Privacy Policy

5PM Worker ("the Company") complies with South Korea's Personal Information Protection Act (PIPA) and related regulations, and has established this Privacy Policy to safely process users' personal information.

This policy applies to the automated-trading (Autobot) service and the Simulator (backtesting) service (together, the "Service") provided by the Company.

1. At signup (email/password): email address, password (stored encrypted), nickname.

2. At signup (Kakao/Google sign-in): the account identifier provided by Kakao/Google, an email address (only if you consented to share it), and an auto-generated nickname — we do not collect your real name or social profile data.

3. Information you register directly while using the Service: Open API keys and secrets for the exchange(s) you connect (Coinbase, Upbit, OKX, Bithumb, Binance, Bitget, CoinOne, Bybit — stored encrypted via Supabase Vault), and your automated-trading configuration (strategy name, order size, etc.).

4. While using the Simulator: Pine Script/Python strategy code you enter or generate, AI chat conversation content, and backtest results.

5. Automatically generated/collected while using the Service: access IP address, access timestamps, service usage logs (e.g. order execution logs), and cookies.

6. Collection methods: the website signup form, Kakao/Google social sign-in, and automatic collection during Service use.

1. Member identification/authentication, providing membership-based service, and preventing fraudulent use.

2. Providing the automated-trading (Autobot) service: using your registered exchange API key to execute orders on your own exchange account when a TradingView alert (webhook) is received, and logging the result.

3. Providing the Simulator (backtesting) service: AI-assisted translation/tuning of strategy code, running backtests, and delivering results.

4. Managing the scope of service access under your plan (Trial/Light/Pro).

5. Responding to customer inquiries and delivering notices.

6. Maintaining service stability, error response, and statistical analysis processed in a form that cannot identify any individual.

In principle, the Company destroys collected personal information without delay upon account withdrawal. The following are retained for the periods below where required.

1. Where retention is required by law, for the period that law specifies (e.g. 3 months for access logs under the Protection of Communications Secrets Act; once paid billing is introduced, 5 years for payment/supply records under the Act on Consumer Protection in Electronic Commerce).

2. Exchange API keys are destroyed immediately when you disconnect them or withdraw your account.

The Company processes your personal information only within the purposes stated in this policy and does not, in principle, provide it to third parties without your prior consent — except where required by law or lawfully requested by an investigative authority following statutory procedure.

The Company outsources the following processing functions to provide the Service, and requires each processor to keep personal information secure under its agreement with the Company.

· Supabase, Inc. — database, member authentication, encrypted storage of sensitive credentials (exchange API keys).

· Vercel Inc. — website/server hosting, code execution environment, AI service relay.

· Anthropic, PBC — only for the Simulator's AI strategy code generation/translation/tuning feature, processing the strategy-related text you enter (authentication credentials such as exchange API keys are never sent to it).

· Resend — sending email (signup confirmation, password reset, etc.).

· Kakao, Google — processing social sign-in authentication.

The Company transfers personal information overseas as follows to operate the Service.

· Recipients: Vercel Inc., Anthropic PBC, Resend (all based in the United States).

· Items transferred: access information generated while using the Service, strategy-related text entered in the Simulator, and the email address used to send email.

· Purpose of transfer: website/server hosting, AI-based strategy code processing, sending email.

· Method of transfer: encrypted transmission over the network.

· Retention period: until the outsourced purpose is fulfilled or until account withdrawal.

The Company's primary database (Supabase) is located in South Korea (Seoul, ap-northeast-2 region).

You may view and update your own personal information at any time, and can view/edit some information such as your nickname directly from the "Profile" page in the Service. To request access, correction, deletion, or suspension of processing of your personal information, or to withdraw your account, contact us using the details in Article 12 and we will act without delay.

The Company destroys personal information without delay once its retention period has passed or its processing purpose has been achieved. Personal information stored as electronic files is deleted using a technical method that prevents the record from being recovered.

1. Sensitive credentials such as exchange API keys are encrypted at rest via Supabase Vault.

2. The database applies row-level access control (Row Level Security) so that a user can only ever query their own data.

3. Communication between you and the Service is encrypted over HTTPS.

4. The admin dashboard uses authentication entirely separate from the regular member authentication system.

The Company uses cookies to keep you signed in and to remember your language preference (Korean/English). You may refuse cookies in your browser settings, but doing so may make it difficult to stay signed in or use parts of the Service.

The Company has designated a Data Protection Officer responsible for personal information processing and for handling complaints and remedying harm.

· Data Protection Officer: [name to be filled in]

· Contact: shikwang@gmail.com

※ The contact above is a temporary placeholder and should be replaced with the actual responsible party's details before public launch.

You may request dispute resolution or consultation from the following bodies for remedies related to personal information infringement.

· Personal Information Infringement Report Center: 118 (privacy.go.kr)

· Personal Information Dispute Mediation Committee: 1833-6972 (kopico.go.kr)

· Supreme Prosecutors' Office Cyber Investigation Division: 1301 (spo.go.kr)

· National Police Agency Cyber Investigation Bureau: 182 (ecrm.police.go.kr)

This policy may be added to, removed from, or amended as laws, policy, or the Service change; changes will be announced through the website.

Announcement date: August 12, 2026 / Effective date: August 12, 2026