Your data lives in storage you own. Data Alliance Co., Ltd. (the "Company") does not keep it in storage of its own and does not view, use, or disclose it without your consent. This policy explains how the Company handles your data while providing the gcube service, what data it collects, and how it protects and deletes that data.

• Services covered: gcube GPU cloud (gcube.ai), workload containers, and the customer storage connection feature
• Governing laws: Act on the Development of Cloud Computing and Protection of Its Users (the "Cloud Computing Act", as in force on October 1, 2025, with its Enforcement Decree as in force on January 2, 2026), Personal Information Protection Act, and Act on Promotion of Information and Communications Network Utilization and Information Protection of the Republic of Korea
• Related documents: Personal information such as account and payment details is handled under the gcube Privacy Policy, and service terms are governed by the gcube Terms of Service. If this policy conflicts with the Terms of Service, the Terms of Service prevail.

The Company classifies gcube data into four categories, and what the Company may do with data depends on its category.

Category	Meaning	Examples	Company use
Customer Content	Data you connect to or create on gcube for processing, and the credentials you entrust to the Company; "user information" under Article 2 of the Cloud Computing Act	Training data and model weights in your storage, workload outputs, credentials for your storage and private registries	Processed only on your instructions. Never viewed, analyzed, or used for training
Account Information	Information you give the Company to create and manage your account	Name, email, phone number, company name, payment details	Governed by the Privacy Policy
Service Data	Technical information generated while operating the service	GPU usage, quotas, container image URLs you specify, storage connection settings, operation logs, audit logs	Billing, incident response, security, service improvement
Provider Data	Information received from providers who supply GPU resources	Equipment specifications, operating status, settlement details	See Section 13

Workload names, storage connection names, and tags are treated as Service Data and may appear in operator screens and logs. Do not put personal or confidential information in these fields.

Storage credentials and private registry credentials you enter (keys, tokens, passwords, etc.) are treated as Customer Content, and the Company uses them only to connect your storage to your workloads and to pull images.

The Company collects only the Account Information and Service Data needed to provide the service. Customer Content is neither collected nor stored; the Company processes it on your behalf only while a workload is running.

Stage	Data collected	Category
Sign-up and login	Name, email, phone number, company name, login history, IP address, browser information	Account Information
GPU selection	GPU specifications viewed and selected, pricing plan	Service Data
Image selection	Container image URL (images are pulled from external registries and not stored by the Company), private registry credentials (treated as Customer Content)	Service Data (credentials are Customer Content)
Storage connection	Type and address of your storage, storage credentials (treated as Customer Content)	Service Data (credentials are Customer Content)
Workload execution	GPU and memory utilization, run time, assigned node, error information	Service Data
Payment	Payment method (processed by the payment gateway), usage settlement records, tax invoice details	Account Information

Logs and audit records never contain the contents of your storage or any credentials. Workload logs record only status information such as start, stop, and errors, and never record what a workload processes.

You own and control your Customer Content. Under Article 27 of the Cloud Computing Act, the Company does not provide it to third parties or use it for purposes other than providing the service without your consent.

• What the Company does not do: View or analyze your storage, use Customer Content to train AI models, use it for marketing or advertising, or copy or retain it outside your storage without authorization
• What you control: The storage you connect and the data in it, registration and deletion of storage and registry credentials, workload access credentials
• Tenant isolation: Your storage is connected only to your own workloads and cannot be mounted or viewed from any other customer's workload.
• Sharing you direct: Providing a file through a share link you create in the console is processing on your instructions. You control the scope of sharing and can revoke it, and the Company makes no other use of shared files.

Company operators access Customer Content in your storage or workloads only in the cases below, and keep the customer request record together with an access log (operator, time, target workload, request number) for each access.

1. You request support, such as incident handling, and consent to access
2. A court submission order or a warrant issued by a judge requires it (Section 11)

The Company uses Service Data only for the purposes below and never discloses it externally in a form that identifies individuals.

• Service delivery: Workload assignment, customer storage connection, quota management
• Billing and settlement: Usage metering, invoicing, resolving billing disputes
• Operations and security: Incident detection, access auditing, responding to misuse and security threats
• Service improvement: Capacity planning and performance improvement using usage statistics (aggregated so that customers cannot be identified)

The Company obtains separate consent before using Account Information for marketing or sending advertising messages.

Customer Content stays in storage that you own and manage, and the Company does not keep it in storage of its own. The Company connects your storage to your workload only while the workload is running, and any temporary data created on the node in the process is deleted when the workload ends.

• Storage country: Customer Content is stored under the contract between you and your own cloud provider, so please confirm the storage country with that provider. The Company holds only your storage and registry credentials and your workload settings, on infrastructure operated by the Company.
• Distributed node execution: gcube workloads may run on equipment of GPU providers verified by the Company. Data in use is isolated in containers, and customer data remaining on a node is deleted when the workload ends.
• No copying outside your storage: The Company does not copy or retain data from your storage in any other storage (such as local disks or other clouds) for any purpose other than running your workload.

The Company does not sell or provide Customer Content to third parties, and entrusts processing to the companies below only as needed to operate the service.

Processor	Service entrusted	Data processed
GPU providers (verified by the Company)	Supplying equipment for workload execution	Customer Content in use (isolated)

Processing and outsourcing of payment information is governed by the Privacy Policy. If the Company ever needs to provide Customer Content to a third party or use it for purposes other than providing the service, it will first tell you the recipient, the purpose, the items, the retention and use period, and your right to refuse consent and any disadvantage of refusing, and obtain your prior consent (Article 27(2) of the Cloud Computing Act).

When a processor changes, the Company updates this policy and gives 30 days' notice before any change that affects the processing of Customer Content.

Because Customer Content stays in your storage, the Company has nothing of yours to keep or return. The credentials and workload settings the Company holds are permanently deleted in an unrecoverable way when the contract ends (Article 27 of the Cloud Computing Act and Article 19 of its Enforcement Decree).

Data	Retention period	After the period
Temporary data on the node during workload execution	While the workload runs	Deleted when the workload ends
Storage and registry credentials	Until you delete them or the contract ends	Permanently deleted immediately
Workload settings	Until you delete them or the contract ends	Permanently deleted
Operation logs and access records	90 days	Automatically discarded
Billing and payment records	5 years (Act on the Consumer Protection in Electronic Commerce)	Discarded
Audit logs	1 year	Discarded

• Contract end notice: At least 30 days before the contract ends (or when you apply for termination), the Company notifies you of the end date and time, the information that will be deleted at the end (credentials and workload settings), and the contact point. Because the data in your storage remains with you, no return procedure is needed.
• Service discontinuation: If the Company discontinues all or part of the service, it notifies you at least 30 days before the end date, posts the notice on its website until the end date, and permanently deletes the user information it holds on the end date.
• Inactive accounts: For accounts not used for one year, the Company follows the inactive user standard in the Privacy Policy, notifies you at least 30 days before processing, and then permanently deletes your credentials and workload settings.
• Statutory retention: Data that the law requires to be retained is stored separately for the required period.

The Company encrypts traffic between your storage and your workloads, stores the credentials you entrust to it in encrypted form, and records every operator access to Customer Content.

Area	Measures
Encryption in transit	TLS 1.2 or higher for external API traffic and for connections to your storage (where your storage supports it)
Credential protection	Storage and registry credentials you enter are stored encrypted, used only to connect storage and pull images, and never shown in operator screens or logs
Credential management	Company access keys issued with least privilege, stored only in a dedicated secrets manager, rotated annually and immediately on suspected exposure
Operator privileges	Role-based least privilege, quarterly access reviews, revocation on the same day as departure or role change
Node cleanup	Container and temporary node data deleted when a workload ends
Audit records	Operator access to customer workloads and storage

Security of your storage itself (access control, encryption, backups) is managed by you. The Company does not back up your storage, so we recommend that you back up important data separately.

If a security incident, a leak of Customer Content, or an unannounced service interruption (10 consecutive minutes or longer, or two or more interruptions within 24 hours totaling 15 minutes or longer) occurs, the Company notifies you without delay under Article 25 of the Cloud Computing Act and Articles 16 and 17 of its Enforcement Decree.

Event	Customer notice	Report to authorities
Security incident, service interruption	Without delay	As required by applicable law
Leak of Customer Content (user information)	Without delay	Immediately to the Minister of Science and ICT
Leak of personal information in Account Information	Within 72 hours (Personal Information Protection Act)	Personal Information Protection Commission or Korea Internet & Security Agency

Customer notices include what happened, the cause (as soon as it is identified, if not known at first), the Company's measures to prevent further damage, how you can prevent damage, and the responsible department and contact details. Notices are given by one or more of email, text message, or a posting on the service screen (for at least 15 days). In case of a leak of Customer Content, the Head of Operations and Development reports immediately to the Ministry of Science and ICT (received by the Korea Internet & Security Agency). On learning of an incident, the Company immediately revokes the relevant credentials and keys, determines the scope of impact, recovers, and shares the post-incident analysis. If your storage credentials are leaked, you should reissue them immediately.

The Company provides Customer Content only when a court submission order or a warrant issued by a judge requires it, and never provides data beyond the scope of the request.

• The Company first asks the requesting authority to seek the data directly from you.
• Unless prohibited by law, the Company notifies you of the request before disclosure so that you can object.
• The Company responds after legal review of the request's lawfulness and scope, and keeps a record of how it was handled.

You may manage and delete your connected storage, credentials, and share links yourself at any time, and may ask the Company for a record of how your data has been processed.

• Deleting credentials and settings: Delete storage and registry credentials and workload settings directly in the console.
• Managing shares: Create and revoke share links directly in the console.
• Access history: Request records of operator access to your workloads or storage.
• Privacy rights: Request access to, correction, deletion, or suspension of processing of your Account Information (under the Privacy Policy).
• Damages: If you suffer damage because the Company violated the Cloud Computing Act, the Company is liable unless it proves it acted without intent or negligence (Article 29).

Submit requests to the contact point in Section 14. The Company responds within the period required by applicable law.

The Company collects from GPU providers only the information needed to operate equipment and settle payments, and providers cannot access Customer Content running on their equipment.

Data collected	Purpose
GPU model, memory, driver version, network bandwidth	Resource registration, workload assignment
Operating status, availability, performance measurements	Quality management, provider rating
Business information, settlement account	Revenue settlement

• Under the provider terms, providers agree not to access Customer Content, to keep their equipment secure, and to report incidents immediately.
• The Company runs an isolated execution environment on provider equipment and deletes data remaining on the node when a workload ends.

The Company reviews this policy once a year and whenever the storage structure changes, and gives 30 days' notice before any change unfavorable to customers.

• Contact: CS@data-alliance.com
• Effective date: November 3, 2026

Version	Effective date	Description
1.0	2026-11-03	Initial release

The Korean version of this policy is the official version. If the Korean and English versions differ, the Korean version prevails.

Effective Date: November 3, 2026