Privacy Policy and Content Policy

Article 1. Purposes of Processing

We do not use personal information for purposes other than those stated above. If the purpose changes, we will take necessary measures such as obtaining separate consent under Article 18 of the Personal Information Protection Act.

Article 2. Items Processed and Retention Periods

1. Account information

Optional items may be left blank without any restriction on service use.

2. Learning data

Learning data may be retained after withdrawal so that the affiliated institution can manage learning records. If a data subject requests destruction, we destroy it without delay under Article 8.

3. Automatically collected information

4. Retention required by law

We do not currently offer paid services and therefore do not collect payment information.

Article 3. Personal Information of Children Under 14

We do not accept sign-ups from children under the age of 14.

Even where a teacher of an affiliated institution issues student accounts, we provide the service only to students aged 14 or older, and the institution verifies this when issuing accounts.

If we become aware that personal information of a child under 14 has been collected, we destroy it without delay.

Article 4. Provision to Third Parties

We process personal information only within the scope of the purposes stated in Article 1, and provide it to third parties only where Articles 17 and 18 of the Personal Information Protection Act apply, such as with the data subject’s consent or under specific provisions of law.

We do not provide personal information to any other third party.

Article 5. Outsourcing of Processing

When entering into outsourcing agreements, we stipulate responsibilities including compliance with personal information protection instructions, restrictions on sub-processing, technical and managerial safeguards, and liability for damages, and we supervise the processors’ compliance.

Article 6. Cross-Border Transfer of Personal Information

Under Article 28-8 of the Personal Information Protection Act, we transfer personal information overseas as follows.

Data subjects may refuse the cross-border transfer of their personal information. To do so, please contact us using the details in Article 10 and we will act without delay. Note that AI automatic grading requires cross-border transfer, so refusing may restrict the use of that feature.

Account information, original handwritten answers, and grading results are stored in the Republic of Korea (AWS Seoul region). The transfers above occur only at the time of each processing operation. We also use an overseas provider to generate search indexes for problem, solution, and concept text; that data contains no personal information.

Article 7. Destruction of Personal Information

We destroy personal information without delay (within 5 days of the triggering event) once the retention period has elapsed or the processing purpose has been achieved.

• Procedure — We identify the personal information subject to destruction and destroy it with the approval of the Data Protection Officer.
• Method — Electronic files are permanently deleted so that they cannot be recovered or reproduced; printed materials are shredded or incinerated.
• Where retention is required by law — Such information is stored in a separate database and destroyed after the statutory period.

Article 8. Rights of Data Subjects and How to Exercise Them

Data subjects may exercise the following rights at any time.

1. Request access to personal information
2. Request correction of errors
3. Request deletion
4. Request suspension of processing
5. Request data portability

Access and correction can be performed directly under Profile → Account settings in the app or on the web. Other rights may be exercised by email or in writing to the Data Protection Officer in Article 10. We take action within 10 days of receiving a request and notify you of the result. Where a correction is requested, we do not use or provide the relevant personal information until the correction is complete. Rights may be exercised through a legal representative or an authorized agent.

Account Deletion

You may delete your account at any time in either of the following ways.

• In the app or on the web: Profile → Delete Account
• By email: send a deletion request from your registered email address to privacy@esamath.org

Deleting your account removes your account and profile information. Assignments, handwritten answers, and grading results you have already submitted may be retained so that your affiliated institution can manage learning records; if you also want these destroyed, please state so in your deletion request and we will destroy them without delay. Records we are legally required to keep are retained only for the statutory period and then destroyed.

Article 9. Security Measures

Managerial measures

• Minimizing the number of personnel who handle personal information and granting differentiated access rights
• Designating a Data Protection Officer and establishing an internal management plan

Technical measures

• One-way encrypted storage of passwords
• Encryption in transit (HTTPS/TLS)
• Login attempt limits — temporary account lock after consecutive failures
• Access control and permission management for databases and file storage
• Authentication and access restriction for administrative systems
• Retention of access records and prevention of forgery or alteration

Physical measures

• Compliance with the physical security controls of our cloud providers’ data centers

We do not currently hold ISMS-P or CSAP certification.

Article 10. Data Protection Officer

We have designated a Data Protection Officer who is responsible for overseeing personal information processing and for handling complaints and remedies related to that processing.

Data subjects may direct any inquiries, complaints, or requests for remedy relating to personal information protection to the contact above, and we will respond without delay.

Article 11. Remedies for Infringement of Rights

Data subjects may apply for dispute resolution or consultation with the following bodies to obtain remedies for personal information infringement.

Article 12. Changes to This Policy

This Privacy Policy is effective as of July 26, 2026. If content is added, deleted, or modified due to changes in law, policy, or security technology, we will announce the changes on this page before they take effect.

Previous policy in effect: July 11, 2026 – July 25, 2026