This document is a draft pending legal review. Final wording will be confirmed after review under Korea's Personal Information Protection Act and Act on Promotion of Information and Communications Network Utilization; until then, it is provided for reference only.
HanaEnglish Privacy Policy
FIRST FLUKE (hereinafter the "Company") establishes and discloses the following Privacy Policy pursuant to Article 30 of the Personal Information Protection Act (개인정보 보호법) in order to protect the personal information of data subjects and to handle related grievances promptly and smoothly.
- Effective date: (to be confirmed after legal review)
- Last amended: September 3, 2026 (draft)
Article 1 (Purposes of Processing Personal Information)
The Company processes personal information for the following purposes. The personal information processed will not be used for any purpose other than those set out below, and where the purpose of use is changed, the Company will take necessary measures, such as obtaining separate consent pursuant to Article 18 of the Personal Information Protection Act.
- Membership registration and management: Confirming intent to register, identifying and authenticating the individual, distinguishing the student and teacher roles, maintaining and managing membership status, and preventing fraudulent use of the service
- Service provision: Booking, assignment, and delivery of 1:1 live video English classes; provision of PTE (Pearson Test of English) learning content, on-device speaking scoring, dictation, and review scheduling; management of learning records, attendance, and feedback; issuance of certificates
- Paid subscription billing: Processing subscription payments (Free, Pro Monthly, Exam Pass), managing payment records, and handling refunds
- Marketing communications: Sending service updates and promotions by email or push notification, only where the user has given separate consent
- AI model improvement: Collecting and analyzing voice samples to improve the accuracy of the on-device speaking-scoring model, only where the user has given separate consent
- Customer support: Receiving and handling inquiries, reviewing scoring disputes, and delivering notices and service change announcements
- Service improvement: Analyzing usage statistics, developing new features, and improving service quality
- Compliance with legal obligations: Retaining electronic commerce records and fulfilling other obligations prescribed by applicable law
Article 2 (Categories of Personal Information Processed)
The Company processes the following categories of personal information.
Mandatory items
- Email address — Member identification, sign-in, and delivery of notices
- Password — Authentication (stored using one-way encryption; the Company does not retain plaintext passwords)
- Name (display name) and role (student/teacher) — Class assignment and identification of learning records
- Payment and subscription information (subscription status, payment identifiers) — Paid subscription billing and settlement. Payment instrument details such as card numbers are held by the payment gateway and are not stored by the Company
Items processed only for student members
- Level, goals, and learning records (attendance, progress, PTE practice results, review schedule, XP and league participation) — Providing personalized learning and progress tracking
- Live class attendance records (class date/time, attendance, assigned teacher) — Class operations
Items processed only for teacher members
- Qualification and experience information, and video-meeting account connection information (Microsoft Teams or Zoom account identifier) — Class assignment and delivery of live classes
- Settlement-related information (class delivery records) — Instructor payout settlement
Sensitive-nature items processed only with consent
- Voice data: Audio recorded during speaking practice is, in principle, scored entirely on the user's device (in the browser) and is never transmitted to the server. It is transmitted to and stored on the server only in the following two cases, and only where the user has given explicit, per-instance consent:
- Scoring dispute: The user selects and submits a specific recording clip while disputing a scoring result
- AI model-improvement participation: A quality-filtered sample is collected from an account whose "AI model improvement" consent is active (given with registration under the Terms of Service and revocable at any time in the settings menu, regardless of plan)
- Voice data collected through the two paths above is processed only within the scope of scoring-accuracy verification and model improvement; the Company does not use it for any other purpose such as advertising.
The Company processes the above items on the basis of Article 15(1)(4) of the Personal Information Protection Act (performance of a contract) and consent (Article 15(1)(1)), and discloses the purpose and items and obtains separate consent at registration and at the time each consent item is collected.
Automatically collected items
IP address, cookies, service usage records, access logs, device information, and the device's speech-scoring processing capability (used to determine the model tier) may be generated and collected automatically in the course of using the service.
Children under the age of 14
The Company does not accept membership registration from children under the age of 14 and confirms at registration that the member is at least 14 years old (or that a legal guardian has consented). Detailed procedures will be confirmed after legal review.
Article 3 (Processing and Retention Periods)
The Company processes and retains personal information within the retention and use period prescribed by law or consented to by the data subject.
| Processing activity | Retention period | Basis |
|---|---|---|
| Membership registration and management | Until withdrawal of membership or of consent | Consent of the data subject |
| Records on contracts and withdrawal of subscription | 5 years | Act on Consumer Protection in Electronic Commerce |
| Records on payment and supply of goods | 5 years | Act on Consumer Protection in Electronic Commerce |
| Records on consumer complaints or dispute resolution | 3 years | Act on Consumer Protection in Electronic Commerce |
| Service access logs | 3 months | Protection of Communications Secrets Act |
| Learning records (progress, PTE practice results, attendance) | Until withdrawal of membership | Service provision (record and evidence of results) |
| Scoring-dispute voice clips | A separate policy period after the dispute is resolved (to be confirmed after legal review) | Achievement of the dispute-handling purpose |
| AI model-improvement voice samples | Until consent is withdrawn, or a separate policy period after training is complete (to be confirmed after legal review) | Consent of the data subject |
| Video-meeting account connection tokens (teachers) | Destroyed immediately upon disconnection or withdrawal | Consent of the data subject |
Article 4 (Provision of Personal Information to Third Parties)
The Company processes personal information only within the scope specified in Article 1 and provides personal information to third parties only where Articles 17 and 18 of the Personal Information Protection Act apply, such as with the consent of the data subject or under specific provisions of law. The Company currently does not provide personal information to third parties.
Where a teacher connects a Microsoft Teams or Zoom account to deliver a live class, the Company uses that connection only within the scope necessary to assign the class and confirm attendance.
Article 5 (Entrustment of Processing and Overseas Transfers)
The Company's service infrastructure and database are located in a region within the Republic of Korea (Microsoft Azure Korea Central). To provide the service smoothly, however, the Company entrusts part of its personal information processing to overseas providers, and discloses those overseas transfers pursuant to Article 28-8 of the Personal Information Protection Act as follows.
| Entrusted party | Entrusted work | Destination country | Method of transfer | Retention and use period |
|---|---|---|---|---|
| The Company's designated payment gateway (PG) | Processing paid subscription payments and holding payment instruments | (to be confirmed after legal review) | Transmission over an information and communications network | Until termination of the entrustment agreement or the retention period required by law |
| Microsoft Corporation (Teams) / Zoom Video Communications, Inc. | Video-meeting connection for delivering live classes | United States and each provider's service regions | Transmission over an information and communications network | Until termination of the connection agreement or achievement of the processing purpose |
| Cloudflare, Inc. | Web delivery, CDN, and security | United States and global edge regions | Transmission over an information and communications network | Until termination of the entrustment agreement or achievement of the processing purpose |
Voice data collected under the scoring-dispute and AI model-improvement consents is, in principle, processed on the Company's domestic infrastructure. If overseas infrastructure comes to be used for model training, the Company will amend and disclose this Privacy Policy in advance.
When entering into an entrustment agreement, the Company specifies in writing the prohibition of processing personal information beyond the purpose of the entrusted work, technical and administrative safeguards, restrictions on sub-entrustment, supervision of the entrusted party, and liability including damages, pursuant to Article 26 of the Personal Information Protection Act, and supervises whether the entrusted party processes personal information safely.
Article 6 (Procedures and Methods for Destroying Personal Information)
The Company destroys personal information without delay once it becomes unnecessary, such as upon expiry of the retention period or achievement of the processing purpose. Personal information for which grounds for destruction have arisen is destroyed with the approval of the Chief Privacy Officer; information in electronic file form is permanently deleted by a method that makes recovery and reproduction impossible. Video-meeting account connection tokens are destroyed immediately upon disconnection or withdrawal. Where personal information must be retained under applicable law, it is moved to a separate database or stored in a different location.
Article 7 (Rights and Obligations of Data Subjects and How to Exercise Them)
Data subjects may exercise their rights to access, correct, delete, suspend the processing of, and request the transmission of their personal information at any time. Such rights may be exercised in writing, by email, and by other means pursuant to Article 41(1) of the Enforcement Decree of the Personal Information Protection Act, and the Company will act on such requests without delay.
How to exercise
- Email: hello@firstfluke.com
- Post: 25 Jowon-ro, Gwanak-gu, Seoul, Republic of Korea
- The account settings menu within the service (you can withdraw your membership, export your data, and manage consents directly)
Account deletion and data export
Users may, at any time in the account settings menu, download an export of their own learning and class records, and may request account deletion. Upon deletion, the Company destroys personal information without delay, except for information the Company must retain under applicable law.
Right to request transmission of personal information
Data subjects may request that their personal information be transmitted to another personal information controller, and the Company will process legitimate requests within the period prescribed by applicable law.
Article 8 (Installation, Operation, and Refusal of Automatic Collection Devices)
The Company uses cookies and equivalent browser storage to provide the service and to maintain sign-in state. The Company does not issue a language cookie; the language of the interface is determined solely by the URL.
How to refuse
- Chrome: Settings > Privacy and security > Cookies and other site data
- Safari: Preferences > Privacy > Manage Website Data
- Edge: Settings > Cookies and site permissions > Manage cookies and site data
- Firefox: Settings > Privacy & Security > Cookies and Site Data
Refusing cookie storage may restrict the use of services that require signing in.
Article 9 (Special Provisions on Voice Data Processing)
① Principle: on-device scoring. Audio recorded during speaking practice is scored entirely on the user's device (in the browser) and is not transmitted to or stored on the server for scoring purposes.
② Exception 1 — scoring dispute. Only where the user disputes a scoring result and directly selects and submits a specific recording clip is that clip transmitted to the server, and only for the purpose of reviewing the dispute.
③ Exception 2 — AI model improvement (consent). To improve the accuracy of the on-device scoring model, the Company may, with the user's consent, receive a limited number of voice samples on the server, quality-filter them, and use them to improve the model. This consent is given with registration under the Terms of Service and may be withdrawn at any time in the settings menu, regardless of plan. Withdrawing consent does not retroactively undo training results already incorporated into the model, but the Company will immediately stop collecting new samples after withdrawal.
④ Other than the two paths above, the user's voice is never transmitted to the Company's servers. Neither the Company nor its entrusted parties use voice data for any purpose other than scoring and model improvement, such as advertising or behavioral profiling.
Article 10 (Measures to Secure the Safety of Personal Information)
The Company takes the following measures to secure the safety of personal information. Administratively, it establishes and implements an internal management plan, minimizes the number of employees who handle personal information, and conducts regular inspections. Technically, it manages access privileges to the personal information processing system on a role basis, retains access records, applies one-way encryption to passwords, stores video-meeting connection tokens in encrypted form, and encrypts data in transit (HTTPS/TLS). Physically, access to the systems where data is stored is controlled.
Article 11 (Chief Privacy Officer and Department for Access Requests)
The Company designates a Chief Privacy Officer as set out below to take overall responsibility for personal information processing and to handle complaints and provide remedies for data subjects in relation to personal information processing. Data subjects may direct requests to exercise rights, such as access to personal information, to the contact below.
Chief Privacy Officer
- Name: Kim Gahyun
- Title: Chief Executive Officer (Chief Privacy Officer)
- Email: hello@firstfluke.com
Article 12 (Remedies for Infringement of Rights)
Data subjects may apply to the following bodies for dispute resolution or consultation in order to obtain relief from personal information infringement.
- Personal Information Dispute Mediation Committee: 1833-6972 (www.kopico.go.kr)
- Privacy Infringement Report Center: 118 (privacy.kisa.or.kr)
- Cybercrime Investigation Division, Supreme Prosecutors' Office: 1301 (www.spo.go.kr)
- National Police Agency Cyber Investigation Bureau: 182 (ecrm.police.go.kr)
Article 13 (Changes to This Privacy Policy)
This Privacy Policy applies from its effective date. Where there are additions, deletions, or corrections arising from changes in law or policy, the Company will give notice through announcements within the service from seven days before the changes take effect.