Privacy Policy

1. Personal information we collect

• When you sign up with email: email address, password (stored only as a hash), preferred language
• When you sign up or log in with Google: the email address, name and unique account identifier of your Google account. We do not receive your photo or other profile information, and no password is stored.
• In the welcome step right after sign-up: your name (required); nationality, intended programme and intended intake (optional)
• When you enter personal details: name, date of birth, nationality (required); passport expiry date (optional)
• Passport number (optional; a unique identifier under Korean law): collected only with your separate consent. Purpose: preparing admission and visa documents, and sharing with agencies or universities you choose. Kept until you delete it, withdraw your consent or close your account. Refusing does not affect anything else on the Service. To withdraw, uncheck the box on the personal info screen of your profile and save; the number is deleted.
• When you enter your education: school name, degree level, major, grades, language test scores, (expected) graduation date
• When you enter study plans: preferred universities, preferred major, intake year
• When you answer the optional quick questions while using the Service: where you are in the process, whether you work with an agency, your yearly tuition budget range, TOPIK level, English test score
• When you save favourite universities or ask a university to join (optional): your list of saved universities, your notes on them, and the universities you asked to join
• When the calendar subscription link is created (it is created when you open "My application calendar" on My Page): the link itself (a random string), when it was created or reset, and when and how many times a calendar app last fetched it
• When you use the Document Locker: the document files you upload (diplomas, passport copy, financial statements, etc.)
• When university, language institute and agency staff apply or sign up: contact name, title, email, organisation name, website, application note. Agencies also give city and country, the number of students sent last year, and the licence and fee schedule files; staff accounts hold an email and a password (stored only as a hash).
• When you contact an advisor: name, contact channel (KakaoTalk, WhatsApp or WeChat ID, or email), nationality, your message
• When you request a visa document checklist or visa-change alerts: email address
• Collected automatically while you use the Service: access logs, session cookies, a first-visit cookie (see section 9)
• Collected automatically by analytics and advertising tools: cookie-based identifiers, usage records such as pages visited and clicks, device and browser information, referral source (see section 9)

2. Why we use it

• Confirming sign-up, verifying your identity and keeping you logged in
• Addressing you by name and tailoring guidance to your nationality, programme and intake
• Using your answers to the quick questions to fit guidance to your stage and to pre-fill the school match tool (answers are not passed to agencies or universities automatically, and you can change or delete them in your profile at any time)
• Saved favourites and join requests are given to a university only as totals that cannot identify you (not given at all when fewer than 5 students are involved; never names or emails). Your notes are visible only to you
• Providing a link that shows the application dates of your saved universities in a calendar app. Anyone who has this link can see, without logging in, which universities you saved and their application dates, so please do not share it. If you shared it by mistake, create a new link on My Page and the old one stops working at once. If you add the link to a calendar app such as Google, Apple or Microsoft Calendar, that provider fetches the dates through the link and handles them under its own policy
• Producing usage statistics by country and programme (only as totals that cannot identify you)
• Providing the Document Locker for tracking admission and visa documents
• Sending emails and alerts in your preferred language
• Preventing misuse and keeping accounts secure (for example, limiting login attempts)
• Sharing documents with partner agencies you choose, only with your consent
• Answering your enquiries and sending the materials or alerts you requested
• Reviewing and approving applications from universities, language institutes and agencies, issuing staff accounts and contacting them

3. How long we keep it

We delete your personal information without delay when you close your account, unless a law requires us to keep it for a set period, in which case we keep it for that period only.

• If you withdraw your consent to share with a university, language institute or agency, it can no longer view your information or documents, immediately.
• Documents you upload to the Locker are deleted 3 months after your admission is confirmed. Confirmation starts when you tell us yourself, or when a university marks you as enrolled and you confirm it (a university's mark alone does not start it). We warn you by email 14 days before deletion. You can extend by 3 months at a time, up to 6 months in total.
• A university or language institute can view the documents you shared in an inquiry until 3 months after it marks you as enrolled, or 6 months after the last activity in the inquiry. We warn you and the institution 14 days before. Your own Locker files are not deleted by this.
• Application details and staff accounts of universities, language institutes and agencies are deleted without delay when an application is rejected or when they ask for the account to be deleted (ask through the contact in section 12).
• If you do not use the Service for 6 months after your last use, we delete your account and uploaded documents, and warn you by email first.
• AI assistant questions are kept as described in section 11.
• The name, contact details and message you send through the contact form are deleted one year after we receive them.
• Your passport number is deleted immediately when you withdraw your consent.

4. Service providers that process data for us

• Resend (email delivery): processes email addresses to send verification codes and alerts
• Cloudflare (servers and storage): provides the infrastructure that runs the Service and stores data
• Google LLC (Google Analytics, Google Tag Manager): processes cookie-based usage records for usage statistics
• Meta Platforms, Inc. (Meta Pixel): processes cookie-based usage records to measure advertising and show personalised ads
• Anthropic PBC (AI model provider): processes the text of visa assistant and university question assistant questions and advisor requests to generate answers and reply drafts (see section 11)

5. Sharing with third parties

We do not give your personal information to third parties beyond the providers above, except:

• Partner agencies you select yourself in the Document Locker (up to three) after giving separate consent: the documents you choose to share and your email, name and nationality. They use this to advise and support your admission and visa preparation. You can stop sharing at any time.
• Universities and language institutes registered on the Service that you contact or apply to: the items you choose and consent to when you start an enquiry (any of name, nationality, intended programme, email) and the individual documents you decide to share. Documents are view-only unless you allow download. They use this to answer your enquiry and to advise on and review your application. Each time they open or download a document, it is recorded and shown to you. You can withdraw at any time and viewing stops immediately. Copies an institution has already downloaded are managed by that institution under its own privacy policy.
• When the law requires it, or investigative authorities request it following legal procedures

You may refuse, but then you cannot use enquiries and document sharing with that agency or university.

6. Your rights

You can view and correct your personal information at any time, and ask us to stop processing or delete it. You can delete it yourself with "Delete my account" at the bottom of My Page; closing your account permanently deletes your account, profile, uploaded documents, enquiries and messages, and sharing records. You can replace documents in the Document Locker by uploading them again.

Closing your account does not delete copies already held by universities, language institutes or agencies that received your information beforehand, AI assistant questions kept without a link to your account (section 11), or information a law requires us to keep.

7. How we destroy data

Personal information stored as electronic files is permanently deleted in a way that cannot be recovered, without delay once there is a reason to destroy it.

However, document files removed by automatic deletion (6 months without use, 3 months after admission is confirmed) are kept separately for up to 30 days after deletion, so that a mistake can be undone, and are then deleted for good. When a member closes their own account, document files are deleted immediately. The database is backed up automatically for disaster recovery, and deleted information may remain in those backups for up to 30 days.

8. Security measures

• Passwords are hashed with PBKDF2; we never keep the original.
• Login sessions use random tokens, and the server stores only a hash of each token.
• Files in the Document Locker can be viewed only by you and the agencies, universities and language institutes you choose to share them with; views and downloads are logged.
• All connections are encrypted with HTTPS.

9. Cookies and behavioural data

We use the tools below for usage statistics and advertising measurement, which collect behavioural data (pages visited, clicks, referral source, device and browser information) through cookies. We do not send information that directly identifies you, such as your name, email or passport number, to these tools.

• Google Analytics (installed through Google Tag Manager): usage statistics
• Meta Pixel: advertising measurement and personalised ads

Separately, we use our own cookie (st_ft) to see, in totals only, which routes sign-ups come from. For up to 30 days it holds only the first page you opened, the domain of the site you came from and the campaign tags (utm) on the link; when you sign up we delete it and add one to a daily total. The totals are not linked to any account and are deleted after one year. We use this cookie from 2026-10-09.

To opt out:

• Block or delete cookies in your browser settings
• Google Analytics: install the Google Analytics opt-out browser add-on (tools.google.com/dlpage/gaoptout)
• Meta personalised ads: change "Ads based on data from partners" in your Facebook or Instagram ad settings

Refusing cookies does not stop you from using the Service, though some features may work differently.

10. Use of Google account information

When you sign up or log in with Google, we receive only your email address and a unique account identifier from Google, and use them only to create your account and log you in. We do not use this information for advertising and do not sell or give it to third parties.

11. AI assistant questions

Questions typed into the university question assistant are handled the same way (kept: the question, the university, language and time, without a link to your account). Questions members type into the AI visa assistant are sent to Anthropic PBC (United States) to generate the answer, and kept by the Service to improve it and to produce per-country question statistics.

• What is kept: the question, your nationality (if given in the readiness check or your profile), language, time, and the topics the answer used.
• It is kept without any link to your account, and anything that looks like an email address, phone number or passport number is masked before it is stored.
• Retention: deleted one year after the question was asked.
• Transfer abroad: recipient Anthropic PBC (United States, privacy@anthropic.com); item: the question text; when and how: over an encrypted connection each time you ask; purpose: generating the answer; retention: under Anthropic's API data retention policy.
• Advisor requests: the question you send through the contact form may be sent to Anthropic in the same way, with your nationality and stage, when our staff drafts a reply (your name and contact details are not sent). A draft is only sent to you after staff have checked and edited it.
• If you do not want your questions transferred abroad, do not use the visa assistant, or say so in your advisor request; nothing else on the Service is affected.

12. Contact for privacy matters

For questions, or to request access, correction or deletion of your personal information, contact us:
Operator: CONVENIENCE PEOPLE CO., LTD (주식회사 편의민족), Busan, Republic of Korea
Privacy officer: Chief Executive Officer
Email: conveniencepeople@gmail.com

13. Transfers of personal information abroad

To provide the Service we transfer personal information abroad as follows. If you do not want this transfer, you cannot use the Service (sign up).

• Cloudflare, Inc. (United States and other countries where Cloudflare data centres are located): servers, database and file storage / all member information, including Locker files / continuously while you use the Service, over encrypted connections / purpose: running the Service and storing data / retention: until you close your account or the data is deleted
• Resend, Inc. (United States): email delivery / email address, name and the content of the email / each time we send a verification or alert email / purpose: sending email / retention: under Resend's policy
• Google LLC (United States): usage statistics / cookie-based identifiers and visit records / while you use the Service / purpose: usage analysis / retention: under Google's policy
• Meta Platforms, Inc. (United States): advertising measurement / cookie-based identifiers and visit records / while you use the Service / purpose: measuring advertising and personalised ads / retention: under Meta's policy
• Anthropic PBC (United States): see section 11

For privacy questions about these companies, use the contact given in each company's privacy policy.

14. Remedies for infringement of your rights

You can report or ask about a privacy infringement to the following bodies:

• Personal Information Infringement Report Center: privacy.kisa.or.kr / 118 (no area code)
• Personal Information Dispute Mediation Committee: kopico.go.kr / 1833-6972
• Supreme Prosecutors' Office Cyber Crime Investigation Division: spo.go.kr / 1301
• Korean National Police Agency Cyber Bureau: ecrm.police.go.kr / 182

15. Children under 14

The Service is not aimed at children under 14 and does not collect their personal information. If we learn that we have collected information from a child under 14, we delete it without delay.

Effective date

This Privacy Policy takes effect on 2026-10-20.