bondit PRIVACY POLICY

Effective Date: October 1, 2026

Last Updated: September 30, 2026

Bondit Community Inc. (“Company,” “we,” “us,” or “our”) respects your privacy and is committed to handling personal information responsibly.

This Privacy Policy explains how we collect, use, disclose, retain, and otherwise process personal information in connection with the bondit mobile application, its artificial intelligence conversation and creation features, related online services, and customer support functions.

The bondit mobile application and related services are collectively referred to in this Privacy Policy as the “Service.”

Please read this Privacy Policy carefully. Your privacy rights may vary depending on where you live and which laws apply to you.

1. WHO WE ARE AND SCOPE OF THIS PRIVACY POLICY

The Service is provided and operated by:

Bondit Community Inc.

The Company may be contacted at either of the following addresses:

140 York Street

Canton, MA 02021

United States

2055 Limestone Road, Suite 200C

Wilmington, DE 19808

United States

Privacy Inquiries and Rights Requests:

[bondit.contact@gmail.com](mailto:bondit.contact@gmail.com)

This Privacy Policy describes:

1. the categories of personal information we collect;

1. how we collect that information;

1. why we use it;

1. when and with whom we disclose it;

1. how long we retain it;

1. how we protect it; and

1. the privacy choices and rights that may be available to you.

Third party services, including social login providers, app stores, payment providers, and other services that process information for their own purposes, may separately process information under their own privacy policies.

2. PERSONAL INFORMATION WE COLLECT

The categories of information we collect depend on how you use the Service.

2.1 Account and Profile Information

You may sign in by receiving an authentication code at your email address or by using a supported social login method, such as Apple or Google.

Depending on the sign in method and features you use, we may process:

1. your email address;

1. your login provider;

1. identifiers associated with your login provider;

1. your Firebase user identifier;

1. authentication status and related authentication information;

1. your nickname or display name;

1. your profile image;

1. your date of birth; and

1. gender information that you choose to provide through the Service.

We use date of birth information to determine eligibility to create an account and eligibility for age restricted or Adult features.

Where required by applicable law or platform policy, we may request additional information or verification to determine a user’s age or eligibility to access adult features.

2.2 Plots, AI Conversations, and AI Generated Content

When you create or interact with content through the Service, we may process information including:

1. prompts you submit;

1. character settings;

1. fictional world and story settings;

1. lorebook information;

1. persona information;

1. Plot settings and introductions;

1. reference images and other images you upload;

1. AI generated text and images;

1. whether a Plot is public or private;

1. Adult content classifications;

1. your conversation inputs;

1. AI responses;

1. conversation and story identifiers;

1. recent conversation context and progress;

1. selected AI models and personas;

1. relevant settings and lorebook context;

1. bookmarks;

1. generation history;

1. Sparks or other credits used in connection with generation requests; and

1. error and processing information.

To provide conversational continuity, we may store conversation histories, memory information, and related scene or story information on our servers.

Certain session information and settings may also be stored locally on your device.

An AI generation request may include not only the prompt you directly submit, but also information necessary to provide a coherent response, such as recent conversation history, story definitions, character information, persona settings, or lorebook context.

AI conversation, memory, and related scene information may be cleared or otherwise managed based on a period of approximately 180 days from the last update, subject to the retention practices described in Section 8.

If you request deletion of your account, a separate account deletion process applies.

Information submitted to external AI providers may be retained by those providers for periods determined by our contractual arrangements, account configurations, and the providers’ applicable processing terms.

2.3 Sensitive Information You Include in Content

Your prompts, conversations, images, or other content may contain information that may be considered sensitive under applicable law.

For example, information you choose to provide may concern:

1. health;

1. sexual activity or sexual orientation;

1. religious or other beliefs;

1. facial images or likeness;

1. other sensitive personal characteristics; or

1. sensitive information relating to another person.

Information included in prompts or reference images may be transmitted to external AI service providers where necessary to perform the generation request.

Please avoid entering sensitive information, confidential information, or another person’s nonpublic information unless it is reasonably necessary for your use of the Service and you have an appropriate basis to provide it.

Where applicable law requires separate consent or another specific legal basis for processing sensitive personal information, we will apply the required process and safeguards.

The fact that information is entered into a conversation or made public does not constitute blanket consent to every possible use of sensitive personal information.

2.4 Community Information

If you use community features, we may process information associated with:

1. comments;

1. likes;

1. follows;

1. blocks;

1. reports;

1. community notifications; and

1. related activity.

Information you choose to make public may be displayed to other users according to the nature of the feature and the visibility settings you select.

2.5 Sparks Purchases and Payment Information

When you purchase Sparks, we may process information including:

1. order identifiers;

1. the product purchased;

1. purchase amount and currency;

1. payment status;

1. refund status;

1. transaction identifiers;

1. purchase receipts or purchase tokens provided by Apple App Store or Google Play; and

1. records of Sparks issuance and use.

We do not directly receive or store your full payment card number or card security code, such as a CVV or CVC, as part of the in app payment process.

Payments are generally processed through the applicable app store or payment platform.

2.6 Device and Technical Information

We may process device and technical information reasonably necessary to provide, secure, troubleshoot, and maintain the Service, including:

1. device identifiers;

1. device platform;

1. operating system;

1. application version;

1. build number;

1. device name or similar device information;

1. request timestamps;

1. processing information;

1. error information;

1. feature identifiers;

1. the AI model used;

1. processing time;

1. token counts; and

1. response length.

If you enable push notifications, we may process push notification tokens and notification settings through systems such as Firebase Cloud Messaging or Apple Push Notification service.

After account deletion, push tokens associated with the account may be disabled or removed as part of the deletion process.

We generally do not continuously record the full text of every prompt and AI response in ordinary technical logs.

However, limited portions of content may be separately stored or reviewed where reasonably necessary for troubleshooting, abuse prevention, safety investigations, or other purposes described in this Privacy Policy.

Technical logs are retained for periods reasonably necessary for security, fraud and abuse prevention, error investigation, and Service reliability.

2.7 Customer Support, Reports, and Rights Requests

If you contact us for customer support, submit a report, appeal an enforcement action, or exercise a legal right, we may process:

1. the contents of your request;

1. your email address and other contact information;

1. relevant order identifiers;

1. relevant content identifiers;

1. reports and appeals;

1. supporting documentation;

1. information reasonably necessary to verify your identity or authority; and

1. records relating to our handling of the request.

Certain legal processes, including copyright procedures under the Digital Millennium Copyright Act, may require us to receive information such as a person’s name, address, telephone number, signature, or legally required statements.

We do not ask users to submit unnecessary identification documents, complete payment card numbers, or payment card security codes for ordinary privacy requests.

Privacy requests may be submitted to:

[bondit.contact@gmail.com](mailto:bondit.contact@gmail.com)

We may provide specific instructions for identity verification or secure submission of supporting information depending on the nature of the request.

3. HOW WE USE PERSONAL INFORMATION

We may use personal information to:

1. create, authenticate, secure, and administer accounts;

1. determine registration eligibility and applicable age restrictions;

1. provide and maintain user profiles;

1. create, generate, play, store, restore, and manage Plots and other content;

1. provide AI conversations and maintain relevant conversational context;

1. generate AI text and images;

1. provide community features, including comments, likes, follows, blocks, reports, and notifications;

1. process and verify Sparks purchases;

1. administer Sparks balances, usage, refunds, and related transaction records;

1. provide push notifications that you choose to receive;

1. maintain, troubleshoot, and improve Service quality and reliability;

1. detect, investigate, and prevent fraud, abuse, security incidents, and violations of our rules;

1. perform content safety review during creation or publication;

1. investigate user reports and rights infringement complaints;

1. enforce our Terms of Service and other policies;

1. review appeals of enforcement actions;

1. comply with legal obligations;

1. establish, exercise, or defend legal claims; and

1. resolve disputes.

Safety review may include automated examination of relevant prompts, images, generated outputs, or portions of conversations and, where necessary, review by authorized personnel.

As of the Effective Date, the Service does not provide personalized advertising.

If we later seek to use personal information for a materially different purpose that is not necessary to provide the Service, including a new use such as training a general purpose AI model, we will provide appropriate notice and any consent, opt out mechanism, or other choice required by applicable law.

4. AI SERVICE PROVIDERS AND HUMAN REVIEW

4.1 AI Providers

To provide AI text and image generation features, we may transmit information needed to perform a generation request to external AI model providers, cloud service providers, or related technology providers.

Depending on the feature, this information may include:

1. your prompt;

1. recent conversation context;

1. story information;

1. character information;

1. persona information;

1. lorebook settings;

1. generation settings;

1. image generation prompts;

1. reference images; and

1. other information reasonably necessary to perform the requested generation.

Some requests may be processed through different AI service providers or technical routing paths for purposes such as availability, reliability, model selection, or Service performance.

As a result, personal information that you include in a prompt, conversation, or image may be included in information transmitted to an external provider.

External AI providers may process inputs and outputs to perform generation requests, maintain the safety and reliability of their services, and for other purposes permitted under our applicable contracts, configurations, and legal requirements.

Retention and processing conditions may vary depending on the provider, our contractual arrangements, and applicable account settings.

4.2 General Purpose AI Model Training

If the Company intends to use private conversations, private drafts, reference images, or other personal information to train its own general purpose AI models in a manner that requires additional notice, consent, or another privacy choice under applicable law, we will provide that notice and the legally required method to consent, decline, or withdraw consent before engaging in that processing.

Use of the Service alone does not constitute blanket consent to every form of general purpose AI model training.

4.3 Human Review

Automated systems may be used for generation, safety screening, and abuse detection.

Authorized personnel may access limited information where reasonably necessary for:

1. customer support;

1. troubleshooting;

1. security and safety investigations;

1. rights infringement review;

1. policy enforcement;

1. legal compliance; or

1. dispute resolution.

We seek to limit access to the information reasonably necessary for the relevant task and to manage access permissions appropriately.

Private conversations with an AI character do not establish a legally recognized confidential relationship such as an attorney client, physician patient, therapist patient, or similar professional privilege.

5. INFORMATION YOU MAKE PUBLIC

Depending on your settings and how you use the Service, information you make public may include:

1. public Plots;

1. characters;

1. images;

1. comments;

1. your nickname;

1. your profile image;

1. likes;

1. follows; and

1. other activities that you choose to make public.

Other users may view information you make public according to the visibility settings and functionality of the Service.

Information made public may also be copied, saved, or reshared by other users.

Where public web discovery or indexing is permitted, publicly available information may also become accessible through external search services.

Private conversations and private drafts are treated differently from public posts.

Authorized personnel may nevertheless access relevant private information to the limited extent reasonably necessary for customer support, troubleshooting, safety review, enforcement, rights protection, or legal compliance.

We do not treat the decision to make particular information public as a blanket waiver of privacy rights that may apply under law.

As a general practice, we do not display your date of birth, email address, authentication information, or payment information as part of your ordinary public profile.

6. SERVICE PROVIDERS AND OTHER DISCLOSURES

We may disclose or otherwise make personal information available to service providers where reasonably necessary to operate the Service.

The categories below reflect the services described in this Privacy Policy. Providers may change as our infrastructure and Service evolve.

Provider or Provider Type

Purpose

Information That May Be Processed

Google Firebase

Account authentication and push notifications

Account identifiers, authentication status, push tokens, notification settings

Apple and Google social login services

Social authentication

Apple App Store and Google Play

Sparks purchases, in app payment processing, and purchase verification

Order identifiers, products, transaction identifiers, receipts, purchase tokens

AI text generation providers

AI text generation and Service reliability

Prompts, recent conversation context, story, character, persona, and lorebook information

AI image generation providers

AI image generation

Image prompts, reference images, generation or job identifiers

Cloud hosting, database, file storage, and logging providers

Hosting, storage, file processing, Service reliability, and technical logging

Account information, content, conversations, files, security logs, and error logs

Customer support or safety review providers, if used

Customer support, reports, and safety review

Inquiry contents, relevant content identifiers, and necessary supporting materials

We will update this Privacy Policy where required if the identity of material providers or the nature of their processing changes in a manner that requires additional disclosure.

6.1 Legal Requests and Safety

We may disclose information where reasonably necessary to:

1. respond to a legally valid request;

1. comply with a court order;

1. comply with legally applicable child exploitation reporting obligations;

1. comply with another applicable legal obligation;

1. protect life or physical safety in a lawful emergency; or

1. establish, exercise, or defend legal claims.

We do not automatically provide every user report or all information associated with every report to law enforcement.

6.2 Copyright and Similar Legal Procedures

Certain statutory procedures may require information submitted by one party to be provided to another party.

For example, information contained in a valid DMCA counter notification, including certain identity and contact information, may be provided to the original copyright claimant as required by the applicable process.

Where appropriate, we will explain the information required and the possibility that it may be disclosed to another party.

We do not ordinarily disclose a reporter’s personal information to a reported user without a lawful or legitimate basis for doing so.

6.3 Corporate Transactions

If Bondit Community Inc. is involved in a merger, acquisition, reorganization, financing, sale of assets, transfer of business, or similar corporate transaction, personal information may be transferred as part of that transaction where permitted by applicable law.

Where required, we will provide notice and implement appropriate safeguards.

If a recipient intends to use transferred personal information for materially different purposes, additional notice, consent, or other procedures will be provided where required by law.

7. DEVICE STORAGE, PUSH NOTIFICATIONS, AND ANALYTICS

The Service may use secure device storage, local storage technologies, and similar mechanisms to maintain authentication, preferences, settings, or security related information on your device.

Push notifications are provided only where you have permitted them through your device or application settings.

You can disable optional push notifications through your device or application settings.

As of the Effective Date:

1. the Service does not provide personalized advertising; and

1. the Service does not use Firebase Analytics for user behavior analytics.

If we introduce personalized advertising, behavioral analytics, or similar functionality in the future, we will first implement any notice, consent, opt out mechanism, or other privacy control required by applicable law.

8. RETENTION AND DELETION

We retain personal information only for as long as reasonably necessary for the purposes described in this Privacy Policy, including Service operation, security, legal compliance, accounting, dispute resolution, and enforcement.

When the applicable purpose has been satisfied and no legal reason requires continued retention, information will be deleted, anonymized, or otherwise handled in accordance with applicable law and our retention processes.

We do not impose a separate discretionary grace period before beginning the account deletion process after receiving a valid deletion request.

Our general retention approach is as follows:

Information Category

General Retention Approach

Account, profile, and age information

Processed while your account remains active. When a valid account deletion request is received, deletion begins without a separate discretionary grace period, and relevant information is deleted or anonymized subject to applicable exceptions.

Private conversations, AI memory, and scene information

May be cleared based on approximately 180 days from the last update. When an account is deleted, we begin deletion of associated data, subject to legally required retention.

Public Plots, characters, and images

May remain until you delete them or the Company removes them under applicable policy or law. Account deletion alone does not necessarily delete public content. You may separately request deletion or removal of personal information.

Order, payment, and Sparks records

Retained as necessary for transactions, tax, accounting, refunds, fraud prevention, and disputes, and for any period required by applicable law.

Reports, enforcement, customer support, and identity verification records

Retained for periods reasonably necessary to handle the matter, enforce policies, protect users, and address disputes or legal obligations.

Device information and push tokens

Processed for as long as reasonably necessary to provide notifications and manage devices. Tokens may be disabled or removed following account deletion, expiration, or replacement.

Security, access, and error logs

Retained for periods reasonably necessary for security, Service reliability, fraud and abuse prevention, and troubleshooting.

Backups and caches

Information may remain temporarily within ordinary backup cycles. Our deletion processes are designed so that completed deletion requests remain effective when backup data is later restored into active systems.

Legally preserved reports and evidence

Retained only for the information and period required by applicable law, valid preservation requirements, or reasonably necessary dispute handling, with access restricted where appropriate.

8.1 Account Deletion

After receiving a valid account deletion request, we begin the deletion process without imposing an additional discretionary waiting period.

As part of that process, we may:

1. invalidate authentication credentials associated with the account;

1. delete or anonymize account information;

1. begin deletion of associated AI conversations;

1. begin deletion of AI memory and scene information;

1. disable or remove related push notification tokens; and

1. take other steps reasonably necessary to complete the deletion process.

Certain information may remain after account deletion, including:

1. public Creator content as described in Section 9;

1. legally required transaction, payment, and Sparks records;

1. records relating to reports, disputes, enforcement, and customer support;

1. certain security and error logs;

1. information maintained temporarily in ordinary backups; and

1. information that must be preserved under applicable law.

Personal information embedded directly within public content may not automatically disappear when the associated account is deleted.

You may separately request removal of that personal information or deletion of the public content.

8.2 Legally Required Preservation

Certain reports involving child sexual exploitation may be subject to separate reporting and preservation obligations under United States law.

For example, where 18 U.S.C. § 2258A applies, materials included in a completed CyberTipline report may be subject to a one year preservation requirement following submission, together with applicable security and access restrictions.

Such preserved information is maintained separately from ordinary public availability and is handled in accordance with applicable legal requirements.

8.3 Korean Transaction Records

Where the Republic of Korea’s Act on the Consumer Protection in Electronic Commerce, Etc. and its implementing rules apply, transaction records may be retained for the applicable statutory periods, including:

1. records concerning contracts and cancellation of orders: 5 years;

1. records concerning payments and supply of goods or services: 5 years;

1. records concerning consumer complaints and dispute resolution: 3 years; and

1. records concerning indications and advertising: 6 months.

These transaction retention requirements do not mean that all conversations, images, or other Service content are retained for the same periods.

9. PUBLIC CONTENT AFTER ACCOUNT DELETION

Deleting your account does not necessarily automatically delete every public character, Plot, image, or other item that you previously chose to make public.

When an account is deleted, we may anonymize or remove certain account information while public content remains available in accordance with our Terms of Service and applicable law.

Information contained directly within the title, body, cover image, attachment, or other contents of public material may therefore remain unless separately removed.

You may request:

1. deletion of public content;

1. removal of personal information contained in public content; or

1. another appropriate privacy measure available under applicable law.

We will review the request in light of applicable privacy rights, legal obligations, the nature of the content, and other relevant circumstances and may edit, restrict, make private, or delete information as appropriate.

Changing or anonymizing the displayed Creator name does not necessarily make information nonpersonal if a person can still reasonably be identified from the title, image, text, or other information.

The license applicable to public content does not give the Company an unlimited right to retain personal information indefinitely or to disregard a legally valid deletion request.

We cannot necessarily retrieve copies that other users independently saved or information that was shared to services outside our control.

However, we will take legally required action with respect to information that remains under our control and information publicly displayed through the Service.

10. YOUR PRIVACY CHOICES AND RIGHTS

Depending on where you live and the law that applies to your information, you may have the right to request:

1. confirmation of whether we process your personal information;

1. access to personal information;

1. a copy of personal information;

1. correction of inaccurate personal information;

1. deletion of personal information;

1. data portability where applicable;

1. restriction or limitation of certain processing;

1. withdrawal of consent where processing is based on consent;

1. an appeal of certain privacy request decisions; or

1. other rights provided by applicable law.

Privacy requests may be submitted to:

[bondit.contact@gmail.com](mailto:bondit.contact@gmail.com)

The Service does not currently provide a self service tool to download a complete copy of your personal information.

If you request access or a copy by email, we will provide the applicable process after reasonably verifying your identity and determining the scope of the request.

We may verify:

1. your identity;

1. account ownership; or

1. the authority of a person acting on your behalf.

We seek to request only the information reasonably necessary for verification.

Information submitted solely for verification will not be used for an unrelated new purpose.

If we deny or limit a request based on an applicable legal exception, we will provide the reason and available appeal information where required by law.

We will not unlawfully discriminate against you because you exercised a privacy right.

However, if you ask us to delete information or stop processing information that is necessary to provide a feature, some account, gameplay, or other Service functionality may no longer be available.

Where appropriate, we will explain that effect before completing the request.

10.1 Push Notifications

You can disable optional push notifications through your device or application settings.

Important transactional, security, account, or legal notices may be provided separately from optional promotional or engagement notifications where permitted by law.

11. ADDITIONAL RIGHTS FOR UNITED STATES RESIDENTS

Residents of certain United States states may have additional privacy rights if an applicable state privacy law applies to Bondit Community Inc. and to the relevant processing.

Depending on the applicable law, these rights may include:

1. confirming whether we process your personal information;

1. accessing or obtaining a copy of personal information;

1. obtaining portable personal information;

1. correcting inaccuracies;

1. deleting personal information;

1. opting out of the sale of personal information where applicable;

1. opting out of sharing or targeted advertising where applicable;

1. limiting certain uses or disclosures of sensitive personal information where applicable;

1. withdrawing consent to certain sensitive information processing where applicable;

1. opting out of certain forms of profiling or automated processing where applicable; and

1. appealing the denial of a privacy request.

Not every state provides the same rights, applies the same definitions, or imposes the same response periods.

The availability of a particular right depends on the applicable law and the Company’s obligations under that law.

11.1 California Residents

If the California Consumer Privacy Act, as amended, applies to your personal information and request, you may have rights provided by that law and its implementing regulations.

For applicable requests to know, delete, or correct personal information, we generally will:

1. confirm receipt within 10 business days; and

1. respond within 45 calendar days after receiving the request.

Where permitted and reasonably necessary, the response period may be extended by an additional 45 calendar days, for a maximum of 90 calendar days, provided that we give the required notice and explanation.

Different statutory response periods may apply to particular requests, including certain opt out or sensitive information requests.

11.2 Authorized Agents and Appeals

Where applicable law permits an authorized agent to submit a request, we may take reasonable measures to verify the agent’s authority and, where permitted, the identity of the consumer.

If applicable state law provides a right to appeal a denied privacy request, you may request reconsideration by contacting:

[bondit.contact@gmail.com](mailto:bondit.contact@gmail.com)

We will process the appeal within the period required by applicable law and provide information about any further complaint mechanism or regulator where legally required.

12. CHILDREN AND MINORS

The minimum age to create an account on the Service is 13.

The Service is not designed or directed to children under 13.

If we learn that we have collected personal information from a child under 13 without the legally required process, we will take appropriate steps, which may include restricting the account, deleting information, and implementing other legally required safeguards.

Where the United States Children’s Online Privacy Protection Act and its implementing rules apply, we will evaluate and comply with applicable notice, parental consent, data minimization, security, retention, and parental rights requirements.

A statement that the minimum age is 13 does not by itself replace obligations that may arise if we have actual knowledge that a user is under 13.

For users in the Republic of Korea, additional legal requirements may apply to processing personal information of children under age 14 where Korean law applies.

Minors may not access Adult Plot gameplay.

Eligibility for Adult features may be determined based on:

1. date of birth information provided by the user;

1. adult content settings;

1. Service policies;

1. applicable law; and

1. additional age assurance or verification where required.

Parents or guardians who believe a child has improperly created an account or whose personal information is being processed improperly may contact:

[bondit.contact@gmail.com](mailto:bondit.contact@gmail.com)

We may reasonably verify the parental relationship and authority before acting on the request.

13. INTERNATIONAL PROCESSING AND USERS IN THE REPUBLIC OF KOREA

13.1 International Processing

Bondit Community Inc. is based in the United States.

Personal information may therefore be processed in the United States and in other countries where our service providers operate.

International processing may occur in connection with:

1. account authentication;

1. social login;

1. push notifications;

1. in app purchase verification;

1. AI text generation;

1. AI image generation;

1. cloud hosting and storage;

1. technical logging;

1. customer support; and

1. safety and security operations.

Privacy and data protection laws may differ between countries.

Where applicable law requires particular safeguards, notices, contractual protections, consent, or other mechanisms for international transfers, we will apply the legally required measures.

13.2 Users Subject to Korean Privacy Law

Where the Personal Information Protection Act of the Republic of Korea applies, international transfers of personal information will be conducted on an applicable legal basis and subject to legally required safeguards.

Where required, the applicable cross border transfer notice or consent process will identify information such as:

1. the categories of personal information transferred;

1. the country to which the information is transferred;

1. the timing and method of transfer;

1. the identity and contact information of the recipient;

1. the recipient’s purpose for using the information;

1. the applicable retention and use period;

1. the legal basis for the transfer; and

1. the method for refusing the transfer, where a right to refuse applies, together with the consequences of refusal.

Where Korean law permits information necessary to perform a contract with the user to be processed or stored abroad based on appropriate disclosure or another authorized mechanism, we will provide the disclosures required for that mechanism.

Where a right to refuse a particular international transfer applies, you may contact:

[bondit.contact@gmail.com](mailto:bondit.contact@gmail.com)

If a transfer is necessary to provide a requested feature, refusing the transfer may prevent us from providing that feature.

Where required, we will explain the relevant effect and available alternatives.

14. SECURITY AND INCIDENT RESPONSE

We use reasonable administrative, technical, and physical safeguards appropriate to the nature of the information we process and the risks associated with that processing.

These measures may include:

1. access controls;

1. authentication measures;

1. encryption in transit;

1. access permission management;

1. security logging;

1. monitoring and abuse prevention measures; and

1. incident response procedures.

No technology, system, transmission method, or storage environment can eliminate every security risk.

If a personal information incident occurs, we will investigate and respond as appropriate and will provide legally required notifications to affected individuals, regulators, or other parties within the periods required by applicable law.

We may also take reasonable steps to contain the incident, mitigate harm, preserve relevant evidence, and prevent recurrence.

15. CHANGES TO THIS PRIVACY POLICY AND CONTACT INFORMATION

We may update this Privacy Policy from time to time.

When we update it, we will publish the revised Privacy Policy and its effective date through the Service or another appropriate location.

If a change materially affects how we process personal information, we will provide additional notice through email, an in Service notification, or another legally appropriate method where required.

If a new purpose or type of processing requires new consent or another affirmative privacy choice under applicable law, we will complete the required process before relying on that processing.

For privacy questions, complaints, and rights requests, contact:

Bondit Community Inc.

Email: [bondit.contact@gmail.com](mailto:bondit.contact@gmail.com)

Mail may also be directed to:

140 York Street

Canton, MA 02021

United States

2055 Limestone Road, Suite 200C

Wilmington, DE 19808

United States

Where applicable Korean law requires the designation or disclosure of a privacy officer, domestic representative, or other statutory privacy contact for the scope in which the Service operates, the applicable contact information will be separately provided as required by law.