Privacy Policy

SPODA LAB (represented by Seelbi Choi; the “Company”) establishes and publishes this Privacy Policy to protect personal data and promptly address related complaints under the Republic of Korea's Personal Information Protection Act.

Article 1. Scope

① This Policy applies to personal data processed through our SPODA platform (spoda.co.kr), company website (spodalab.com), TEAM SPODA inquiries and customer support.

② SPODA stands for Sport Performance Optimization & Data Analytics. It integrates and standardizes scattered training data, focusing on endurance sports, to support training management for individual athletes, coaches and teams.

③ External wearable providers' own processing is governed by their policies; our processing after integration is governed by this Policy. The company website currently processes personal data to receive and answer TEAM SPODA inquiries. Platform registration, record management, integrations and team sharing apply only to available features and the scope separately notified and consented to. We do not collect data in advance for features not yet introduced.

Article 2. Purposes of Processing

We process personal data only as necessary for the purposes below. Changes to purposes are subject to the notices and consent required by applicable law.

Article 3. Data We Collect and How

① Data is collected through registration, profiles, record entry and uploads, integration authorization, team membership and inquiry submissions. We process only data you provide or authorize. Optional items and items required for specific features are distinguished on the relevant entry or authorization screen.

② Information necessary to perform the contract, including account and identity verification data, is processed on a lawful basis such as Article 15(1)(4) of the Personal Information Protection Act. Optional profile and integration data is processed based on the relevant collection and use consent. Health information requires separate consent under Article 23 of that Act.

③ Account management involves email, password verification values, name or display name, account identifiers and authentication history. Profiles may include a date of birth, gender, photo, height, weight and health-related notes entered by you.

④ Training, integration and inquiry data is listed below. We do not separately collect items unavailable from a device or unused by the relevant feature.

Article 4. Retention

① We retain data only as long as necessary for its purposes and delete it without delay when it is no longer needed due to account withdrawal, consent withdrawal or expiration. If retention is required by law, only the relevant data is retained separately.

② Consent and withdrawal records are kept to the minimum extent and duration necessary to establish the basis for processing. Where transactions, disputes or other matters require separate retention, the basis, items and duration are notified individually. These reasons are not used as blanket grounds for extending retention.

③ If paid transactions are introduced, we will separately notify the applicable statutory retention items and periods for contracts, payments, cancellations and disputes.

Article 5. Wearable Integrations

① We receive data within the scope you permit on the external service's authorization screen. We do not directly collect the password of your external account.

② Building on Polar integration, we are expanding to Garmin, Suunto and other providers. New integrations are offered after provider approval and technical integration are complete. We do not collect information through APIs that are not yet available.

③ For Garmin integration, we process authorized activity and training record items needed for SPODA training analysis. Separate categories such as sleep and women's health are excluded unless actually introduced with separate notice and consent.

④ Disconnection stops new collection and discards tokens. It is distinct from deleting records already lawfully collected; you may request deletion of existing records at the same time or separately. Provider withdrawal or deletion notices are handled under applicable law and API agreements.

⑤ We do not use or redistribute data beyond the scope allowed by API agreements. If we introduce outbound transfer of records or training plans to providers, we will separately notify the destination, items and purpose.

Article 6. Deletion Procedures and Methods

① We identify data for deletion and take necessary action without delay when retention expires, purposes are fulfilled, a lawful deletion request is received or an account is withdrawn. If legal retention is necessary, we explain the basis and retain the relevant data separately.

② Electronic files are deleted using methods preventing recovery; paper records are shredded or destroyed. Deletion covers relevant database records, source files, profile images, reports and storage objects.

③ Account withdrawal stops access and collection and triggers deletion of personal data. Team access is revoked and identifiable histories and reports are addressed within the applicable deletion scope.

④ Backups are restricted to recovery purposes and managed under their storage and deletion cycles. After restoration, earlier deletion and withdrawal requests are reapplied.

⑤ Automated and authorized manual deletion procedures are used. Account deactivation or removal of a name alone is not treated as complete deletion.

Article 7. Research and AI

① General service consent under this Policy does not authorize blanket research disclosure, retention of pseudonymized data after withdrawal or AI model training.

② Before introducing research collaboration or model development, we will review purposes, items, recipients, periods, pseudonymization or anonymization methods and API terms, and obtain required notice and consent. Consent needed for service use is distinguished from marketing and research consent.

Article 8. Disclosure to Third Parties

① We do not disclose personal data to third parties beyond the notified and consented scope, except where there is a legal basis or valid consent.

② If team services disclose data to an independent team operator or coach, we identify the team, recipient, purpose, items and retention period and obtain necessary consent. The general disclosure scope is as follows.

③ Downloaded materials are also restricted to authorized purposes. When sharing or membership is withdrawn, we request that recipients delete externally held materials as appropriate. Where a team contract establishes processing on behalf of another party, the processing relationship follows the parties' actual roles.

④ Separate disclosure to research institutions is distinguished from ordinary team sharing under this Policy.

Article 9. Service Providers

We entrust necessary service tasks to external providers and supervise purpose limitations, access restrictions, safeguards, subprocessors, return and deletion through processing agreements.

The Company controls service and data management. Outsourced development alone does not transfer independent personal data usage rights or ownership to Article21 Co., Ltd. Changes to entrusted tasks or providers will be notified through this Policy.

Article 10. International Transfers

① Where international transfers occur, including email processing through overseas providers, we disclose recipients, countries, items, purposes, timing, methods, retention and lawful basis. Separate consent, where required, is obtained before transfer.

② Website inquiry delivery through Resend involves the following processing. The Tokyo sending region is distinct from storage in the United States.

③ Google Workspace is used to receive, store and answer inquiry emails. Sender and recipient emails, message contents and metadata are processed. Inquiry records in our mailbox follow Article 4. Google's global infrastructure may involve processing in the United States and other countries with Google or subprocessor facilities. Google's official information describes processing and facility locations and contractual deletion procedures. Direct email inquiries also involve this processing.

Resend Data Processing Agreement · Resend retention information · Google processing locations · Google subprocessors

Article 11. Your Rights and Legal Representatives

① You may exercise statutory rights to access, correct, delete or restrict processing of your data and withdraw consent. Use service settings or contact privacy@spodalab.com to make a request. After minimum necessary identity verification, we will act within the statutory period and inform you of the outcome.

② We verify the lawful authority of agents and legal representatives. If a right is restricted, we explain the legal basis, reasons and how to object.

③ Withdrawal of sensitive-data consent stops relevant collection and processing and triggers necessary deletion. Analysis features requiring that data may be limited. Coaches and teams cannot waive an athlete's rights on their behalf.

Article 12. Children

We do not accept registration from children under 14 until procedures for necessary legal-representative consent and verification are established. If such use is identified, we conduct appropriate verification, restrict use and delete unnecessary personal data. Young people's team information is processed only within authorized scope.

Article 13. Cookies and Browser Storage

① The SPODA platform uses cookies and browser storage necessary to maintain login, verify registration and restore screens. Additional advertising tracking, if introduced, will be separately explained with its purpose and refusal method.

② You can restrict or delete storage in the privacy, cookie and site-data settings of browsers such as Chrome, Safari and Edge. Blocking necessary storage may limit login and registration verification. Actual retention, including session restoration, depends on browser settings.

Article 14. Security Measures

We apply necessary organizational and technical measures, including internal procedures; minimizing and revoking handler access; protecting credentials; storing non-recoverable password verification values; protecting data in transit; keeping and reviewing access and download logs; and controlling backup access and deletion. Development and maintenance access is limited to what the task requires.

Article 15. Privacy Officer and Contact

For privacy complaint assistance or remedies, you may contact relevant Korean authorities, including the Privacy Portal (privacy.go.kr) and the Personal Information Dispute Mediation Committee (kopico.go.kr).

Article 16. Changes to This Policy

We publish changes, reasons and effective dates through the service or website, generally at least 7 days in advance, or 30 days for changes important to user rights. Individual notice, such as email, is provided where needed. Processing requiring separate consent starts only after that consent is obtained. Previous policies will also be made available.

Supplementary provision: This Policy takes effect on November 1, 2026.