This document is a draft pending legal review. Final wording will be confirmed after review under Korea's Personal Information Protection Act and Act on Promotion of Information and Communications Network Utilization; until then, it is provided for reference only.

HanaEnglish Privacy Policy

FIRST FLUKE (hereinafter the "Company") establishes and discloses the following Privacy Policy pursuant to Article 30 of the Personal Information Protection Act (개인정보 보호법) in order to protect the personal information of data subjects and to handle related grievances promptly and smoothly.

• Effective date: (to be confirmed after legal review)
• Last amended: October 7, 2026 (draft)

Article 1 (Purposes of Processing Personal Information)

The Company processes personal information for the following purposes. The personal information processed will not be used for any purpose other than those set out below, and where the purpose of use is changed, the Company will take necessary measures, such as obtaining separate consent pursuant to Article 18 of the Personal Information Protection Act.

• Membership registration and management: Confirming intent to register, identifying and authenticating the individual, distinguishing the student and teacher roles, maintaining and managing membership status, and preventing fraudulent use of the service
• Service provision: Booking, assignment, and delivery of 1:1 live video English classes; provision of PTE (Pearson Test of English) learning content, on-device speaking scoring, dictation, and review scheduling; management of learning records, attendance, and feedback; issuance of certificates
• Paid subscription billing: Processing subscription payments (Free, Pro Monthly, Exam Pass), managing payment records, and handling refunds
• Marketing communications: Sending service updates and promotions by email or push notification, only where the user has given separate consent
• AI model improvement: Collecting and analyzing voice samples to improve the accuracy of the on-device speaking-scoring model, only where the user has given separate consent
• Customer support: Receiving and handling inquiries, reviewing scoring disputes, and delivering notices and service change announcements
• Service improvement: Analyzing usage statistics, developing new features, and improving service quality
• Compliance with legal obligations: Retaining electronic commerce records and fulfilling other obligations prescribed by applicable law

Article 2 (Categories of Personal Information Processed)

The Company processes the following categories of personal information.

Mandatory items

• Email address — Member identification, sign-in, and delivery of notices
• Password — Authentication (stored using one-way encryption; the Company does not retain plaintext passwords)
• Name (display name) and role (student/teacher) — Class assignment and identification of learning records
• Payment and subscription information (subscription status, payment identifiers) — Paid subscription billing and settlement. Payment instrument details such as card numbers are held by the payment gateway and are not stored by the Company

Items processed only for student members

• Level, goals, and learning records (attendance, progress, PTE practice results, review schedule, XP and league participation) — Providing personalized learning and progress tracking
• Live class attendance records (class date/time, attendance, assigned teacher) — Class operations

Items processed only for teacher members

• Qualification and experience information, and video-meeting account connection information (Google Meet, Microsoft Teams or Zoom account identifier) — Class assignment and delivery of live classes
• Settlement-related information (class delivery records) — Instructor payout settlement

Voice data

• RA and RS speaking practice is scored on the user's device (in the browser). Recordings are uploaded to private server storage for replay. For each user and question, up to 3 distinct recordings are retained: the latest recording and 2 highest-scoring recordings. Excess audio is deleted, while scores, timestamps, and analysis remain in the learning history.
• Separately from replay storage, the following paths depend on the user's submission or AI model-improvement consent:
  • Scoring dispute: The user selects and submits a specific recording clip while disputing a scoring result
  • AI model-improvement participation: A quality-filtered sample is collected from an account whose "AI model improvement" consent is active (given with registration under the Terms of Service and revocable at any time in the settings menu, regardless of plan)
• Storing a recording for replay does not constitute consent to AI model improvement. The Company does not use voice data for other purposes such as advertising.

The Company processes the above items on the basis of Article 15(1)(4) of the Personal Information Protection Act (performance of a contract) and consent (Article 15(1)(1)), and discloses the purpose and items and obtains separate consent at registration and at the time each consent item is collected.

Automatically collected items

IP address, cookies, service usage records, access logs, device information, and the device's speech-scoring processing capability (used to determine the model tier) may be generated and collected automatically in the course of using the service.

Children under the age of 14

The Company does not accept membership registration from children under the age of 14 and confirms at registration that the member is at least 14 years old (or that a legal guardian has consented). Detailed procedures will be confirmed after legal review.

Article 3 (Processing and Retention Periods)

The Company processes and retains personal information within the retention and use period prescribed by law or consented to by the data subject.

Article 4 (Provision of Personal Information to Third Parties)

The Company processes personal information only within the scope specified in Article 1 and provides personal information to third parties only where Articles 17 and 18 of the Personal Information Protection Act apply, such as with the consent of the data subject or under specific provisions of law. Sharing and entrusted processing of Google connection data are described below and in Article 5.

Where a teacher connects a Google Meet, Microsoft Teams or Zoom account to deliver a live class, the Company uses that connection only for class delivery and attendance confirmation where supported by the provider.

Access, Use and Sharing of Google User Data

When a teacher authorizes a Google Meet connection, the Company requests openid, email and https://www.googleapis.com/auth/meetings.space.created. It accesses the Google account identifier, email address and, when available, the Workspace domain used to distinguish account types. It processes OAuth access and refresh tokens and the identifiers, meeting codes and join links of Meet spaces created by HanaEnglish. It does not access Gmail messages, Google Calendar events, Google Drive files, or Meet recordings or transcripts.

This data is used to identify the connected account, create lesson meeting spaces on the teacher's behalf, and let the student and teacher assigned to that lesson join. The recipients and purposes of sharing, transfer and disclosure are as follows.

The Company does not sell Google user data or share, transfer or disclose it for advertising, ad targeting, credit assessment or data brokerage. Data obtained through Google Workspace APIs is not used to develop, improve or train generalized AI or machine-learning models, or provided to third parties for those purposes. The AI model-improvement consent in Articles 1 and 9 does not apply to Google user data.

OAuth tokens and meeting join links are stored encrypted, and data in transit uses HTTPS/TLS. Disconnecting Google stops new API use through that connection. Account and meeting data is retained for the period needed to provide the connection and lessons; deletion requests and account withdrawal are handled under Articles 3, 6 and 7. Users can revoke access in the service's connection settings or Google Account third-party connection settings, or request deletion by emailing hello@firstfluke.com.

HanaEnglish's use and transfer to any other app of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements.

Article 5 (Entrustment of Processing and Overseas Transfers)

The Company's service infrastructure and database are located in a region within the Republic of Korea (Microsoft Azure Korea Central). To provide the service smoothly, however, the Company entrusts part of its personal information processing to overseas providers, and discloses those overseas transfers pursuant to Article 28-8 of the Personal Information Protection Act as follows.

Voice data collected under the scoring-dispute and AI model-improvement consents is, in principle, processed on the Company's domestic infrastructure. If overseas infrastructure comes to be used for model training, the Company will amend and disclose this Privacy Policy in advance.

When entering into an entrustment agreement, the Company specifies in writing the prohibition of processing personal information beyond the purpose of the entrusted work, technical and administrative safeguards, restrictions on sub-entrustment, supervision of the entrusted party, and liability including damages, pursuant to Article 26 of the Personal Information Protection Act, and supervises whether the entrusted party processes personal information safely.

Article 6 (Procedures and Methods for Destroying Personal Information)

The Company destroys personal information without delay once it becomes unnecessary, such as upon expiry of the retention period or achievement of the processing purpose. Personal information for which grounds for destruction have arisen is destroyed with the approval of the Chief Privacy Officer; information in electronic file form is permanently deleted by a method that makes recovery and reproduction impossible. Video-meeting account connection tokens are destroyed immediately upon disconnection or withdrawal. Where personal information must be retained under applicable law, it is moved to a separate database or stored in a different location.

Article 7 (Rights and Obligations of Data Subjects and How to Exercise Them)

Data subjects may exercise their rights to access, correct, delete, suspend the processing of, and request the transmission of their personal information at any time. Such rights may be exercised in writing, by email, and by other means pursuant to Article 41(1) of the Enforcement Decree of the Personal Information Protection Act, and the Company will act on such requests without delay.

How to exercise

• Email: hello@firstfluke.com
• Post: 25 Jowon-ro, Gwanak-gu, Seoul, Republic of Korea
• The account settings menu within the service (you can withdraw your membership, export your data, and manage consents directly)

Account deletion and data export

Users may, at any time in the account settings menu, download an export of their own learning and class records, and may request account deletion. Upon deletion, the Company destroys personal information without delay, except for information the Company must retain under applicable law.

Right to request transmission of personal information

Data subjects may request that their personal information be transmitted to another personal information controller, and the Company will process legitimate requests within the period prescribed by applicable law.

Article 8 (Installation, Operation, and Refusal of Automatic Collection Devices)

The Company uses cookies and equivalent browser storage to provide the service and to maintain sign-in state. The Company does not issue a language cookie; the language of the interface is determined solely by the URL.

How to refuse

• Chrome: Settings > Privacy and security > Cookies and other site data
• Safari: Preferences > Privacy > Manage Website Data
• Edge: Settings > Cookies and site permissions > Manage cookies and site data
• Firefox: Settings > Privacy & Security > Cookies and Site Data

Refusing cookie storage may restrict the use of services that require signing in.

Article 9 (Special Provisions on Voice Data Processing)

① Principle: on-device scoring. Audio recorded during speaking practice is scored entirely on the user's device (in the browser) and is not transmitted to or stored on the server for scoring purposes.

② Exception 1 — scoring dispute. Only where the user disputes a scoring result and directly selects and submits a specific recording clip is that clip transmitted to the server, and only for the purpose of reviewing the dispute.

③ Exception 2 — AI model improvement (consent). To improve the accuracy of the on-device scoring model, the Company may, with the user's consent, receive a limited number of voice samples on the server, quality-filter them, and use them to improve the model. This consent is given with registration under the Terms of Service and may be withdrawn at any time in the settings menu, regardless of plan. Withdrawing consent does not retroactively undo training results already incorporated into the model, but the Company will immediately stop collecting new samples after withdrawal.

④ Replay storage. RA and RS recordings are kept in private storage for replay. For each user and question, the latest recording is retained first, followed by 2 highest-scoring recordings from the remainder. If too few recordings have scores, newer recordings fill the remaining slots, up to 3 in total. Excess audio is deleted after the new recording has been saved successfully. Scores, timestamps, and analysis remain available after audio deletion, but the deleted recording cannot be replayed. Replay requires verification of ownership. This storage is separate from AI model-improvement consent.

⑤ The Company and its entrusted parties use voice data only for replay, review of submitted scoring disputes, and consented model improvement, not for advertising or behavioral profiling.

Article 10 (Measures to Secure the Safety of Personal Information)

The Company takes the following measures to secure the safety of personal information. Administratively, it establishes and implements an internal management plan, minimizes the number of employees who handle personal information, and conducts regular inspections. Technically, it manages access privileges to the personal information processing system on a role basis, retains access records, applies one-way encryption to passwords, stores video-meeting connection tokens in encrypted form, and encrypts data in transit (HTTPS/TLS). Physically, access to the systems where data is stored is controlled.

Article 11 (Chief Privacy Officer and Department for Access Requests)

The Company designates a Chief Privacy Officer as set out below to take overall responsibility for personal information processing and to handle complaints and provide remedies for data subjects in relation to personal information processing. Data subjects may direct requests to exercise rights, such as access to personal information, to the contact below.

Chief Privacy Officer

• Name: Kim Gahyun
• Title: Chief Executive Officer (Chief Privacy Officer)
• Email: hello@firstfluke.com

Article 12 (Remedies for Infringement of Rights)

Data subjects may apply to the following bodies for dispute resolution or consultation in order to obtain relief from personal information infringement.

• Personal Information Dispute Mediation Committee: 1833-6972 (www.kopico.go.kr)
• Privacy Infringement Report Center: 118 (privacy.kisa.or.kr)
• Cybercrime Investigation Division, Supreme Prosecutors' Office: 1301 (www.spo.go.kr)
• National Police Agency Cyber Investigation Bureau: 182 (ecrm.police.go.kr)

Article 13 (Changes to This Privacy Policy)

This Privacy Policy applies from its effective date. Where there are additions, deletions, or corrections arising from changes in law or policy, the Company will give notice through announcements within the service from seven days before the changes take effect.