Privacy Policy

(1) Depending on how the Service is delivered, the Company acts either as a personal information controller or as an entrusted processor. Different rules apply in each case.

(2) Where the Company acts as a processor, responsibility for establishing the lawful basis for collection and for obtaining legal-representative consent rests with the institution. If a data subject makes a request directly to the Company, the Company forwards it to the institution without delay, acts on the institution’s instructions, and informs the data subject that it has done so.

The Company does not collect sensitive information under Article 23 of PIPA — such as ideology or belief, health, genetic information or criminal records — nor unique identifiers such as resident registration numbers.

The Company processes personal information only for the following purposes, and will obtain consent in advance if a purpose changes.

1. Registration and account management, identity verification, permissioning, and prevention of misuse
2. Recommending books matched to a student’s reading level and setting the range of books available
3. Automated pronunciation and fluency assessment of Read Aloud practice and provision of result reports
4. Marking quizzes and assignments, providing learning reports, and sharing progress with teachers, institution administrators and guardians
5. Course operation, assignment of work, and teaching support
6. Fee calculation, payment processing and tax invoicing
7. Responding to enquiries and handling disputes
8. Providing product and usage information, receiving enquiries, and routing them to a teacher or to customer support, through the chatbots on the website and inside the service
9. Service improvement, incident response and statistical analysis (processed in a form that does not identify individuals)
10. Compliance with legal obligations

The Company processes and retains personal information within the period required by law or consented to by the data subject, and destroys it without delay once that period expires.

(1) Where the Company processes the personal information of a child under 14, it obtains the consent of the child’s legal representative under Article 22-2 of PIPA and verifies that consent was given. Verification is carried out by the methods set out in Article 17-2 of the Enforcement Decree: confirmation by SMS to the legal representative’s mobile phone; confirmation by credit card or identity authentication; or having the legal representative indicate consent on a page setting out its content and notifying them by SMS that the Company has confirmed it.

(2) The minimum information needed to obtain that consent — the legal representative’s name and contact details — may be collected directly from the child without the legal representative’s consent under Article 22-2(2), and the Company does not use it for any other purpose.

(3) For institution-managed students, the institution obtains that consent before the account is created, and the Company processes the personal information as its entrusted processor.

(4) For individual student accounts opened by a guardian, the Company verifies the legal representative’s consent directly during account creation.

(5) When informing a child about the processing of their personal information, the Company uses language the child can readily understand.

(6) A legal representative may at any time request access to, correction, deletion or suspension of processing of the child’s personal information, or withdraw consent. The Company will act on such a request and notify the outcome within 10 days of receipt.

(1) The Read Aloud feature captures audio only when the student actively starts a recording. The Company does not record in the background; the microphone is used only while browser permission has been granted and a recording is in progress.

(2) Recordings are transmitted over an encrypted connection to the Company’s cloud storage and are sent to Microsoft Corporation’s Azure AI Speech (East US region) for pronunciation and fluency assessment. See sections 8 and 9 for details.

(4) The Company does not use voice recordings for speaker identification or to generate biometric information, and does not use them for any purpose other than pronunciation assessment and learning feedback.

(5) A legal representative or institution may request deletion of a particular recording or of all of a student’s recordings at any time, and may simply decline to use the Read Aloud feature. Listening, reading, quizzes and all other features remain fully available in that case.

(1) The Company processes personal information only within the scope set out in section 3, and provides it to third parties only where Articles 17 and 18 of PIPA permit — such as with the data subject’s consent or under a specific provision of law.

(2) A student’s learning records are made available to the teachers and institution administrators of the institution the student belongs to, for the purpose of teaching, and to the student’s guardian where a teacher uses the sharing feature. This is an inherent function of the Service.

(1) The Company entrusts personal information processing as follows in order to deliver the Service.

(2) In accordance with Article 26 of PIPA, entrustment agreements specify the prohibition on processing beyond the stated purpose, restrictions on sub-entrustment, technical and organisational safeguards, supervision of the processor and liability for damages; the Company supervises compliance with them.

(3) Where the entrusted work or the identity of a processor changes, the Company discloses the change through this Policy without delay.

(1) The Company transfers personal information overseas as follows in order to deliver the Service.

(2) These transfers fall under Article 28-8(1)3 of PIPA — entrustment or storage of personal information necessary to perform a contract with the data subject and to enhance their convenience — and separate consent is dispensed with by disclosing the matters above in this Privacy Policy, as that provision permits.

(4) In accordance with Article 28-8(4) of PIPA, the Company contractually requires recipients to apply the protective measures necessary to process personal information safely — including encryption, access control, a prohibition on use beyond the stated purpose, and a prohibition on use for AI model training — and verifies that they do so.

(1) The Company uses artificial-intelligence technology for the following, some of which may constitute fully automated decision-making under Article 37-2 of PIPA.

(2) A data subject or their legal representative may request an explanation of such an automated decision. The right of refusal under Article 37-2(1) of PIPA arises where an automated decision significantly affects the data subject’s rights or obligations; the Company accepts requests to refuse each of the decisions above, and to have them reconsidered with human intervention, regardless of whether that threshold is met. Requests are received at the privacy officer’s contact details below, and the Company notifies the outcome within 30 days of receipt.

(3) Teachers and institution administrators can manually adjust a student’s reading level and book range at any time; this operates as a standing means of human intervention in the automated decision.

(5) The Company contractually requires the processors listed in section 8 not to use data received from the Company to train their own artificial-intelligence models.

(1) Where personal information becomes unnecessary — because the retention period has expired or the purpose of processing has been achieved — the Company destroys it without delay, and in any event within 5 days.

(2) Where information must be retained under law, it is moved to a separate database or stored in a separate location.

(3) Personal information held in electronic files is permanently erased by a method that prevents recovery or reproduction; personal information recorded on paper is shredded or incinerated.

(4) Under the storage lifecycle policy, Read Aloud voice recordings are automatically deleted 23 days after creation — after which they can no longer be played or accessed — and are permanently and unrecoverably destroyed after a further 7-day storage recovery window. The maximum period from creation to complete destruction is therefore 30 days.

(1) Data subjects may exercise the following rights against the Company at any time.

1. Request access to personal information
2. Request correction of errors
3. Request deletion
4. Request suspension of processing
5. Withdraw consent
6. Request an explanation of, or refuse, an automated decision
7. Refuse the overseas transfer of personal information

(2) Rights may be exercised by email, in writing, or through features within the Service, and the Company will act without delay. For children under 14, the legal representative may exercise the child’s rights on their behalf.

(3) Where a data subject requests correction of an error, the Company will not use or provide the personal information concerned until the correction is complete.

(4) Rights may also be exercised through an agent, such as the data subject’s legal representative or a duly authorised person, who must submit a power of attorney in the form prescribed by the Notice on Methods of Processing Personal Information.

(5) Because the Company acts as a processor in respect of institution-managed students, requests received are forwarded to the institution and handled on its instructions, except where law requires the Company to respond directly.

The Company takes the following measures to secure the safety of personal information.

• Organisational measures — establishment and implementation of an internal management plan; minimisation of staff handling personal information and regular training
• Access control — role-based permission management, per-account restriction of data access through database security rules, and retention of records of permissions granted, changed and revoked
• Encryption of credentials — passwords and student PINs are stored using one-way encryption (hashing) that cannot be reversed
• Encryption in transit and at rest — TLS on all connections and encryption of stored data
• Retention and tamper-protection of access logs — access logs of the personal information processing system are retained for at least one year
• Intrusion response — operation of intrusion prevention and detection measures and vulnerability assessment
• Physical measures — facilities storing personal information are operated in access-controlled cloud data centres under an entrustment arrangement

(1) The Company uses cookies and browser storage to keep users signed in and to remember settings such as language preference.

(3) Users may refuse cookies through their browser settings. Refusing cookies essential to the Service may prevent sign-in from being maintained and otherwise impair use of the Service.

The Company has designated a privacy officer with overall responsibility for personal information processing and for handling complaints and remedying harm in connection with it.

Data subjects may direct any enquiry, complaint or request for remedy relating to personal information protection arising from use of the Service to the privacy officer, and the Company will respond and act without delay.

Data subjects may apply to the following bodies for dispute resolution or consultation in order to obtain redress for infringement of their personal information rights.

A person whose rights or interests are infringed by a disposition or omission of the head of a public institution in respect of a request under Articles 35 (access), 36 (correction and deletion) or 37 (suspension of processing) of PIPA may file an administrative appeal under the Administrative Appeals Act.

(1) This Privacy Policy applies from its effective date.

(2) Where content is added, deleted or amended in response to changes in law, policy or security technology, the Company gives notice through the Service at least 7 days before the change takes effect — or at least 30 days in advance where the change materially affects data subjects’ rights, obtaining fresh consent where necessary.

(3) The Company publishes its revision history so that earlier versions of this Policy can be reviewed.