Nowhereto (the ‘Company’) establishes and publishes this Privacy Policy to process personal information lawfully and manage it securely in accordance with applicable laws, including the Personal Information Protection Act of the Republic of Korea.
1. Purposes of processing personal information
The Company processes personal information for the following purposes. Information will not be used for other purposes. If a purpose changes, the Company will take the necessary measures, including obtaining separate consent.
- ① Confirming the intention to register, identifying and authenticating members, and maintaining and managing membership
- ② Storing learning records, including progress, review schedules and wordbooks, and synchronising and backing them up across devices
- ③ Managing Pro subscription status, including activation, maintenance and cancellation
- ④ Responding to customer enquiries and delivering service notices
- ⑤ Analysing de-identified statistics to improve the service
- ⑥ Fulfilling obligations under applicable laws
2. Information collected and collection methods
- ① Email registration: email address and password, stored using one-way encryption
- ② Social sign-in through Google or Kakao: the account’s unique identifier and email address
- ③ Information generated or collected through use: nickname, learning records (progress, review schedules, wordbooks, quiz results, etc.), subscription status, device information (OS type and version, app version and language settings), and service usage records
- ④ Payments: in-app payments are processed by the app marketplace. The Company does not directly collect payment instrument details, such as credit card numbers. It processes only subscription status information, including whether a subscription is active, the product type and its expiration date.
3. Retention periods
- ① Personal information collected is destroyed without delay when a member deletes their account.
- ② The following records are retained for the periods required by applicable law:
- Contracts and withdrawal of purchase: 5 years, under the Act on the Consumer Protection in Electronic Commerce, Etc.
- Payments and the supply of goods or services: 5 years, under the Act on the Consumer Protection in Electronic Commerce, Etc.
- Consumer complaints and dispute handling: 3 years, under the Act on the Consumer Protection in Electronic Commerce, Etc.
- Service access records: 3 months, under the Protection of Communications Secrets Act
4. Disclosure to third parties
The Company processes personal information only within the purposes described in Section 1. It does not disclose information to third parties unless the user separately consents or a specific provision of law permits disclosure.
5. Processing providers and international transfers
The Company entrusts the following providers with processing personal information to operate the service reliably. Where a provider is based overseas, the following information is provided under Article 28-8 of the Personal Information Protection Act.
▸ Supabase, Inc. (United States / data server: Seoul region, Republic of Korea)
- Services: member authentication and database operation for learning records and account information
- Information transferred: email addresses, social account identifiers and learning records
- Timing and method: transmitted over information and communications networks when the service is used
- Retention: until account deletion or termination of the processing agreement
▸ RevenueCat, Inc. (United States)
- Services: subscription status management and in-app purchase receipt verification
- Information transferred: internal member identifiers and subscription/payment event information
- Timing and method: transmitted over information and communications networks when a payment or subscription status changes
- Retention: until the subscription ends and settlement is completed
Users may refuse international transfers of their personal information. Refusal may limit access to all or part of the service, including sign-in, synchronisation and subscriptions. Requests may be sent to the contact in Section 9.
6. Destruction procedures and methods
Personal information is destroyed without delay when its retention period expires or its processing purpose is fulfilled. Electronic records are deleted using technical methods that prevent recovery or reproduction.
7. Rights, obligations and how to exercise them
- ① Users may request access to, correction or deletion of, or suspension of processing of their personal information at any time.
- ② Requests may be made through app features, such as nickname changes or account deletion, or through the contact in Section 9. The Company will act without delay.
- ③ These rights may also be exercised through a legal representative or an authorised agent.
8. Security measures
- ① One-way password encryption and encrypted communications using TLS
- ② Database access controls, including row-level security policies, and minimised access permissions
- ③ Retention of access logs for personal information processing systems
9. Privacy officer
- Business: Nowhereto, a sole proprietorship
- Privacy officer: the business representative
- Contact: ghfaoa21@gmail.com
Users may contact the above address about any privacy enquiry, complaint or request for redress arising from use of the service.
10. Children under 14
The Company does not collect personal information from children under 14. If it becomes aware that a child under 14 has registered, it will promptly delete the account and destroy the personal information.
11. Automatic collection tools
The app does not use web browser cookies. Minimal app usage records may be collected to improve service stability and quality.
12. Reporting privacy infringements
Privacy infringements may be reported to, or discussed with, the following organisations:
- Personal Information Dispute Mediation Committee: 1833-6972 (www.kopico.go.kr)
- Personal Information Infringement Report Center: 118, without an area code (privacy.kisa.or.kr)
- Supreme Prosecutors’ Office: 1301 (www.spo.go.kr)
- Korean National Police Agency: 182 (ecrm.police.go.kr)
13. Changes to this Privacy Policy
Additions, deletions or changes to this Policy will be announced through in-app notices at least 7 days before they take effect, or at least 30 days in advance where a change materially affects users’ rights.