KoKoPang Privacy Policy
KoKoPang Privacy Policy
Effective date: September 7, 2026
Correction and service improvement notice, September 7, 2026: this revision clarifies existing social-account linking and inquiry processing, and permits video viewing without optional analytics consent. It introduces no new payment obligation or refund restriction.
KoKoPang Co., Ltd. (the “Company”) provides the following information about the personal information processed through the KoKoPang service and users’ rights in accordance with the Personal Information Protection Act (개인정보 보호법).
1. Purposes, Items, and Retention Periods
| Category | Purpose | Items Processed | Retention Period |
|---|---|---|---|
| Registration and authentication | User identification, sign-in, and account and consent management | Username, password hash, name or nickname, email address, mobile phone number, membership type, authentication and consent records, and registration and sign-in timestamps. When social sign-in is used: provider, user identifier, authentication token, and information the user has agreed to provide | Until membership withdrawal. The recovery grace period after withdrawal is up to 30 days, and incomplete authentication records are deleted within 30 days |
| Organizations, students, and learning services | Organization contracts, role and affiliation management, and provision of content, assignments, assessments, and reports | Organization name, branch and class, role, identifying information of staff, teachers, instructors, and students, approval and assignment history, content use, progress, attendance, answers and scores, assignments, tracing activities, teacher feedback, points, and learning reports | Until membership withdrawal, termination of the organization contract, or completion of the organization’s lawful instruction to return, transfer, or delete the information |
| Pronunciation assessment | Speech recognition, pronunciation and fluency analysis, and provision of learning results | Recorded voice, target sentence, content identifier, processing status, transcription, pronunciation and fluency scores, and error analysis | Original recordings are processed in the Company’s local server environment and deleted within 2–7 days depending on processing status. Derived learning records, such as text and scores, are retained until membership withdrawal or termination of the organization contract or completion of a deletion instruction |
| Payments, orders, and delivery | Payments and subscriptions, settlement, cancellations and refunds, delivery and returns of learning materials | Order number, product, term, amount, payment method type, approval and cancellation status, masked payment information, and the names, contact details, address, and delivery requests of the purchaser and recipient | Records of contracts and withdrawal of offers, payments, and supply of goods: 5 years |
| Customer support | Responding to inquiries and handling complaints, objections, and disputes | Account and name, email address and phone number, inquiry and response content, and attachments | General inquiries: until the purpose is fulfilled; consumer complaints and dispute records: 3 years |
| Notices and marketing | Essential authentication, transaction, and security notices, and advertising messages to users who have consented | Email address, mobile phone number, push token, platform, delivery result, and records of consent to and withdrawal from receipt | Until the delivery purpose is fulfilled or consent is withdrawn or membership is terminated. Consent evidence is retained for the period necessary to respond to disputes |
| Optional usage analytics | Improving service usability and quality | Pseudonymous or internal user identifier, screen and feature usage events, referral source, event timestamp, and device and browser information | For 90 days from collection when the user has opted in. After withdrawal, no new events are stored and pending transmission data is deleted |
| Security and abuse prevention | Session maintenance, incident and intrusion response, and prevention of account theft, abnormal transactions, and free-trial abuse | IP address, access timestamp, device, operating system, browser and app version, authentication, error and security events, and minimal hashed identifiers | General web-access and video-security records: up to 90 days. Statutory communications-confirmation records follow the legal period below. Minimal hashes preventing withdrawal and re-registration abuse: up to 1 year after withdrawal |
| Existing administrator and staff operational audits | System security and verification of operational changes | Operator account and role, time, action and target identifiers, IP or IP hash, and minimal change details | 1 year; the statutory 2-year period applies if its qualifying conditions become applicable |
| Operational permission history | Verification of staff permission grants, changes, and revocations | Operator and target account, changes, and time | 3 years |
The Company processes the above information to perform a contract with a member or organization, based on the user’s consent, to comply with a legal obligation, or for the legitimate interest necessary to secure the service. A user may use the core learning service without providing optional information, but the relevant optional feature may be unavailable.
New registration through a social provider is available only to individual members (B2C). An existing B2C or B2B member may first sign in with the fixed ID and password and, after any required first-sign-in procedure, link or unlink Kakao, Google, Apple, or Naver in My Page only after current-password reauthentication and express consent. The Company stores the exact provider and subject identifier; a provider email is never used for automatic sign-in, automatic linking, or account merging. Institutional and Student Account recovery and recall remain separate from social email.
A new user using Kakao Sync Simple Signup must give each required agreement to the Terms of Service and Privacy Policy on the Kakao Simple Signup screen. Only after confirming both agreements, a valid and verified email address, and that the Kakao identifier is new and not linked to an existing account, the Company creates an individual-member (B2C) account without a separate registration form and records the effective version, language, and time of each document agreed to. A one-time registration ticket is valid for up to 15 minutes, and the Company does not store Kakao access tokens or refresh tokens. When the link is disconnected or membership is withdrawn, the Company immediately requests that the Kakao link be disconnected. Only a recovery matching value for which the user has separately consented may be retained for up to 30 days.
The Company does not directly store full card numbers, card passwords, or CVCs. Original recordings for pronunciation assessment are not transmitted to an external voice AI service.
2. Children of Individual Members and Student Information Managed by Organizations
For an individual membership (B2C), an adult parent or legal representative registers as the account holder and manages the contract, payments, settings, and membership withdrawal. A child does not register directly. The Company processes the child’s voice, answers, progress, and assessment results only to the extent necessary to provide the learning service requested by the account holder.
Student accounts for organizations (B2B) are issued and managed by a school, academy, or other organization under applicable law and its contract. When the organization determines the purposes and means of processing student information, the organization is the personal information controller and the Company is a processor that follows the organization’s lawful instructions. The organization is responsible for notices to students and legal representatives, obtaining any required consent, managing permissions, and recovering accounts when the contract ends.
Where consent is required to process the personal information of a child under 14, the Company or organization verifies the consent of the child’s legal representative. The legal representative may request access to, correction or deletion of, or suspension of processing of the child’s personal information.
3. Provision to Third Parties
The Company processes personal information within the purposes stated in Section 1 and does not provide it to a third party unless the user has separately consented or a law specifically permits the provision. When third-party provision is required, the Company gives advance notice of the recipient, purpose, items, retention period, and the consequences of refusing consent.
4. Domestic Processing Contractors
| Contractor | Contracted Service | Information Processed | Retention Period |
|---|---|---|---|
| Toss Payments Co., Ltd. | Web and recurring payments, cancellations, and refunds | Order and customer identifiers, product and amount, purchaser contact information, payment method, and approval result | As required by applicable law and the payment service’s retention policy |
| Alim People Co., Ltd. (Aligo) | SMS and AlimTalk delivery | Recipient phone number, sender information, message content, and delivery result | Until the delivery purpose is fulfilled or as required by applicable law and the contractor’s policy |
| Kakao Corp. (Daum Mail) | Sending and receiving authentication, notice, and customer support emails | Sender and recipient email addresses, subject, body, attachments, and transmission information | Until the email purpose is fulfilled or in accordance with the Company mailbox and contractor policies |
| ECOUNT Co., Ltd. (ECOUNT ERP) | Order, product, payment, delivery, and settlement management | Order, product, amount, purchase, delivery, and settlement information necessary for the service | Until the transaction purpose is fulfilled and for the retention periods required under e-commerce and tax laws |
The Company specifies restrictions on processing beyond the contracted purpose, security measures, and restrictions on subcontracting in its processing agreements and oversees its contractors. Changes to a contractor or contracted service will be disclosed in this Policy.
When Kakao OAuth/OIDC is selected, the Company exchanges the Kakao service user number, valid and verified primary email address, and authentication and linking status with Kakao Corp. New Kakao registration creates only a B2C account; sign-in, linking, and unlinking are also processed for an existing B2C or B2B member after express linking. The Company does not receive a name, profile photo, or phone number, and Kakao account information is processed separately under Kakao’s Privacy Policy.
When Naver sign-in is selected, we exchange the provider user identifier, authentication and linking status, and the email, name or nickname, and profile-image URL the user has agreed to share with NAVER Corporation. Email verification is handled separately; matching email addresses alone never link accounts automatically. Authentication tokens are used only for sign-in and unlinking. Account-linking information is processed until unlinking, withdrawal, or completion of its processing purpose. Information in the Naver account itself is governed by Naver’s privacy policy.
5. Overseas Transfer of Personal Information
The Company transfers personal information overseas when providing the functions below. Each provider name links to that provider’s privacy inquiry and policy page.
| Recipient and Country | Items and Purpose | Timing and Method | Retention Period | Legal Basis and Consequences of Refusal |
|---|---|---|---|---|
| Google LLC (global processing facilities, including the United States) |
Google OAuth and Firebase Authentication: user identifier, authentication token, and email, name, and profile the user has agreed to provide, for sign-in and account linking reCAPTCHA: IP address and device, browser, and interaction information, to prevent automated attacks Firebase Cloud Messaging: push token, platform, notification content, and result, to send push notifications Google Translate and YouTube: text selected for translation or, when a video is played, IP address, device and browser information, and playback information, to provide the relevant function |
Transmitted over an encrypted network when the user uses the relevant sign-in, security, push, translation, or video function | Until the account is unlinked, the token expires or is revoked, or the purpose of providing the function is fulfilled, and thereafter according to Google’s policy for each service | Consent under Article 28-8(1)1 of the Personal Information Protection Act (개인정보 보호법), or processing outsourcing necessary for conclusion or performance of a contract under Article 28-8(1)3. Refusal of an optional transfer restricts the relevant sign-in, push, translation, or video function; refusal of the security processing prevents completion of the protected authentication request |
| Apple Inc. (global processing facilities, including the United States) |
Apple user identifier, authentication token, and email and name the user has chosen to share, for Sign in with Apple and account linking | Transmitted over an encrypted network when the user selects Apple sign-in | Until account unlinking or membership withdrawal, and thereafter according to Apple’s policy for each service | Consent under Article 28-8(1)1. Refusal restricts only Apple sign-in, and another available sign-in method may be used |
| 650 Industries, Inc. (Expo) (United States) |
Push token, platform, notification content, and result, to relay app push notifications | Transmitted over an encrypted network during push registration and delivery | Push token: until expiration, withdrawal, or membership withdrawal; notification: for the period necessary to deliver it and thereafter according to Expo’s policy | Consent under Article 28-8(1)1. Refusal restricts only Expo app push notifications |
| OpenMeteo GmbH (Switzerland) |
Coordinates or regional search terms selected by the user, to provide weather information | Transmitted over an encrypted connection through the Company’s server when the weather function is used | Provider web-server logs: up to 90 days. The Company does not store coordinates or regional values in its database | Consent under Article 28-8(1)1. Refusal restricts only the weather function |
| OpenStreetMap Foundation (United Kingdom and Netherlands, with backups in the EU) |
Coordinates or regional search terms, to convert an address | Transmitted over an encrypted connection through the Company’s server when the address-conversion function is used | Detailed usage information: up to 180 days. The Company does not store coordinates or regional values in its database | Consent under Article 28-8(1)1. Refusal restricts only the address-conversion function |
6. Cookies, Automatic Collection, and Optional Consent
The Company uses cookies or local-storage technology necessary for sign-in maintenance, security, and user settings. Blocking essential cookies may prevent certain functions, including sign-in, from operating.
Usage analytics are conducted only with separate optional consent, and analytics information is deleted within 90 days. External video, translation, weather and address conversion, and push functions also transfer necessary information to the relevant provider only when selected by the user.
Users may withdraw optional consent for analytics, marketing, push notifications, and similar processing at any time through the analytics consent setting at the bottom of this Privacy Policy and the service’s notification settings. Users may also block or delete cookies in their browser’s privacy settings and change app permissions, including notifications, in their device settings.
Sample videos can be watched without optional analytics consent. Separately allowing video analytics permits retention of a pseudonymous visitor identifier, video or playlist identifier, view and playback times, and language for 90 days. Raw IP addresses, browser details, and referring URLs are not stored in analytics records. Necessary security records, such as failed codes, blocks, and downloads, are separate: IP hash, target, time, and result are kept for up to 90 days. The analytics settings below the video allow changes at any time. Withdrawal stops new analytics collection and removes the browser’s analytics identifier.
7. Destruction and Statutory Retention
The Company deletes personal information without delay when its processing purpose has been fulfilled or its retention period has expired. Electronic files are deleted using a method that makes recovery difficult, and paper documents are shredded or incinerated. Information retained under law is separated from general service information and used only for the relevant legal purpose during the periods below.
| Record | Legal Basis | Period |
|---|---|---|
| Contracts or withdrawal of offers | Act on Consumer Protection in Electronic Commerce (전자상거래 등에서의 소비자보호에 관한 법률) | 5 years |
| Payments and supply of goods or services | Act on Consumer Protection in Electronic Commerce (전자상거래 등에서의 소비자보호에 관한 법률) | 5 years |
| Consumer complaints or dispute resolution | Act on Consumer Protection in Electronic Commerce (전자상거래 등에서의 소비자보호에 관한 법률) | 3 years |
| Labels and advertisements | Act on Consumer Protection in Electronic Commerce (전자상거래 등에서의 소비자보호에 관한 법률) | 6 months |
| Access records constituting communications confirmation data | Protection of Communications Secrets Act (통신비밀보호법) | 3 months |
8. Rights of Users and Legal Representatives
Under applicable law, users may request access to or transfer of their personal information, correction or deletion, suspension of processing, withdrawal of consent, and membership withdrawal. A parent or legal representative who is the account holder of an individual membership may exercise the same rights with respect to learning information of a child under their protection and supervision.
These rights may be exercised through the privacy settings in My Page, Customer Support, by email at info@kokopang.com, or by phone at 0507-1367-0581. After verifying the identity or authority of the requester or representative, the Company handles the request without delay and explains any restriction required by law.
A request concerning student information managed by an organization may be handled first by that organization, and the Company assists as its processor. The Company directly handles account-security and payment information that it processes independently.
9. Security Measures and Responsible Department
The Company operates one-way password hashing, encryption in transit, least-privilege access by role and affiliation, review of existing operational audit records, security updates, short retention and automatic deletion of original voice recordings, contractor oversight, and incident-response procedures.
| Personal information controller | KoKoPang Co., Ltd. (Representative: Kim Dae-hyeon) |
|---|---|
| Responsible department | Privacy Protection and Customer Support |
| info@kokopang.com | |
| Phone | 0507-1367-0581 |
| Address | Room 1024, Bupyeong Tech City, 293 Bupyeong-daero, Bupyeong-gu, Incheon, Republic of Korea |
For consultation regarding a personal-information infringement, exercise of rights, or dispute mediation, please contact the responsible department above.
10. Changes to This Policy
If applicable law or the Company’s processing of personal information changes, the Company will provide reasonable notice of the changes and their effective date through a service notice or similar means. The Company will give notice and obtain consent before a user uses any new optional processing or overseas transfer that requires separate consent.