Privacy Policy

1. Purposes of Collection and Use of Personal Information

LOING (hereinafter the "Company") collects and uses personal information for the following purposes:

• Member management: Identifying members, verifying identity, and responding to service usage inquiries
• Service provision: Providing customized learning content, managing learning progress, and managing Nogli character data
• Service improvement: Optimizing AI difficulty adjustment through analysis of learning patterns, and developing new services
• AI-based automation: Automatic adjustment of learning difficulty (ELO system), recommendation of customized questions, and generation of TTS audio
• Sending advertising information: Sending advertising information such as events and special offers (limited to users who have consented to receive it)
• Avatar and draw operations: managing current appearance and composing profile images; providing draws, processing costs, restricting paid sources by country, verifying published probabilities, handling inquiries and disputes, and retaining records under applicable law

2. Items of Personal Information Collected

Email addresses, public usernames, and IP addresses are not copied into draw records. Only the internal identifier (_id) is used to link the user. General Service access logs are managed separately under the automatic-collection category above.

The store-country code is processed to determine whether paid sources may be used for draws and to record that decision. It is information read from the payment platform and reported by the app, and is not replaced by self-reported nationality, IP address, or app language.

Avatar profile images are composed on the server from pre-made layers corresponding to selected appearance identifiers. Photos of faces or hair from the device are not uploaded for this purpose. Collection of profile images supplied by social-login platforms follows the social-login category above.

3. Retention and Use Period of Personal Information

A user's personal information is destroyed immediately after the purposes of collection and use have been achieved. Records necessary under applicable law or the stated retention purposes below are kept only for the corresponding periods and purposes, and stored separately after account deletion:

Draw records, including free and ticket draws, are retained for 5 years from creation. On account deletion, they are moved to a separate storage area with restricted access, accessible only to personnel authorized for the retention purposes. They are destroyed using the methods in Section 7 when the retention period expires. The most recent 90 days available in the app are a viewing window, not the retention period.

4. Provision of Personal Information to Third Parties

As a general rule, the Company does not provide users' personal information to third parties. However, the following cases shall be exceptions:

• Where the user has consented in advance
• Where a request is made in accordance with statutes
• Where processing is entrusted within the scope necessary for the provision of services (see Article 5)

5. Entrustment of Personal Information Processing

For the provision of services, the Company entrusts personal information processing tasks as follows:

6. Transfer of Personal Information Abroad

For the provision of services, the Company transfers personal information abroad as follows:

All transfers abroad are carried out in compliance with the protective measures under Article 28-8 of the Personal Information Protection Act (Korea), and the Company has entered into personal information processing entrustment contracts with the relevant entrustees.

7. Procedures and Methods for Destruction of Personal Information

Destruction Procedure

1. Selection of items subject to destruction upon expiration of the retention period or achievement of the processing purpose
2. Approval by the Chief Privacy Officer
3. Execution of destruction and management of records

Destruction Method

• Electronic files: Permanently deleted by technical means that make recovery and reproduction impossible
• Paper documents: Shredded with a shredder or incinerated

8. Measures to Ensure the Safety of Personal Information

The Company takes the following measures to ensure the safety of personal information:

• Encryption: Passwords are stored using bcrypt one-way encryption, and transmission channels are encrypted with SSL/TLS.
• Access restriction: Access rights to personal information are minimized, and access records are managed.
• Access control: Access rights to the personal information processing system are managed on a role-based basis.
• Key management: Sensitive information such as encryption keys and API keys is managed separately as environment variables.
• Security inspection: Regular security inspections and remediation of vulnerabilities are conducted.

9. Users' Rights and How to Exercise Them

Users may exercise the following rights at any time:

• Request to access, correct, or delete personal information
• Request to suspend the processing of personal information
• Request for membership withdrawal

Procedure for Exercising Rights

1. Receipt: Submit a request through the in-app settings or to support@loing.app
2. Identity verification: Verification of whether the requester is the data subject (additional authentication if necessary)
3. Processing: Processed within 10 days from the date of the request
4. Notification: The result of processing is notified by email

Membership withdrawal can be made in-app via [Profile > Settings > Delete account] or on the website's Account Deletion Request Page.

10. Information on Automated Decision-Making

Based on a user's learning data, the Company's AI algorithms automatically make the following decisions:

• Adjustment of learning difficulty: Using the ELO rating system, questions suited to the user's level are automatically selected.
• Recommendation of customized content: Personalized learning content is recommended through analysis of learning history.

Users have the right to request an explanation of automated decisions or to refuse automated decisions. For related requests, please contact support@loing.app.

11. Personal Information of Children

The Company allows only persons aged 14 or older to sign up for the Service and confirms at sign-up whether the user is aged 14 or older. The Company does not collect personal information of children under 14, and if it becomes aware that personal information of a child under 14 has been collected, it will destroy that information without delay.

Our service is not directed to children under 13, and we do not knowingly collect personal information from children under 13. If we learn that we have collected such information, we will delete it promptly.

12. Receipt of Advertising Information

• The Company sends advertising information by email, push notification, or other means only to users who have consented in advance to receive it.
• When a user consents to receive advertising information or refuses it (withdraws consent), the Company notifies the user of the date and result of the processing.
• The Company reconfirms each user's consent to receive advertising information every 2 years from the date of consent.
• Users may withdraw their consent to receipt at any time in the in-app settings.
• Even after withdrawal of consent to receipt, notifications essential to the operation of the service (security alerts, changes to the terms, etc.) may still be sent.

13. Chief Privacy Officer

External Reporting and Counseling Agencies

• Privacy Infringement Report Center: privacy.kisa.or.kr / Tel. 118
• Personal Information Dispute Mediation Committee: www.kopico.go.kr / Tel. 1833-6972
• Supreme Prosecutors' Office Cyber Investigation Division: www.spo.go.kr / Tel. 1301
• National Police Agency Cyber Investigation Bureau: ecrm.police.go.kr / Tel. 182

14. Matters Concerning Changes to the Privacy Policy

This Privacy Policy may be amended in accordance with changes in statutes, policies, or security technologies, and in the event of any amendment, prior notice will be given through in-service announcements or by email.

These avatar- and draw-related amendments take effect on October 27, 2026 (on October 20, 2026, the effective date was changed from October 26 to October 27). The previous policy is available under Previous Privacy Policy.