Privacy Policy

Article 1 (Purpose of Processing Personal Information)

The Company processes personal information for the following purposes:

1. Registration and identity verification: Member identification, verification of intent to register, prevention of fraudulent use
2. Service provision: Class search, booking, schedule management, timezone conversion
3. Payment processing: Class payments, refund processing, payment history management
4. Instructor settlement: Earnings settlement, tax reporting (3.3% business income tax)
5. Service improvement: Access statistics analysis, service quality enhancement
6. Customer support: Complaint handling, dispute resolution

Article 2 (Types of Personal Information Collected)

1. General Members

• Required: Name, email address, password (hashed)
• Optional: Timezone, currency preference
• Google Login: Google account identifier (provider, uid)

2. Instructors (Additional Collection)

• Profile: Display name, bio, Instagram URL, homepage URL, profile photo
• Settlement info: Legal name, resident registration number (encrypted), bank name, account number, account holder name

3. Payment Information

• Payment amount, currency, payment date
• Toss Payments payment key and order ID
• Lemon Squeezy order ID

4. Automatically Collected Information

• Visitor identifier, IP address, User-Agent (browser information)
• Page path accessed, referrer URL

5. User-Generated Content

• Class reviews (rating, content)
• Bookmarks (wishlist), cart items

Article 3 (Retention Period)

The Company processes and retains personal information within the retention period required by law or agreed upon at the time of collection.

Article 4 (Third-Party Disclosure)

The Company processes personal information only within the purposes specified in Article 1 and discloses it to third parties in the following cases:

Information may also be disclosed when required by law, such as requests from investigative authorities.

Article 5 (Cross-Border Data Transfer)

The Company transfers personal information overseas for the provision of services as follows:

Article 6 (Destruction of Personal Information)

1. The Company destroys personal information without delay when it is no longer needed, such as when the retention period has expired or the processing purpose has been achieved.
2. Personal information is immediately destroyed upon member withdrawal. Information that must be retained by law is stored separately and destroyed upon expiration of the retention period.
3. Destruction methods: Electronic files are permanently deleted using methods that prevent recovery. Paper documents are shredded.

Article 7 (Rights of Data Subjects)

1. Data subjects may exercise the following rights at any time:
   • Request to access personal information
   • Request correction of errors
   • Request deletion
   • Request suspension of processing
2. Rights may be exercised by contacting james@heyjames.ai. The Company will take action without delay.
3. Members may directly delete their accounts from the Settings page.
4. In accordance with Articles 35 through 38 of the Personal Information Protection Act.

Article 8 (Security Measures)

The Company takes the following measures to ensure the security of personal information:

1. Password encryption: Passwords are hashed using the bcrypt algorithm. Plain text passwords are never stored.
2. RRN encryption: Instructor resident registration numbers are encrypted using Active Record Encryption.
3. Communication encryption: SSL/TLS is applied to encrypt data in transit.
4. Access control: Admin roles are separated to minimize access to personal information.
5. Access log retention: Access logs for the personal information processing system are maintained.

Article 9 (Cookies and Automatic Collection)

1. Session cookies: Used to maintain login status. Deleted when the browser is closed.
2. Locale cookie: Stores language preference (Korean/English).
3. Visit records: Visitor identifiers, page paths, IP addresses, and User-Agent information are collected for service improvement.
4. How to refuse cookies: You can refuse cookie storage through your web browser settings. However, refusing cookies may limit the use of some services such as login.

Article 10 (Data Protection Officer)

Article 11 (Remedies for Rights Infringement)

If you need to report or consult about personal information infringement, you may contact the following organizations:

• Personal Information Infringement Report Center (KISA): 118 / privacy.kisa.or.kr
• Personal Information Dispute Mediation Committee: 1833-6972 / www.kopico.go.kr
• Supreme Prosecutors' Office Cyber Investigation Division: 1301 / www.spo.go.kr
• National Police Agency Cyber Bureau: 182 / ecrm.police.go.kr

Supplementary Provisions

This Privacy Policy shall take effect on April 4, 2026.