Privacy Policy

Controller: Wellbian Labs Pte. Ltd. (Singapore). Data protection officer: Changmin Lee (CSO), admin@wellbianlabs.io. Device, installation and customer support operations in the Republic of Korea are carried out by the Partner, KWeather Co., Ltd. (see Section 6, Processors); responsibility for data processing remains with the Company.

Identifying members and signing them in; registering devices and issuing license NFTs; calculating and paying rewards; processing payments and shipping products; customer support and notices; detecting and responding to fraud and security incidents; complying with legal obligations (tax, e-commerce, cooperation with investigations); statistics for improving the Service. The commercial use of station data is governed by Article 9 of the Terms.

Personal data is deleted without delay when a member withdraws, except: (1) for the periods required by e-commerce and other applicable laws - contract, payment and shipping records for 5 years, consumer complaint and dispute records for 3 years, access logs for at least 3 months; (2) for the period needed to investigate security incidents, cooperate with law enforcement or resolve disputes; (3) on-chain transactions recorded on the XRP Ledger cannot be deleted; (4) data that has already been de-identified and included in derived data or data products is not personal data and is not subject to deletion.

The Company does not sell personal data to third parties. Only de-identified station data and derived data are provided as data products under Article 9 of the Terms. Otherwise, personal data is disclosed only (1) with the user's separate consent (opt-in for data bounties, sponsor marketing, etc.); (2) where required by law or upon a lawful request from law enforcement or a court; (3) where urgently necessary for the user's life or safety or for the security of the Service.

The Company engages the following processors, who process personal data only within the scope of the engagement: KWeather Co., Ltd. (Republic of Korea) - domestic device distribution, installation, after-sales service, customer support and marketing / Vercel Inc. (USA) - web hosting and servers / Supabase Inc. (USA) - database / Resend (USA) - email delivery / Toss Payments (Republic of Korea) - card payments / CJ Logistics and Korea Post (Republic of Korea) - shipping / Google (USA) - social login and analytics (where enabled).

The Company is a Singapore company, and the Service's servers and database are located in the United States. The user's personal data is therefore transferred to the processors in Section 6 and processed in the United States and Singapore. The data transferred is all personal data in Section 2, for the purposes in Section 3, for the periods in Section 4. If you do not consent to the transfer, you cannot use the Service.

You may at any time request access to, correction or deletion of, or suspension of processing of your personal data, withdraw consent, and withdraw from the Service. Requests can be made in My Page or to admin@wellbianlabs.io, and the Company handles them within 10 days after verifying your identity. Deletion may be limited for information that must be retained by law or for on-chain records, in which case we will tell you why.

Hashed password storage, encryption of stored data and data in transit, a non-custodial wallet structure in which the Company holds no keys, access control and retention of access logs, regular review of external credentials, and a security incident response procedure. The incident of 24 October 2026 and the measures taken are published on the notice board (wellbian.io/notice).

The Service uses a login session cookie and a language setting cookie. Google Analytics may be used for visit statistics, and you can refuse it through your browser settings or an ad-blocking tool. If you refuse cookies, some functions such as sign-in may not work.

The Service is not directed at children under 14 (Republic of Korea) or under the age set by the law of the user's country of residence, and does not accept their sign-up. If we learn that a child's personal data has been collected, we delete it without delay.

The Company may change this Policy, and changes will be announced within the Service at least 7 days before the effective date (30 days for changes unfavorable to users). This Policy takes effect on 2026-11-27 (announced 2026-10-27).