Privacy Policy

Updated Oct 12, 2026

1. General Provisions

SEDA (the “Service”), operated by CoKoRoad Corp. (the “Company”), places great importance on protecting Users’ Personal Information and complies with applicable laws and regulations including the Personal Information Protection Act and the Act on Promotion of Information and Communications Network Utilization and Information Protection, etc.

Through this Privacy Policy, the Company explains how the Personal Information provided by Users is used, for what purposes and by what methods, and what measures are taken to protect Personal Information.

2. Changes to the Privacy Policy

  1. This Privacy Policy may be amended in accordance with changes in applicable laws, policies, or the Service.
  2. Changes will be notified at least 7 days prior to the effective date via in-app notice, push notifications, email, etc.
  3. However, if there are material or unfavorable changes for Users, the Company will provide notice at least 30 days before the effective date and, if necessary, obtain Users’ consent again.
  4. If a User continues to use the Service without explicitly indicating refusal after notice of changes, the User shall be deemed to have agreed only to minor operational changes. However, changes that materially affect Users’ rights—such as purposes of collection/use, third-party provision, or overseas transfer—will follow a separate consent procedure.

3. Information Collected

The Company collects the following Personal Information to provide the Service.

If required information is not provided, use of the Service may be restricted. Even if optional information is not provided, basic Service use is available.

  1. Information required for sign-up and social login
Google social login Email address [Required], name (if provided by the Google account)
Apple social login Email address (real or private relay) [Required], name (if the User chooses to provide it)
Facebook social login Facebook account ID [Required], email address (if registered to the Facebook account), name
  1. Information required to use the Service
  2. Service usage records
  3. Device unique identifiers
  4. Information entered by Users when registering and using the Service
  5. Nickname [Required]
  6. Email address or ID received via social login (Google, Apple, Facebook) [Required]
  7. Learning course selection (TOPIK, EPS-TOPIK, Basic Korean) [Required]
  8. Learning purpose selected upon sign-up (EPS-TOPIK desired occupation, Basic Korean learning goal, reason for preparing for TOPIK) and access route [Optional]
  9. Learning language settings [Optional]
  10. Information required when contacting customer support
  11. When Users inquire about the Service or report rights infringement, email or SNS account may be collected during the inquiry handling/resolution process
  12. For mobile: device model, carrier information, hardware ID, basic statistics about Service use
  13. Information about the device
  14. Automatically collected items

During Service use, the following may be automatically generated and collected for Service improvement, prevention of illegal use, personalization, and customer support:

  • IP address, cookies, login timestamps, usage history

  • Device information (model name, carrier, OS information, screen size, language/country, etc.)

  • Error logs, OS and app version information

  • Product improvement analytics data: app launch and session information, screen views, button clicks, service usage events such as learning started, completed, or dropped off, learning course and learning purpose selected upon sign-up, app version, OS version, device type, language and country settings, internal user identifier, and device identifier.

    The Company manages product analytics events so that they do not include directly identifying information such as the user’s email address, name, nickname, or social login token.

Users may refuse automatic collection items; refusal may restrict use of certain Service features.

  1. Protection of children’s Personal Information
  • The Company does not intentionally collect Personal Information of children under 14.
  • If a child under 14 provides information contrary to the Company’s intent, the User or legal representative may request access, correction, or deletion at any time.
  • Requests for deletion/modification may be processed via the “Withdraw Membership” function or by contacting the Personal Information Protection Officer in writing/email, and the Company will act without delay.

4. Purposes of Collection and Use of Personal Information

The Company uses collected information for the following purposes:

  1. User management
  • Identifying Users and preventing fraudulent use
  • Providing important notices as necessary
  • Preventing fraudulent use in accordance with operational policies
  1. Providing the Service
  • Enabling Users to use the Service smoothly
  • Providing translated explanations in the User’s selected language
  • Providing personalized learning content and incorrect-answer notes
  • Sending review reminders and learning reminders
  1. Customer support
  • Verifying identity and responding to inquiries
  • Receiving and processing error reports
  • Preserving records for dispute mediation
  1. Service operation and improvement
  • Preparing statistical data on Service usage
  • Providing new features and updates
  • Improving the Service (improving question quality, UI/UX, bug fixes, new feature development, etc.) and related surveys/analysis
  • Analyzing anonymized Learning Data to improve AI models
  • Preventing illegal use and ensuring stability
  • To use product analytics tools to analyze users’ learning flows, screen usage, feature usage, errors, and drop-off points, and to improve service quality, content quality, UI/UX, and stability.
  • Product analytics data is not used to individually evaluate a user’s learning performance or to track users for advertising purposes. It is used for statistical and analytical purposes to operate and improve the service.
  1. Marketing and advertising (with optional consent)
  • Providing promotional information such as new features (products) and events

[4.1. Provision and Processing of AI-Based Services]

To provide a more efficient learning experience, the Company may perform the following processing using generative AI technology under the Framework Act on the Advancement of Artificial Intelligence and the Establishment of a Trust-Based Foundation.

In this process, the Company may analyze and use:

  • the User’s learning records, question-solving history, language settings, etc.
  • such information is used only to assist learning (e.g., personalized question recommendations, explanation provision, learning feedback generation).

In accordance with Article 31 of the same Act and Article 22 of the Enforcement Decree, the Company labels AI-generated content in a manner that Users can recognize.

AI is used as a tool to support learning, and the final judgment or decision regarding learning outcomes rests with the User.

Users may request explanations regarding AI-generated or recommended learning content or raise objections to errors. The Company will review such requests within a reasonable scope and take necessary measures.

The Company's AI-based Service is intended to assist learning and provide information and does not constitute "high-impact AI" under Article 2(4) of the same Act that automatically determines or restricts a User's legal status, rights, or obligations.

[4.1.1. Data Transmitted to Third-Party AI Services]

To generate explanations, translations, and learning content, the Service transmits the following data to third-party AI service providers (Google Gemini and Anthropic Claude, accessed via Google Cloud Platform):

  • Question text, answer options, and related educational content
  • The User's selected interface/learning language setting
  • Question-solving context (e.g., which answer was selected) for generating targeted explanations

The following data is NOT transmitted to third-party AI services:

  • User account information (email, name, nickname)
  • Device identifiers or IP addresses
  • Login credentials or social login tokens
  • Usage history, learning records, or any data that can identify an individual User

AI service providers process the transmitted data solely for the purpose of generating a response and do not retain the data for model training purposes. The Company has confirmed through contractual agreements and service terms that these providers do not use SEDA's transmitted data to train their AI models.

5. Retention and Use Period

In principle, the Company destroys Users’ Personal Information without delay upon withdrawal or upon achievement of the processing purpose. However, the Company may retain and use Personal Information within the period prescribed by law or within the scope of the User’s consent.

All Personal Information is securely stored on the Company’s servers.

  1. Service operation standards
Information retained Retention period Purpose
Member account information (social ID, Email address, nickname) Until withdrawal Service provision
Learning records (question-solving history, incorrect-answer notes) 30 days after withdrawal Responding to withdrawal reversal requests and preserving evidence in case of disputes
Account identification information (device ID, social ID) – general withdrawal 30 days after withdrawal Responding to withdrawal reversal requests and preserving evidence in case of disputes
Account identification information (device ID, social ID) – withdrawal due to sanctions 1 year after withdrawal Preventing re-registration of Terms violators and preventing fraudulent use
History of usage restriction measures 1 year after withdrawal Re-registration review, prevention of fraudulent use, dispute resolution
Access logs (login/logout times, IP address) 6 months after withdrawal Prevention of fraudulent use and dispute response

※ Note: Learning records and account identification information retained after withdrawal are stored separately and are not used for Service provision purposes.

However, if membership is suspended or revoked due to violation of the Terms, account identification information may be used to prevent re-registration and fraudulent use.

  1. Retention periods under applicable laws
Information retained Retention period Law
Login records 3 months Protection of Communications Secrets Act

※ The above period is the statutory minimum retention period. In accordance with the table in Paragraph 1, the Company retains access logs for up to 6 months after withdrawal.

※ Since the Company does not provide paid services, it does not retain transaction records under the Act on the Consumer Protection in Electronic Commerce. If paid services are introduced, the Company will amend this Policy and notify Users.

  1. Upon withdrawal
  • When a User requests withdrawal, Service use is stopped immediately.
  • The User may request immediate deletion upon withdrawal.
  • If immediate deletion is requested, the User will be informed that recovery is impossible; if no separate request is made, Personal Information will be stored separately for 30 days after withdrawal and then destroyed in an unrecoverable manner.
  • If an investigation into a violation of law is in progress, the Company may retain information until completion of the investigation.

6. Outsourcing of Personal Information Processing

The Company outsources Personal Information processing as follows to provide the Service:

Processor Country Outsourced tasks Data transmitted Retention/use period
Supabase, Inc. Republic of Korea (Seoul region) User authentication, storage/retrieval of learning data, real-time synchronization User account data (email, social login ID, nickname), learning records, notification settings and push notification tokens, device identifiers Until withdrawal or termination of the outsourcing agreement
Google LLC (Google Cloud Run) Republic of Korea (Seoul region) Server operation (admin system, notification scheduling) Member identifiers and member information required for administration and notification dispatch Until termination of the outsourcing agreement
Google LLC (Google Cloud Identity Platform) United States Member login authentication Email address, name (if provided by the social account), social login account identifier, login records (IP address, device and browser information) Deleted upon withdrawal (completely deleted within 180 days including backups). Login IP records are retained for several weeks
Google LLC (Firebase Cloud Messaging) United States and other countries where Google data centers are located Sending push notifications Push notification tokens, notification content Until the push notification token expires or is deleted
Google LLC (Firebase Crashlytics) United States and other countries where Google data centers are located App error and crash analysis Error occurrence records, device model/OS/app version information, installation identifier for error analysis 90 days from the date of collection
Google LLC (Google Analytics) United States and other countries where Google data centers are located Website (seda.coko.kr) usage statistics analysis Website visits, page views, and click information, cookie identifiers, browser and device information, access location (country/city level) The data retention period set in Google Analytics (up to 14 months)
Mixpanel, Inc. United States Product usage analytics, funnel and retention analysis, error analysis, and usability improvement App events, screen navigation and button click information, learning course and learning purpose codes selected upon sign-up, app/OS/device information, language and country settings, access location (country/city level), internal user identifier, and device identifier. Email address, name, nickname, and social login token are not transferred. Until termination of the outsourcing agreement. If a User requests deletion, the data will be deleted without delay
Google LLC (Gemini API, Google Cloud) United States AI-powered question generation, explanation generation, translation of learning content Learning content data (question text, answer options, explanation prompts), User's selected language setting. No personally identifiable information is included in AI processing requests. Until withdrawal or termination of the outsourcing agreement
Anthropic (Claude API, via Google Cloud) United States AI-powered explanation generation and translation of learning content Learning content data (question text, answer options, explanation prompts), User's selected language setting. No personally identifiable information is included in AI processing requests. Until withdrawal or termination of the outsourcing agreement

Among these, contact information for processors that process Personal Information overseas, the timing and method of transfer, and how to refuse are provided in Section 14.

If the outsourced tasks or processors change, the Company will notify Users in accordance with the amendment procedures of this Privacy Policy.

※ Note: The transmission of educational content data to Google and Anthropic AI services for the purpose of generating learning explanations and translations constitutes outsourced processing performed under the Company's instructions and contractual agreements. These AI service providers act as data processors and do not independently use, retain, or share the transmitted data. This does not constitute "provision of Personal Information to third parties" as defined under applicable law, since the transmitted data does not include personally identifiable information.

7. Procedure and Method of Personal Information Destruction

The procedure and method of destroying personal data in CoKoRoad Corp. are as follows.

  1. Timing of destruction
  • When the purpose of processing Personal Information is achieved
  • When the retention period expires
  • When the User requests withdrawal
  1. Destruction procedures

When Personal Information becomes unnecessary depending on the timing, the Company destroys the Personal Information without delay.

If Personal Information must be retained under applicable laws, the Company stores and manages such Personal Information or Personal Information files separately from other Personal Information.

  1. Destruction methods
  2. Electronic files: permanently deleted in an unrecoverable manner
  3. Paper documents: shredded
  4. Information retained under laws
  • Personal Information required to be retained for a certain period under laws is stored and managed separately in a separate database (DB).

8. Provision of Personal Information to Third Parties

In principle, the Company does not provide Personal Information to third parties without the User’s consent.

However, the following cases are exceptions:

  1. where there is a special provision in laws;
  2. where unavoidable to comply with legal obligations;
  3. where unavoidable for a public institution to perform duties under laws; or
  4. where consent cannot be obtained in advance because the User or legal representative cannot express intention or is missing, and it is clearly necessary to protect urgent life/body/property interests of the User or a third party.

9. Users’ Rights

  1. Users may exercise the following rights at any time and request them as described below:
  • request access to Personal Information
  • request correction of errors
  • request deletion
  • request suspension of processing
  • opt out of marketing communications

[How to exercise rights]

  1. In-app settings: - My Page > Settings > Notification Settings - My Page > Manage Account > Delete Account: request membership withdrawal and deletion of personal information
  2. Email: coko@coko.kr
Requests to access, correct, delete, or suspend the processing of personal information, and requests related to product analytics data processing, may be submitted by email.
  1. The Company will take necessary measures and notify the User of the results within 10 days of receiving the request.
  2. If there are legitimate reasons, the Company may extend the processing period and will inform the User of the reason and the extended period.
  3. Until correction/deletion is completed, the Company will not use or provide the relevant information.

[9.1. Rights regarding AI-based automated processing]

Users may, with respect to results generated or recommended by AI in the Service:

  • request an explanation of such results; and
  • raise objections to erroneous or inaccurate results.

The Company will review such requests within a reasonable scope and, if necessary, provide human review or measures.

10. Transfer of Personal Information upon Data Transfer

If the Company transfers Personal Information due to a data transfer or merger, the Company will notify Users 30 days in advance of:

  • the fact of transfer of Personal Information;
  • the name, address, and contact information of the acquirer (data transferee); and
  • procedures if the User does not wish the transfer.

Users may refuse the transfer by withdrawing membership during the notice period.

11. Use of automatic collection tools and product analytics tools, and exercise of rights

The Company may use in-app product analytics tools to secure service stability, analyze errors, improve features, and analyze learning flows.

  1. Purpose of use
  • Service usage statistics and funnel analysis
  • Analysis of learning flows, such as learning started, completed, or dropped off
  • Identification of errors and performance issues
  • Improvement of UI/UX and content quality
  • Prevention of improper use and securing service stability
  1. Information collected
  • App events, screen views, button clicks, and session information
  • App version, OS version, device information, and language and country settings
  • Internal user identifier and device identifier
  1. Information not collected
  • Email address, name, nickname, and social login token
  • Personal information entered by the user while solving questions
  • Cross-app or cross-website tracking information using advertising identifiers
  1. User rights
  • Users may contact the personal information protection officer by email or request suspension of processing in relation to product analytics data.
  • The Company will review the request in accordance with applicable laws and guide the user on the necessary measures.
  • Product analytics data is used for statistical and analytical purposes to operate and improve the service, and is not used for cross-app or cross-website tracking for advertising purposes.
  1. How to refuse:
  • App: In My Page → Manage Account, if the User turns off “App Tracking”, product analytics data will no longer be transmitted. Turning it off does not restrict the use of the Service.
  1. When using the website (cookies)
  • The Company’s website (seda.coko.kr) uses Google Analytics for visit statistics analysis, and in this process, cookies are stored in the User’s browser.
  • A cookie is a small text file stored in the User’s browser by a website, used to statistically analyze visit, page view, and click information.
  • How to refuse: Users can refuse cookie storage in browser settings or install the Google Analytics opt-out add-on (https://tools.google.com/dlpage/gaoptout). Refusing cookies does not restrict use of the website.

12. Measures to Protect Personal Information

To prevent loss, theft, leakage, forgery, alteration, or damage of Personal Information, the Company implements the following measures:

  • establishing and operating internal management plans
  • access control and limiting privileges
  • retaining access records and preventing tampering
  • installing/managing security programs
  • encrypted storage and transmission of Personal Information
  • appointing minimal number of Personal Information handlers and conducting regular training

13. GDPR Compliance

  1. Scope
  • The Company complies with the EU General Data Protection Regulation (GDPR) for Users residing in the European Union (EU) and the European Economic Area (EEA).
  1. Legal bases for processing
  • The Company processes Personal Information based on:
    • consent of the data subject
    • conclusion and performance of a contract
    • compliance with legal obligations
    • protection of vital interests of the data subject or others
    • responding to fraud/misuse/security risks
    • the Company’s legitimate interests (preventing fraudulent use, strengthening security, etc.), provided that such interests do not override the data subject’s rights
  1. User rights under GDPR: access, rectification, erasure, restriction of processing, data portability, objection, refusal of automated decision-making
  2. How to exercise rights
  • Users may request via the methods specified in Section 9 or by contacting the Personal Information Protection Officer.
  • The Company will process and notify the result within one (1) month of receiving the request.

14. Overseas Transfer

  1. Legal basis for transfer

To perform the Service use agreement concluded with Users, the Company outsources the processing of Personal Information to overseas business operators and, in accordance with Article 28-8(1)3(a) of the Personal Information Protection Act, discloses the following matters in this Privacy Policy and transfers Personal Information overseas.

The database storing member information and learning records (Supabase) and server operations (Google Cloud Run) are processed in the Republic of Korea (Seoul region).

  1. Status of overseas transfer
Recipient (Contact) Country Transferred items Purpose of transfer Retention and use period Timing and method of transfer
Mixpanel, Inc. (compliance@mixpanel.com) United States App events, screen navigation and button click information, learning course and learning purpose codes selected upon sign-up, app/OS/device information, language and country settings, access location (country/city level), internal user identifier, and device identifier Product usage analytics, funnel and retention analysis, error analysis, and usability improvement Until termination of the outsourcing agreement. Deleted without delay upon the User’s request Transferred through an encrypted communication network whenever an event occurs during app use
Google LLC (googlekrsupport@google.com) United States Email address, name (if provided by the social account), social login account identifier, login records (IP address, device and browser information) Member login authentication (Google Cloud Identity Platform) Deleted upon withdrawal (completely deleted within 180 days including backups). Login IP records are retained for several weeks Transferred through an encrypted communication network upon member sign-up or login
Google LLC (googlekrsupport@google.com) United States and other countries where Google data centers are located Push notification tokens, notification content Sending push notifications (Firebase Cloud Messaging) Until the push notification token expires or is deleted Transferred through an encrypted communication network when notifications are allowed or sent
Google LLC (googlekrsupport@google.com) United States and other countries where Google data centers are located Error occurrence records, device model/OS/app version information, installation identifier for error analysis App error and crash analysis (Firebase Crashlytics) 90 days from the date of collection Transferred through an encrypted communication network when an error occurs in the app
Google LLC (googlekrsupport@google.com) United States and other countries where Google data centers are located Website visits, page views, and click information, cookie identifiers, browser and device information, access location (country/city level) Website (seda.coko.kr) usage statistics analysis (Google Analytics) The data retention period set in Google Analytics (up to 14 months) Transferred through an encrypted communication network upon visiting the website

Learning content data transmitted to Google Gemini and Anthropic Claude, as described in Section 6, does not contain Personal Information and therefore does not constitute an overseas transfer of Personal Information.

  1. Method and procedure for refusing transfer, and effect of refusal
  • Member login authentication (Google Cloud Identity Platform): This processing is necessary to provide member services. If the User does not wish for data to be transferred, the User may choose not to sign up as a member or withdraw membership. In this case, member-only features will not be available, but the User may continue to use the Service to the extent available to non-members.
  • Product usage analytics (Mixpanel): Turning off “App Tracking” in the app under My Page → Manage Account stops subsequent transmissions. There are no restrictions on using the Service.
  • Push notifications (Firebase Cloud Messaging): Turning off notification permissions for SEDA in device settings prevents new push notification tokens from being transmitted. In this case, the User will not receive push notifications, but there are no other restrictions on using the Service.
  • Error analysis (Firebase Crashlytics): This processing is necessary for the stable provision of the app, and no separate opt-out feature is provided. If the User does not wish for data to be transferred, the User may delete the app after membership withdrawal, in which case the User cannot use the Service.
  • Website usage analytics (Google Analytics): Users may refuse cookie storage in the browser or install the Google Analytics opt-out add-on. There are no restrictions on using the website.
  • For other inquiries or requests to suspend processing related to overseas transfer, Users may contact the Personal Information Protection Officer in Section 15.
  1. Safeguards
  • Processors hold international security certifications such as ISO 27001 and SOC 2.
  • For EU User data, the Company complies with Standard Contractual Clauses (SCC) under GDPR Article 46 or adequacy decisions.
  • If the above matters, such as recipients or transferred items, change, the Company will amend and disclose this Privacy Policy and notify Users in advance.

15. Personal Information Protection Officer

For inquiries, complaints, or requests for remedies regarding Personal Information processing, please contact:

The Company also establishes and operates an internal accountability system for operation and outcome management of AI systems to ensure stability and trust in AI-based processing.

AI-related inquiries or issue reports may be submitted to the Personal Information Protection Officer, and the Company will coordinate with relevant departments to handle them.

  • Personal Information Protection Officer: Cho Dohee (CEO)
  • Company: CoKoRoad Corp.
  • Address: 3F, Seoul Forest Biz Foret, 6 Wangsimni-ro 10-gil, Seongdong-gu, Seoul, Republic of Korea
  • Email: chodohee@coko.kr

The Company will respond promptly and sincerely to Users’ inquiries.

16. Remedies for Rights Infringement

Users may seek assistance from the following organizations to remedy Personal Information infringement:

  1. Personal Information Infringement Report Center
  • Operated by: Korea Internet & Security Agency (KISA)
  • Tel: 118 (no area code)
  • Website: privacy.kisa.or.kr
  1. Personal Information Dispute Mediation Committee
  1. Supreme Prosecutors’ Office
  1. National Police Agency

Addendum

  1. Effective Date

This Privacy Policy takes effect on October 20, 2026.

  1. Previous Policy

The previous Privacy Policy remains in effect until the day before the effective date of this Policy, and can be viewed in the version selection menu on this page.

Last Updated: October 12, 2026