Privacy Policy

This Privacy Policy explains how Byond R Co., Ltd. ("Byond R," "we," "us," or "our") collects, uses, stores, shares, and protects your personal information when you use View R — our platform for organizing, viewing, and sharing 3D models and related content in an interactive workspace, available in extended reality (XR) environments and on standard desktop — and when you visit https://viewr.co or any of our websites that link to this Privacy Policy (together, the "Services").

If you do not agree with this Privacy Policy, please do not use the Services. If you have questions, contact us at privacy@byond-r.com.

1. Who We Are

Byond R Co., Ltd., a company incorporated in the Republic of Korea, is the data controller responsible for the personal information described in this Privacy Policy.

• Company: Byond R Co., Ltd.

• Address: 201, 6 Gangnam-daero 10-gil, Seocho-gu, Seoul 06787, Republic of Korea

• Privacy Officer: Park Byung Jun (Chief Executive Officer)

• Privacy contact: privacy@byond-r.com

Language. This Privacy Policy is provided in English and in Korean. Both editions are intended to have the same substance. For users in the Republic of Korea, the Korean edition (개인정보 처리방침) is the governing version and prevails in case of any difference.

2. Information We Collect

We collect the following categories of information.

Account information. You sign in to View R with an email account or a Google, Microsoft, or Apple account. We process your email address, an account identifier (UID), display name, profile image URL, sign-in provider, email-verification status, sign-up time, and last sign-in time. Passwords are passed directly to our authentication service (Firebase Authentication) and are not stored in our service database. Apart from these sign-on providers, we do not collect personal information about you from third parties.

Organization and account-permission information. When you request or are granted access to the Services, we process your company/tenant affiliation, account role and status, the requester's email, display name and company affiliation, approval or rejection status and notes, and the identifier and email of the administrator who processed the request.

Support request information. When you submit a support request, we process your identifier and email address, the request type, reason and message, and the name, extension, and size of any related file.

User content. We store the content you upload or create in the Services, such as 3D assets, projects, and workspaces, along with related metadata. Content uploaded on behalf of an enterprise customer may also be governed by our agreement with that customer.

Usage, device, and log information. When you use the Services, we automatically collect service-related, diagnostic, and performance information, such as your IP address, browser type and settings, device and operating system information, language preferences, referring URLs, approximate country derived from your IP address, date/time stamps, pages and features used, error reports, and other technical log data. We do not collect precise (GPS-level) geolocation.

(The categories above reflect the engineering inventory confirmed on 2026-09-01. We do not collect telephone numbers, dates of birth, gender, postal addresses, national identification numbers, credit card numbers, precise location data, or advertising identifiers.)

Payment information. If you purchase paid Services in the future, payment information may be processed through a third-party payment processor, and we will provide details at or before the time of purchase.

Sensitive information. We do not intentionally collect sensitive personal information (such as racial or ethnic origin, political opinions, religious beliefs, health data, or biometric data), and we ask that you not include it in your account information.

Pseudonymized data and automated decision-making. We do not process pseudonymized personal information, and we do not make fully automated decisions (including decisions made by systems applying artificial-intelligence technology) that have legal or similarly significant effects on you.

3. How We Use Information

We use the information described above to:

• Provide, operate, and maintain the Services, including account creation, authentication, and account management;

• Store, display, and enable sharing of your user content as you direct;

• Respond to your inquiries and provide user support;

• Send administrative information, such as notices about changes to our terms and policies;

• Protect the security and integrity of the Services, including detecting, preventing, and investigating fraud, abuse, and unauthorized access;

• Analyze how the Services are used so we can maintain and improve them;

• Comply with applicable law and legal process.

We do not use your personal information for targeted advertising, and we do not build advertising profiles about you. If we need to use your personal information for a materially different purpose, we will inform you and, where required, obtain your consent first.

4. Cookies and Analytics

We use cookies and similar technologies that are necessary for the Services to function — for example, to keep you signed in, remember your preferences, maintain security, and prevent errors. You can set your browser to remove or reject cookies, but some features of the Services may not work properly without them.

We do not use third-party analytics services or third-party tracking cookies on the Services. Firebase is used only for account authentication and web hosting; its analytics features are not enabled.

We do not use advertising cookies, third-party advertising trackers, or cross-site tracking technologies.

5. Sharing and Service Providers

We do not sell or share personal information, and we do not use it for targeted advertising. We have not sold or shared personal information in the preceding twelve (12) months.

We disclose personal information only in the following situations:

Service providers (processors). We use third-party service providers that process personal information on our behalf and under our instructions, limited to the following functional categories:

• Cloud infrastructure, hosting, and data storage — Megazone Cloud Co., Ltd. (managed cloud services on AWS; it sub-processes to Amazon Web Services EMEA SARL) and Google Cloud (see Section 6);

• User authentication and web hosting (Google — Firebase Authentication and Firebase Hosting);

• Payment processing (only if and when paid Services are offered).

Our service providers are contractually required to process personal information only for the purposes we specify, to protect it, and not to use or disclose it for their own purposes. Where a processor engages a sub-processor, it must obtain our consent under Article 26(6) of PIPA, and the sub-processor is identified above.

Legal requirements. We may disclose personal information where required by applicable law, regulation, legal process, or enforceable governmental request, or to protect the rights, property, or safety of our users, ourselves, or others.

Business transfers. If we are involved in a merger, acquisition, financing, or sale of all or part of our business, personal information may be transferred as part of that transaction, subject to applicable law and to notice where required.

6. Data Location and International Transfer

Your data is stored on cloud infrastructure in Germany (through Megazone Cloud, our processor, which sub-processes to Amazon Web Services EMEA SARL) and in the Republic of Korea (Google Cloud, Seoul).

Because part of this infrastructure is located outside Korea, personal information of users in Korea is transferred abroad for processing and storage as an entrustment of processing and storage necessary to perform our contract with you, under Article 28-8(1)3 of the Personal Information Protection Act (PIPA). Details of the overseas transfer are as follows:

We also use Google's Firebase services — Firebase Authentication for account sign-in, and the Firebase Hosting global content delivery network to serve the Services' web application. Personal information may be transferred abroad in that process as follows:

If the countries, providers, or other details above change (for example, upon completion of a planned infrastructure migration), we will update this Privacy Policy and give notice as described in Section 12. Personal information processed through Google Cloud is stored in the Korean (Seoul) region and is therefore not an overseas transfer. You may refuse the overseas transfer of your personal information by contacting us at privacy@byond-r.com. However, because the Services are provided on cloud infrastructure located abroad, if you refuse the overseas transfer, your use of all or part of the Services may be limited.

7. Retention and Deletion

We keep personal information only as long as needed for the purposes described in this Privacy Policy, unless a longer period is required by applicable law. Our retention periods by category are:

When your account is deleted (or your use of the Services otherwise terminates), we retain your account information and user content for the 60-day data-export grace period provided in Section 10 of the Terms of Service and delete them after that period expires. When a retention period ends, we delete the personal information or anonymize it so it can no longer identify you. Deletion from active systems and from backups occurs through our standard deletion and backup-rotation processes rather than instantaneously: a new backup is created daily and the oldest backup is deleted automatically, with a 30-day retention window in the production environment.

8. Security

We maintain technical, administrative, and physical safeguards designed to protect personal information:

• Administrative. We maintain an internal management plan, limit the people who handle personal information to those who need it to operate the Services, train them, and grant and manage their access rights.

• Technical. Systems that process personal information run on a private network that cannot be reached directly from the internet, with restricted reachable services and paths; access rights are separated by function and granted on a least-privilege basis, with credentials held encrypted in a dedicated secret-management service; traffic between you and the Services and between internal systems is encrypted (HTTPS/TLS); databases and file storage holding personal information are encrypted at rest; and a web application firewall blocks abnormal access and attack attempts.

• Access logging. Access to the personal-information processing system is logged and retained for two years in storage that operators cannot modify or delete, protecting the records against tampering. We review these logs periodically.

• Physical. Servers run in our cloud providers' data centres and physical access control relies on those providers' controls. We do not operate our own server room.

No method of transmission or storage is completely secure, however, and we cannot guarantee absolute security. If we become aware of a breach affecting your personal information, we will notify you and the relevant authorities as required by applicable law.

9. Your Rights

Users in the Republic of Korea. Under PIPA, you (or your legal representative or an authorized agent) may at any time request:

• Access to your personal information;

• Correction or deletion of your personal information;

• Suspension of the processing of your personal information; and

• Withdrawal of any consent you have given.

To exercise these rights, email us at privacy@byond-r.com. We will verify your identity (or your agent's authority) and respond within the period required by PIPA (in principle, within 10 days for access requests). Exercising these rights is not more difficult than the way the information was collected, and we will explain the reason and how to appeal if we must limit or refuse a request on legal grounds. If you believe your privacy rights have been infringed, you may also contact the dispute-resolution bodies listed in Section 13.

All users. You may review and update your account information through the Services or by contacting us, opt out of any marketing email via the unsubscribe link or by contacting us, and request deletion of your account at privacy@byond-r.com.

Users in other jurisdictions. Where required by applicable law in your jurisdiction, you may have rights to access, correct, delete, or receive a copy of your personal information, to object to or restrict certain processing, and not to be discriminated against for exercising your rights. You can submit any such request to privacy@byond-r.com, and we will consider and act on it in accordance with the applicable law.

European Economic Area, United Kingdom, and Switzerland. If the GDPR or UK GDPR applies to our processing of your personal information, we process it on the legal bases of contract performance, legitimate interests, legal obligation, and consent (which you may withdraw at any time). You have the rights of access, rectification, erasure, restriction, data portability, and objection, and the right to lodge a complaint with your data protection authority.

California residents. We collect the categories of personal information described in Section 2, share them only with the service providers described in Section 5, and do not sell or share personal information or use it for targeted advertising. We do not permit third parties to collect personal information about your online activities over time and across different websites when you use the Services. Some browsers offer a "Do Not Track" (DNT) signal; because no uniform standard for DNT signals has been adopted, we do not respond to them at this time. You may request review of, changes to, or deletion of your personal information at privacy@byond-r.com. Changes to this Privacy Policy are notified as described in Section 12.

Nevada residents. We do not sell covered information as defined under Nevada law. Nevada residents may nonetheless submit a request to opt out of any future sale by emailing privacy@byond-r.com.

10. Children

The Services are intended for users 18 years of age or older and are not directed to children. In particular, the Services are not offered to children under 14 years of age, and we do not knowingly collect personal information from them. If we learn that we have collected personal information from a child under 14 (or from a minor in violation of applicable law), we will delete it and deactivate the related account. If you believe a child has provided us personal information, contact us at privacy@byond-r.com.

11. Figma Plugin

This Section applies when you use the View R Figma Plugin (the "Plugin") to sign in to your View R account and import a Figma prototype into your View R Library. Other uses of the Services are governed by the remaining Sections of this Privacy Policy.

Information processed through the Plugin. We process:

1. the prototype link and the identifiers needed to locate it (such as file key and node ID);

2. the file, page, and frame names of the selected prototype and the frame's width and height;

3. a preview image (thumbnail) of the selected prototype;

4. View R Library item information (item name, source, status, and creation/update dates);

5. account, authentication, and session information, including the email address shown for the signed-in account; and

6. diagnostic records generated to operate, secure, and troubleshoot the Plugin.

The Plugin processes information from the Figma file only as needed to complete the action you request; it does not receive a copy of the whole Figma file.

Purposes. We use this information to connect the Plugin to your View R account, validate and import the prototype you select, create, display, and manage the related View R Library item, generate and display its preview, provide the HMI Preview feature in View R Studio, and secure, maintain, and troubleshoot the Plugin and related services.

How preview images are made available. Preview images are stored in the cloud storage identified in the Section 6 transfer tables and served through public URLs that can be accessed without authentication. Anyone who knows the URL can therefore view the preview image without signing in to View R. This is done so that previews can be displayed in your View R Library and in HMI Preview; the URLs do not contain authentication tokens or your personal information. Please do not import prototypes containing material you do not want made available in this way.

Retention and deletion.

1. Library items and preview images are kept while the item exists.

2. If you delete a Library item, the item information and its preview image are deleted without undue delay.

3. Image objects that are no longer referenced are cleaned up within 24 hours.

4. If your account is deleted (termination), the information is deleted after the 60-day data-export grace period described in Section 7 expires.

5. Backups and operational records follow the retention periods in Section 7.

Information stored in the Plugin environment. The Plugin may store authentication and session information, such as sign-in tokens and the email address displayed for the signed-in account, within the Figma Plugin environment. That information is removed on sign-out, account switching, token expiry or revocation, Plugin removal, or account deletion.

Do not send prototypes containing personal, confidential, or third-party information through the Plugin unless you have the rights, permissions, and consents needed to do so.

12. Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will post the updated version with a new effective date on our website at least seven (7) days before it takes effect. If a change is material — including any change to the overseas-transfer details in Section 6, the addition of categories of personal information we collect, or a change in purposes of use — we will provide notice at least thirty (30) days in advance through the Services or by individual notice (such as email) before the change takes effect, and we will obtain your consent where applicable law requires it. Previous versions of this Privacy Policy will be made available on our website.

Upon taking effect, this Privacy Policy (together with the substantively identical Korean edition) replaces the English-language Privacy Notice previously posted (last updated 2025-11-03).

13. Contact and How to Complain

For any question, concern, or request regarding this Privacy Policy or your personal information, contact:

Byond R Co., Ltd.

Privacy Officer: Park Byung Jun (CEO)

201, 6 Gangnam-daero 10-gil, Seocho-gu, Seoul 06787, Republic of Korea

Email: privacy@byond-r.com

The Privacy Officer oversees personal-information protection and handles related complaints and remedies. If you are in the Republic of Korea and need further assistance or dispute resolution, you may also contact:

• Personal Information Dispute Mediation Committee: 1833-6972 (www.kopico.go.kr)

• Personal Information Infringement Report Center (KISA): 118 (privacy.kisa.or.kr)

• Supreme Prosecutors' Office: 1301 (www.spo.go.kr)

• National Police Agency: 182 (ecrm.police.go.kr)

Users in other jurisdictions may have the right to lodge a complaint with their local data protection or consumer protection authority.