Privacy Policy

Effective Jun 25, 2026

1. General Provisions

SEDA (the “Service”), operated by CoKoRoad Corp. (the “Company”), places great importance on protecting Users’ Personal Information and complies with applicable laws and regulations including the Personal Information Protection Act and the Act on Promotion of Information and Communications Network Utilization and Information Protection, etc.

Through this Privacy Policy, the Company explains how the Personal Information provided by Users is used, for what purposes and by what methods, and what measures are taken to protect Personal Information.

2. Changes to the Privacy Policy

  1. This Privacy Policy may be amended in accordance with changes in applicable laws, policies, or the Service.
  2. Changes will be notified at least 7 days prior to the effective date via in-app notice, push notifications, email, etc.
  3. However, if there are material or unfavorable changes for Users, the Company will provide notice at least 30 days before the effective date and, if necessary, obtain Users’ consent again.
  4. If a User continues to use the Service without explicitly indicating refusal after notice of changes, the User shall be deemed to have agreed only to minor operational changes. However, changes that materially affect Users’ rights—such as purposes of collection/use, third-party provision, or overseas transfer—will follow a separate consent procedure.

3. Information Collected

The Company collects the following Personal Information to provide the Service.

If required information is not provided, use of the Service may be restricted. Even if optional information is not provided, basic Service use is available.

  1. Information required for sign-up and social login
Google social login Email address, name (optional, if provided) [Required]
Apple social login Email address (real or private relay), name (optional, if provided) [Required]
Facebook social login Mobile phone number or email address, name (if publicly available) [Required]
  1. Information required to use the Service
  2. Service usage records
  3. Device unique identifiers
  4. Information entered by Users when registering and using the Service
  5. Nickname [Required]
  6. Email address or ID received via social login (Google, Apple, Facebook) [Required]
  7. Industry selection and access route [Optional]
  8. Learning language settings [Optional]
  9. Information required when contacting customer support
  10. When Users inquire about the Service or report rights infringement, email or SNS account may be collected during the inquiry handling/resolution process
  11. For mobile: device model, carrier information, hardware ID, basic statistics about Service use
  12. Information about the device
  13. Automatically collected items

During Service use, the following may be automatically generated and collected for Service improvement, prevention of illegal use, personalization, and customer support:

  • IP address, cookies, login timestamps, usage history

  • Device information (model name, carrier, OS information, screen size, language/country, etc.)

  • Error logs, OS and app version information

  • Product improvement analytics data: app launch and session information, screen views, button clicks, service usage events such as learning started, completed, or dropped off, app version, OS version, device type, language and country settings, internal user identifier, and device identifier.

    The Company manages product analytics events so that they do not include directly identifying information such as the user’s email address, name, nickname, or social login token.

Users may refuse automatic collection items; refusal may restrict use of certain Service features. 6. Protection of children’s Personal Information

  • The Company does not intentionally collect Personal Information of children under 14.
  • If a child under 14 provides information contrary to the Company’s intent, the User or legal representative may request access, correction, or deletion at any time.
  • Requests for deletion/modification may be processed via the “Withdraw Membership” function or by contacting the Personal Information Protection Officer in writing/email, and the Company will act without delay.

4. Purposes of Collection and Use of Personal Information

The Company uses collected information for the following purposes:

  1. User management
  • Identifying Users and preventing fraudulent use
  • Providing important notices as necessary
  • Preventing fraudulent use in accordance with operational policies
  1. Providing the Service
  • Enabling Users to use the Service smoothly
  • Providing translated explanations in the User’s selected language
  • Providing personalized learning content and incorrect-answer notes
  • Sending review reminders and learning reminders
  1. Customer support
  • Verifying identity and responding to inquiries
  • Receiving and processing error reports
  • Preserving records for dispute mediation
  1. Service operation and improvement
  • Preparing statistical data on Service usage
  • Providing new features and updates
  • Improving the Service (improving question quality, UI/UX, bug fixes, new feature development, etc.) and related surveys/analysis
  • Analyzing anonymized Learning Data to improve AI models
  • Preventing illegal use and ensuring stability
  • To use product analytics tools to analyze users’ learning flows, screen usage, feature usage, errors, and drop-off points, and to improve service quality, content quality, UI/UX, and stability.
  • Product analytics data is not used to individually evaluate a user’s learning performance or to track users for advertising purposes. It is used for statistical and analytical purposes to operate and improve the service.
  1. Marketing and advertising (with optional consent)
  • Providing promotional information such as new features (products) and events

[4.1. Provision and Processing of AI-Based Services]

To provide a more efficient learning experience, the Company may perform the following processing using generative AI technology under the Framework Act on the Advancement of Artificial Intelligence and the Establishment of a Trust-Based Foundation.

In this process, the Company may analyze and use:

  • the User’s learning records, question-solving history, language settings, etc.
  • such information is used only to assist learning (e.g., personalized question recommendations, explanation provision, learning feedback generation).

In accordance with Article 31 of the same Act and Article 22 of the Enforcement Decree, the Company labels AI-generated content in a manner that Users can recognize.

AI is used as a tool to support learning, and the final judgment or decision regarding learning outcomes rests with the User.

Users may request explanations regarding AI-generated or recommended learning content or raise objections to errors. The Company will review such requests within a reasonable scope and take necessary measures.

The Company's AI-based Service is intended to assist learning and provide information and does not constitute "high-impact AI" under Article 2(4) of the same Act that automatically determines or restricts a User's legal status, rights, or obligations.

[4.1.1. Data Transmitted to Third-Party AI Services]

To generate explanations, translations, and learning content, the Service transmits the following data to third-party AI service providers (Google Gemini and Anthropic Claude, accessed via Google Cloud Platform):

  • Question text, answer options, and related educational content
  • The User's selected interface/learning language setting
  • Question-solving context (e.g., which answer was selected) for generating targeted explanations

The following data is NOT transmitted to third-party AI services:

  • User account information (email, name, nickname)
  • Device identifiers or IP addresses
  • Login credentials or social login tokens
  • Usage history, learning records, or any data that can identify an individual User

AI service providers process the transmitted data solely for the purpose of generating a response and do not retain the data for model training purposes. The Company has confirmed through contractual agreements and service terms that these providers do not use SEDA's transmitted data to train their AI models.

5. Retention and Use Period

In principle, the Company destroys Users’ Personal Information without delay upon withdrawal or upon achievement of the processing purpose. However, the Company may retain and use Personal Information within the period prescribed by law or within the scope of the User’s consent.

All Personal Information is securely stored on the Company’s servers.

  1. Service operation standards
Information retained Retention period Purpose
Member account information (social ID, Email address, nickname) Until withdrawal Service provision
Learning records (question-solving history, incorrect-answer notes) 30 days after withdrawal Responding to withdrawal reversal requests and preserving evidence in case of disputes
Account identification information (device ID, social ID) – general withdrawal 30 days after withdrawal Responding to withdrawal reversal requests and preserving evidence in case of disputes
Account identification information (device ID, social ID) – withdrawal due to sanctions 1 year after withdrawal Preventing re-registration of Terms violators and preventing fraudulent use
History of usage restriction measures 1 year after withdrawal Re-registration review, prevention of fraudulent use, dispute resolution
Access logs (login/logout times, IP address) 6 months after withdrawal Prevention of fraudulent use and dispute response

※ Note: Learning records and account identification information retained after withdrawal are stored separately and are not used for Service provision purposes.

However, if membership is suspended or revoked due to violation of the Terms, account identification information may be used to prevent re-registration and fraudulent use. 2. Retention periods under applicable laws

Information retained Retention period Law
Login records 3 months Protection of Communications Secrets Act
Display/advertising records 6 months Act on Consumer Protection in Electronic Commerce, etc.
Contract/withdrawal records 5 years Act on Consumer Protection in Electronic Commerce, etc.
Consumer complaints/dispute records 3 years Act on Consumer Protection in Electronic Commerce, etc.
  1. Dormant account handling
  • If there is no access for 12 months, the account will be converted to dormant status, and the Company will provide advance notice 30 days prior via the email used for sign-up.
  • After dormancy, Personal Information is stored separately for one (1) year, and the account is restored to normal status upon login during that period.
  • If one (1) year passes after dormancy, Personal Information is destroyed.
  1. Upon withdrawal
  • When a User requests withdrawal, Service use is stopped immediately.
  • The User may request immediate deletion upon withdrawal.
  • If immediate deletion is requested, the User will be informed that recovery is impossible; if no separate request is made, Personal Information will be stored separately for 30 days after withdrawal and then destroyed in an unrecoverable manner.
  • If an investigation into a violation of law is in progress, the Company may retain information until completion of the investigation.

6. Outsourcing of Personal Information Processing

The Company outsources Personal Information processing as follows to provide the Service:

Processor Country Outsourced tasks Data transmitted Retention/use period
Google Cloud Platform (incl. Gemini API) United States AI-powered question generation, explanation generation, translation of learning content, cloud infrastructure Learning content data (question text, answer options, explanation prompts), User's selected language setting. No personally identifiable information is included in AI processing requests. Until withdrawal or termination of the outsourcing agreement
Anthropic (Claude API, via Google Cloud) United States AI-powered explanation generation and translation of learning content Learning content data (question text, answer options, explanation prompts), User's selected language setting. No personally identifiable information is included in AI processing requests. Until withdrawal or termination of the outsourcing agreement
Supabase, Inc. United States User authentication, storage/retrieval of learning data, real-time synchronization User account data (email, social login ID, nickname), learning records, device identifiers Until withdrawal or termination of the outsourcing agreement
Mixpanel, Inc. United States Product usage analytics, funnel and retention analysis, error analysis, and usability improvement App events, screen navigation and button click information, app/OS/device information, language and country settings, internal user identifier, and device identifier. Email address, name, nickname, and social login token are not transferred. Until withdrawal, until the analytics purpose is achieved, or until termination of the outsourcing agreement

If the outsourced tasks or processors change, the Company will notify Users in accordance with the amendment procedures of this Privacy Policy.

※ Note: The transmission of educational content data to Google and Anthropic AI services for the purpose of generating learning explanations and translations constitutes outsourced processing performed under the Company's instructions and contractual agreements. These AI service providers act as data processors and do not independently use, retain, or share the transmitted data. This does not constitute "provision of Personal Information to third parties" as defined under applicable law, since the transmitted data does not include personally identifiable information.

7. Procedure and Method of Personal Information Destruction

The procedure and method of destroying personal data in CoKoRoad Corp. are as follows.

  1. Timing of destruction
  • When the purpose of processing Personal Information is achieved
  • When the retention period expires
  • When the User requests withdrawal
  1. Destruction procedures

When Personal Information becomes unnecessary depending on the timing, the Company destroys the Personal Information without delay.

If Personal Information must be retained under applicable laws, the Company stores and manages such Personal Information or Personal Information files separately from other Personal Information. 3. Destruction methods

  1. Electronic files: permanently deleted in an unrecoverable manner
  2. Paper documents: shredded
  3. Information retained under laws
  • Personal Information required to be retained for a certain period under laws is stored and managed separately in a separate database (DB).

8. Provision of Personal Information to Third Parties

In principle, the Company does not provide Personal Information to third parties without the User’s consent.

However, the following cases are exceptions:

  1. where there is a special provision in laws;
  2. where unavoidable to comply with legal obligations;
  3. where unavoidable for a public institution to perform duties under laws;
  4. where consent cannot be obtained in advance because the User or legal representative cannot express intention or is missing, and it is clearly necessary to protect urgent life/body/property interests of the User or a third party; or
  5. where provided for statistics, research, or market research in a form that cannot identify a specific individual.

9. Users’ Rights

  1. Users may exercise the following rights at any time and request them as described below:
  • request access to Personal Information
  • request correction of errors
  • request deletion
  • request suspension of processing
  • opt out of marketing communications

[How to exercise rights]

  1. In-app settings: - My Page > Settings > Notification Settings - My Page > Account Management > Delete Account: request membership withdrawal and deletion of personal information
  2. Email: coko@coko.kr
Requests to access, correct, delete, or suspend the processing of personal information, and requests related to product analytics data processing, may be submitted by email.
  1. The Company will take necessary measures and notify the User of the results within 10 days of receiving the request.
  2. If there are legitimate reasons, the Company may extend the processing period and will inform the User of the reason and the extended period.
  3. Until correction/deletion is completed, the Company will not use or provide the relevant information.

[9.1. Rights regarding AI-based automated processing]

Users may, with respect to results generated or recommended by AI in the Service:

  • request an explanation of such results; and
  • raise objections to erroneous or inaccurate results.

The Company will review such requests within a reasonable scope and, if necessary, provide human review or measures.

10. Transfer of Personal Information upon Data Transfer

If the Company transfers Personal Information due to a data transfer or merger, the Company will notify Users 30 days in advance of:

  • the fact of transfer of Personal Information;
  • the name, address, and contact information of the acquirer (data transferee); and
  • procedures if the User does not wish the transfer.

Users may refuse the transfer by withdrawing membership during the notice period.

11. Use of automatic collection tools and product analytics tools, and exercise of rights

The Company may use in-app product analytics tools to secure service stability, analyze errors, improve features, and analyze learning flows.

  1. Purpose of use
  • Service usage statistics and funnel analysis
  • Analysis of learning flows, such as learning started, completed, or dropped off
  • Identification of errors and performance issues
  • Improvement of UI/UX and content quality
  • Prevention of improper use and securing service stability
  1. Information collected
  • App events, screen views, button clicks, and session information
  • App version, OS version, device information, and language and country settings
  • Internal user identifier and device identifier
  1. Information not collected
  • Email address, name, nickname, and social login token
  • Personal information entered by the user while solving questions
  • Cross-app or cross-website tracking information using advertising identifiers
  1. User rights
  • Users may contact the personal information protection officer by email or request suspension of processing in relation to product analytics data.
  • The Company will review the request in accordance with applicable laws and guide the user on the necessary measures.
  • Product analytics data is used for statistical and analytical purposes to operate and improve the service, and is not used for cross-app or cross-website tracking for advertising purposes.
  1. How to refuse:
  • iOS: Settings → Privacy & Security → Tracking → Turn off “Allow Apps to Request to Track”
  • Android: Settings → Google → Ads → “Opt out of Ads Personalization” or “Reset advertising ID”

However, refusal of cookies may restrict use of certain Service features.

12. Measures to Protect Personal Information

To prevent loss, theft, leakage, forgery, alteration, or damage of Personal Information, the Company implements the following measures:

  • establishing and operating internal management plans
  • access control and limiting privileges
  • retaining access records and preventing tampering
  • installing/managing security programs
  • encrypted storage and transmission of Personal Information
  • appointing minimal number of Personal Information handlers and conducting regular training

13. GDPR Compliance

  1. Scope
  • The Company complies with the EU General Data Protection Regulation (GDPR) for Users residing in the European Union (EU) and the European Economic Area (EEA).
  1. Legal bases for processing
  • The Company processes Personal Information based on:
    • consent of the data subject
    • conclusion and performance of a contract
    • compliance with legal obligations
    • protection of vital interests of the data subject or others
    • responding to fraud/misuse/security risks
    • the Company’s legitimate interests (preventing fraudulent use, strengthening security, etc.), provided that such interests do not override the data subject’s rights
  1. User rights under GDPR: access, rectification, erasure, restriction of processing, data portability, objection, refusal of automated decision-making
  2. How to exercise rights
  • Users may request via the methods specified in Section 9 or by contacting the Personal Information Protection Officer.
  • The Company will process and notify the result within one (1) month of receiving the request.

14. Overseas Transfer

  1. Notice of transfer
  • The Company is headquartered in the Republic of Korea, and Personal Information may be transferred to and processed in Korea and the countries specified in Section 6 for Service provision.
  • Personal Information transferred overseas may be used for Service provision purposes including cloud-based infrastructure operation and processing/generation/analysis of AI models.
  • The Company may transfer and process product analytics data through Mixpanel, Inc. for product usage analytics.
Recipient Country Transferred items Purpose of transfer Retention and use period Timing and method of transfer
Mixpanel, Inc. United States App events, screen navigation and button click information, app/OS/device information, language and country settings, internal user identifier, and device identifier Product usage analytics, funnel and retention analysis, error analysis, and usability improvement Until membership withdrawal, until the analytics purpose is achieved, or until termination of the outsourcing agreement Transferred through an encrypted communication network when the service is used
  1. Safeguards
  • Processors hold international security certifications such as ISO 27001 and SOC 2.
  • For EU User data, the Company complies with Standard Contractual Clauses (SCC) under GDPR Article 46 or adequacy decisions.
  • If additional overseas transfers occur, the Company will provide prior notice and obtain consent.
  1. Users’ rights
  • If a User does not consent to overseas transfer, the User may stop using the Service and request withdrawal.

15. Personal Information Protection Officer

For inquiries, complaints, or requests for remedies regarding Personal Information processing, please contact:

The Company also establishes and operates an internal accountability system for operation and outcome management of AI systems to ensure stability and trust in AI-based processing.

AI-related inquiries or issue reports may be submitted to the Personal Information Protection Officer, and the Company will coordinate with relevant departments to handle them.

  • Company: CoKoRoad Corp. (Representative: Cho Dohee)
  • Address: 3F, Seoul Forest Biz Foret, 6 Wangsimni-ro 10-gil, Seongdong-gu, Seoul, Republic of Korea
  • Email: chodohee@coko.kr

The Company will respond promptly and sincerely to Users’ inquiries.

16. Remedies for Rights Infringement

Users may seek assistance from the following organizations to remedy Personal Information infringement:

  1. Personal Information Infringement Report Center
  • Operated by: Korea Internet & Security Agency (KISA)
  • Tel: 118 (no area code)
  • Website: privacy.kisa.or.kr
  1. Personal Information Dispute Mediation Committee
  1. Supreme Prosecutors’ Office Cyber Crime Investigation Division
  1. National Police Agency Cyber Bureau

Addendum

  1. Effective Date

This Privacy Policy takes effect on June 25, 2026. 2. Previous Policy

The previous Privacy Policy remains in effect until the day before the effective date of this Policy.

Last Updated: June 25, 2026