Privacy Policy and Content Policy

Article 1. Purposes of Processing

We do not use personal information for purposes other than those stated above. If the purpose changes, we will take necessary measures such as obtaining separate consent under Article 18 of the Personal Information Protection Act.

Use for AI model development and improvement

To improve the accuracy of handwriting recognition and automatic grading, we use learning data (smart-pen handwritten answer images and stroke coordinates, grading results) to develop, train and validate AI models. Under Article 28-2 of the Personal Information Protection Act we use only pseudonymized information for scientific research, which includes technology development and demonstration, and we observe the following.

• Identifying information such as name, ID, school and grade is separated and stored apart, and is not used for model training. Where a name or student number is handwritten on an answer, that part is removed before use.
• We do not process pseudonymized information for the purpose of identifying a specific individual. If an individual becomes identifiable during processing, we stop immediately and retrieve and destroy the information.
• Pseudonymized information is used only within the company and is never provided to third parties or made public. It is destroyed as soon as the purpose is achieved.
• Under Article 8 you may request suspension of processing of your personal information at any time, in which case it will not be used for training. We will not disadvantage you in the service for making such a request.

Article 2. Items Processed and Retention Periods

1. Account information

Optional items may be left blank without any restriction on service use.

2. Learning data

Learning data may be retained after withdrawal so that the affiliated institution can manage learning records. If a data subject requests destruction, we destroy it without delay under Article 8.

3. Automatically collected information

4. Retention required by law

We do not currently offer paid services and therefore do not collect payment information.

Article 3. Personal Information of Children Under 14

We do not accept sign-ups from children under the age of 14.

Even where a teacher of an affiliated institution issues student accounts, we provide the service only to students aged 14 or older, and the institution verifies this when issuing accounts.

If we become aware that personal information of a child under 14 has been collected, we destroy it without delay.

Article 4. Provision to Third Parties

We process personal information only within the scope of the purposes stated in Article 1, and provide it to third parties only where Articles 17 and 18 of the Personal Information Protection Act apply, such as with the data subject’s consent or under specific provisions of law.

We do not provide personal information to any other third party.

Article 5. Outsourcing of Processing

When entering into outsourcing agreements, we stipulate responsibilities including compliance with personal information protection instructions, restrictions on sub-processing, technical and managerial safeguards, and liability for damages, and we supervise the processors’ compliance.

Article 6. Cross-Border Transfer of Personal Information

Under Article 28-8 of the Personal Information Protection Act, we transfer personal information overseas as follows.

Data subjects may refuse the cross-border transfer of their personal information. To do so, please contact us using the details in Article 10 and we will act without delay. Note that AI automatic grading requires cross-border transfer, so refusing may restrict the use of that feature.

Account information, original handwritten answers, and grading results are stored in the Republic of Korea (AWS Seoul region). The transfers above occur only at the time of each processing operation. We also use an overseas provider to generate search indexes for problem, solution, and concept text; that data contains no personal information.

AI math concept chat logs are retained for 90 days and then destroyed, and are deleted without delay when a member withdraws. Chat logs are not used for AI model training, user profiling, or advertising. Access is scoped as follows: the student sees the full question and answer, their teacher sees only the number of sessions and a concept summary (never the question text itself), and administrators within the student’s organization may view records to the extent needed to operate the service.

Article 7. Destruction of Personal Information

We destroy personal information without delay (within 5 days of the triggering event) once the retention period has elapsed or the processing purpose has been achieved.

• Procedure — We identify the personal information subject to destruction and destroy it with the approval of the Data Protection Officer.
• Method — Electronic files are permanently deleted so that they cannot be recovered or reproduced; printed materials are shredded or incinerated.
• Where retention is required by law — Such information is stored in a separate database and destroyed after the statutory period.

Article 8. Rights of Data Subjects and How to Exercise Them

Data subjects may exercise the following rights at any time.

1. Request access to personal information
2. Request correction of errors
3. Request deletion
4. Request suspension of processing
5. Request data portability

Access and correction can be performed directly under Profile → Account settings in the app or on the web. Other rights may be exercised by email or in writing to the Data Protection Officer in Article 10. We take action within 10 days of receiving a request and notify you of the result. Where a correction is requested, we do not use or provide the relevant personal information until the correction is complete. Rights may be exercised through a legal representative or an authorized agent.

Account Deletion

You may delete your account at any time in either of the following ways.

• In the app or on the web: Profile → Delete Account
• By email: send a deletion request from your registered email address to privacy@esamath.org

Deleting your account removes your account and profile information. Assignments, handwritten answers, and grading results you have already submitted may be retained so that your affiliated institution can manage learning records; if you also want these destroyed, please state so in your deletion request and we will destroy them without delay. Records we are legally required to keep are retained only for the statutory period and then destroyed.

Article 9. Security Measures

Managerial measures

• Minimizing the number of personnel who handle personal information and granting differentiated access rights
• Designating a Data Protection Officer and establishing an internal management plan

Technical measures

• One-way encrypted storage of passwords
• Encryption in transit (HTTPS/TLS)
• Login attempt limits — temporary account lock after consecutive failures
• Access control and permission management for databases and file storage
• Authentication and access restriction for administrative systems
• Retention of access records and prevention of forgery or alteration

Physical measures

• Compliance with the physical security controls of our cloud providers’ data centers

We do not currently hold ISMS-P or CSAP certification.

Article 10. Data Protection Officer

We have designated a Data Protection Officer who is responsible for overseeing personal information processing and for handling complaints and remedies related to that processing.

Data subjects may direct any inquiries, complaints, or requests for remedy relating to personal information protection to the contact above, and we will respond without delay.

Article 11. Remedies for Infringement of Rights

Data subjects may apply for dispute resolution or consultation with the following bodies to obtain remedies for personal information infringement.

Article 12. Changes to This Policy

This Privacy Policy is effective as of September 21, 2026. If content is added, deleted, or modified due to changes in law, policy, or security technology, we will announce the changes on this page before they take effect.

Previous policy in effect: September 10, 2026 – September 20, 2026

1. Allowed Content

Users may post and share educational content such as assignments, feedback, class discussions, and school-related materials.

2. Prohibited Content

• Harassment, bullying, hate speech, or threats.
• Sexually explicit, violent, or otherwise harmful material.
• Spam, scams, or misleading information.
• Content that infringes intellectual property rights.
• Any illegal content or activity.

3. Reporting and Enforcement

We may review, remove, or restrict content that violates this policy. Accounts may be suspended or terminated for repeated or severe violations.

4. User Responsibility

Users are responsible for the content they submit. By using the app, users agree that their content must follow applicable laws, school rules, and this policy.

5. Contact

To report policy violations, contact privacy@esamath.org