking
• Access logs, IP information, device information, OS information, app version
• Location information or neighborhood verification results when using location-based features
• Information related to the accrual and withdrawal of points, rewards and digital assets (such as QTA)
• Wallet addresses and information related to withdrawal requests

5) Information the Company in principle does not disclose to the other party

The Company does not, by default, disclose information such as real names, phone numbers or email addresses to the other party. Mobile phone numbers received through Step 2 phone verification are never disclosed to other users under any circumstances.

However, the Company may separately check the minimum information necessary to fulfil legal obligations, handle customer inquiries, prevent fraudulent use, respond to disputes and the like.

2.Purposes of Use of Personal Information

The Company uses the personal information it collects for the following purposes:

1. Identifying members and providing the Service
2. Listing items, connecting transactions and providing QR-based features
3. Providing chat and communication features
4. Processing the accrual and withdrawal of rewards, points and digital assets
5. Confirming wallet ownership (wallet verification) and sending withdrawals to the verified wallet
6. Confirming one account per person (preventing multiple accounts from being verified, or rewards from being received more than once, with a single phone number or wallet)
7. Mobile phone numbers: tracking illegal or fraudulent users and responding to lawful requests from relevant authorities such as investigative agencies (they are not used for any other purpose, including marketing)
8. Preventing fraudulent use, securing accounts and detecting abnormal activity
9. Handling reports, responding to disputes and creating a safe service environment
10. Improving the Service, responding to incidents and statistical analysis
11. Fulfilling legal obligations

3.Retention and Use Period of Personal Information

1. The Company destroys personal information without delay once the purpose of its collection and use has been achieved.
2. However, the Company may retain information for a certain period in the following cases:
   • Minimum information related to accounts and Service operation: until the member withdraws or stops using the Service
   • Information related to reports, blocking and sanctions: for a certain period, to the extent necessary to resolve disputes and prevent re-registration
   • Information related to withdrawals and rewards: for a certain period, to the extent necessary for accounting, preventing fraudulent use and legal compliance
   • Mobile phone numbers (stored encrypted) and hash values used for duplicate checks: destroyed immediately upon withdrawal of membership (not retained after withdrawal)
   • Information that must be retained under applicable laws, such as access records: for the statutory retention period
3. Chat and some communication information in the Service may not be retained permanently in accordance with Company policy, and its recovery may be limited.

4.Provision of Personal Information to Third Parties

In principle, the Company does not provide users' personal information to outside parties.
However, the following cases are exceptions:

1. Where the user has given prior consent
2. Where there are special provisions in law, or a lawful request from relevant authorities such as investigative agencies
3. Where it is urgently necessary to protect the life, body or property of the user or a third party

5.Outsourcing of Personal Information Processing

The Company may outsource personal information processing tasks to external companies to the extent necessary to operate the Service.

When entering into an outsourcing contract, the Company specifies the matters necessary to ensure that personal information is processed safely in accordance with applicable laws, and manages and supervises the contractor.

6.Overseas Transfer of Personal Information

Personal information may be processed outside Korea in the course of the Company's use of cloud infrastructure, content delivery networks, security services and the like.

In such cases, the Company will disclose the destination country, the items transferred, the purpose of the transfer, the retention and use period and other matters in accordance with applicable laws, and will implement the necessary protective measures.

7.Users' Rights and How to Exercise Them

Users may exercise the following rights regarding their personal information at any time:

• Request access to personal information
• Request correction or deletion
• Request suspension of processing
• Withdraw consent and withdraw membership

Users may exercise the above rights through features in the Service or by making a request to the Company's privacy department (quantarium1004@gmail.com), and the Company will act without delay in accordance with applicable laws.

Users in the Philippines also have the rights of data subjects under the Data Privacy Act of 2012 (Republic Act No. 10173), including the rights to be informed, to access, to object, to rectification, to erasure or blocking, to data portability and to file a complaint, and may contact the National Privacy Commission (privacy.gov.ph).

8.Destruction of Personal Information

The Company destroys personal information without delay when the retention period expires or the purpose of processing has been achieved.

1. Information in electronic file form is deleted using secure technical methods so that it cannot be recovered or reproduced.
2. Information in paper form is shredded or incinerated.

9.Measures to Ensure the Security of Personal Information

The Company implements the following measures to protect personal information:

• Access rights management
• Encryption in transit
• Security updates and vulnerability checks
• Monitoring of logs and abnormal activity
• Applying the principle of minimum personal information processing
• Storing passwords with one-way encryption (PBKDF2)
• Encrypting mobile phone numbers with AES-256-GCM and storing them separately from general member information — decryption is possible only by the top administrator after recording a reason for viewing, and every view is kept as an audit record

10.Processing of Location Information

1. The Company may process location information or location-based verification results to provide area-based services and the neighborhood verification feature.
2. Users may decline to provide location information; in that case, the use of some features may be restricted.

11.Protection of Children's Personal Information

1. The Company does not intentionally collect children's personal information where this is not permitted by applicable laws.
2. Where necessary, the Company may separately establish a procedure for obtaining the consent of a legal guardian.

12.Chief Privacy Officer

13.Reporting Privacy Infringements and Dispute Mediation

If users need to report or seek advice regarding an infringement of personal information, they may contact the following bodies:

Users in the Philippines may also file a complaint with the National Privacy Commission (privacy.gov.ph) under the Data Privacy Act of 2012 (Republic Act No. 10173).

14.Changes to this Privacy Policy

1. The Company may amend this Privacy Policy in accordance with changes in laws, the content of the Service or internal policies.
2. Material changes will be announced through notices in the Service or on the website.

Addendum

This Policy takes effect on October 11, 2026. (Changes: added items collected, purposes of use, retention periods and security measures related to wallet verification and mobile phone verification)

The previous policy applied from May 6, 2026 to October 10, 2026.