One Account,
All of WEBTOON

What Your WEBTOON ACCOUNT Is

Your WEBTOON ACCOUNT is the single sign-on account used to create and manage your login credentials and core account attributes, and to authenticate you into Downstream Services. Processing at the WEBTOON ACCOUNT layer typically includes:

• account registration and login,
• security and fraud prevention,
• account recovery,
• maintaining basic account attributes needed to enforce eligibility rules (including age gating).

Who We Are (Controllers; Corporate Entities)

Your WEBTOON ACCOUNT can be used across multiple corporate entities and Downstream Services. The provider of each Downstream Service is identified before you access that Downstream Service.

• WEBTOON Entertainment Inc. (“WEI”) operates certain Downstream Services.
• NAVER WEBTOON, Ltd. (“NW”), a wholly owned Korean subsidiary of WEI, operates certain Downstream Services.

NW and WEI act as joint controllers for the processing of personal information at the WEBTOON ACCOUNT layer. The entities share personal information as joint controllers to efficiently provide you with seamless account access across Downstream Services and for ongoing account administration. WEI and NW have entered into a joint controller agreement setting out their respective responsibilities. In essence, NW, as the developer and technical operator of WEBTOON ACCOUNT, remains primarily responsible for the day-to-day processing of your WEBTOON ACCOUNT personal information and for responding to any privacy rights requests you may make. Irrespective of this arrangement, you may exercise your rights under data protection law against either controller at the following addresses:

• NAVER WEBTOON Ltd.: NAVER Green Factory, 6, Buljeong-ro, Bundang-gu, Seongnam-si, Gyeonggi-do, Republic of Korea
• WEBTOON Entertainment Inc.: 222 N. Pacific Coast Highway, Suite 2300, El Segundo, CA 90245, United States

Personal Information We Collect at the WEBTOON ACCOUNT Layer

We collect and process personal information that is reasonably necessary to create and administer your WEBTOON ACCOUNT and authenticate you to Downstream Services. We collect personal information (a) directly from you, (b) from identity providers if you use SSO, and (c) automatically from your device/browser when you use your WEBTOON ACCOUNT.

Information you provide

• Email address (if registering via email, or if otherwise provided to your account)
• Credentials (passwords, passkeys, MFA methods, one-time passcodes, tokens, or other authentication methods, as defined in the WEBTOON ACCOUNT Terms of Use)
• Date of birth
• Name and legal guardian’s email address (if legal guardian’s consent is required)
• Support communications you send to WEBTOON ACCOUNT support (if applicable)

Social sign-on (SSO) information
If you choose to sign up or sign in through SSO (e.g., Apple, Google, or other providers offered), we receive information from the SSO provider such as:

• a provider-specific user identifier,
• nickname and profile picture,
• your email address (depending on provider settings),
• authentication tokens necessary to enable sign-in.

The SSO provider’s processing is governed by that provider’s own terms and privacy policy.

Device and technical information
We may automatically collect:

• IP address
• device identifiers and device attributes (e.g., operating system, browser type)
• log data related to sign-in events and account security
• approximate location inferred from IP address (for security, fraud prevention, and compliance purposes where applicable)

Account data, age/eligibility flags and service connection records. We may generate or maintain:

• WEBTOON ACCOUNT Identifier (a unique, system-generated ID),
• age/age-band or eligibility status indicators (e.g., “18+ eligible”), records of Downstream Services connected to your WEBTOON ACCOUNT (such as which Downstream Services are linked to your account, and the dates of connection or disconnection).

How We Use Personal Information at the WEBTOON ACCOUNT Layer

We use personal information for the following purposes:

• Account creation and authentication (registering your WEBTOON ACCOUNT; enabling login across Downstream Services).
• Eligibility and age gating support, including collecting date of birth and applying rules required by Downstream Services (for example, a Downstream Service may require account holders to be 18 or older).
• Security, fraud prevention, and abuse detection, including monitoring for suspicious logins, credential stuffing, and account takeover attempts.
• Account management and support, including responding to account inquiries and enabling account recovery. Credentials are used solely to create your WEBTOON ACCOUNT, authenticate you, secure your WEBTOON ACCOUNT, and prevent fraud and unauthorized access.
• Compliance and legal obligations, including responding to lawful requests and enforcing applicable terms.

Where the GDPR or the UK GDPR applies to processing at the WEBTOON ACCOUNT layer, we are required to only process your personal information where there is a 'lawful basis' under that legislation. The lawful basis relied on in relation to the above purposes is as follows:

• Account creation and authentication: necessary for the performance of a contract (the WEBTOON ACCOUNT Terms of Use).
• Eligibility and age gating support: necessary for our legitimate interest to ensure that users are of the appropriate age to view the content available on the Downstream Services.
• Security, fraud prevention, and abuse detection: necessary for our legitimate interest to maintain the security of the platforms.
• Account management and support: necessary for the performance of a contract (the WEBTOON ACCOUNT Terms of Use) and necessary for our legitimate interests to provide you with optimal support and resolve your queries and technical issues as efficiently as possible.
• Compliance and legal obligations: necessary to comply with our legal obligations.

How We Share Personal Information at the WEBTOON ACCOUNT Layer

NW and WEI share personal information as joint controllers to efficiently provide you with seamless account access across Downstream Services and for ongoing account administration. We may share personal information in limited ways consistent with operating a multi-tenant identity layer.

• With Downstream Services. We share information with Downstream Services you access to enable authentication and account administration. This may include your WEBTOON ACCOUNT Identifier; email address; date of birth; device and technical information. Each Downstream Service determines its own purposes for processing the personal information we share with it for authentication and account administration, and that processing is governed by the Downstream Service’s privacy policy rather than this WEBTOON ACCOUNT Privacy Policy.
• With service providers. We use vendors (e.g., hosting, security monitoring, customer support tooling) who process data on our behalf under contractual restrictions appropriate to their role.
• With Identity Providers (SSO providers). If you use SSO, we exchange authentication information with the SSO provider to enable sign-in.
• Legal and safety disclosures. We may disclose information where required by law or to protect rights, safety, and security (e.g., investigating suspected fraud or responding to legal process).

Minors

We collect your date of birth at the WEBTOON ACCOUNT layer and use it to support age gating and to perform the eligibility checks defined in the terms of use of each Downstream Service you access with your WEBTOON ACCOUNT. The applicable age and eligibility requirements are set by each Downstream Service and described in that Downstream Service’s own terms of use and privacy policy. If the consent of the parent (or legal guardian) is required to process the child's personal information pursuant to the applicable law, we will process such information upon obtaining consent of the parent (or legal guardian) in accordance with the legally required process.

Cookies and Similar Technologies (WEBTOON ACCOUNT Layer)

When you visit our websites, we use cookies for authentication flows, session management, and security. Depending on their function, these cookies are either session-based (which expire when you close your browser or within a short duration) or persistent cookies that are stored on your device for a maximum of up to 60 days (for example, to maintain your login session).

A cookie is a small data file that is placed on the hard drive of your computer when you visit a website. Other similar technologies (such as web beacons, tracking URLs, social media plugins and local shared objects) work in a similar way and we use the word 'cookie' here to refer to all technologies that collect information from your device.

Cookie use specific to a Downstream Service is described in that Downstream Service’s privacy policy (and cookie disclosures where applicable).

If you would like to opt out of accepting cookies altogether, you can generally set your browser to not accept cookies or to notify you when you are sent a cookie, giving you the chance to decide whether or not to accept it. We do not use any cookies which are not essential to provide you with the WEBTOON ACCOUNT services, we are therefore not required to collect you consent for the use of these cookies and if you do block cookies using your browser certain features of our websites or other services may not work.

International Data Transfers

We operate WEBTOON ACCOUNT globally, which may involve transferring personal information to countries outside of the country in which you reside, including to the United States and the Republic of Korea, for example to operate shared account infrastructure or provide centralized security monitoring. These countries may not provide the same level of data protection as the country in which you reside. Where we transfer personal information internationally, we ensure that appropriate safeguards (such as an adequacy decision, appropriate contractual protections, derogations and/or privacy impact assessment) are in place as required by applicable data protection law.

For more information about the safeguards we have in place, you may contact us as described in the Contact Us section.

Data Retention

We retain personal information at the WEBTOON ACCOUNT layer for as long as necessary to:

• maintain and administer your WEBTOON ACCOUNT,
• provide authentication and security services,
• comply with legal obligations,
• resolve disputes and enforce agreements.

Retention periods may vary depending on data type (e.g., security logs may be retained for a defined period for fraud detection and incident investigation). In determining retention periods, we consider factors such as the duration of our relationship with you, the necessity of retaining information to provide WEBTOON ACCOUNT functionality, security and fraud prevention needs, and applicable legal obligations.

Security

We maintain administrative, technical, and organizational measures designed to protect WEBTOON ACCOUNT information, including access controls and security monitoring appropriate to the risks of operating an account and authentication layer. No system can be guaranteed 100% secure.

Your Privacy Rights and Choices

Depending on where you live, you may have certain rights. These data privacy rights are not absolute. In some situations we may not be able to process your request. This may include if a legal exception applies. These rights may be offered based on your location. We will let you know when or if a right does not apply to you. You will not be discriminated against for exercising a privacy right. If you disagree with our decision you can contact us as described at the end of this Policy. We will also maintain a record of your rights requests.

These data privacy rights are:

• Right to Know / Access: Request confirmation of processing, access to, and disclosure of the categories and specific pieces of personal information we collect, as well as the sources, purposes, and third-party recipients.
• Right to Delete / Erasure: Request the deletion or erasure of your personal information, subject to certain exceptions permitted by applicable law.
• Right to Correct / Rectification: Request the correction or update of inaccurate or incomplete personal information.
• Right to Data Portability: Request to receive a copy of your personal information in a structured, commonly used, and machine-readable format, or have it transmitted directly to another controller where technically feasible.
• Right to Restriction of Processing: Request that we restrict or suppress the processing of your personal information in certain circumstances.
• Right to Object: Object at any time to the processing of your personal information where we rely on legitimate interests as our legal basis, or object to processing for direct marketing purposes.
• Right to Withdraw Consent: Withdraw your consent at any time where processing is based on your consent, without affecting the lawfulness of processing carried out prior to withdrawal.
• Right to Opt-Out of Sale, Sharing, or Targeted Advertising: Direct us not to sell or share your personal information or use it for cross-context behavioral advertising. We honor Global Privacy Control (GPC) opt-out signals.
• Right to Limit Use of Sensitive Personal Information: Request that we limit the use and disclosure of your sensitive personal information to purposes necessary to perform the service.
• Right to Opt Out of Profiling and Automated Decision-Making: Request to opt out of profiling or automated decision-making that produces legal or similarly significant effects.
• Right to Non-Discrimination: We will not discriminate against you for exercising any of your privacy rights.
• Right to Appeal: If we decline or are unable to fulfill your privacy request, you have the right to appeal our decision.
• Right to Complain / Lodge a Complaint: If you believe we have not handled your personal information in accordance with applicable privacy law, you may contact us as described in the Contact Us section. We will acknowledge your complaint, investigate it, and respond to you in writing within the period required by applicable law, and in any event within 30 days unless applicable law permits a longer period or an extension. If you are not satisfied with our response, you may escalate your complaint to the privacy regulator in your jurisdiction.

Automated Decision-Making
We do not currently carry out any automated decision-making that produces legal or similarly significant effects concerning you. If we introduce such processing in the future, we will update this Policy accordingly. Any such automated decision-making would only take place where permitted by applicable law, and you would have the right to be informed of the decision, to obtain human intervention, to express your point of view, and to contest the outcome.

Additional U.S. State Disclosures

• Nevada Residents: If you are a Nevada resident, please note that we do not sell the personal information of Nevada consumers for monetary consideration to other entities for resale.
• No Sale/Sharing & Sensitive Personal Information: As described throughout this Policy, we do not sell personal information, and we do not share personal information for targeted advertising or cross-context behavioral advertising. We do not use or disclose sensitive personal information (including your Credentials), as defined by California law, for inferring characteristics or for reasons other than those permitted by law (such as providing account access, authentication, security, fraud prevention, and account administration).
• Shine the Light: California residents are entitled once a year, free of charge, to request and obtain certain information regarding our disclosure, if any, of certain categories of personal information to third parties for their direct marketing purposes in the preceding calendar year. We do not share personal information with third parties for their own direct marketing purposes.

How to Exercise Your Rights

To exercise any of your privacy rights, you may use the self-service features in your account or contact us as specified in the Contact Us section. Please note that requests specific to a particular Downstream Service should be directed to that Downstream Service.

Accessing and Correcting Your Information
You may access and correct your personal information registered with us at any time directly through the “Account Center” page, while certain information (such as your date of birth) can only be modified after registration by contacting Customer Care as described in the Contact Us section. Any updates or corrections to your personal information will automatically synchronize across WEBTOON ACCOUNT and all connected Downstream Services.

Deleting Your Information
Please note that if we delete your Personal Information, some of our services will not work the same. For example, your previous opt out requests will not be saved and saved preferences and information will no longer be available. Deletion operates at two levels depending on your choices:

(a) Deletion at the Downstream Service level: You may request deletion of your personal information for an individual Downstream Service at any time through the settings of that Downstream Service.

• Multiple Downstream Services: If you use two or more Downstream Services, deletion at the level of one Downstream Service will delete the data associated with your use of that Downstream Service (such as your service-level information and subscription history for that Downstream Service) while your WEBTOON ACCOUNT remains active, together with your access to your remaining Downstream Services.
• Single Downstream Service: If you use only one Downstream Service, deletion at that Downstream Service level will automatically result in the deletion of your WEBTOON ACCOUNT and the personal information associated with it.

(b) Deletion of your WEBTOON ACCOUNT: You may request the complete deletion of your WEBTOON ACCOUNT at any time by contacting Customer Care as described in the Contact Us section. Deleting your WEBTOON ACCOUNT will remove your access to every Downstream Service, permanently deleting your WEBTOON ACCOUNT, your account information, and your history across all connected Downstream Services. Once deleted, this information is unrecoverable, though you may register for a new WEBTOON ACCOUNT at any time.

Request Verification and Authorized Agents
To protect your privacy and account security, we must reasonably verify your identity or authority before fulfilling your request.

• Verification Requirement: Please provide sufficient identifying information to allow us to reasonably verify you are the person about whom we collected and retained Personal Information, and/or your authority to make such request on behalf of the data subject, and describe your request with sufficient detail that allows us to properly understand, evaluate, and respond to it. Personal information provided in a verifiable consumer request will be used solely for identity verification and compliance purposes. If we cannot verify your identity to an appropriate level of confidence, we cannot respond to your request or disclose personal information.
• Authorized Agents: You may designate an authorized agent to submit a request on your behalf. To protect your account, we require proof of written permission (or proof of the agent's registration with the Secretary of State) and will contact you directly via your registered email to verify your identity and confirm the agent’s authority before taking action.

Right to Appeal
If we decline or are unable to fulfill your privacy request, you have the right to appeal our decision. You may submit an appeal by contacting us as described in the Contact Us section, providing a detailed explanation for your appeal along with your state of residence.

Updates to This Policy

We may update this WEBTOON ACCOUNT Privacy Policy from time to time. If we make material changes, we will provide notice as required by law.

Contact Us

For questions about this WEBTOON ACCOUNT Privacy Policy or to submit a privacy request relating to your WEBTOON ACCOUNT, contact us through the Customer Care of the applicable Downstream Service or at dpo@webtoon.com
If you are located in the European Economic Area or the United Kingdom, you may also send your general privacy questions, or requests to exercise your privacy rights to our data protection representative, Data Rep at:

77 Camden Street Lower, Dublin, D02 XE80, Ireland;107-111 Fleet Street, London, EC4A 2AB, United Kingdom; or
webtoon@datarep.com.