Privacy Policy

1. Personal information we process

We collect only information necessary for the service. We do not collect resident registration numbers or card numbers.

Student accounts

Name, preferred name, grade, username, and password (encrypted so that it cannot be recovered and stored only on the authentication server)

Parent accounts

Name, mobile number, username, password, subscription status, and transaction ID (issued by the store)

Overseas parent sign-up

Email address (for verification and notices when signing up from overseas)

Academy administrator accounts

Academy name, administrator username, password, and payment and billing records (amount, date and time, and payment method type)

Learning records

Submitted answers and grading results for each problem, solution time, lesson viewing time, feedback results (recognized solution lines and error types), mastery by concept, and credit usage history

Uploaded materials

Photos of solutions, photos of workbook problems, and written questions

Inquiries and launch notifications

Name, contact details, academy name (for academy inquiries only), and inquiry content

Automatically generated information

Cookies that keep you signed in and access records (access date and time, IP address, and error records)

2. Purposes of processing

Account management

Issuing accounts and signing in, verifying the user (parent), and preventing misuse

Learning services

Grading, feedback on solution photos, generating personalized lessons and solution explanations, analyzing progress and weaknesses, and recommending review

Academy and parent management

Providing academy administrators and parents with the learning status of students under their care

Payments

Processing academy service fees and refunds, verifying family plan subscriptions, and granting credits

Responding to inquiries

Providing service adoption and launch information and handling customer inquiries

3. Children under 14

Principle

Students under 14 cannot sign up directly. An academy or parent creates their account.

Legal guardian consent

For the family plan, parents create their children's accounts themselves, and this process constitutes legal guardian consent. When an academy creates an account for a student under 14, it must obtain legal guardian consent during enrollment.

Legal guardian rights

Legal guardians may request access to, correction or deletion of, or suspension of processing of their child's information.

4. Retention and use periods

We destroy information without delay once its purpose has been fulfilled. However, we retain the following information for the specified periods.

Solution photos and instant lesson files

Automatically deleted 30 days after upload (or creation)

Account and learning records

Until an account deletion request or the end of the service agreement

Mobile verification records

Verification codes are stored encrypted and valid for only 5 minutes; sending-count records are automatically deleted after 1 day

Email verification records

Verification codes are stored as hashes and valid for only 10 minutes; sending-count records are automatically deleted after 1 day

Inquiries and launch notifications

1 year after the response is completed

Server logs (error records)

Automatically deleted after 1 year. Names and contact details are not logged.

Payment and withdrawal records

5 years (Act on the Consumer Protection in Electronic Commerce, Etc. of the Republic of Korea)

Consumer complaint and dispute records

3 years (under the same Act)

5. Destruction procedures and methods

Procedure

When the retention period expires or a deletion request is received, we verify and destroy the information within 30 days. Information that must be retained by law is stored separately from other information.

Method

Electronic files are deleted in a way that prevents recovery. We do not create paper documents.

6. Provision to third parties

Principle

We do not sell or provide personal information to outside parties.

Affiliated academy or parent

A student's learning records are displayed only in the interface of the academy administrator or parent who created that student's account (a core service function).

Where required by law

We provide information only when requested by investigative authorities or others through procedures prescribed by law.

7. Outsourced processing

Amazon Web Services, Inc.

Server operation and data storage (Seoul region, stored in the Republic of Korea)

Toss Payments Co., Ltd.

Processing academy service fee payments (the Company does not store card information)

Aligo SMS service

Sending parents mobile verification codes and operational text notifications (mobile numbers)

Resend email service

Sending verification codes for overseas parent sign-up (email addresses)

Apple Inc. · Google LLC

Processing in-app subscription payments (the Company receives only transaction IDs issued by the store)

8. International transfers

When generating solution feedback, workbook question responses, and personalized lessons, we send photos and solution content to the AI services below for processing. We do not send names, usernames, or contact details. Student names are added on the Company's server after results are returned.

Recipients and countries

Processed through OpenRouter, Inc. (United States) using models from Google LLC, OpenAI, L.L.C., and Microsoft Corporation (United States) / TypeSafe (United States)

Transferred information

Solution and problem photos, recognized solution lines, written questions, and lesson script sentences

Timing and method

Sent over encrypted communication (HTTPS) each time a student requests feedback, a question response, or a personalized lesson

Purpose

Reading photos, checking solutions, classifying error types, and generating explanations, lesson scripts, and audio

Retention period

Subject to each provider's policy after processing the request (the Company receives and stores only the results)

How to refuse and consequences

No international transfer occurs if you do not use feedback, questions, or personalized lessons. You may still solve problems, receive grading, and use prepared lessons.

9. Your rights and how to exercise them

Rights

You may request access to, correction or deletion of, or suspension of processing of your personal information at any time.

Method

Contact ceo@flowmate.kr or ask the academy or parent who created your account. After verification, we will notify you of the outcome within 10 days.

Account deletion

Follow the instructions on the account and data deletion request page (/account-deletion). App subscriptions must be canceled through the app marketplace where you paid for the subscription.

10. Security measures

Technical measures

Encryption of all communications (HTTPS), encrypted storage of passwords and verification codes, encryption of stored data, and account-level access control

Administrative measures

Limiting personal information access to those who need it for their work and reviewing operational records

Physical measures

Data is stored only in the cloud provider's secure data centers

11. Cookies and other automatic collection tools

Sign-in cookies

We use cookies to keep you signed in (up to 30 days). You may reject them in your browser settings, but you will not be able to sign in if you do.

Advertising and tracking

We do not use advertising identifiers or behavioral tracking tools.

12. Privacy officer

Officer

Dohyung Kwon (CEO of FlowMate Inc.)

Contact

ceo@flowmate.kr · Customer support 070-8098-5126

13. Remedies for infringement of rights

You may also contact the following organizations for advice or to report a personal information infringement.

Personal Information Dispute Mediation Committee

1833-6972 (www.kopico.go.kr)

Personal Information Infringement Report Center

118 (privacy.kisa.or.kr)

Supreme Prosecutors' Office

1301 (www.spo.go.kr)

Korean National Police Agency

182 (ecrm.police.go.kr)

14. Operating company and policy changes

Operating company

FlowMate Inc. · CEO Dohyung Kwon · Business registration number 772-88-04021 · Suite 353, 7th floor, 49 Gamcheon-ro, Saha-gu, Busan (Gamcheon-dong, Huiwon Gamcheon), Republic of Korea

Notice of changes

If this policy changes, we will give notice within the service 7 days before the effective date (30 days for changes unfavorable to users).

Effective date

October 13, 2026