Privacy Policy

The Company processes personal information for the purposes below and does not use it for other purposes. If a purpose changes, the Company will take the required steps, including obtaining separate consent, under Article 18 of the Personal Information Protection Act.

• Providing the Service — Providing English learning features, including real-time conversations with AI characters, role-play conversations, interactive stories, and pronunciation assessments
• Managing accounts — Creating accounts, verifying identity, maintaining sign-in sessions, and verifying and documenting legal guardian consent
• Providing learning reports — Sharing learning time, activities, pronunciation scores, and other progress with legal guardians through the parent dashboard
• Reviewing pronunciation practice (optional) — Allowing legal guardians to replay pronunciation practice recordings only when they have given separate consent
• Keeping the Service reliable — Preventing misuse, limiting request frequency, and responding to outages

① The Company collects the following personal information.

• [Required] Nickname — The name the child uses in the app (a real name is not required)
• [Required] Sign-in email — For account creation and sign-in
• [Required] Legal guardian email — To verify legal guardian consent and link the parent dashboard. Under Article 22-2(2) of the Personal Information Protection Act, this is collected directly from the child as the minimum information necessary to verify legal guardian consent
• [Required] Conversation text records — Text of conversations with AI characters (to provide learning reports)
• [Required] Pronunciation assessment results — Pronunciation scores, word-level accuracy, and feedback
• [Optional] Pronunciation practice recordings — Audio files recorded while reading along with stories. These are stored only with separate legal guardian consent. The pronunciation assessment feature remains available without this consent

② Personal information is collected through information entered directly by the child or legal guardian while using the Service (account registration and consent), or generated during use (conversation records and pronunciation assessments).

Beyond the items listed above, the Company does not collect children's real names, ages, addresses, phone numbers, or location information. It does not use advertising tracking technologies, such as advertising identifiers or third-party tracking cookies.

① As a service primarily for children under 14, the Company obtains legal guardian consent before processing children's personal information under Article 22-2 of the Personal Information Protection Act.

• Consent is obtained by verifying a one-time code sent to the legal guardian's email. Features that generate learning data are restricted until consent is verified.
• The Company records and retains consent history, including the date, method, and scope of consent, as evidence of consent.
• The app also provides notices in a format children can easily understand (Article 22-2(3)).

② Storage of pronunciation practice recordings (the optional item in Article 2(1)) requiresseparate, optional consent in addition to basic consent. Refusing or withdrawing this consent does not disadvantage the user in using the Service.

• Account information and learning data (nickname, email, conversation records, and pronunciation assessment results): retained until account closure or a legal guardian's deletion request, and deleted without delay upon closure or deletion. If an account has been inactive for 1 year, the legal guardian is notified by email of scheduled deletion. The account is deleted if use does not resume within 30 days after notification (the scheduled deletion is automatically canceled if use resumes).
• Pronunciation practice recordings: only the most recent20 recordings per child are retained, for a maximum of 90 days. Excess recordings are deleted automatically. All recordings are deleted immediately upon account closure.
• Legal guardian consent records: deleted without delay along with other personal information upon account closure.
• Where applicable law requires retention (for example, transaction records under Korea's Act on the Consumer Protection in Electronic Commerce when paid features are introduced), the information will be retained for the legally required period. This Policy will be revised and advance notice provided in such cases.

① The Company uses the following processors to provide the Service. Processors may not process personal information beyond the scope of their assigned tasks, and the Company manages and supervises their processing practices.

② The Company does not provide personal information to third parties other than the processors above, except as required by law or in response to a request from an investigative authority following legally prescribed procedures and methods.

① The processors in Article 5 have servers outside Korea, in the United States. Personal information is therefore transferred overseas during use of the Service as follows (transfers for outsourced processing and storage under Article 28-8(1)(3) of the Personal Information Protection Act).

• Information transferred: the items collected under Article 2, limited to what each processor needs for its assigned tasks
• Destination country: United States
• Transfer timing and method: transmitted through encrypted communications (TLS) when the Service is used
• Recipients: the processors listed in Article 5 (each processor's privacy contact details are available on its website's privacy page)
• Purposes and retention periods: processing is limited to the assigned tasks. Stored information (Supabase) follows the retention periods in Article 4. For processing-only tasks (OpenAI and Microsoft), information is deleted without delay after processing is complete. Under its API policy, OpenAI may retain data for abuse monitoring for up to 30 days before deletion and does not use submitted data to train AI models.

② Data subjects or legal guardians may refuse international transfers. Because these transfers are necessary to provide the Service, refusal prevents use of the Service. You may refuse by not registering an account or by contacting us using the details in Article 12.

① The Company deletes personal information without delay when it is no longer needed, including when its retention period expires or its processing purpose is fulfilled.

② Personal information in electronic files is immediately and permanently deleted (hard delete) using methods that prevent recovery, without a separate deactivation or retention stage. Upon account closure, account information, learning data, pronunciation practice recordings, consent records, and the sign-in account are deleted together.

① Legal guardians may request access, correction or deletion, suspension of processing, and withdrawal of consent for children's personal information at any time through the following methods.

• Access — View the child's learning records and pronunciation assessments directly in the parent dashboard
• Obtain a copy — Download the child's data as a file using “Export data” in the parent dashboard
• Deletion — Permanently delete the child's data through the parent dashboard or app settings (account closure). Deletion is processed after verification through the legal guardian's email
• Correction, suspension of processing, or withdrawal of consent — Contact us using the details in Article 12. The Company will notify you of the outcome within 10 days of receiving the request

② Consent to store pronunciation practice recordings may be withdrawn at any time. Stored recordings will be deleted without delay after withdrawal. Please use the contact details in Article 12 to request withdrawal.

③ Exercising these rights may require verification of legal guardian status, such as a power of attorney, under Article 41 of the Enforcement Decree of the Personal Information Protection Act.

The Company takes the following measures under Article 29 of the Personal Information Protection Act.

• Encryption in transit — All communications are encrypted using TLS (HTTPS)
• Encryption at rest — Data is encrypted at the cloud storage level
• Access control — Row Level Security is applied to databases and file storage so only the user and verified legal guardian can access the data
• Credential protection — Access keys for external AI services are kept only on the server and are not included in the app
• Abuse prevention — Rate limiting blocks abnormal access
• Minimal collection and retention — Only information necessary for the purpose is collected, and pronunciation practice recordings are subject to count and retention limits

• To keep users signed in, authentication tokens are stored in browser storage (web) or secure device storage (app). These are necessary to provide the Service and can be removed by clearing browser data or signing out.
• Hosting providers may temporarily process access logs, including IP addresses, for security and incident response.
• The Company does not use advertising cookies, advertising identifiers, or third-party analytics tools.

In the 3-minute guest trial available without registration, no account is created, and no personal information is stored, including conversation records or audio. Trial audio is transmitted only for real-time processing and disappears immediately after processing.

The Company has appointed the following privacy officer to oversee personal information processing and handle complaints and remedies related to personal information.

• Privacy officer: Park Jeong-gyu
• Phone: 010-4345-3644
• Email: oakcask12321@gmail.com
• Business: AI Edu Studio, business registration number 472-26-01960

Data subjects and legal guardians may use these contact details for privacy inquiries, complaints, and requests for remedies. The Company will respond and take action without delay.

To report a privacy infringement or seek advice, contact the following agencies in Korea.

• Privacy Infringement Report Center (operated by the Korea Internet & Security Agency) — 118 (no area code within Korea), privacy.kisa.or.kr
• Personal Information Dispute Mediation Committee — 1833-6972, kopico.go.kr
• Supreme Prosecutors' Office, Cyber Investigation Division — 1301 (no area code within Korea), spo.go.kr
• Korean National Police Agency, Cyber Investigation Bureau — 182 (no area code within Korea), ecrm.police.go.kr

If this Policy is added to, removed from, or amended, notice will be given on the website or by email at least 7 days before the change takes effect (30 days for significant changes, such as collected information or purposes of use).

Publication and effective date: this Policy (v1.0) takes effect on July 15, 2026.