Privacy Policy

XimTier collects the following information to provide its services. - Demo requests: name, email, company, role, industry, data description, optional file, preferred time - Contact inquiries: name, email, company, industry, message - IR downloads: name, email, company, role - Auto-collected: web server access logs (IP, timestamp, request path) — for security and troubleshooting We use Google Analytics 4 to collect anonymized aggregate statistics such as visit counts, country, referral source, and device; IP addresses are anonymized.

- Responding to demo requests and inquiries; scheduling - Sending IR deck download links - Legal compliance (e-commerce law, information & communications network act)

- Demo requests: 1 year after the meeting concludes (completed or cancelled) - Inquiries: 1 year after submission - IR deck requests: 1 year after submission. The download link itself expires 24 hours after issuance. - Case gallery comments: published comments are retained until deletion is requested - Web server access logs: deleted automatically after 14 days - Google Analytics data: deleted automatically after 14 months Records past these periods are purged automatically every day.

XimTier does not share personal information with third parties, except: - Required by law or investigation - Google LLC (Gmail SMTP — sending confirmation and notification emails, transferred internationally to the United States) · Items: recipient email address, and the name, company, and inquiry content contained in the message · Country: United States / Timing: at the time of sending / Method: SMTP over TLS · Recipient: Google LLC (contact: https://support.google.com/policies) · Purpose: sending confirmation and notification emails / Retention: subject to Google's policy · Right to refuse: email contact@ximtier.com to stop email delivery. We will notify you of the result by other means, with no disadvantage - Gabia, Inc. (email hosting — receiving and storing @ximtier.com mail, within Korea) - Google LLC (Google Analytics 4 — web usage analytics, transferred internationally to the United States) - Google LLC (Google Sheets — inquiry and demo request management, transferred internationally to the United States) · Items: name, email, company, industry, inquiry/request content, submission time, referral source, language · Country: United States / Timing: immediately upon submission / Method: HTTPS API transfer · Recipient: Google LLC (contact: https://support.google.com/policies) · Purpose: inquiry response and lead management / Retention: 1 year after submission (same as Section 3) · Right to refuse: email contact@ximtier.com to stop the international transfer. Your inquiry will still be received and answered without any disadvantage

You may exercise the following rights at any time. - Access, correct, or delete your personal information - Withdraw consent and stop processing - GDPR additional rights (EU residents): data portability, object to automated decisions Rights requests: contact@ximtier.com

XimTier uses cookies required to run the service and analytics cookies. - Session cookie: keeps you signed in. Removed when you close your browser. - Remember-me cookie: issued only if you tick "Remember me" at sign-in. Expires after 2 weeks, and is removed immediately when you sign out. - Like cookie: a random identifier that prevents duplicate likes in the case gallery. Expires after 30 days. It does not identify you or track you across other sites. - Analytics cookie (_ga): a visitor-distinguishing identifier issued by Google Analytics 4. It expires after 2 years and does not identify individuals. We do not use advertising cookies.

- In transit: TLS 1.2/1.3 (HTTPS enforced) - Passwords: stored as irreversible hashes (not readable by anyone, including admins) - Access control: Admin role separation, Rack::Attack rate limit

- Privacy Officer: Kang Seung-sik (CTO) - Contact: contact@ximtier.com - Dispute resolution: Korea PIPC (privacy.go.kr) / EU local DPA