Playio Privacy Policy
GNA COMPANY CORP (the “Company”) values users’ personal information and makes best efforts to process such information lawfully and securely in compliance with applicable laws and regulations, including the Personal Information Protection Act.
This Privacy Policy sets forth the procedures and standards for the processing of personal information in connection with the use of Playio (the “Service”) operated by the Company, and is intended to protect users’ rights and facilitate prompt handling of complaints and inquiries. Users under the age of fourteen (14) are restricted from using the Service. The Service is not directed to children under the age of 14, and the Company does not knowingly collect personal information from children under 14.
Purpose of Processing Personal Information
The Company processes personal information for the following purposes and does not use such information for any purposes other than those listed below. If the purpose of processing changes, the Company will provide prior notice through service announcements or obtain separate consent.
•
Identification of members; confirmation of intent to register; verification of identity and age
•
Handling inquiries, complaints, and providing notices and customer support
•
Service improvement and development of new services based on analysis of service usage records and access frequency
•
Provision of personalized and customized content based on analysis of user characteristics and usage history
•
Prevention of and sanctions against activities that hinder service operations, such as account theft or fraudulent use
•
Establishment of a secure environment to ensure the safety of personal information
•
Marketing and advertising; operation of events and promotions (including participation verification and prize delivery)
•
Provision of communication features, such as activity notifications
•
Provision of location-based services (including in-service content delivery and recommendations, as well as service enhancement based on location data)
Processing and Retention Period of Personal Information
In principle, the Company retains personal information from the time it is collected with the user’s consent and destroys it without delay when the user withdraws from membership or when the purpose of processing has been achieved.
However, where retention is required for a certain period pursuant to applicable laws or service operation policies, the Company will retain the information for that period only and will not use it for other purposes.
(1) Retention Periods Required by Law
Retained Information | Legal Basis | Retention Period |
Records of consumer complaints or dispute resolution | Consumer Protection in Electronic Commerce and Related Laws | 3 years |
Records related to labeling and advertising | Consumer Protection in Electronic Commerce and Related Laws | 6 months |
Login records related to service use | Protection of Communications Secrets Act | 3 months |
Records verifying the collection, use, and provision of location information | Act on the Protection and Use of Location Information | Minimum of 6 months |
(2) Retention Periods Based on Service Policies
•
If a user does not access the Service for 210 consecutive days, the account will be converted to an inactive account, and free virtual assets (Gems, Hearts, Coins) may expire. Prior notice will be provided via email or push notifications 60 days and 30 days before the conversion. Upon re-login, the account will be immediately reactivated; however, any free virtual assets that have already expired will not be restored.
•
If a user withdraws from the Service and/or deletes the account, related information will be retained for 90 days and then destroyed.
•
Where necessary to prevent improper use or to respond to disputes, the Company may retain personal information for up to one (1) year after withdrawal.
Categories of Personal Information Processed
[Items of Personal Information Collected]
1.
At the time of registration, the Company collects email address, date of birth, and gender as required items. Information collected varies depending on the login method, as described below.
2.
If a user uses paid services, the Company may collect payment method information, payment approval numbers, and related data at the time of payment through a personal information processor (payment service provider).
3.
If a user purchases products, the Company may collect the information listed below.
4.
If a user participates in events or promotions, the Company may collect the information listed below.
5.
In the course of handling inquiries, the Company may collect the information listed below.
6.
During the use of the Service, the following information may be automatically generated and collected:
•
Registration path, registration date, IP address, cookies, access logs, service usage records, records of improper use, device information (model name, unique device identifiers, MAC address, OS information), mobile carrier, payment records, and purchase history
•
When using location-based services: GPS-based location information (latitude and longitude coordinates)
7.
Location information is collected and used only when the user utilizes location-based services. Detailed provisions are governed by the separate Location Information Terms of Use.
Category | Personal Information Collected |
Membership registration (Email) | Email address, password, date of birth, gender |
Membership registration (Google) | Email address, date of birth, gender |
Membership registration (Facebook) | Email address, date of birth, gender |
Events / Promotions | Name, email address, mobile phone number, address, date of birth |
Customer Support | Account ID, contact information, device information, payment and purchase information |
Service improvement and stabilization | Email address, mobile phone number, device information, service usage (suspension) records, access logs, cookies, IP address, payment and purchase information |
Use of location-based services | ID, GPS-based location information, service usage records |
[Methods of Collecting Personal Information]
When collecting personal information, the Company provides prior notice to users and obtains their consent. Personal information is collected through the following methods:
•
Where users agree to the collection of personal information and directly enter such information through the Company’s website or mobile applications during registration or service use
•
Where personal information is provided by affiliated services or organizations
•
Where personal information is provided through web pages, email, or telephone during customer support or inquiry handling
•
Where personal information is provided through participation in online or offline events and promotions
App Permission Information
The Company requests only the minimum access permissions necessary to provide the Service.
[Required Permissions]
•
Display over other apps: Permission to display reward acquisition information during gameplay
•
Access to usage information: Permission to check game app usage time for the purpose of granting rewards
[Optional Permissions]
•
Contacts: Permission for the friend invitation feature
•
Camera: Permission to attach photos when posting community content or submitting customer support inquiries
•
Files and media: Permission to attach files when posting community content or submitting customer support inquiries
•
Location information: Permission required to enable location-based services
[Data Access Information]
•
Installed app information: Used to provide the “Continue Playing” feature and to synchronize game lists; such information is securely transmitted outside the device.
•
Optional permissions are not required to use the Service; however, certain features may be limited if such permissions are not granted.
Provision and Entrustment of Personal Information
The Company does not provide users’ personal information to third parties without prior consent. However, the Company may entrust certain tasks necessary for service provision to external service providers. In such cases, the Company strengthens management and supervision through contractual arrangements to ensure the protection of personal information.
Service Provider | Purpose of Use | Information Provided | Retention Period |
Twilio Inc. | SMS delivery service | Phone number | Until the purpose is achieved |
Amazon Web Services, Inc. | Data storage / hosting | IP address, location information, basic user information, advertising ID | Until contract termination or membership withdrawal / purpose achievement |
Google LLC | Service usage analysis and advertising performance measurement | Advertising ID, event data | Until the purpose is achieved |
Meta Platforms, Inc. | Service usage analysis and advertising performance measurement | Advertising ID, event data | Until the purpose is achieved |
Singular Labs, Inc. | Advertising performance measurement | Device ID, location information, advertising ID | Until the purpose is achieved |
Cross-Border Transfer of Personal Information
The Company may transfer users’ personal information to overseas recipients as described below. Such cross-border transfers are conducted for purposes including service provision and marketing activities (e.g., analysis of user activity statistics, notifications of events and promotions). Users’ personal information is transmitted through secure information and communication networks. The transferred personal information is retained and used until the relevant purposes are achieved. Details of cross-border transfers are as follows:
Recipient | Country | Contact | Purpose | Information Provided | Retention Period |
AppsFlyer Ltd. | Israel / United States | privacy@appsflyer.com | Advertising performance measurement | Device ID, location information, advertising ID | Until the purpose is achieved |
Adjust GmbH | Germany | privacy@adjust.com | Advertising performance measurement | Device ID, location information, advertising ID | Until the purpose is achieved |
Grey Box, Co., Ltd. | South Korea | contact@greyboxhq.com | Delivery of messages such as automatically collected information to users, app push notifications, SMS, and emails | Name, phone number, email address, date of birth | Until membership withdrawal or termination of the entrustment agreement |
Destruction of Personal Information
When the retention period of personal information expires or the purpose of processing has been achieved, the Company destroys such personal information without delay. However, where retention is required for a certain period pursuant to applicable laws or internal policies, the information will be stored separately and then destroyed.
(1) Destruction Procedures
•
Personal information is destroyed immediately after the retention period prescribed by internal policies and applicable laws has elapsed following the achievement of the processing purpose.
(2) Destruction Methods
•
Personal information stored in electronic file form is permanently deleted in a manner that prevents recovery or reproduction.
•
Personal information stored in paper document form is destroyed by shredding or incineration.
Users’ Rights and Methods of Exercising Rights
The Company does not sell or share users’ personal information as defined under applicable U.S. state privacy laws, including the California Consumer Privacy Rights Act (CPRA). The Company does not use or disclose sensitive personal information except as permitted by applicable law.
•
Users may exercise the following rights related to personal information protection at any time:
◦
Request access to personal information
◦
Request correction of errors or inaccuracies in personal information
◦
Request deletion of personal information (except for items required to be collected by law)
◦
Request membership withdrawal or suspension of personal information processing (note that some or all services may be restricted as a result)
•
Users may access or correct their personal information after identity verification, in accordance with the procedures established by the Company.
•
Membership withdrawal may be requested directly through the “Withdraw Membership” menu within the app.
•
If direct withdrawal or correction is difficult, users may submit a request to customer support or the personal information protection officer by written request, telephone, or email, and the Company will take action without delay.
•
If a user withdraws consent for the use of personal information or requests account deletion, the account will be deleted, and all virtual assets (Gems, Coins, Hearts) and purchased items held by the member will also be deleted. However, posts and comments previously published in the community will not be deleted.
•
Where a correction of personal information is requested, the relevant personal information will not be used or provided until the correction is completed. If the information has already been provided to a third party, the Company will promptly notify such third party to ensure that the correction is made.
•
Personal information deleted at the request of the user or legal guardian will be processed in accordance with the procedures set forth in this Privacy Policy and will not be accessed or used for any other purpose.
Technical and Administrative Safeguards for Personal Information
To prevent loss, theft, leakage, alteration, or damage of users’ personal information, the Company implements the following technical and administrative safeguards.
(1) Access Control and Authorization Management
•
Access to personal information is granted only to the minimum number of personnel necessary to perform their duties.
•
When a person handling personal information changes roles or leaves the Company, access rights are immediately modified or revoked.
•
When accessing systems externally, personal information handlers use secure connections (such as SSL), and additional security measures are applied to systems and personal computers to prevent unauthorized access.
(2) Encryption of Personal Information
•
Personal information is encrypted during transmission and receipt.
•
Where personal information must be stored for business reasons, it is securely stored in encrypted form.
•
Sensitive information, such as passwords and unique identifying information (e.g., date of birth, gender, alien registration numbers), is stored and managed using secure encryption algorithms.
(3) Retention of Access Logs and Prevention of Tampering
•
Records of personal information processing through systems by authorized personnel are retained for at least three (3) months.
•
Such records are securely managed to prevent tampering, theft, or deletion.
(4) Physical Access Control
•
Servers and documents containing personal information are stored in separate areas with restricted access.
•
Documents, electronic files, and auxiliary storage media containing personal information are stored in secure locations equipped with locking devices.
Collection and Use of Behavioral Information
The Company may collect and use behavioral information generated during users’ use of the Service for the purpose of improving service quality and providing personalized content.
[Purposes of Collection]
•
Analysis of service usage statistics and improvement of service features
•
Analysis of game usage patterns by user groups
•
Creation of content based on de-identified statistical data
(e.g., Top 5 popular games, usage pattern reports, campaign performance metrics)
The collected behavioral information is processed only in a form that does not allow identification of individual users. Even when such information is used on external channels such as social media or blogs, it is used only in an anonymized form that does not identify any individual.
The Company does not use identifiable personal information for external marketing or advertising purposes without the user’s explicit prior consent.
[Advertising Identifiers]
•
The Company may collect users’ ADID. ADID is an advertising identifier for mobile app users and may be collected to provide better services.
•
Users may refuse the collection of ADID as described below.
•
Menu names and paths may vary slightly depending on the operating system version.
Platform | Path |
Android | Settings > Google (Google Settings) > Ads > Opt out of Ads Personalization |
[Third-Party Advertising Notice]
The Company may enter into advertising agreements with various mobile game studios (third-party advertisers) in order to operate the Service and provide useful content to users.
•
To measure the performance of advertising campaigns, the Company uses service providers (analytics platforms) and does not directly provide users’ personal information to advertisers (game studios).
•
All information related to advertising campaigns is collected, used, and deleted solely within the scope of contracts between the Company and the service providers.
•
If a user downloads a specific game and provides personal information to the relevant game studio, such information is managed in accordance with that studio’s privacy policy, and the Company is not involved in the processing of such information. Users are encouraged to review the game studio’s privacy policy in advance.
Personal Information Protection Officer
•
Company: GNA Company Corp.
•
Name: Jiwoong Choi
•
Email: system@gna.company
Scope of Application of This Privacy Policy
•
This Privacy Policy applies to the Service operated by the Company (playio.co) and all related web- and app-based services.
•
Services provided under a separate brand name may be subject to a separate privacy policy.
•
Where personal information is collected by external websites linked within the Service, the privacy policy of such external website shall prevail.
Changes to the Privacy Policy
•
The Company may revise this Privacy Policy to reflect changes in applicable laws or the Service.
•
In the event of additions, deletions, or modifications to this Privacy Policy, notice will be provided at least seven (7) days prior to the effective date. If the changes materially affect users’ rights—such as changes to the categories of information collected or the purposes of use—prior notice will be provided at least thirty (30) days in advance.
•
The revised Privacy Policy shall take effect on the announced date or on a separately specified effective date.
Addendum
(Effective Date)
This Privacy Policy shall take effect on April 10, 2026.
All prior privacy policies are hereby replaced by this Privacy Policy.
•
Last Updated: April 2, 2026
•
Privacy Policy of Service Version : v2.1