Privacy Policy – Cramify

Effective date: 7th March, 2024

Mathpresso Inc. (the “Company” or “We”) takes your personal information very seriously and does its best to protect your personal information and to guarantee the self-determination of your personal information. This Privacy Policy is meant to help you understand how we process the personal information you provide when you use the services we provide (the “Services”), such as Cramify and QANDA, including through our website and mobile applications (the “Platform”).

This Privacy Policy includes:

1. PERSONAL INFORMATION WE COLLECT

Information Needed to Provide the Services

We collect personal information about you when you use the Services. Without it, we may not be able to provide the Services requested. This information may include:

Contact, Account, and Profile Information

Such as your name, user ID, nickname, phone number, postal address, email address, profile picture, gender, date of birth (age verification for children under 14), name and phone number of the legal representative (in case the use is under 14 or using Ask My Parents service).

Some information will depend on the features you use, such as enrolled university or school information, school or college year, course code and name, instructor’s name, verification such as a student ID (or ID with university admission certificate, enrollment certificate, or graduation certificate), score/grade/achievement level of exams, user group (student, parent, teacher, etc.), relationship with other users (for student/parent pairing), information on relationship and interaction with the paired user. In case you use Cramify, information about the course you attend (such as enrolled course, study materials, semester) will be collected.
Information for Specific Services

For Diagnosis Service, we collect your name, phone number, school name, school year, grade course code and name, instructor’s name, preferred subjects, answer to diagnosis test, result of diagnosis test, etc.

For Study Counselling Service, we collect your name, grade, phone number, preferred time for counseling, information and voice (recording) provided by the user during counseling.
Identity Verification

If a copy of your ID is provided to us, we may scan, use, and store information contained in your ID to verify your identity and for security purposes.

Information Collected During the Use of Services

When you use the Services, we collect personal and other information. This information may include texts and images posted by users, files uploaded by users, purchase history of products and services, refund history, location information generated by user’s network connection, log data, device information (OS, browser type and version, screen size, device ID, type of mobile phone, model name of device), IP address, cookies, location information, service usage record, improper usage record, at the occurrence of error (function used and the application status at the time of occurrence), advertisement identifier, interaction between users, interaction between user and the Services, interaction between user and server, information provided by the user (name, phone number, etc.) when participating in events, information collected during customer service (including information provided by parents).

Information Collected by Payment Services

When you use our payment services, we collect your personal information. This information may include:

Information Collected for Payment

Such as your payment details, phone number, name of bank, account number, account holder’s name, approval number, etc.
Information Collected for Refund

Such as your name, account number, name of bank, resident registration number (if needed), name of bank, account number, account holder’s name.

Information Collected When Registering and Contracting as a QANDA Teacher

When you register and contract as a QANDA teacher, we collect personal information. This information may include:

When Applying for the Teacher Registration

Such as your name, phone number, date of birth, personality type (MBTI) email address, phone number, gender, postal address, information on educational background (university, major, enrollment status, admission type, etc.), information on graduated high school (location, type, etc.), lecture video sample, content in self-introduction (cover letter).
When Contracting as a Teacher

Such as your name, postal address, phone number, email address, data from monitoring and recording (audio and video) tutoring sessions (including the voice, notes, conversation, tutoring content, etc. of participants), resident registration number (collection and use within the scope permitted by relevant laws such as the Income Tax Act), ID (resident registration ID or driver’s license), bank of transaction, bank account number, name of account holder, enrollment certificate, or graduation certificate.

2. HOW WE COLLECT PERSONAL INFORMATION

Directly Collect from User

Some personal information is collected directly from a user during the process of signing up for a membership, editing membership information, and the use of service. Also, a user’s personal information may be collected via the customer service center during the customer helpline.

Collect from Third Parties

Some personal information is provided by external companies through third-party affiliations such as signing up with social media accounts. In this case, we ensure that the third party through which personal information is provided complies with legal requirements such as users’ consent.

Automatically Collected During the Use of Services

We may automatically generate and collect information related to a user during the user’s use of service. Information collected likewise may or may not qualify as personal information depending on the possibility of the information being associated with the user.

3. HOW WE USE PERSONAL INFORMATION COLLECTED

Managing Membership

We may process the collected information for managing user membership service (“Membership”), such as:

Member identification, person identification, confirmation of relationship between members (parent-student relationship, etc.), age verification, confirmation of consent from a legal representative when collecting personal information of children under the age of 14, confirmation of possession of a phone number.
Management of membership such as confirming the user’s will to sign up and withdraw.
Provision of the Services such as Cramify and QANDA, provision of the Services based on member groups, delivery of service-related commodities such as class material, tablet PC, etc., receipt of returned commodities, settlement of charge and payment of price for provision of paid services, refund.
Restriction of rejoining for dishonest purposes, limitation on the number of sign-up opportunities, demographic analysis, analysis of service usage record, development of new services and improvement of existing services, improvement of service quality.
Provision of customized services, establishment of safe internet environment.
Prevention and sanction of any act that interrupts normal operation of the Service (illegal or fraudulent use of accounts, authentication materials, etc.), usage limitation on members who violated relevant laws or our Terms and Conditions.
Resolution of complaints, recordkeeping for future dispute resolution, delivery of notices, etc.
Delivery and shipment of prizes and gifts during an event.

Fulfillment of Service Provision Contract and Fee Settlement

We may use the collected information for provision of services and fee settlement, such as:

Provision of contents and customized services.
Identity verification, purchase and billing, collection of charges.

Improvement of Service Quality, Marketing, and Advertisement

We may use the collected information to improve service quality and promote the Services, such as:

Collection of service usage statistics based on which service satisfaction rate is analyzed, development of new services and provision of customized services.
Estimation of members’ interest, taste, propensity, and learning state information, etc. and utilization of the foregoing information for recommending customized content and for other marketing methods, provision of marketing information including events and participation opportunities for these events.
Utilization for statistics on service usage record and access frequency, for establishment of service environment, and for service improvement, statistics on service usage of members, confirmation of service validation.
Usage and provision after pseudonymization for purposes such as production of statistics, research, recordkeeping for public interests, etc.

To be clear, we assure you that your personal information is not used for developing, improving, or training generalized AI or machine learning models.

Screening and Contracting for Teacher Registration

We may process the collected information to screen and contract for teacher registration, such as:

Person identification, registration and screening for teacher registration process, administration of relevant process, notification and guidance of relevant process, verification of double registration, registration to resource pool and its usage.
Notification of admission, entrance and compliance of contracts, quality control and improvement of tutoring sessions, management of tax affairs, managing complaints and conflicts from tutoring and monitoring recorded (audio and video) tutoring sessions between students and tutors.

4. SHARING & DISCLOSURE

Sharing With Your Consent

Where you provide consent, we share your information as described at the time of consent.

Where permissible under applicable law, we may use certain information about you, such as your email address, that we share with social media platforms after de-identifying it to generate leads, drive traffic to the Platform, or otherwise promote our products and services.

Service Providers

We share personal information with affiliated and unaffiliated service providers (including their service providers) to help us run the Services and for their compliance purposes, including those that help us: (i) verify your identity or authenticate your identification documents, (ii) fraud prevention, security investigations, and risk assessments, (iii) perform product development, maintenance, and debugging, (iv) allow the provision of the Services through third-party platforms and software tools (e.g., through the integration with our APIs), (v) provide the Services, advertising, or payments services, (vi) offer additional services you select, (vii) process, handle, or assess claims, (viii) data storage and data analysis, (ix) sending messages such as text messages and emails, (x) customer services such as chatbot services, user survey services, or (xi) delivering items or devices such as tablet PC.

These providers are contractually bound to protect your personal information and have access to your personal information to perform these tasks.

Complying with Law, Responding to Legal Requests

We may disclose your information to courts, law enforcement, governmental or public authorities, tax authorities, or authorized third parties, if and to the extent we are required or permitted to do so by law or where disclosure is reasonably necessary to: (i) comply with our legal obligations, (ii) comply with a valid legal request (such as a subpoena or court order) or to respond to claims asserted against the Company, (iii) respond to a valid legal request relating to a criminal investigation to address alleged or suspected illegal activity, or to respond to or address any other activity that may expose us, you, or any other of our users to legal or regulatory liability, (iv) enforce and administer our agreements with users, including our Terms and Conditions, or (v) protect the rights, property or personal safety of the Company, its employees, or its users.

Where appropriate, we may notify users about legal requests unless: (i) providing notice is prohibited by the legal process itself, by court order we receive, or by applicable law, or (ii) we believe that providing notice would be futile, ineffective, create a risk of injury or bodily harm to an individual or group, or create or increase a risk of fraud upon or harm to the Company, other users, or expose the Company to a claim of obstruction of justice.

Business Transfer

If we undertake or are involved in any merger, acquisition, or business transfer, then we may transfer or share some or all of our assets, including your information in connection with such transaction or in contemplation of such transaction (e.g., due diligence). In this event, we will notify you before your personal information is transferred and becomes subject to a different privacy policy.

5. CHILDREN’S PRIVACY

We do not knowingly collect or solicit personal information about children under 13 years of age. If you are a child under the age of 13, please do not attempt to register for or otherwise use the Services or send us any personal information.

If we learn we have collected personal information from a child under 13 years of age, we will delete that information as quickly as possible. If you believe that a child under 13 years of age may have provided personal information to us, please contact us to provide that information by emailing us at legal@cramify.ai.

6. Cookies

Use of Cookies

Cookies that store and retrieve user information may be used to automatically collect necessary information such as access logs, device information, etc. for service provision. A cookie is a small piece of text file set by the web server (HTTP) and stored in a user’s computer hard disk while the user is browsing the website.

Purpose of Use

In order to provide users with personalized services, we use cookies that store and retrieve user information. When a user visits the website, the website server reads cookies stored in the user’s device to maintain environment settings and customized services.

Cookies help the user to access and use the website conveniently according to previously set preferences. Also, they are used to provide customized information, such as personalized ads and marketing by tracing the user’s website visit history and use patterns.

Settings/Operation and Refusal of Cookies

A user has the right to choose whether to allow cookies. Hence, a user may set the option on the web browser to accept all cookies, complete confirmation thereof whenever a cookie is stored, or refuse the storage of all cookies. Provided, however, when a user refuses the storage of a cookie, then the user may experience difficulties in using the service.

7. YOUR PRIVACY RIGHTS

You can inquire about and edit your personal information on the Services at any time and may request to view, edit, delete, or terminate the use of personal information of your own or, in the case of legal representatives, of users under the age of 14. To exercise the rights of users or legal representatives through the Privacy Protection Officer, please send an email to legal@cramify.ai.

Users or their legal representatives may withdraw their consent to the processing of personal information or request the termination of their Membership. To request changes or cancellations of accounts, you can do so either through the Platform or by sending an email to legal@cramify.ai. We will process the request and notify users of the result without delay. We may ask you to verify your identity and request before taking further action on your request.

8. HOW WE PROTECT PERSONAL INFORMATION

Retention and Destruction of Personal Information

Your personal information is processed during the retention period to which you have given consent. Your personal information is destroyed immediately once the purpose of collection and use of personal information is fulfilled. Provided, however, when required under applicable laws and regulations, your personal information is retained for the legally required period.

The criteria used to determine our retention periods include:

The length of time we have an ongoing relationship with you and provide the Services to you (for example, for as long as you have an account with us or keep using the Services) and the length of time thereafter during which we may have a legitimate need to reference your personal information to address issues that may arise;
Whether there is a legal obligation to which we are subject (for example, certain laws require us to keep records of your transactions for a certain period of time before we can delete them); or
Whether retention is allowed by applicable law (such as in regard to applicable statutes of limitations, litigation or regulatory investigations).

We destroy your personal information immediately once the purpose of collection and use of personal information is fulfilled unless retention is required by applicable laws and regulations. Personal information stored in electronic file formats is to be destroyed using technical means to avoid recovery and regeneration of the information. Personal information printed on paper is destroyed through shredding or incineration.

Security Measures to Protect Personal Information

In dealing with personal information, we take technical and administrative protection measures required by the relevant laws and regulations by restricting unauthorized access, storing access records to the personal information processing system, and conducting regular training on personal information protection and security for employees who handle personal information to ensure the prevention of loss, theft, leakage, forgery, or damage of personal information.

9. ADDITIONAL RIGHTS FOR CERTAIN US STATES RESIDENTS

Additional Rights for Users in Certain US States

The laws in certain US states (such as California, Colorado, Connecticut, Utah, Vermont, and Virginia) provide the residents of those states with rights to receive disclosures regarding the collection, use and sharing of personal information, as well as rights to know, access, correct, delete and/or opt out of certain disclosures of personal information. To the extent that we collect personal information that is subject to such laws, that information, our practices and your rights are described below. Note that certain information we collect may be exempt from such state laws because it is considered public information (because it is made available by a government entity) or covered by a federal privacy rule.

You may submit a request to exercise your rights described below by contacting us through the Platform or by emailing us at legal@cramify.ai.

Applicable state law requires us to verify your identity before providing a substantive response to your request to exercise some of your rights described below. Generally, we will verify your identity by asking you to (a) provide us with your email to ensure your email is verified, and (b) confirm the right you wish to request under this Privacy Policy. In appropriate circumstances, we may ask you for additional information to verify your identity. Once your identity is verified, we will work to process your request in a timely manner in accordance with applicable law. If we cannot verify your identity, we may not be able to process your request.

You can designate an authorized agent to submit requests on your behalf. However, we will require written proof of the agent’s permission to do so, and we will need to verify your identity directly.

Right to Know Categories of Information Collected, Sold, Disclosed or Shared, and Purposes for Collection

You have a right to receive information regarding the categories of personal information we collect, sell, disclose, or otherwise share. However, to be clear, we do not sell your personal information to any third parties.

You also have the right to receive information regarding the sources of personal information we collect, the purposes for which we collected it and the third parties and service providers with whom we shared it as well as the retention period or criteria for determining retention of such data.

Right to Access Personal Information

You have the right to request access to specific pieces of personal information collected about you. To protect your personal information, we are required to verify your identity before we can act on your request. Note that we may not be permitted to give you access to certain specific pieces of sensitive information (such as a driver license or social security number), or records that contain the personal information of a third party.

Right to Delete Personal Information

You have the right to request in certain circumstances that we delete any personal information that we or third parties on our behalf have collected directly from you. To protect your personal information, we are required to verify your identity before we can act on your request and maintain a record of your request, and in some cases, we are required or permitted by law to retain all or some of your personal information for specific purposes. If we do, we will explain that to you in our response.

Right to Correct Personal Information

You have the right to request in certain circumstances that we correct any inaccurate personal information that we have collected directly from you. To protect your personal information, we are required to verify your identity before we can act on your request.

Right to Information Regarding Participation in Data Sharing for Financial Incentives

We may run promotions from time to time whereby we incentivize a user to share certain pieces of information with us; for example, we may offer a one-time discount if consumers sign up for our email marketing list. The value of the personal information provided to us is based on the value of the discount provided to you. Participation in these incentives is voluntary and you may opt out of the data sharing at any time.

Right to Opt Out of Targeted Advertising or Sale or Sharing of Personal Information to Third Parties

You have the right to opt out of any sharing of personal information by us to third parties. While you also have the right to opt out of sale of personal information under applicable law, we do not sell your personal information to third parties.

Please note that under applicable law your right to opt out does not apply to our sharing of data with use of service providers, who are parties we engage to perform a function on our behalf and are contractually obligated to use the data.

Additionally, certain browsers may allow you to opt-out of sale or sharing on all websites accessed through that browser. Where required by law, we will honor browser-based opt-out settings out settings and we treat those requests in the same manner that we treat requests submitted through the Platform.

Right to Limit Use of Sensitive Personal Information

We may collect and use sensitive personal information when that information is needed for the purposes described to you at the time of collection. We may also collect sensitive personal information for advertising purposes. You may have the right to limit our use of your sensitive personal information to only what is strictly necessary for us to provide our services to you and for the limited purposes otherwise allowed by applicable law. You may exercise this right by contacting us through the Platform.

Right to Personal Information about Certain Third-Party Disclosures

While, under applicable law, you have the right to request information regarding third parties to whom the company has disclosed certain categories of personal information during the preceding year for the third parties’ direct marketing purposes, we do not disclose your personal information to any third parties for the aforementioned purposes.

Right of Non-Discrimination

We will not discriminate against you for exercising your rights and choices, although some of the functionality and features available on the Services may change or no longer be available to you. Any differences in the Services are related to the information provided.

10. HOW WE CHANGE PRIVACY POLICY

We reserve the right to modify this Privacy Policy at any time in accordance with applicable law. If we do so, we will post the revised Privacy Policy and update the “Last Updated” date at the top.

In case of material changes, we will also provide you with notice of the modification by email at least thirty (30) days before the effective date. If you disagree with the revised Privacy Policy, you can cancel your account. If you do not cancel your account before the date the revised Privacy Policy becomes effective, your continued access to or use of the Services will be subject to the revised Privacy Policy.

11. CONTACT INFORMATION

For questions or complaints about this Privacy Policy or our handling of personal information, please contact Mathpresso Inc., Legal Division, 17th floor, 428 Seolleung-ro, Gangnam-gu, Seoul, Korea or by emailing us at legal@cramify.ai.

If you believe you have found a security vulnerability, please submit your report to us by emailing us at legal@cramify.ai. We will do our best to respond to your report as soon as possible. However, we do not offer monetary rewards for vulnerability disclosures.