EXAONE API Platform Privacy Policy
In accordance with the Personal Information Protection Act (the "PIPA"), LG Management Development Institute Co., Ltd. ("we", "us" or "our") establishes and discloses this Privacy Policy for EXAONE API Platform (the "Platform") to protect your Personal Information and to handle related complaints promptly and smoothly. The Platform provides API access to our AI models for non-commercial use. Personal Information processed in connection with signing up for an EXAONE ID is governed by the EXAONE Showroom Privacy Policy.
1. Purposes, Items, Legal Bases and Retention Periods of Personal Information Processing
We process only the minimum Personal Information necessary to provide our services, as set out below. We do not use Personal Information for any purpose other than those described below, and if the purposes of processing change, we will take the necessary measures, such as obtaining your separate consent.
A. Personal Information processed without your consent
Legal basis: Article 15(1)(4) of the PIPA (entering into and performing a contract)
| Category | Purpose | Personal Information processed | Processing and retention period |
|---|---|---|---|
| Application to use the service (required) | Receiving applications to use the Platform, identifying users, issuing API Keys, checking whether use must be restricted under export control and economic sanctions laws and which laws apply, and sending notices and announcements | Email address, nickname and country | Until you delete your account |
| Usage information (required) | Managing usage limits, operating the service and responding to outages, analyzing use of the service, and preventing fraudulent use and ensuring security | API request identifier, IP address, requested API URL, HTTP headers, API Key, HTTP response code, server processing result code, response data size (bytes), response token count and server processing time | Retained for one year after you delete your account to prevent fraudulent use, and then destroyed |
B. Personal Information processed with your consent
Legal basis: Article 15(1)(1) of the PIPA (consent of the data subject)
| Category | Purpose | Personal Information processed | Processing and retention period |
|---|---|---|---|
| EXAONE and K-EXAONE (optional) | Training and evaluating our AI models (in addition to being provided through the Platform, these models may be distributed, such as by publishing their model weights, and used for other business purposes) | Input and Output (as defined in the EXAONE API Platform Terms of Use), and the request identifiers and timestamps of that Input and Output | One year after you delete your account, or until you withdraw your consent |
| EXAONE Tabular (optional) | Analyzing use of the Platform, improving quality and identifying use cases (not used to train AI models) | Input (including any tabular data you submit), Output (such as predicted values), and the request identifiers and timestamps of that Input and Output | One year after you delete your account, or until you withdraw your consent |
| Receipt of marketing communications (optional) | Sending promotional (advertising) information about our services, new features and events by email | Email address | Until you delete your account or withdraw your consent |
- If you have not consented to the optional processing of your Input and Output described above, we process your Input and Output only to the extent necessary to handle your request under Article 15(1)(4) of the PIPA, and we do not store them once your request has been handled.
2. Entrustment of Personal Information Processing
We entrust the processing of your Personal Information as follows. If the entrustees or the details of the entrusted work change, we will disclose the changes through this Privacy Policy without delay.
| Entrustee | Details of the entrusted work |
|---|---|
| Google Cloud Platform | Operating the Platform and storing data |
| Amazon Web Services | Sending advertising information by email (only if you have consented to receive it) |
When we enter into an entrustment agreement with an entrustee, we specify in the agreement or other documents, as required by applicable laws, matters such as the prohibition on processing Personal Information for purposes other than performing the entrusted work, technical and administrative safeguards, restrictions on re-entrustment, management and supervision of the entrustee, and liability for damages. We also supervise whether the entrustee processes Personal Information securely.
3. Processing of Personal Information of Children under 14
You must be at least 19 years of age to sign up for or use the Platform. We do not process Personal Information of children under 14.
4. Destruction of Personal Information
We destroy your Personal Information without delay when it is no longer needed, such as when you delete your account, the retention period expires or the purpose of processing has been achieved.
If other laws require us to keep Personal Information even after the retention period you consented to has expired or the purpose of processing has been achieved, we transfer that Personal Information to a separate database or store it in a different storage location.
The procedures and methods for destroying Personal Information are as follows.
| Category | Details |
|---|---|
| Destruction procedure | We select the Personal Information for which a reason for destruction has arisen, and destroy it with the approval of our Chief Privacy Officer. |
| Destruction method | We destroy Personal Information recorded and stored in electronic file format so that the records cannot be recovered, and we shred or incinerate Personal Information recorded and stored in paper documents. |
5. Measures to Ensure the Security of Personal Information
We take the following administrative, technical and physical measures to ensure the security of the Personal Information we process.
| Category | Measure | Details |
|---|---|---|
| Administrative measures | Establishment and implementation of an internal management plan | We establish internal policies and procedures for protecting Personal Information and review them regularly to continuously improve our level of protection. |
| Employee education and training | We regularly provide privacy training to employees who process Personal Information to raise their awareness and to ensure that they comply with relevant laws and internal policies. | |
| Management of access rights | We minimize the number of employees who can access Personal Information and grant access rights based on their roles. We also review access rights regularly and adjust them where necessary. | |
| Designation of persons responsible for Personal Information | We designate a Chief Privacy Officer and a Privacy Manager and clearly define their duties so that the protection of Personal Information is managed systematically. | |
| Technical measures | Encryption | We use encryption when transmitting or storing Personal Information to block unauthorized access from outside. For example, we encrypt Personal Information transmitted over the internet using the SSL/TLS protocol. |
| Access control system | We use technical means that restrict access to Personal Information to block unauthorized access, including user authentication, ID and password management and two-factor authentication. | |
| Retention and review of access logs | We keep access logs for our Personal Information processing systems and review them regularly. | |
| Intrusion detection and prevention systems (IDS/IPS) | We operate systems that detect and block, in real time, external intrusions into the systems that protect Personal Information, to prevent hacking attempts. | |
| Backup and recovery systems | We store Personal Information securely, perform regular backups in case of system failure or data loss, and maintain recovery procedures to minimize data loss. | |
| Masking of Personal Information | To the extent possible, we use automated means to mask Personal Information that may be included in Input. | |
| Physical measures | Management of device disposal and reuse | When a storage medium containing Personal Information is no longer used, we completely delete or destroy the data on it to prevent leakage of Personal Information. |
| Entry control | To prevent your Personal Information from being leaked or damaged by hacking, computer viruses or similar threats, we install our systems in areas with restricted access and maintain procedures to control entry. |
6. Rights and Obligations of Data Subjects and How to Exercise Them
- You may at any time request access to, correction or deletion of, or suspension of processing of your Personal Information, withdraw your consent, and refuse or request an explanation of automated decisions (collectively, "exercising your rights"). You may also withdraw any optional consent directly through the Platform.
- If you have consented, we use your Input to, and Output from, EXAONE and K-EXAONE models to train our AI models. You may at any time opt out of this training (withdraw your consent) at My profile > Consent and Notification on the Platform. Once you opt out, we will no longer use your Input and Output to train our AI models.
- You may at any time opt out of training and request deletion of your Input and Output that has not yet been incorporated into an AI model through training. However, any portion that has already been incorporated into an AI model through training cannot technically be separated out and deleted.
- If a response from an AI model contains Personal Information or similar information, you may report it to privacy@lgresearch.ai.
- You may exercise your rights in writing or by email in accordance with Article 41(1) of the Enforcement Decree of the PIPA, and we will act on your request without delay.
- You may email privacy@lgresearch.ai to request access to, correction or deletion of your Personal Information, to withdraw your consent to its collection and use, or to refuse or request an explanation of automated decisions.
- You may exercise your rights through a representative, such as a person you have authorized. In that case, the representative must submit a power of attorney in the form set out in Annex Form 11 of the Public Notice on the Methods of Processing Personal Information.
- Your right to request access to, or suspension of processing of, your Personal Information may be restricted under Articles 35(4) and 37(2) of the PIPA.
- If other laws specify that the Personal Information is to be collected, you may not request its deletion.
- We verify whether the person exercising your rights is you or your duly authorized representative.
7. Chief Privacy Officer and Privacy Manager
We have designated a Chief Privacy Officer as set out below to handle complaints and provide relief for damage relating to the processing of Personal Information.
| Category | Name | Department/Position | Contact |
|---|---|---|---|
| Chief Privacy Officer | Kijeong Jeon | Head of Product Unit | privacy@lgresearch.ai |
| Privacy Manager | Moonkyung Cho | IT & Security Team | privacy@lgresearch.ai |
You may contact the Chief Privacy Officer and the responsible department with any inquiries, complaints or requests for relief for damage regarding the processing and use of Personal Information.
8. Requests for Access to Personal Information
You may submit a request for access to Personal Information to the department below. We will make every effort to process your request promptly.
| Category | Name | Department/Position | Contact |
|---|---|---|---|
| Department receiving and handling access requests | Moonkyung Cho | IT & Security Team | privacy@lgresearch.ai |
9. Remedies for Privacy Infringement
You may contact the following organizations for relief or consultation regarding infringement of your Personal Information.
| Organization | Information |
|---|---|
| Personal Information Infringement Report Center (operated by the Korea Internet & Security Agency) | Services: reporting infringement of Personal Information and requesting consultation Website: privacy.kisa.or.kr Phone: 118 (without area code) Address: Korea Internet & Security Agency, 9 Jinheung-gil, Naju-si, Jeollanam-do |
| Personal Information Dispute Mediation Committee | Services: applications for dispute mediation and collective dispute mediation (civil resolution) Website: www.kopico.go.kr Phone: 1833-6972 Address: 12th Floor, Government Complex Seoul, 209 Sejong-daero, Jongno-gu, Seoul |
| Cyber Investigation Division, Supreme Prosecutors' Office | Phone: 1301 (without area code) Email: privacy@spo.go.kr Website: www.spo.go.kr |
| Cyber Investigation Bureau, Korean National Police Agency | Phone: 182 (without area code) Website: ecrm.cyber.go.kr |
10. Changes to This Privacy Policy
This Privacy Policy takes effect on November 9, 2026.