Privacy Policy

Effective: October 4, 2026 · Controller: Quantum Materials Inc.

This privacy policy covers the following topics.

• 1. Purposes of collection and use
• 2. Items collected and how they are collected
• 3. Children under 14
• 4. Retention periods and destruction
• 5. Provision to third parties and outsourced processing
• 6. Your rights and how to exercise them
• 7. Automatic collection tools and how to refuse them
• 8. Technical and organizational safeguards
• 9. Privacy inquiries and grievance handling
• 10. Use of the apps (mobile & tablet)
• 11. Changes to this policy

1. Purposes of collection and use

The Company collects the minimum personal data and uses it only for the following purposes.

• a. Handling inquiries — receiving, consulting on, and answering contact / business inquiries
• b. Fulfilling and settling paid license contracts — issuing and re-issuing license keys, payments and refunds
• c. Stable service operation — reliable website and download delivery, abuse prevention

2. Items collected and how they are collected

a. Items by activity

b. How the data is collected

• Entered directly by you, with consent, in the website contact form
• Collected in the course of paid-license payment and refunds
• Generated automatically while you use the website

• Card numbers and other payment-method details are collected and processed directly by the payment gateway (PG); the Company never stores or accesses them.
• The Company does not collect resident registration numbers.

3. Children under 14

Creating an account (signing in) is optional, and the free features can be used without one. The service is not directed at children under 14. When an account is created, we ask for a date of birth to confirm that the user is 14 or older; the date of birth is used only for that check and is not stored (we keep only the time of the check and the age threshold). Only people aged 14 or older may send an inquiry, and children under 14 must not enter personal data when making an inquiry or purchase. If the Company learns that personal data of a child under 14 has been collected without the consent of a legal guardian, it is destroyed without delay. Records we are legally required to keep (such as purchase records) are stored separately for the required period and then destroyed.

4. Retention periods and destruction

a. Retention — data is destroyed without delay once its purpose is fulfilled; where Korean law requires retention, it is kept safely for the periods below.

• Records of consumer complaints and dispute handling (inquiry records): 3 years (E-Commerce Act)
• Records of contracts, withdrawal, payments, and supply of goods (purchase records): 5 years (E-Commerce Act)
• Automatically generated data (access logs): about 3 months from collection — after 3 months we delete the IP address and browser information (including device type, network provider and city-level location) and keep only statistical records that cannot identify anyone (page visited, country, date and time, etc.).
• Fraud-prevention and security records (IP address and browser information at the time of a paid license purchase or activation, an organization seat request, or an account sign-up, password change or deletion): 1 year from collection — after 1 year we delete the IP address and browser information (the purchase record itself is kept for the 5 years stated above).

b. Destruction method

• Electronic files: deleted irrecoverably using technical means
• Printed materials: shredded or incinerated

5. Provision to third parties and outsourced processing

a. The Company does not provide personal data to third parties without prior consent, except with the data subject's separate consent or where specifically required by law.

b. The Company transfers personal data overseas as set out below. Transfers marked “Processor” are made under Article 28-8(1)3 of the Personal Information Protection Act of Korea — outsourced processing or storage necessary to enter into and perform a contract with you — by disclosing the matters listed in Article 28-8(2) in this policy. Transfers marked “Third-party provision” serve the performance of the payment contract you requested. Entries marked “Collected directly” are collected and processed by that company directly from you and are not transferred by the Company. All transfers are made by encrypted transmission over the network (HTTPS/TLS); no storage media are exported.

c. The Company supervises its processors through contracts so that personal data is handled safely. You may refuse the overseas transfer of your personal data; to do so, contact info@qmscience.net or +82-70-7609-1376. Inquiries are also received and answered by phone, so you can use the service without any transfer. However, payment and licence-key delivery cannot be provided without the companies above, so if you refuse you will not be able to use paid purchases or automatic delivery. Personal data already transferred is destroyed in line with the retention periods in the table above.

6. Your rights and how to exercise them

You may at any time request access, correction, deletion, or suspension of processing of your personal data by contacting our support line (+82-70-7609-1376) or emailing info@qmscience.net. The Company will act without delay. A power of attorney is required when acting through a representative.

7. Automatic collection tools and how to refuse them

• The website does not use advertising or tracking cookies. It does use one cookie (hf_lang) to remember the display language you chose. That cookie holds only a language code, does not identify you, and — as cookies do — is sent to our server with requests. You can delete it in your browser at any time.
• Display preferences such as your language choice are stored only in your browser (localStorage); they are never sent to our servers and do not identify you. You can delete them in your browser at any time.
• Program update checks and download counts are processed in a non-identifying way.
• We run cookie-free visit statistics to count visitors. Cloudflare Web Analytics leaves no identifier on your device and does not identify individuals. Our own counter additionally records the access IP, browser information and the approximate location inferred from the IP (country, city), used only to count visits and prevent abuse.
• You can refuse this counting with your browser's tracking protection or a content blocker, and refusing places no restriction whatsoever on your use of the service.

8. Technical and organizational safeguards

• Encryption in transit (HTTPS/TLS)
• Minimal personnel with access, with access-permission management
• Data minimization — payment details are never stored (handled by the PG)

9. Privacy inquiries and grievance handling

The Company has designated a privacy officer and a grievance-handling desk for privacy inquiries, complaints, and remedy requests.

• Privacy officer: Hwanyeol Park (CEO)
• Grievance desk: Customer support · (phone) +82-70-7609-1376 (weekdays 09:00–18:00 KST) · (email) info@qmscience.net

We review every request promptly and let you know the outcome without delay.

10. Use of the apps (mobile & tablet)

The HanFlow PDF apps (web app, Android, iOS, tablet) process documents entirely on your device and never collect or transmit the contents of your documents.

• a. File access — The app only accesses PDFs you select yourself or send to it via “Open with”. Files are never uploaded to a server.
• b. Recent documents — Kept only in local storage on your device (browser storage or app-internal storage) so you can reopen files quickly; never transmitted. Clearing the app data removes them.
• c. Advertising & tracking — No advertising identifiers or tracking tools are used.
• d. Permissions (Android) — Internet: the app itself works without an internet connection; this permission exists for standard components and no document data is sent out. Open file: only PDFs handed over via “Open with HanFlow PDF” are read.
• e. Children — The apps are not directed at children. When an account is created, we use a date of birth to confirm that the user is 14 or older (the date of birth is not stored); personal data of children under 14 is handled as described in section 3 above.
• f. In-app purchases (subscriptions) — When you buy a subscription inside the app, payment is handled directly by Apple (App Store) or Google (Google Play); the Company never receives your card number, name or address. To confirm that a purchase is valid, the Company stores only a transaction reference and a device identifier. Changing, cancelling or refunding a subscription is handled by the respective store.
• g. App account (email sign-in) — So that you can unlock what you bought on more than one device, we collect your email address, your password (stored in a form that cannot be reversed) and a device identifier. The app's free features work without an account. To delete your account and data, see Delete your account and data. To confirm that you are 14 or older, we ask for your date of birth but do not store it; we keep only the time of the check and the age threshold (14).

10-2. When you use “Send to my device” in the PC edition (temporary storage of a document)

Section 10 above is about the apps. The PC edition (Windows and Mac) has a [Send to my device] feature for moving a document to your phone or tablet, and only when you use that feature is the document stored temporarily on our storage. If you do not use it, your documents do not leave your device.

• a. What is stored — the document file itself, its file name, the 6-digit code that was issued, and, if you set a password, an irreversible form (hash) of that password.
• b. How long — up to 24 hours, after which it is deleted automatically (a scheduled clean-up runs separately, so it is deleted even if nobody downloads it).
• c. Purpose and basis — performance of the contract, namely the device-to-device transfer you asked for; we process it only when you press that button.
• d. Deleting it sooner — you do not have to wait 24 hours. Email info@qmscience.net with the code and we will delete it.
• e. Who can receive it — anyone who knows the 6-digit code. For sensitive documents we recommend setting a password when you send.

10-3. When you use “Invite friends” in the PC edition (invite codes)

The PC edition (Windows and Mac) has an [Invite friends] feature that extends the free trial when a friend enters your invite code. The program contacts our server when you open that feature or enter an invite code from a friend, and — once an invite code has been issued on that PC (including through other HanFlow programs) — about once a day at start-up to check whether friends have used it. The contents of your documents are never sent.

• a. What we process — the invite code, device identifiers reduced to a 24-character value with a one-way hash (SHA-256; one for the device and one for the user account on it), the program (HanFlow PDF, Windows or Mac), the date and time a code was issued and used, and the access IP address.
• b. Purpose — issuing your invite code, extending the free trial of the person who invited and of the friend who was invited, and preventing the same reward from being received twice (a PC can receive a friend's code only once, one code can be used by up to 20 friends, and the inviter's reward is capped at 3 friends (90 days)).
• c. How long — kept for as long as we provide the service; the access IP address is deleted after 90 days. These records are stored on our payment and license server (Cloudflare, Inc., USA).
• d. Basis — performance of the contract, namely the trial extension you asked for. It is not used for advertising and is not provided to third parties.
• e. If you do not use it — if you never use invite codes in HanFlow programs, none of this is sent and the program works exactly the same. To have your invite record deleted, email info@qmscience.net.

11. Changes to this policy

Changes to this policy are announced on this page at least 7 days before they take effect (30 days for changes unfavorable to data subjects).

• Announced: October 4, 2026 · Effective: October 4, 2026
• Previous version effective: September 27, 2026
• ※ This revision took effect on the day it was announced (no advance notice period was given).
• Addition of section 10-3 (“Invite friends” in the PC edition — invite codes) — Announced: November 6, 2026 · Effective: November 6, 2026 ※ This addition took effect on the day it was announced (no advance notice period was given).