Privacy Policy
Last updated: October 15, 2026
Effective date: February 4, 2026
Revision history: enacted February 4, 2026 · fully amended September 17, 2026 (restructured to the 2026 PIPC drafting guidelines; processors PortOne·KG Inicis named; outsourcing and international-transfer disclosures updated; under-14 standard applied) · amended October 15, 2026 (Kakao and Naver sign-in items, Toss Payments for subscriptions, OpenAI added as AI sub-processor, no sign-up under 14 and legal-representative consent for payments under 19, correction on retention of recognized figure-area images, purchaser information and billing key items, browser storage items, processing basis for acquisition data, roles of login providers distinguished).
This English text is a reference translation of the Korean Privacy Policy. The Korean version is the
authoritative and binding version; in case of any conflict, the Korean version prevails.
EasyMakeQuiz (the "Company") establishes and discloses this Privacy Policy pursuant to Article 30 of the Korean Personal Information Protection Act (PIPA) to protect the personal information of data subjects and to handle related grievances promptly. This policy applies to the EasyMakeQuiz service (easymakequiz.com and its subdomains).
Article 1 (Purposes of Processing)
The Company processes personal information for the following purposes:
- Membership registration and management: providing membership services, identity verification, preventing unauthorized use, notices
- Service provision: creating and storing problems/workbooks, AI recognition features, content management
- Paid services: credit/subscription payment, billing, refunds and settlement
- Customer support: handling inquiries, dispute resolution, delivering notices
- Service improvement & statistics: usage analysis, new feature development, quality improvement
- Security & safety: detecting abnormal access, responding to security threats, retaining access logs
Article 2 (Items of Personal Information Processed)
| Category | Items | Required/Optional |
|---|---|---|
| Google social login | Email address, name, profile picture URL, Google account identifier | Required |
| Kakao social login | Email address, Kakao member identifier (when the user agrees on Kakao's consent screen) | Required |
| Naver social login | Contact email address, Naver member identifier (when the user agrees on Naver's consent screen) | Required |
| Automatically collected during use | Access IP address, access date/time, device/browser/OS information, service usage and access logs, information collected via cookies and similar technologies | Required |
| Acquisition source (first-touch) | Referrer host, UTM parameters (utm_source/medium/campaign), first landing page path | Required (automatic) |
| When using paid services | Payment amount/date/method, subscription type/period, credit usage records, purchaser's name, email and mobile phone number (entered on the checkout screen and passed to the payment processor), subscription billing key (stored encrypted), card issuer and last 4 digits of the card number | Required |
| When using AI recognition | Uploaded problem images and text, recognition results (shapes, text, LaTeX) | Required |
- The full card number, expiry date and CVC are processed by the payment companies (the payment processor PortOne, the integrated PG company (KG Inicis) and the subscription payment company Toss Payments); the Company does not store them. For subscription recurring billing, the Company stores the billing key issued by Toss Payments (encrypted), the card issuer and the last 4 digits of the card number.
- First-touch acquisition data is recorded only once at sign-up, for sign-up source analysis under PIPA Article 15(1)(vi), and is not updated thereafter.
- The Company does not separately collect or use personal information of third parties (such as students) contained in problem images or documents that members upload, and is not involved in the content of those materials. Members must take care not to include such information unnecessarily; if they upload it, the authority and responsibility to use that material lawfully rest with the member.
Article 3 (Retention and Use Periods)
| Information | Retention Period | Legal Basis |
|---|---|---|
| Account information | Until account deletion (30-day recovery window after deletion → anonymization / permanent deletion) | Service agreement / consent |
| Login (access) logs | 3 months | Protection of Communications Secrets Act |
| Payment / transaction records | 5 years | E-Commerce Act |
| Contract / withdrawal records | 5 years | E-Commerce Act |
| Consumer complaint / dispute records | 3 years | E-Commerce Act |
| AI recognition usage records (usage, credit deductions, cost) | 5 years | E-Commerce Act (payment records) |
| AI recognition logs (extracted text/summary, error logs) | Up to 30 days | Service operation / error response |
| First-touch acquisition data | Until account deletion (removed upon anonymization) | Sign-up source analysis (PIPA Article 15(1)(vi)) |
- Deletion process: Upon withdrawal, the account is immediately deactivated (soft delete) and sessions are invalidated. If the same Google account signs in within the 30-day recovery window, the account and content are restored. After 30 days, stored content (problems, images, fonts, etc.) is permanently deleted and account personal information (email, name, profile) is anonymized. Payment and accounting records are stored separately for the statutory retention periods above.
- AI input images: Entire uploaded original images (pages, photos) are transmitted to the AI processor for recognition and are not stored on the Company's servers. However, the figure-area image (crop) used for recognition is kept in the member's storage (R2) for the "compare with original" feature, and is deleted when the problem is deleted or when content is deleted on account withdrawal. Recognition results (shapes, text) are saved as the user's problem content.
Article 4 (Provision to Third Parties)
The Company does not provide personal information to third parties, except:
- When the data subject has given prior consent;
- When specifically required by law;
- When an investigative agency requests it under statutory procedures.
The Company does not sell personal information to third parties for advertising or marketing purposes.
Article 5 (Outsourcing of Processing)
The Company outsources personal information processing as follows, and supervises processors under contract:
| Processor | Outsourced Work | Retention/Use Period |
|---|---|---|
| Cloudflare, Inc. | Cloud infrastructure/CDN/data storage (DB, files, sessions), anonymous web analytics (cookieless) | Until end of contract or account deletion |
| OpenRouter, Inc. | AI recognition request relay — forwards uploaded images/text to AI model providers (sub-processors: Google LLC, OpenAI, L.L.C. and other AI model providers) | At time of request (not retained) |
| Google LLC (information source / authentication provider) | Google account login (OAuth) — provides the Company with the account identifier, email, name and profile picture the Member agreed to share (an information source, not outsourcing) | Until end of contract or account deletion |
| Google LLC | Gemini AI recognition via OpenRouter (sub-processing) | Until end of contract or account deletion |
| Korea PortOne Co., Ltd. (PortOne) / KG Inicis | Credit payment processing (domestic credit cards) | Statutory retention periods |
| Toss Payments Co., Ltd. | Subscription recurring billing and payment processing (domestic credit cards) | Statutory retention periods |
| Kakao Corp. / NAVER Corp. (information source / authentication provider) | Kakao and Naver account login (OAuth) — provides the Company with the account identifier and email the Member agreed to share (an information source, not outsourcing) | Until end of contract or account deletion |
* Login providers (Google, Kakao, Naver) are not processors to which the Company outsources processing; they are information sources and authentication providers that give the Company information with the Member's consent, and are listed in this table for clarity.
* The Kakao alert feature is used only for internal usage alerts sent to the Company operator and contains no user personal information.
Article 6 (International Transfers of Personal Information)
The Company transfers personal information overseas as follows. You may refuse international transfer; refusal may restrict features (login, AI recognition, error response). Refusal can be made by withdrawing membership or by contacting customer support ([email protected]).
| Recipient (Contact) | Country | Timing & Method | Items | Purpose | Retention/Use Period |
|---|---|---|---|---|---|
| Cloudflare, Inc. ([email protected]) | USA | Transmitted over the network (TLS) at time of use | Account/content data, access logs | Cloud infrastructure/CDN/storage | Until end of contract or deletion |
| OpenRouter, Inc. (privacy policy openrouter.ai/privacy) | USA | Transmitted over the network (TLS) on AI recognition requests | Uploaded images/text | AI recognition relay | At time of request (not retained) |
| Google LLC (privacy policy policies.google.com/privacy) | USA | Transmitted over the network (TLS) for login/recognition | Account identifier, email, images/text | OAuth login, Gemini AI recognition (sub-processed via OpenRouter) | Until end of contract or deletion |
| OpenAI, L.L.C. (privacy policy openai.com/policies/privacy-policy) | USA | Transmitted over the network (TLS) via OpenRouter for recognition | Uploaded images/text | AI recognition (sub-processed via OpenRouter) | Per OpenAI's API data retention policy |
* Domestic payment companies (PortOne, KG Inicis, Toss Payments) and domestic login providers (Kakao, Naver) process data within Korea and are not subject to international transfer.
Article 7 (Destruction Procedures and Methods)
- Procedure: Personal information whose retention period has expired or purpose achieved is destroyed without delay. Information that must be retained by law is separated into a distinct database and destroyed after the retention period.
- Method: Electronic files are permanently deleted by irreversible means; paper documents are shredded or incinerated.
- Basis/items for retained information: Under the E-Commerce Act, payment/contract/consumer-complaint records (items: payment, transaction, subscription, credit usage) are retained for the periods in Article 3.
Article 8 (Rights of Data Subjects and Legal Representatives)
- You may at any time exercise the rights to: access (PIPA Art. 35), rectification (Art. 36), deletion (Art. 36), and suspension of processing (Art. 37).
- Requests may be made via the in-service settings page or by email ([email protected]); the Company acts within 10 days and notifies the result.
- Rights may be exercised through a legal representative or authorized agent, who must submit a power of attorney.
- You are responsible for keeping your personal information accurate.
Article 9 (Security Measures)
- Administrative: minimizing and controlling access rights, managing personnel.
- Technical: transport encryption (HTTPS/TLS), authentication/session management, access logging, vulnerability response.
- Access control: managing the grant, change, and revocation of access rights to processing systems.
Article 10 (Automatic Collection Devices and Behavioral Information)
1. Cookies and similar technologies
| Name/Technology | Purpose | Type | Duration |
|---|---|---|---|
sid | Login session authentication | Essential | 7 days (30 days for "remember me") |
csrf_token | CSRF security | Essential | 1 hour |
locale | Language preference | Preference | 1 year |
emq_ft | First-touch acquisition (temporary) | Functional | 30 days |
emq_li | Login-state hint | Functional | Same as session cookie (7 days, 30 days for "remember me") |
emq_checkout_phone:<member ID> (localStorage) | Remembers the mobile number entered on the checkout screen | Functional | Deleted on logout or account withdrawal |
emq_last_login_provider (localStorage) | Shows the sign-in method used last | Functional | Kept in the browser (can be cleared by the user) |
| localStorage (editor autosave) | Prevent work loss | Functional | 24 hours (auto-cleanup) |
| localStorage (UI preferences) | Dark mode, fonts, etc. | Preference | Until cleared |
- Essential cookies (
sid,csrf_token) cannot be refused. Preference/functional cookies can be blocked via browser settings, though some features (language persistence, autosave) may then be limited. - For visit statistics the Company uses Cloudflare Web Analytics, which is cookieless and does not collect information that identifies individuals (Cloudflare's published statement: cloudflare.com/web-analytics).
- The Company does not use third-party tracking cookies for advertising.
2. Behavioral information — collection, use, and refusal
The Company does not collect or use behavioral information for online targeted advertising. If behavioral information is collected in the future, the Company will disclose the items, purpose, retention period, and refusal method in this policy in advance and obtain separate consent.
Article 11 (AI and Automated Processing)
- The AI recognition feature is an assistive tool that converts uploaded images/text into shapes, formulas, and problem data; it does not make automated decisions with legal or similarly significant effects on the user.
- AI recognition occurs via the Company-provided path (Gemini via OpenRouter); uploaded images/text are sent for that processing, and the Company stores the result.
- You may request an explanation of, or object to, automated processing ([email protected]). The Company does not use user content for AI training; if such use becomes necessary, it will amend this policy in advance and obtain separate consent.
Article 12 (Notification of Data Breach)
- Upon becoming aware of a loss, theft, or breach of personal information, the Company notifies affected data subjects within 72 hours (absent justifiable cause) of the affected items, timing and circumstances, mitigation measures, and the Company's response and remedy procedures. Where unlawful access to a personal-information processing system makes a breach likely but the affected individuals cannot yet be identified, or a confirmed partial breach suggests that other individuals' data may also have been exposed, the Company notifies the possibility of a breach within 72 hours of becoming aware, before confirmation, and follows up once confirmed (Enforcement Decree of the Personal Information Protection Act, Article 39-2).
- Where a breach affects 1,000 or more data subjects, or involves sensitive or unique identifying information, the Company reports to the Personal Information Protection Commission or the Korea Internet & Security Agency as required by law.
Article 13 (Personal Information of Children Under 14)
- Children under 14 may not sign up, and the Company does not collect personal information from children under 14. Users confirm that they are 14 or older when signing up.
- Members under 19 need the consent of their legal representative to pay for paid services (Terms of Service, Article 4-2).
- If personal information of a child under 14 is found to have been collected without the legal representative's consent, the Company destroys it without delay. Legal representatives may request access/rectification/deletion at [email protected].
Article 14 (Data Protection Officer)
| Data Protection Officer | Han Gyeol (Representative) |
| Contact | [email protected] / 070-7954-9088 |
- Inquiries, complaints, and remedy requests may be submitted to the above contact; the Company responds within 3 business days.
- Department receiving/processing access requests: Customer Support ([email protected]).
Article 15 (Remedies for Infringement of Rights)
- Privacy Infringement Report Center (KISA): 118 / privacy.kisa.or.kr
- Personal Information Dispute Mediation Committee: 1833-6972 / www.kopico.go.kr
- Supreme Prosecutors' Office Cybercrime Division: 1301 / www.spo.go.kr
- National Police Agency Cybercrime Bureau: 182 / ecrm.police.go.kr
Article 16 (Changes to this Privacy Policy)
- This policy may be amended due to changes in law, policy, or the service.
- Amendments are announced at least 7 days in advance via in-service notice or email.
- Material changes (new items collected, changes to third-party provision/outsourcing) are announced at least 30 days in advance, with renewed consent obtained where necessary.
Addendum (Overseas Users)
The Korean version is authoritative, and the Service processes personal information under the laws of the Republic of Korea. Only if the Company formally targets users in the EEA or California, etc., will it add separate GDPR/CCPA notices as an addendum. This policy currently contains no standalone rights sections for those jurisdictions.