Fixo Privacy Policy

REDREDGROUP (the “Company”) establishes and publishes this Privacy Policy under Article 30 of the Personal Information Protection Act to protect the personal information of Fixo users and handle related complaints promptly and effectively.

This Privacy Policy took effect on January 1, 2021 and was revised on August 12, 2026.

Article 1 (Purposes of processing personal information)Copy Anchor Link

The Company processes personal information for the purposes below. It does not use personal information for other purposes. If a purpose changes, the Company will take necessary measures, including obtaining separate consent, under Article 18 of the Personal Information Protection Act.

1. Registration and account management
   • Identification and authentication using a mobile number, Google or Kakao account; maintaining and managing membership; account recovery; and preventing misuse.
2. Providing Fixo services
   • Core service functions, including workspace setup, registration and retrieval of customers, contracts, schedules, equipment, network settings and work reports, and collaboration between users.
3. Providing AI assistance
   • Processing inputs and generated results for equipment photo analysis, schedule summaries and work report drafts selected by the user.
4. Providing and managing subscriptions
   • Processing purchase and subscription information to display products, process and restore purchases, verify entitlements and manage subscriptions.
5. Service reliability and inquiry handling
   • Processing service usage records and inquiries for error analysis, security incident prevention, service improvements, website and service consultations, and user support.

Article 2 (Processing and retention periods)Copy Anchor Link

1. The Company processes and retains personal information within the period prescribed by law or agreed to by the data subject when the information is collected.
2. Retention periods for each category are as follows.

3. Where applicable law requires preservation for a specified period, information is stored separately for that period and then destroyed.

Article 3 (Disclosure to third parties)Copy Anchor Link

1. The Company processes personal information only within the purposes in Article 1 and discloses it to third parties only where permitted under Articles 17 and 18 of the Personal Information Protection Act, including with the data subject's consent or under a specific legal provision.
2. The Company currently does not disclose personal information to third parties without the data subject's consent. If disclosure becomes necessary, it will give advance notice of the recipient, purpose, information disclosed and retention/use period, and obtain necessary consent.

Article 4 (Outsourced processing)Copy Anchor Link

1. The Company outsources the following processing to provide its services smoothly.

2. The Company does not directly provide credit card numbers or bank account details to RevenueCat. Payment method information is processed by Apple or Google's payment systems. RevenueCat may receive app user identifiers, device and operating system information, Apple receipts or Google purchase tokens, and product and entitlement status needed for subscription management.
3. Under Article 26 of the Personal Information Protection Act, outsourcing contracts document restrictions on processing outside the assigned purpose, technical and administrative safeguards, subcontracting restrictions, processor management and supervision, and liability including damages. The Company supervises processors' safe handling of personal information.
4. Changes to outsourced work or processors will be disclosed promptly through this Privacy Policy.

Article 4-2 (Overseas transfers)Copy Anchor Link

The Company transfers personal information overseas as follows to provide subscription features.

Users can contact the Company's privacy department with questions about overseas transfers or refuse subsequent processing by withdrawing membership. Refusing overseas transfers prevents use of subscription product retrieval, purchase, restoration and entitlement verification features.

Article 5 (Rights and obligations of data subjects and legal representatives)Copy Anchor Link

1. Data subjects may at any time request access, correction, deletion or suspension of processing of their personal information.
2. Requests under paragraph 1 may be submitted in writing, by email, fax or other means under Article 41(1) of the Enforcement Decree of the Personal Information Protection Act. The Company will act without delay.
3. These rights may be exercised through a legal representative or authorized agent. In that case, a power of attorney in the form prescribed in Annex Form 11 of the Notice on Methods of Processing Personal Information (No. 2020-7) must be submitted.
4. Rights to access and suspend processing may be restricted under Articles 35(4) and 37(2) of the Personal Information Protection Act.
5. Deletion cannot be requested where another law expressly requires collection of the information.
6. When receiving requests for access, correction/deletion or suspension of processing, the Company verifies that the requester is the data subject or an authorized representative.

Article 6 (Personal information processed)Copy Anchor Link

The Company processes the following information.

1. Registration and account management
   • Phone sign-in: mobile number, verification code
   • Google sign-in: email, name, profile image
   • Kakao sign-in: email, mobile number, name or nickname, profile image
   • Common generated information: internal user identifier, authentication method, account status, workspace/organization identifiers and permissions
   • Some information may not be collected depending on the sign-in method.
2. Information entered directly by service users
   • Customer name; contact names, phone numbers and roles; addresses and address details; contract types and periods; appointment dates, times, types and notes
   • Equipment names and types, installation locations, manufacturers, models, serial numbers, installation/expiration dates and equipment notes
   • IP addresses, subnet masks, gateways, DNS, MAC addresses, VLANs, ports and connected equipment information, Wi-Fi SSIDs, security modes and passwords
   • Work types, visit dates, work notes, work report content, and user-entered inquiries or feedback
3. Information processed for AI assistance
   • Equipment photos and file formats/sizes, customer/equipment/work inputs, and AI analysis, summary and generation results
4. Information processed for subscriptions
   • App user identifier, device type, operating system, Apple receipt or Google purchase token, and product/subscription/entitlement status
5. Information that may be generated automatically during service use
   • IP address, access date and time, service usage records, device and operating system information, app version, and error/performance information
6. Information processed for website and customer consultations
   • Channel Talk visitor identifier, visited pages and access times, browser/device information
   • Names, emails, mobile numbers, consultation content and attachments entered directly by users
   • Names, emails and mobile numbers not entered by users may not be collected.

Article 7 (Destruction of personal information)Copy Anchor Link

1. The Company destroys personal information without delay when it is no longer needed, including when the retention period expires or the processing purpose is fulfilled.
2. If another law requires continued preservation after the agreed retention period or processing purpose ends, the information is moved to a separate database or stored in a different location.
3. Destruction procedures and methods are as follows.
   1. Procedure: The Company identifies information due for destruction and obtains approval from its privacy officer before destroying it.
   2. Method: Electronic records are destroyed using technical methods that prevent their restoration.

Article 8 (Security safeguards)Copy Anchor Link

The Company takes the following measures to protect personal information.

1. Protection in transit: Encrypted communication is used when personal information is transmitted over networks.
2. Access management: Access to personal information processing systems is limited to what is necessary for work, with grants, changes and revocations managed.
3. Credential protection: Authentication tokens and external service access keys are managed separately from user data, with access restricted to prevent exposure.
4. Access records and anomaly checks: Operational access logs and error information are managed, with measures to detect abnormal access and service incidents.
5. Data minimization: Information unnecessary for the service is not collected; only information needed for the selected sign-in method is processed.

Article 9 (Automatic collection technologies and refusal)Copy Anchor Link

1. The Fixo app does not directly use browser cookies, but SDKs for maintaining sign-in, service security, subscription verification, error analysis and app install attribution may use device identifiers or local storage.
2. The Fixo web console may use cookies, session storage or similar technologies to maintain sign-in and post-authentication destinations, perform security checks and provide customer support.
3. Channel Talk on the REDREDGROUP website and Fixo web console may use cookies or local storage to distinguish visitors, connect consultations and preserve inquiry history. Channel Talk does not run in the REDREDGROUP Document Hub (/docs).
4. Users may delete stored information or restrict its use by uninstalling the app or changing browser settings. Restricting essential storage may affect sign-in, security checks, subscription verification or consultation connections.

Article 10 (Privacy officer)Copy Anchor Link

1. The Company designates the following privacy officer to oversee personal information processing and handle complaints and remedies.

   Privacy officer

   • Name: Seihoon Kim
   • Position: CEO
   • Contact: 070-4466-2214, privacy@redredgroup.com
   • You will be connected to the privacy department.

   Privacy department

   • Department: Engineering
   • Contact person: Seihoon Kim
   • Phone: 070-4466-2214

2. Data subjects may contact the privacy officer or department about all privacy inquiries, complaints and remedies arising from use of the Company's services. The Company will respond and take action without delay.

Article 11 (Requests for access)Copy Anchor Link

Data subjects may request access under Article 35 of the Personal Information Protection Act through the department below. The Company will endeavor to handle requests promptly.

Department receiving and handling access requests

• Department: Engineering
• Contact person: Seihoon Kim
• Phone: 070-4466-2214

Article 12 (Remedies for infringement)Copy Anchor Link

Data subjects may seek dispute resolution or consultation from the Personal Information Dispute Mediation Committee or the Korea Internet & Security Agency's Privacy Infringement Report Center. Other reports and consultations can be directed to:

1. Personal Information Dispute Mediation Committee: 1833-6972 (no area code), www.kopico.go.kr
2. Privacy Infringement Report Center: 118 (no area code), privacy.kisa.or.kr
3. Supreme Prosecutors' Office: 1301 (no area code), www.spo.go.kr
4. National Police Agency Cybercrime Reporting System: 182 (no area code), ecrm.police.go.kr

A person whose rights or interests are infringed by a disposition or inaction of the head of a public institution concerning a request under Articles 35 (access), 36 (correction/deletion) or 37 (suspension of processing) of the Personal Information Protection Act may file an administrative appeal under the Administrative Appeals Act.

For details, visit the Central Administrative Appeals Commission.