FLOJU (the “Company”) complies with applicable law, including the Personal Information Protection Act, and establishes and publishes this Privacy Policy to protect individuals’ personal information and rights. It applies to “Dapulo” (the “Service”), the Company’s focus management and AI-assisted learning and wrong-answer management service.
1. Personal information collected and collection methods
A. Information collected
- Registration and social login: email address, nickname (display name), profile image, and identifiers from social login providers (Kakao or Google).
- Learning materials uploaded during use, including examination papers, workbook images and PDFs, and resulting wrong-answer, solution and review data.
- If notification receipt is consented to: web push subscription tokens.
- Inquiries and feedback: submitted content and information entered by the submitter.
- Automatically collected information: usage records, access logs, device and browser information, IP addresses, usage analytics through cookies and similar technologies, and screen navigation, clicks, error situations and session replay information for Service improvement.
B. Collection methods
- Social login and information entered directly during registration and use.
- Materials uploaded by users.
- Information automatically generated or collected during use, including logs, cookies and analytics tools.
2. Purposes of processing
- Providing the Service, including member identification, identity confirmation, login and authentication.
- OCR of uploaded materials and AI-assisted wrong-answer analysis, solutions and review material generation.
- Operating and improving the Service and developing new services.
- Usability analysis and quality improvement. Sensitive screen areas, including uploaded learning materials, question images and wrong-answer crops, are masked in session replays.
- Responding to inquiries and delivering announcements and notifications.
- Detecting abnormal or unauthorized use and strengthening security.
- Meeting legal obligations.
3. Retention periods
In principle, the Company destroys personal information without delay once the purpose of collection and use has been fulfilled. Exceptions are retained for the periods below.
Scroll horizontally to read all columns.
| Information | Retention period |
|---|---|
| Member account information (email, nickname, etc.) | Until account closure; destroyed without delay after closure. |
| Uploaded original learning materials (images and PDFs) | Until account closure or a user’s deletion request. |
| Learning data, including wrong answers, solutions and review materials | Until account closure or a user’s deletion request. |
| Access records for security and error response | Proposed operating standard: up to 90 days from collection. To be finalized after actual retention and deletion settings are verified. |
| Usage analytics records for feature improvement | Proposed operating standard: up to 90 days from collection. To be finalized after actual retention and deletion settings are verified. |
| Session replay records | Proposed operating standard: up to 30 days from collection. To be finalized after actual retention and deletion settings are verified. |
| Information subject to statutory retention | For the periods required by applicable law, including electronic commerce law: for example, 5 years for contracts and purchase withdrawal records, and 3 years for consumer complaint and dispute handling records. |
Saved questions, PDFs, notes and learning records are not reset solely because the beta ends and are retained for continued use with the same account in the regular service. Access and analytics retention periods are separate from those for saved learning materials.
4. Children under 14
The beta is intended for persons aged 14 or older and does not accept registration by children under 14. Users confirm that they are at least 14 during registration or login. The beta does not collect legal guardian information for child registration. If collection of personal information from a child under 14 is confirmed, the Company takes necessary action under applicable law, including restricting use and destroying the information. Questions may be directed to the privacy officer.
5. Disclosure to third parties
The Company does not provide personal information to third parties beyond the scope disclosed in this Policy, except where:
- The individual has separately consented in advance; or
- A specific legal provision applies or disclosure is lawfully required, including for an investigation.
6. Processing entrusted to providers
The Company entrusts the following processing activities to providers to deliver the Service.
Scroll horizontally to read all columns.
| Provider | Entrusted activities |
|---|---|
| Google LLC | OCR (Document AI), AI analysis (Vertex AI), and social login. |
| Cloudflare, Inc. | Service hosting; storage and transmission of account and learning data; real-time communications infrastructure. |
| PostHog, Inc. | Usage analytics, click and screen-flow analysis, and quality improvement through session replay. |
| Kakao Corp. | Kakao social login authentication. |
When entering into processing agreements, the Company specifies safeguards for personal information and supervises providers. Changes to entrusted activities or providers are disclosed in this Policy.
7. International transfers
The Company transfers personal information internationally for the following entrusted processing and storage activities needed to provide the Service.
Scroll horizontally to read all columns.
| Recipient | Destination country | Information transferred | Purpose, timing and method |
|---|---|---|---|
| Google LLC | United States and other countries | Uploaded learning materials, account identifiers and usage information. | OCR, AI analysis and cloud processing; transmitted over information and communications networks when the Service is used. |
| Cloudflare, Inc. | United States and other countries | Service usage data and access information. | Hosting, storage and transmission; transmitted over information and communications networks when the Service is used. |
| PostHog, Inc. | United States | Usage records, device and browser information, screen navigation, clicks, error situations and masked session replay information. | Usage analytics and quality improvement; transmitted over information and communications networks when the Service is used. |
Individuals may refuse international transfers, which may restrict use of some Service features. Requests to refuse transfers may be sent to the contact below.
8. Automated AI processing
The Company automatically analyzes uploaded learning materials through AI models to extract wrong answers, generate solutions and explanations, and recommend review materials. This processing supports learning and is not used for decisions with legal effects or similarly significant effects on individuals. AI results may contain errors and must be used for reference.
9. Individual rights and how to exercise them
- Individuals may request access, correction, deletion, restriction of processing or withdrawal of consent at any time.
- Rights may be exercised through the contact below, and the Company will take action without delay.
- Children under 14 may exercise their rights through a legal guardian.
10. Destruction procedures and methods
- Procedure: information whose retention period has expired or purpose has been fulfilled is destroyed under internal procedures and applicable law.
- Method: electronic files are permanently deleted using methods that prevent recovery or reproduction. Printed materials are shredded or incinerated.
11. Security measures
- Administrative measures: establishing and implementing an internal management plan, access permission management and staff training.
- Technical measures: encrypted transmission (SSL/TLS), access controls, access log retention and security software.
- Physical measures: access controls for infrastructure.
12. Cookies and other automatic collection technologies
The Company may use cookies and similar technologies for usage analytics and quality improvement. Users may refuse or delete cookies in their browser settings, which may limit some Service features.
Session replay tools may be used to improve quality. Uploaded learning materials and question images are masked in replays, and input fields are masked by default.
13. Privacy officer
The Company has designated the following privacy officer to oversee personal information processing, handle complaints and provide remedies.
- Privacy officer: Junho Kim (김준호), Representative
- Contact: 010-2199-1662, [email protected]
14. Remedies for privacy infringements
For reporting or advice on privacy infringements, individuals may contact the following Korean authorities. The phone numbers below are domestic numbers dialed without an area code.
- Personal Information Dispute Mediation Committee: 1833-6972 / www.kopico.go.kr
- Personal Information Infringement Report Center: 118 / privacy.kisa.or.kr
- Supreme Prosecutors’ Office, Cyber Investigation Division: 1301 / www.spo.go.kr
- National Police Agency, Cyber Investigation Bureau: 182 / ecrm.police.go.kr
15. Changes to this Policy
This Policy applies from its effective date. Additions, deletions or amendments due to changes in laws, policies or the Service will be announced within the Service at least 7 days before they take effect, or at least 30 days in advance for changes materially affecting users’ rights.