Privacy Policy
Effective 2026-10-27
Algoscoring (알고스코어링) (the “Company”) processes Members’ personal data as described below, in accordance with the Korean Personal Information Protection Act. We do not collect phone numbers, postal addresses, dates of birth or national ID numbers.
1. Data we process, why, on what basis and for how long
| Purpose | Data | Legal basis | Retention |
|---|---|---|---|
| Sign-up and login | Email address. With social login (Google, Kakao): the email, unique identifier and profile information (name or nickname, profile-picture URL) that service passes to us. We do not store passwords. | Performance of the contract (Art. 15(1)4) | Until account deletion |
| Tests, scoring and study history | Test and practice answers (written text and transcripts of what you said), scores, timestamps, vocabulary-study records | Performance of the contract | Until account deletion. Records you delete yourself are removed immediately |
| Precision pronunciation scoring | Voice recording (sent only when you request precision scoring) | Performance of the contract | Deleted right after analysis. Recordings of Members who opted in to ‘keep my answers and recordings’ are kept separately as described below. |
| Managing entitlements | Plan, precision-scoring credit balance and usage (which set each credit was spent on) | Performance of the contract | Until account deletion |
| Preventing duplicate sign-up benefits after deletion | A non-reversible token derived from the deleted account’s email. It cannot be turned back into the email and is used only to check whether the same address returns. | Legitimate interest (Art. 15(1)6) | 90 days after deletion, then deleted automatically |
| Payments and refunds | Payment result and transaction ID. Card details are handled by the payment processor and never stored by the Company. | Performance of the contract; legal obligation (Art. 6 of the E-Commerce Act) | 5 years for records of contracts, withdrawals, payments and supply (kept after deletion for this period) |
| Enquiries and disputes | Email address, the enquiry and our reply | Performance of the contract; legal obligation | 3 years (kept after deletion for this period) |
| Preventing misuse, managing usage | Feature usage records (type, test/item/post ID, time), access logs (IP address, time, browser) | Legitimate interest (Art. 15(1)6) | Usage records are detached from the account on deletion so they no longer identify anyone. Access logs are deleted on the hosting provider’s schedule. |
| Blocking automated sign-ins (bots) | IP address, browser signals. Used only to tell people from bots; the Company receives only the pass/fail result. | Legitimate interest (Art. 15(1)6) | Not kept by the Company; deleted on the verification provider’s schedule. |
| Board | Nickname, posts and comments. The board can be read without logging in, so nicknames and posts are visible to anyone. Emails are not shown. | Performance of the contract | Until you delete them or delete your account; posts and comments are deleted with the account. |
| Record of administrator actions | Time, content and reason of credit/plan adjustments and of hiding or deleting posts (including the post title) | Legal obligation (Art. 6 of the E-Commerce Act); legitimate interest | 5 years; detached from identifying data after account deletion |
| Record of consent | Items consented to, time, version of the Terms and this Policy | Legal obligation (proof of consent) | Until account deletion |
| Replaying your speaking answers; improving scoring quality (optional) | Writing answers, speaking recordings and their transcripts, scores — stored separately under an internal ID without your email | Consent (Art. 15(1)1) | Until you withdraw consent or delete the account, when everything is deleted; deleting a test record also deletes its stored copy |
| Study tips and offers by email (optional) | Email address | Consent (Art. 15(1)1) | Until you withdraw consent or delete the account |
Except for the rows whose basis is ‘consent’, the data above may be processed without consent and is limited to what is strictly needed to provide the Service.
2. How voice is handled
- Your speaking answers are turned into text by the speech-recognition feature built into your browser. That feature is operated by the browser vendor and, depending on the browser, may send audio to the vendor’s servers (for example, Chrome sends it to Google). The Company receives only the recognised text.
- The recording stays on your device and is gone when you leave the screen; it is not stored on our servers. Only if you separately opted in to ‘keep my answers and recordings’ do we keep recordings, and we delete them when you withdraw consent or delete the account. Stored recordings are used only so that you can replay them on your own review screen and so that we can check and improve the scoring system. They are not used to identify people or shared with anyone, and replay uses a temporary one-hour link shown only on your review screen.
- Only when you request precision scoring is the recording sent for pronunciation analysis, and it is deleted as soon as the analysis is done.
3. Sharing with third parties
The Company does not share Members’ personal data with third parties, except where a law-enforcement or other authority requires it through lawful procedure.
4. Processors and international transfers
We entrust the following providers with processing in order to run the Service.
| Provider (contact) | Task | Data | Where it is processed |
|---|---|---|---|
| Supabase Inc. (privacy@supabase.com) | Authentication, database and file storage | Email, study data, entitlements, enquiries, board posts and comments, answers and recordings of Members who opted in | Republic of Korea (AWS Seoul region). The operator is a US company and may access data from abroad for technical support. |
| Vercel Inc. (privacy@vercel.com) | Web hosting | Transient processing of data exchanged while you use the Service (answers, and the recording when you request precision scoring), access logs | Runs in the Republic of Korea (Seoul region). The operator is a US company; access logs and other operational records may be stored and processed in the United States. |
| Plus Five Five, Inc. (Resend, support@resend.com) | Sending sign-in emails | Email address, the email containing the sign-in code | United States. Emails leave through a sending server in Japan (Tokyo). |
| Anthropic PBC (privacy@anthropic.com) | AI scoring and feedback | Written answers, transcripts of spoken answers. No account data such as email is sent. | United States |
| Microsoft Corporation (privacy.microsoft.com) | Pronunciation assessment | Voice recording (when you request precision scoring), the sentence being assessed | Republic of Korea (Azure Korea Central region) |
| Toss Payments Co., Ltd. (tosspayments.com) | Processing payments in Korean won (card registration, monthly charges, refunds) | Amount and order number, payment result, a non-reversible member identifier, the email address used for the receipt. Card numbers are entered on the processor’s screen and never reach the Company. | Republic of Korea |
| Cloudflare, Inc. (privacyquestions@cloudflare.com) | Blocking automated sign-ins on the login screen | IP address, browser signals. No account data such as email is sent. | United States and others — processed on Cloudflare servers worldwide, stored mainly in the United States and Europe. |
Notice on international transfers (Art. 28-8 of the Act)
- Data transferred, recipients and countries: the providers in the table whose processing location is outside Korea.
- When and how: transmitted over encrypted connections (HTTPS) at the time you use the Service.
- Recipients’ purpose and retention: used only to perform the task listed, and deleted when that task is done or when you delete your account.
- How to refuse and the effect: if you do not want these transfers, do not sign up, or delete your account to stop them. Because this processing is essential to providing the Service, refusing means the Service cannot be used.
These transfers are entrustment and storage needed to perform our contract with you (Art. 28-8(1)3) and are disclosed in this Policy. Toss Payments is a Korean company, so its processing is not an international transfer.
5. Deletion
We delete data without delay when its retention period ends or when you delete your account. You can delete your account yourself under My account, and deletion takes effect immediately. Database records are deleted irreversibly, and copies remaining in backups are removed automatically when the backup retention period passes. Records that the law requires us to keep (table 1) are stored separately for that period only, then destroyed.
6. Your rights and how to exercise them
- You may at any time request access to, correction of, deletion of or suspension of processing of your personal data, and withdraw consent.
- Under My account you can see the data we hold, delete test records or delete your account. Send other requests to satapmed@gmail.com or the contact page; we handle them within 10 days.
- You may also act through a legal guardian or an authorised representative, in which case proof of authorisation is required.
- Optional consents (keeping answers and recordings, email offers) can be withdrawn at any time under My account without affecting your use of the Service. Withdrawing consent to keep answers and recordings deletes the stored answers and recordings immediately.
7. Automated scoring
Answers are scored and feedback is produced automatically without human involvement, and partly by generative AI. The results are reference information to support your study, not decisions that determine your rights or obligations. You may ask for an explanation of a score through satapmed@gmail.com or the contact page.
8. Cookies and browser storage
We use only a cookie that keeps you signed in and a cookie that remembers your display language. We do not use advertising or behavioural-analytics cookies. Separately, your browser’s local storage keeps display settings (language, flashcard font size, the nickname you last used on the board); these values exist only on your device. You can refuse cookies in your browser settings, but then you cannot stay signed in and cannot use the Service. The login screen includes a bot-detection tool (Cloudflare Turnstile) that processes only what is needed to tell people from bots and is not used for advertising or behavioural analytics.
9. Security measures
- Authentication without stored passwords (email codes, social login)
- Row-level access control in the database — Members can reach only their own data
- Encryption in transit (HTTPS); administrator keys kept server-side only
- Restricted administrator access and a log of administrator actions
- Data minimisation
10. Children under 14
Children under 14 may not sign up, and we confirm at sign-up that you are 14 or older. If we find that an account belongs to a child under 14, we delete the account and its data without delay.
11. Data protection officer
Name: Sunghyuk Song (Representative) · Contact: satapmed@gmail.com or the contact page
12. Remedies
You may report or seek advice on personal-data infringements from the following Korean bodies:
- Personal Information Infringement Report Center: privacy.kisa.or.kr, 118 (no area code)
- Personal Information Dispute Mediation Committee: www.kopico.go.kr, 1833-6972
- Supreme Prosecutors’ Office: www.spo.go.kr, 1301 (no area code)
- Korean National Police Agency: ecrm.police.go.kr, 182 (no area code)
13. Changes to this Policy
Changes are announced on this page at least 7 days before they take effect. Material changes, such as new data items or new purposes, are announced at least 30 days in advance, and we ask for consent again where required.
This English version is provided for convenience. Where it differs from the Korean version, the Korean version governs.