Wingkey (hereinafter the "Company") values users' personal information and complies with relevant laws such as the Personal Information Protection Act so that users can use the Service with peace of mind.
1. Personal Information Items Processed and Methods of Collection
The Company collects the following personal information at the time a user signs up for membership or uses the Service.
[Items Collected at Sign-Up]
| Sign-Up Method | Classification | Items Collected | Purpose of Use |
|---|---|---|---|
| Email login | Required | Email, password, name, mobile phone number, gender, date of birth | User identification, account linkage, delivery of notices |
| Kakao login | Required | Email, profile information (nickname, photo), mobile phone number, gender, date of birth | Same as above |
| Naver login | Required | Email, profile information (nickname, photo), mobile phone number, gender, date of birth | Same as above |
| Common | Optional | Consent to receive advertising notifications (SMS, email), sign-up path | Marketing use and benefit information |
[Items Additionally Collected in the Course of Using the Service]
The Company necessarily collects the following information at the time a user uses the core functions of the Service.
| Classification | Items Collected | Time of Collection | Purpose of Use |
|---|---|---|---|
| Trial application and consultation | Learning goals, preferred schedule, contact information, application path, consultation details | When applying for a trial, requesting a consultation, or using the Dashboard | Assigning trial lessons, responding to consultations, identifying learning needs |
| Use of learning services | Lesson schedule, attendance and lesson history, learning progress, feedback files, records of customized material use | When booking lessons, conducting lessons, or using the Dashboard | Lesson operation, learning management, feedback |
| AI Coaching integration | Whether AI Coaching is used, period of use, and information necessary for Talkio AI integration and inquiry of learning progress | When using a product that includes AI Coaching, or when starting AI Coaching | Creating an AI Coaching account, registering the pass period, integrating SSO login, checking learning progress |
| Payment and refund | Payment history, product and pass information, coupon and refund processing history | When paying for a paid product, using a coupon, or requesting a refund | Payment processing, pass management, refunds and customer response |
[Items Generated and Collected Automatically]
| Classification | Items Collected | Purpose of Use |
|---|---|---|
| Access and usage information | IP address, date and time of access, requested URL, referral path, service usage records | Service provision, failure response, prevention of fraudulent use, usability improvement |
| Authentication and session information | Login session, authentication token, cookies | Member authentication, maintaining login status, security management |
| Browser temporary storage information | Preferred language, referral code, information temporarily saved while filling out the trial survey | Maintaining user settings, linking referrers, maintaining continuity of the trial application process |
| Referral information | Referral path information when access is made through advertising or promotional links, etc. (utm_source, utm_medium, utm_campaign, utm_content) | Verifying referral paths, analyzing marketing performance |
| Security verification information | Number of requests for login, sign-up, password recovery, and public application forms; identifier hashes for preventing duplicate applications; CAPTCHA verification results | Account protection, prevention of duplicate applications and fraudulent use, service security |
2. Purposes of Processing Personal Information
The Company uses the personal information it collects for the following purposes. All information provided by users will not be used for any purpose other than those necessary for the purposes below, and if the purpose of use changes, the Company will obtain prior consent.
[Provision of Services and Performance of the Contract]
Providing content and paid services, processing purchases and payments, managing learning and providing the Dashboard.
Providing the AI Coaching service through Talkio AI integration and analyzing learning data (attendance, time, sentences, words, etc.).
[Member Management]
Identity verification associated with the use of membership-based services, prevention of fraudulent use by improper members, confirmation of intent to sign up, handling of complaints, and delivery of notices.
[Marketing and Advertising Use (Where the User Consents Optionally)]
Delivering customized benefit information and advertising information based on per-user learning pattern algorithms (KakaoTalk, SMS, email).
Developing and specializing new services and providing opportunities to participate in events.
3. Provision of Personal Information to Third Parties
In principle, the Company does not provide users' personal information to external parties. However, in order to provide users with a smooth AI Coaching service, the Company provides personal information as follows.
| Recipient | Purpose of Provision | Items Provided | Retention and Use Period |
|---|---|---|---|
| Talkio AI | Automatic membership registration and pass-period registration through API integration, and provision of AI Coaching learning-progress inquiries | The minimum information necessary for service integration, such as email, name, and the start and end dates of AI Coaching use | Until membership withdrawal or termination of the partnership agreement |
An API (Application Programming Interface) is an intermediary that enables different software programs to communicate with one another and exchange data.
Users have the right to refuse the above provision of personal information to third parties; however, if they refuse, their use of the AI Coaching service provided by the Company may be restricted.
4. Outsourcing of Personal Information Processing
[International Transfer of Personal Information]
For the purposes of building infrastructure to provide the Service, storing data, and providing a stable network service, the Company outsources the processing and storage of personal information overseas as follows.
| Trustee | Name and Country of the Transferee | Details of Outsourced Work | Items Transferred | Retention and Use Period of Personal Information |
|---|---|---|---|---|
| Amazon Web Services | Countries where data centers are located, such as the United States | Providing cloud infrastructure for service provision and storing data (including backup/disaster recovery) | All personal information collected during membership sign-up and use of the Service (email, password, service usage records) | Until membership withdrawal or termination of the outsourcing agreement |
| Supabase | Countries where servers are located, such as the United States | Storing and managing the service database and providing member authentication functions | Member account information, information stored in the database, uploaded files | Until membership withdrawal or termination of the outsourcing agreement |
| Cloudflare | Countries where servers are located, such as the United States | CAPTCHA verification and prevention of fraudulent use | IP addresses of service visitors, web browser information, cookies, service access/usage records | Until the purpose of service use is achieved or the outsourcing agreement is terminated |
| Google LLC | Countries where data centers are located, such as the United States | Operating marketing within the website | IP addresses of service visitors, web browser and device information, in-service behavior and usage records | Until the operational and management purposes are achieved |
[Outsourced Companies for Performing Online Services]
In order to improve the Service and ensure smooth business processing, the Company outsources personal information processing tasks to external specialized firms as follows.
| Trustee | Details of Outsourced Work | Retention and Use Period of Personal Information |
|---|---|---|
| Toss Payments | Processing and settling payments for paid services | Until membership withdrawal or termination of the outsourcing agreement |
| Allineun Saramdeul Co., Ltd. | Sending Kakao AlimTalk messages | Until membership withdrawal or termination of the outsourcing agreement |
| Channel Corporation | Providing customer consultation services and managing chats | Until membership withdrawal or termination of the outsourcing agreement |
5. Retention and Use Period of Personal Information
The Company retains and uses users' personal information from the time of membership sign-up until membership withdrawal. However, if the purpose of use is achieved or the user requests destruction, the Company will destroy the information in question without delay.
[Retention Pursuant to the Company's Internal Policy]
To prevent fraudulent use of the Service (abuse such as duplicate applications for trial passes), the Company retains the minimum information as follows.
Retained items: Email address, sign-up and withdrawal records, trial pass application history.
Reason for retention: Preventing fraudulent use, such as receiving duplicate trial passes by re-registering after withdrawal.
Retention period: 30 days from the date of withdrawal (destroyed immediately thereafter). However, this does not apply where the information must be retained for the stated reason.
[Retention Pursuant to Relevant Laws]
The Company may retain personal information for a certain period in accordance with the provisions of relevant laws, such as the Commercial Act and the Act on the Consumer Protection in Electronic Commerce, Etc.
Records on contracts or withdrawal of subscription, etc.: 5 years (Act on Consumer Protection in Electronic Commerce).
Records on payment and the supply of goods, etc.: 5 years (Act on Consumer Protection in Electronic Commerce).
Records on consumer complaints or dispute handling: 3 years (Act on Consumer Protection in Electronic Commerce).
Website visit records: 3 months (Protection of Communications Secrets Act).
[Dormant Accounts]
To protect users' personal information, the Company may separately store or destroy the personal information of members who do not use the Service for one year from their last access date (dormant accounts), and will notify them of this by email at least 30 days before taking such action.
6. Personal Information Protection Officer and Contact Information
In order to protect users' personal information and handle complaints related to personal information, the Company designates a Personal Information Protection Officer and a responsible department as follows. Users may report any personal-information-related complaints arising while using the Service to the Personal Information Protection Officer or the responsible department.
[Personal Information Protection Officer]
Name: Lee Hee-chang
Position: Personal Information Protection Manager
Phone: 02-757-1466
Email: info@wingkey.kr
7. Installation, Operation, and Refusal of Automatic Personal Information Collection Devices
The Company uses "cookies" that store and frequently retrieve usage information in order to provide users with individually customized services.
A cookie is a very small text file that the server used to operate the website sends to the user's browser, and it is stored on the hard disk of the user's computer.
Purpose of use: Providing individually customized services by maintaining login status, retaining event (trial pass) participation information, and ascertaining the number of visits; preventing fraudulent use; and improving the Service.
How to refuse: Users have the option regarding the installation of cookies. However, if the use of cookies or browser storage is restricted, some services—such as maintaining login, language settings, and events (trial passes)—may be limited.
Chrome: Settings > Privacy and security > Third-party cookies, or Delete browsing data.
Safari: Settings > Privacy > Cookies and website data.
Edge: Settings > Cookies and site permissions > Manage and delete cookies and site data.
8. Rights of Users and Legal Representatives and How to Exercise Them
Users may at any time view or modify their registered personal information and may request termination of membership (withdrawal of consent).
Viewing/modifying personal information is available through the "Profile Settings" menu within the Service, and membership termination can be done directly through the "Account Withdrawal" procedure or by contacting us in writing, by phone, or by email, in which case we will take action without delay.
If a user requests correction of an error in their personal information, the Company will not use or provide the personal information in question until the correction is completed.
The Company does not collect personal information from children under the age of 14 beyond the scope permitted by relevant laws, and does not provide a child's information to third parties or use it for marketing purposes without the consent of the legal representative.
9. Technical and Managerial Measures for Protecting Personal Information
In handling users' personal information, the Company takes the following technical and managerial measures to prevent it from being lost, stolen, leaked, altered, or damaged.
Password encryption: Member passwords are stored and managed in encrypted form so that only the member knows them, and personal information can be checked and changed only by the member.
Measures against hacking: The Company does its utmost to prevent members' personal information from being leaked or damaged by hacking or computer viruses, and uses the latest antivirus software.
Minimization and training of handling staff: Staff handling personal information are limited to designated personnel, and the Company emphasizes compliance with the privacy policy through regular training.
10. Counseling and Reporting Related to Personal Information Infringement
If you need to report or receive counseling regarding a personal information infringement, please contact the following organizations.
Personal Information Infringement Report Center (operated by KISA) — Phone: 118 (no area code) / URL: http://privacy.kisa.or.kr
Personal Information Dispute Mediation Committee — Phone: 1833-6972 (no area code) / URL: https://kopico.go.kr/
Supreme Prosecutors' Office Cybercrime Investigation Unit — Phone: 1301 (no area code) / URL: http://www.spo.go.kr
National Police Agency Cyber Bureau — Phone: 182 (no area code) / URL: https://ecrm.police.go.kr
11. Changes to the Privacy Policy, etc.
If the Company changes this Privacy Policy, it will specify the reasons for the change and the effective date and announce it, together with the current Privacy Policy, through the service screen or notices from 7 to 10 days before the effective date until the day before it takes effect.
However, if there is a change to content material to users' rights or obligations, the Company will give notice at least 30 days in advance.
Notwithstanding that the Company, in announcing the changes pursuant to the preceding paragraph, also gave notice to the effect that "if no refusal is expressed by the effective date of the change, consent shall be deemed given," if a user does not expressly express a refusal, the user shall be deemed to have consented to the changes.
Notwithstanding paragraph 3, where separate consent is required under the law, such as additionally collecting personal information from a user or providing it to a third party, the Company shall go through a separate consent procedure with the user.
Supplementary Provisions
Date of announcement: August 10, 2026 (Reason: Posting of changes to the Privacy Policy due to site remodeling).
Effective date: August 10, 2026.