Legal
Privacy Policy
Version: v1.2 | Amended: 2026-07-19 (effective date to be confirmed upon publication)
1. Introduction
K-Flow Labs ("Company") operates the High Horizon platform ("Service"). The Company handles personal data in compliance with Korea's Personal Information Protection Act (PIPA) and applicable data protection laws.
This Policy describes how the Company collects, uses, shares, and retains personal data, and explains the rights available to data subjects.
Operator Information: 케이플로우 (K-Flow Labs) · Representative 김진주 · Business Registration No. 675-10-03251 · Address 경기도 남양주시 별내중앙로 30, 603-004A호(별내동) · Customer Service [email protected] · E-Commerce Registration No. TBD.
2. Personal Data Collected
2-1. Categories of Data
| Category | Items | Collection Method |
|---|---|---|
| Account | Name, email address, profile image | Google OAuth 2.0 |
| Service settings | Locale, timezone | Automatic during use |
| Booking & lesson records | Booking date/time, lesson type (1:1 · group), lesson history, cancellation/refund records | Generated during service use |
| Learning reports | Per-lesson feedback, assessments, IELTS band scores | Teacher input and system generation |
| AI transcription data | Lesson transcription text (voice/subtitle-based), grammar error flags | AI auto-transcription (video not stored) |
| Payment information | Payment method type, approval number, transaction amount, refund records | Toss Payments / Eximbay / PayPal (Company retains minimum information only) |
| Service usage logs | Access logs, IP address, cookies, session data | Automatic collection |
The Company does not store video recordings. AI transcription processes audio/subtitle data into text only.
2-2. Children Under 14
The Service is not available to persons under 14 years of age. Students confirm they are at least 14 at sign-up. If a user is found to be under 14, account registration will be refused and any existing account will be deleted immediately.
3. Purposes and Legal Bases for Processing
| Purpose | Legal Basis | Data Involved |
|---|---|---|
| Account registration and identity verification | Contract performance | Account data |
| Lesson booking, confirmation, and delivery | Contract performance | Account data, booking & lesson records |
| Teacher-student connection (Google Meet/Calendar) | Contract performance | Account data, booking records |
| Learning reports and feedback | Contract performance | Learning reports, AI transcription data |
| Payment processing and refunds | Contract performance, legal obligation | Payment information |
| Marketing communications (email and web notifications) | Consent (optional) | Account data (email) |
| Service operation, security, and analytics | Legitimate interests | Service usage logs |
4. Retention Periods
| Data Category | Retention Period | Basis |
|---|---|---|
| Account information | Deleted upon withdrawal (statutory retention applies below) | Contract |
| Booking & lesson records | 1 year after withdrawal | Dispute resolution |
| Learning reports / IELTS bands | 1 year after withdrawal | Dispute resolution |
| AI transcription text | 1 year from the date of the last lesson, or upon account deletion — whichever comes first | Re-instruction and quality management |
| Payment records | 5 years | Korean E-Commerce Act, Art. 6 |
| Contract / subscription records | 5 years | Korean E-Commerce Act, Art. 6 |
| Consumer complaint / dispute records | 3 years | Korean E-Commerce Act, Art. 6 |
| Service usage logs | 3 months | Korean Wiretapping Act |
Upon account deletion, data is purged within 30 days, except items subject to statutory retention obligations.
5. Data Processing Entrusted to Third Parties
| Processor | Processing Activity | Country | Retention |
|---|---|---|---|
| Toss Payments (Viva Republica) | Domestic payment processing | Korea | Until contract termination |
| Eximbay Co., Ltd. | International card payment processing | Korea | Until contract termination |
| PortOne Korea, Inc. | Payment gateway integration | Korea | Until contract termination |
| PayPal Pte. Ltd. | International payment processing (PayPal) | Singapore | Until contract termination |
| Google LLC | OAuth authentication, Google Meet & Calendar integration, lesson infrastructure | USA | Until contract termination |
| Self-hosted servers (operated by the Company) | Service infrastructure and video classroom (no audio/video stored) | Korea | Text transcripts per Article 4 |
| OpenAI, L.L.C. | Realtime lesson transcription and caption translation (audio processed via API; discarded immediately, not used for model training) | USA | Not retained after API processing |
| Anthropic, PBC | Grammar analysis of lesson transcripts and lesson-material drafting (AI; not used for model training) | USA | Not retained after API processing |
| Resend, Inc. | Transactional email delivery | USA | Until contract termination |
Note on overseas processors: Transfers to Google LLC, OpenAI, L.L.C., Anthropic, PBC and Resend, Inc. (USA) and PayPal Pte. Ltd. (Singapore) constitute cross-border transfers under PIPA Art. 28-8, conducted on the basis of the cross-border consent collected at sign-up and processor agreements (including no-training clauses). Lesson audio sent for realtime transcription/translation is processed transiently via API and discarded immediately; only text transcripts are kept, per Article 4.
6. Cross-Border Transfer of Personal Data (PIPA Art. 28-8)
The Company transfers personal data outside Korea as described below. All transfers are based on explicit consent from the data subject, obtained through a separate consent screen at sign-up. The table below sets out all mandatory disclosure items under PIPA Art. 28-8(2).
| Item | Details |
|---|---|
| Recipient | Individual teacher (independent contractor / sole proprietor) located in the Philippines |
| Recipient Contact | Provided within the platform at the time of lesson assignment |
| Destination Country | Republic of the Philippines |
| Transfer Timing | On an ongoing basis from the point of lesson assignment |
| Transfer Method | Encrypted network (HTTPS/TLS) access within the platform |
| Data Transferred | Student name, email address, booking & lesson records, AI transcription text |
| Purpose | Lesson delivery, re-instruction and feedback based on lesson content |
| Retention Period | 1 year from the date of the last lesson, or upon account deletion — whichever comes first |
| Legal Basis | Explicit consent of the data subject (PIPA Art. 28-8(1)(i)) |
| How to refuse | Leave the relevant consent checkbox unchecked on the sign-up screen |
| Effect of refusal | If consent is refused, teacher assignment will not be possible and access to the teaching service will be restricted |
Students may withdraw consent for cross-border transfer at any time through account settings or by contacting customer support ([email protected]). Withdrawal will restrict access to the teaching service.
7. Data Subject Rights
| Right | Description |
|---|---|
| Access | View personal data held by the Company |
| Rectification | Request correction of inaccurate data |
| Erasure | Request deletion (except where statutory retention applies) |
| Restriction | Request that certain processing be suspended |
| Withdrawal of consent | Withdraw consent for consent-based processing (marketing, cross-border transfer) |
Requests will be processed within 10 days. Contact: [email protected]
8. Security Measures
- Technical: HTTPS encrypted transmission, database encryption, access controls, personal-data handler access logs retained for at least 1 year, regular security audits
- Organizational: Minimum personnel with data access, staff training, data handling guidelines
- Physical: Server access controls, data center security management
9. Cookies and Sessions
The Service uses cookies and sessions to maintain login state and improve user experience. You may disable cookies through your browser settings; however, certain features may become unavailable.
10. Data Protection Officer
| Data Protection Officer | TBD |
| [email protected] | |
| Phone | 010-4689-3332 |
Additional recourse: KISA (+82-118) | Personal Information Dispute Mediation Committee (+82-1833-6972)
11. GDPR-Lite Section for International Students
This section applies to Students residing in the EEA, the United Kingdom, or other jurisdictions where GDPR or equivalent legislation applies.
Legal Bases: Contract performance (Art. 6(1)(b)) for account, booking, and payment; Consent (Art. 6(1)(a)) for marketing and cross-border transfer; Legal obligation (Art. 6(1)(c)) for transaction records.
Rights: Access, Rectification, Erasure, Restriction, Data Portability, and the Right to Object. Requests are responded to within 1 month.
International Transfers: Data may be transferred to Korea, the United States (Google, OpenAI, Anthropic), Singapore (PayPal), and the Philippines (teachers), protected by appropriate safeguards.
You have the right to lodge a complaint with your local supervisory authority. UK residents may contact the ICO.
Contact: [email protected]
12. Changes to This Policy
Material changes will be announced at least 30 days in advance; minor changes at least 7 days in advance.
Current version: v1.2 | Amended: 2026-07-19 (effective date to be confirmed upon publication)