SSAMM Privacy Policy

This is an English translation provided for convenience. In case of any discrepancy, the Korean original prevails. Korean original: 한국어 원문

SSAMM (쌤) (the "Company") operates the AI math grading and feedback service "SSAMM" (including the website ssamm-ai.com, the web and app for teachers, the web and app for students, and related services; the "Service"), and, pursuant to Article 30 of the Personal Information Protection Act (PIPA), establishes and discloses this Privacy Policy as follows in order to protect the personal information of data subjects and to handle related grievances promptly and smoothly.

Article 1 (The Company's Two Roles — Personal Information Controller and Processor)

The Service is a business-to-business (B2B) service that an academy (hagwon, 학원) subscribes to and uses by issuing accounts to its teachers and students. Accordingly, the personal information processed by the Company is divided into the following two categories according to the Company's role.

1. Where the Company is the personal information controller (개인정보처리자): academy (director, office manager or other administrator) sign-up application information, teacher account information, website adoption inquiry information, information on sales consultation targets (academies) collected by sales representatives commissioned by the Company, information on the sales representatives (commissioned) themselves, and information collected directly by the Company for Service operation, security and fee calculation. In this case, this Privacy Policy applies directly.
2. Where the Company is a processor (수탁자): the personal information of students and guardians (legal representatives) and students' learning data (submitted answer images, grading results, progress, etc.). The personal information controller of this information is the academy with which the student is registered, and the Company processes it on behalf of the academy under the "Personal Information Processing Entrustment Agreement" concluded with the academy (an agreement to which the academy's administrator consents at Service sign-up; the "Entrustment Agreement"). Consent to the collection and use of personal information of students and guardians is obtained by the academy (the consent form on the student sign-up screen is displayed in the academy's name), and the academy's consent form and privacy policy prevail with respect to the purposes of collection, retention periods, etc. This Privacy Policy also sets out such matters in order to transparently inform how the Company, as a processor, processes and protects this information.

Students and guardians who wish to request access, correction, deletion, or suspension of processing should, in principle, make the request to their academy. Even where such a request is made directly to the Company, the Company will forward it to the relevant academy without delay and cooperate in handling it (see Article 9).

Article 2 (Purposes of Processing Personal Information)

1. Purposes for Which the Company Processes Personal Information as a Personal Information Controller

1. Review of academy sign-up applications and account creation: receipt of academy sign-up applications, review, approval and rejection of applications, issuance of academy codes, and creation of administrator accounts.
2. Processing of teacher sign-up applications and account management: creation of teacher accounts approved by the director of the academy concerned, identity verification, password resets, and account security (prevention of unauthorized logins, session management).
3. Provision and operation of the Service: registration and assignment of problems, review of grading results, sending of notifications (in-app notifications, app and web push), responding to usage inquiries (including generating AI answers to "AI Help questions" from teachers and directors and managing question count limits), and improvement of the Service and help using AI Help questions (compiling frequently asked questions, topic analysis, and improvement notifications to users who asked related questions). The content of AI Help questions (including attached images) is not used for marketing or advertising without the User's consent.
4. Fee calculation and contract management: management of plans and free trial periods, aggregation of AI grading usage, fee notices and billing, and suspension and resumption of use.
5. Improvement of Service quality and ensuring stability: error analysis (including collection and analysis of error occurrence information), usability improvement through screen usage records, analysis of beta test participants' activity, prevention of fraudulent use, and management of access logs.
6. Responding to website adoption inquiries: confirming receipt of inquiries, answering and consultation.
7. Sales consultations and follow-up: retention of records of visits to and consultations with academies by sales representatives commissioned by the Company, Service information and follow-up contact after consultations, checking for duplicate consultations with the same academy, verification of the fact of consultation (sample verification calls), linking consultation records to academies that have signed up for the Service (for calculating sales representatives' remuneration), and statistical analysis of adoption opinions (product improvement).
8. Payment of remuneration to sales representatives (commissioned) and tax reporting: management of sales representative accounts, calculation and payment of consultation activity fees and performance commissions, withholding on business income, and submission of withholding receipts and payment statements (including simplified payment statements).

2. Purposes for Which the Company Processes Personal Information on Behalf of Academies as a Processor (Entrusted Tasks under Article 2 of the Entrustment Agreement)

1. Management of student accounts (receipt of sign-up applications, approval by the academy or teacher, login, password management, and un-enrollment processing).
2. Storage of answer images for problems and AI-based grading and feedback processing (including reflecting responses to confirmation questions and supporting teacher review).
3. Management of learning history (submitted answers, grading results, time taken to solve, progress, re-assignment of incorrectly answered problems, etc.) and provision of internal statistics within the academy.
4. Generation of parent reports and issuance of viewing links to be delivered to guardians. Where an academy uses KakaoTalk AlimTalk sending, sending of messages notifying the parent report viewing link to the guardian's mobile phone number registered with the academy (where the AlimTalk message cannot be delivered, a substitute text message is sent depending on the academy's settings).
5. Sending of emails and notifications (in-app notifications, app and web push) to the student, such as notices of sign-up approval results and notifications of homework and grading results.
6. Improvement of grading quality within the relevant academy (using grading cases corrected by teachers of that academy as reference material for that academy's subsequent grading). This material is not shared with other academies or used for grading at other academies.
7. Service operation and quality analysis (error analysis, usability improvement, prevention of fraudulent use, and management of access records using activity records such as screen navigation and interaction records and image viewing records, as well as error occurrence information).
8. Fee calculation and grading quality checks through management of AI grading usage records (throughput, cost, judgment summaries, etc.).

The Company does not use personal information for purposes other than those above, and where a purpose changes, it will take necessary measures such as obtaining separate consent in accordance with Article 18 of PIPA.

Article 3 (Items of Personal Information Processed)

1. Items the Company Processes as a Personal Information Controller

2. Items the Company Processes as a Processor (Personal Information Controller: the Academy to Which the Student Belongs)

※ Except for the resident registration numbers of sales representatives (commissioned), the Service does not collect unique identification information such as resident registration numbers or sensitive information. However, content that a student writes directly on an answer image (such as a name) may be included in the image as is.

※ Legal basis for processing sales representatives' resident registration numbers: Because the Company is required to submit payment statements stating the income earner's resident registration number with respect to the remuneration paid to sales representatives under Article 127 (Withholding Obligation) and Articles 164 and 164-3 (Submission of Payment Statements and Simplified Payment Statements) of the Income Tax Act, the Company processes them without separate consent pursuant to Article 24-2(1)1 of PIPA (where specifically required or permitted by an Act or Enforcement Decree). Resident registration numbers are stored encrypted, only the first 7 digits are displayed on screen, and the original is used only for viewing and preparing data for tax reporting, with the viewer and the time recorded each time.

※ Legal basis for processing information on sales consultation targets: Article 15(1)1 of PIPA (the sales representative informs of the purposes of collection, items and retention period and confirms consent at the consultation site) and Article 15(1)6 (the Company's legitimate interest in providing Service information — minimal collection centered on the academy main phone number). For single-person academies, the academy main phone number may be the director's personal mobile phone, so it is treated as personal information.

Article 4 (Period of Processing and Retention of Personal Information)

The Company processes and retains personal information within the retention period prescribed by law or the retention period consented to by the data subject (in the case of students and guardians, by the academy).

Where retention is required under relevant laws, information is retained as follows.

• Records on contracts or withdrawal of subscription (청약철회), etc., and records on payment and supply of goods, etc.: 5 years (the Act on the Consumer Protection in Electronic Commerce, etc. (E-Commerce Act))
• Records on consumer complaints or dispute resolution: 3 years (the same Act)
• Service visit (access) records: 3 months (the Protection of Communications Secrets Act)
• Books and supporting documents under tax-related laws such as the Framework Act on National Taxes, the Corporate Tax Act and the Value-Added Tax Act: 5 years

Article 5 (Procedures and Methods for Destruction of Personal Information)

1. Destruction procedure: The Company destroys personal information without delay once its retention period has expired or the purpose of processing has been achieved. Where the information must be preserved under other laws, the relevant personal information is separated and stored separately.
2. Automatic destruction for un-enrolled students: When an academy processes a student's un-enrollment, the student's login is blocked immediately, and once 6 months from the date the un-enrollment is processed have passed, an automatic destruction job that runs once a day deletes the following.
   • The student account, profile (contact number, school, date of birth, guardian information, time of consent) and sign-up application forms
   • Submitted answer records and answer images kept in storage, and solution records and images for similar problems and re-assigned incorrectly answered problems
   • Grading review records, class membership and class join application history, and parent report snapshots
   • Screen navigation and interaction records, image viewing records, notifications, push tokens and login tokens
   • Traces remaining in materials kept by teachers: the student's name, ID and email are deleted from per-class statistics snapshots, answer PDF bundles that may include the student's answers are deleted, and the student's name in notification messages sent to teachers is replaced with "(un-enrolled student)"
   • AI grading usage records are kept for fee settlement, but the link to the student's submissions is severed so that the student cannot be identified.
3. Automatic destruction of information whose retention period has expired: An automatic destruction job that runs once a day deletes the following information whose retention period under Article 4 has expired.
   • Screen navigation and interaction records and image viewing records: those for which 1 year has passed from the date of collection
   • Website adoption inquiries: those for which 3 years have passed from the date of receipt
   • Rejected academy, teacher and student sign-up application information (names, IDs, encrypted password values, contact numbers, guardian information, etc. entered at the time of application): those for which 30 days have passed from the date of the rejection decision
   • Among sales consultation records, the academy main phone number, the director's name, the director's opinions, other free-text content, next contact notes, signboard photos and evidence photos (including images in storage): those for which 1 year has passed from the consultation date (excluding consultations linked to an academy that has signed up for the Service, but including them where that academy's data has been destroyed)
   • Sales representatives' (commissioned) resident registration numbers (ciphertext and masked values) and payout accounts: those for which 5 years have passed from the contract end date
   • AI Help question and answer records (including attached images): those for which 6 months have passed from the date of collection
   • Anonymized copies of AI Help questions and topic analysis results: those for which 3 years have passed
4. Automatic destruction upon academy termination or a teacher's leaving the academy: An automatic destruction job that runs once a day processes the following.
   • A teacher's leaving the academy: When the academy (director) processes a teacher's leaving the academy, the teacher's login and existing logged-in sessions are blocked immediately, and the classes in the teacher's charge are transferred to another teacher designated by the academy. Once 30 days from the date the leaving is processed have passed, the teacher account (name, ID, email, contact number, encrypted password value), approved sign-up application forms, problems, passages and problem sets registered by that teacher and the images in storage, and notifications, push tokens, login tokens, interaction records and image viewing records are destroyed. Because problems are the property of the teacher who registered them, they are not moved to other teachers or the director, and teachers may keep their own problems using the export function before their leaving is processed. Students' submission, grading and review records are kept because they are the students' learning history, but for destroyed problems all content (problem, correct answer, explanation, images) is deleted and only the items necessary for grade statistics, such as unit and difficulty, are kept, and the teacher account linked to these records is left in an unidentifiable state with the name, ID, email and contact number deleted. Within 30 days, the academy may cancel the leaving process and restore the account.
   • Academy termination: When the Service Agreement is terminated, logins of all directors, teachers and students of the academy and sign-up applications using the academy code are blocked immediately. Once 30 days from the termination date have passed, all data of the academy, including all students (regardless of un-enrollment, to the same extent as Item 2), all directors and teachers (to the same extent as a teacher's leaving the academy above), classes, homework and assignments, sign-up application forms, and notifications and usage notifications, as well as images and files in storage, are destroyed. AI grading usage records and daily student count records are retained for the period under Article 4 for fee settlement and tax evidence, but are kept with identification information such as the academy name and academy code deleted. Within 30 days, the termination may be cancelled and the data restored.
5. Destruction method: Information in electronic file form is deleted from the database so that the records cannot be reproduced, and image files in storage are deleted. Personal information printed on paper is shredded or incinerated. Information remaining in automatic database backups is automatically deleted according to the hosting provider's backup retention cycle.

Article 6 (Provision of Personal Information to Third Parties)

1. The Company processes the personal information of data subjects only within the scope of the purposes in Article 2, and provides it to third parties only in cases falling under Articles 17 and 18 of PIPA, such as with the data subject's consent or under special provisions of law.
2. The Company currently does not provide personal information to third parties.
3. The display of a student's learning results to the teachers and director of the academy, and viewing by a guardian through a parent report link issued by a teacher, constitute the performance of the business of the academy, which is the personal information controller, and do not constitute provision to third parties by the Company. However, because parent report links can be viewed without logging in, recipients of a link are asked to take care not to forward it to others.

Article 7 (Entrustment of Personal Information Processing)

1. Tasks the Company is entrusted with by academies: As described in Article 1, Item 2 and Article 2, Item 2, the Company is entrusted by academies (entrusting parties) with, and performs, the processing of personal information of students and guardians. The Entrustment Agreement provides for, among other things, prohibition of processing for purposes other than the entrusted purpose, technical and managerial protective measures, restrictions on re-entrustment, management and supervision, and compensation for damages, in accordance with Article 26(1) of PIPA. If the content of the Entrustment Agreement changes, the Company increments the agreement version, has the academy administrator review the full text of the changed agreement and consent again at the next login, and records the version consented to and the time of consent.
2. Tasks the Company entrusts in turn (including re-entrustment): For smooth provision of the Service, the Company entrusts the processing of personal information as follows. The entrustments below relating to student and guardian information are re-entrustments for which notice to the academy under Article 3 of the Entrustment Agreement replaces prior consent.

1. Depending on the type of notification, the title and body of app push notifications may include the class name, the number of homework questions and the deadline, a student's name (in student sign-up application notifications sent to teachers and directors), a teacher's name (in teacher sign-up application and problem handover notifications), and the academy's number of enrolled students and expected billing amount (in fee notices sent to directors), etc. Grading result notifications do not include scores, whether answers are correct, or answer content.
2. Web browser push notifications are delivered through the push service operated by the manufacturer of the browser used by the User (e.g., Google, Mozilla, Apple), and the content of notifications is transmitted encrypted.
3. When concluding an entrustment agreement, the Company specifies, in a contract or other document in accordance with Article 26 of PIPA, matters concerning prohibition of processing personal information for purposes other than performing the entrusted tasks, technical and managerial protective measures, restrictions on re-entrustment, management and supervision of the processor, and responsibilities such as compensation for damages, and supervises whether the processor processes personal information safely. Processing terms with overseas business operators follow the standard data processing terms (DPA) provided by each company.
4. If the content of the entrusted tasks or the processor changes, the Company will disclose this without delay through this Privacy Policy.

Article 8 (Overseas Transfer of Personal Information)

Pursuant to Article 28-8(1)3 of PIPA (overseas transfer for the entrustment of processing or storage of personal information, where disclosed in the privacy policy), the Company transfers personal information overseas and entrusts its processing as follows. Among the processors in Article 7, Solapi Inc. and Kakao Corp. (sending of KakaoTalk AlimTalk and text messages) are domestic business operators and therefore do not constitute an overseas transfer.

• Notice to students and guardians: The consent form in the academy's name on the student sign-up screen also states and gives notice of the recipients, countries of transfer, items transferred, purposes of transfer, time and method of transfer, retention periods, and the disadvantages of refusal above, and the same content is notified to academy administrators in Article 3 of the Entrustment Agreement.
• How to refuse overseas transfer and the disadvantages of refusal: Because the above overseas transfers are essential to the core functions of the Service (server operation, AI grading, sending of emails and notifications, and stable operation through collection and analysis of errors), if you do not wish your information to be transferred, you must stop using the Service (for students, by requesting un-enrollment and account deletion from their academy; for academies and teachers, by cancelling membership), in which case you cannot use the Service. If you do not register an email address, no overseas transfer for sending emails occurs, and if you do not allow push notifications, no overseas transfer for push notifications (Expo, Google, Apple) occurs. If you do not use AI Help questions, no overseas transfer for those questions occurs. Overseas transfer for collection and analysis of errors (Sentry) occurs only when an error occurs and cannot be turned off for individual users, but names, email addresses, phone numbers, answers, images, etc. are not transmitted.

Article 9 (Rights and Obligations of Data Subjects and Legal Representatives and Methods of Exercise)

1. Data subjects may at any time request the Company to provide access to, correct or delete their personal information, suspend its processing, or withdraw consent. In the case of children under the age of 14, the legal representative may exercise the above rights with respect to the child's personal information, and students aged 14 or older may also exercise their rights through their legal representative.
2. Students and guardians: Because the academy is the personal information controller of the personal information of students and guardians, please, in principle, request the exercise of rights from the academy concerned. Where a request is made directly to the Company, the Company will forward it to the relevant academy without delay and process it according to the academy's instructions. The actions that can be taken directly within the Service are as follows.
   • Checking and modifying "My Information" such as the student's own contact number, school and grade
   • Changing the password
   • Withdrawing consent to use for marketing and promotion (on the password change screen of the student app). To consent again after withdrawal, a new application must be made through the academy.
   • Un-enrollment and account deletion are processed by the academy concerned (teacher or director).
3. Academy administrators and teachers: Email addresses and contact numbers can be checked, modified and deleted directly on the "My Information" screen, and directors can do so for the academy main phone number on the "Academy Settings" screen; other requests for access, correction, deletion or suspension of processing may be made to the Chief Privacy Officer in Article 14 by email (support@ssamm-ai.com) or other means, and the Company will take action without delay.
4. Sales consultation targets (academies) and sales representatives (commissioned): Requests for access, correction, deletion or suspension of processing may be made to the Chief Privacy Officer in Article 14 by email (support@ssamm-ai.com), and the Company will take action without delay. However, deletion of sales representatives' resident registration numbers and payment history cannot be requested during the period for which there is a retention obligation under tax laws (Paragraph 6).
5. Rights may be exercised through an agent, such as the data subject's legal representative or a person who has been delegated authority. In this case, a power of attorney in the form of Annex Form No. 11 of the "Public Notice on Personal Information Processing Methods" must be submitted.
6. The rights of data subjects regarding requests for access to and suspension of processing of personal information may be restricted under Article 35(4) and Article 37(2) of PIPA. With respect to requests for correction and deletion of personal information, deletion cannot be requested where other laws specify that personal information as subject to collection.
7. The Company verifies whether the person who requested the exercise of rights is the data subject or a legitimate agent.

Article 10 (Processing of Personal Information of Children under the Age of 14)

1. Because the Service's main users range from elementary school students to high school students, personal information of children under the age of 14 is processed. The academy, as the personal information controller of the personal information of students and guardians, shall obtain the consent of the legal representative in accordance with Article 22-2 of PIPA.
2. The student sign-up screen of the Service displays the consent form in the academy's name and, regardless of age, requires confirmation by the legal representative (guardian) for all student sign-up applications except those of university students. At the time of application, the guardian's contact number and email and the relationship with the student must be entered, the legal representative's signature is replaced by checking a consent box for the confirmation details summarizing the student's name, date of birth, guardian's name and relationship, and the time of consent is recorded. An account is created only after the sign-up application is approved by a teacher of the academy.
3. Where a teacher registers a student directly, the academy shall register the student after obtaining the consent of the legal representative outside the Service.
4. The Company and the academy process only the minimum legal representative information necessary to confirm the legal representative's consent (name, contact number, email, relationship with the student).
5. When giving notice of matters concerning the processing of personal information to children under the age of 14, the Company endeavors to use an easy-to-understand format and clear and plain language.

Article 11 (Safeguards (Measures to Ensure Security) for Personal Information)

Pursuant to Article 29 of PIPA, the Company takes the following technical, managerial and physical measures necessary to ensure security.

1. Data isolation by academy: All data is separated by academy, and users of other academies cannot access it.
2. Restriction of access to content: Problems, correct answers and grading criteria registered by a teacher can be accessed only by the teacher who registered them, and neither the director nor other teachers can access them (an exception is made for quality review viewing by the Company's operations staff of problems in an account designated upon the consent of the teacher who registered the content to participate in beta testing; accounts are not designated without the teacher's consent, and access is blocked immediately upon withdrawal of consent or cancellation of the designation. Accounts of test academies that the Company operates itself for testing the Service are not Members' academies, so this consent requirement does not apply to them).
3. Encryption of passwords and tokens: Passwords are stored using one-way encryption (hashing) that cannot be decrypted, and for tokens for staying logged in and password reset tokens, only hash values, not the originals, are stored. When a password is changed, all existing login sessions are terminated.
4. Encryption in transit: Communications between the Service and Users are encrypted with HTTPS (TLS).
5. Protection of stored data: The database and storage apply encryption at rest provided by the hosting provider, and passwords are stored only as irreversible one-way hashes. Sales representatives' resident registration numbers are encrypted once more with a separate encryption key (AES-256) and stored, only the first 7 digits are displayed on screen, and the viewer and time are recorded each time the original is viewed or payment data (including resident registration numbers and accounts) is exported.
6. Management of access rights: Access rights are granted differentially according to role (student, teacher, director, platform operator), and the platform operator console is protected by separate access control (Cloudflare Access). When a user logs in with a temporary password reset by an administrator, the user is required to change the password.
7. Retention of access logs and viewing records: Image viewing records and key interaction records are retained to check for unauthorized access.
8. Minimization of handlers: Persons who handle personal information are limited to the representative (CEO).
9. Automatic destruction of information whose retention period has expired: Accounts and data of un-enrolled students, terminated academies and teachers whose leaving the academy has been processed, trial accounts, interaction and viewing records whose retention period has expired, sign-up application and inquiry information, etc. are automatically destroyed as set out in Article 5.

Article 12 (Installation, Operation and Refusal of Devices that Automatically Collect Personal Information)

1. The Company's website (ssamm-ai.com) does not use cookies that identify users or advertising or behavioral analysis tools. However, the website uses the language setting information sent by the browser to determine the visitor's language, and this information is not stored.
2. The teacher and student web screens store a login token in the user's browser storage (local storage) to keep the user logged in. The mobile apps store it in the device's storage. It is deleted upon logout, and users may refuse it by deleting site data in the browser settings. In this case, however, the login will not be maintained.
3. The Service stores screen navigation and key interaction records on the Company's servers (see Article 3). This is for Service improvement and ensuring stability, and the records are not provided to external analytics companies. However, when an error occurs on the Service server, the teacher and student apps and web, or the platform operator console, the error information set out in Articles 7 and 8, such as error details and the screen path of occurrence (including the immediately preceding screen navigation path), is transmitted to the error monitoring processor (Functional Software, Inc. — Sentry) for error analysis (from 2026-10-15). This transmission does not use cookies and is not used for advertising or behavioral analysis.

Article 13 (Automated Decisions)

1. The Service has AI analyze answers submitted by students and determine whether they are correct, partial scores, and feedback content.
2. Where the reliability of the AI's judgment is high, the result is finalized automatically; where it is ambiguous, the student is asked a short confirmation question or the case is referred to a teacher for review. Teachers can check and change all grading results.
3. Students and guardians may request an explanation or re-review of grading results from their academy (teacher).

Article 14 (Chief Privacy Officer)

The Company designates the Chief Privacy Officer as follows to take overall responsibility for work related to the processing of personal information and to handle data subjects' complaints and provide remedies for damages.

• Chief Privacy Officer: Christopher J. You (유재원) (Representative)
• Contact: support@ssamm-ai.com

Data subjects may contact the Chief Privacy Officer and the department in charge regarding all personal information protection inquiries, complaints, remedies for damages, etc. arising from the use of the Service. Students and guardians may also contact the chief privacy officer of their academy.

Article 15 (Requests for Access to Personal Information)

Data subjects may submit requests for access to personal information under Article 35 of PIPA to the department below. The Company will endeavor to ensure that data subjects' requests for access to personal information are processed promptly.

• Receipt and processing of requests for access to personal information: Chief Privacy Officer Christopher J. You (유재원) (support@ssamm-ai.com)

Article 16 (Remedies for Infringement of Data Subjects' Rights and Interests)

To obtain remedies for infringement of personal information, data subjects may apply for dispute resolution or consultation to the Personal Information Dispute Mediation Committee, the Personal Information Infringement Report Center of the Korea Internet & Security Agency (KISA), etc. For other reports of and consultations on personal information infringement, please contact the agencies below.

• Personal Information Dispute Mediation Committee: (without area code) 1833-6972 (www.kopico.go.kr)
• Personal Information Infringement Report Center: (without area code) 118 (privacy.kisa.or.kr)
• Supreme Prosecutors' Office: (without area code) 1301 (www.spo.go.kr)
• Korean National Police Agency: (without area code) 182 (ecrm.police.go.kr)

A person whose rights or interests have been infringed by a disposition or omission of the head of a public institution with respect to a request under Article 35 (Access to Personal Information), Article 36 (Correction and Deletion of Personal Information) or Article 37 (Suspension of Processing of Personal Information, etc.) of PIPA may file an administrative appeal as prescribed by the Administrative Appeals Act.

• Central Administrative Appeals Commission: (without area code) 110 (www.simpan.go.kr)

Article 17 (Changes to the Privacy Policy)

1. This Privacy Policy applies from 2026-10-10 (notice date 2026-10-02).
2. If any content of this Privacy Policy is added, deleted or modified, notice will be given through the website and Service notices at least 7 days before the effective date (30 days before for material changes unfavorable to users).
3. Change history
   • 2026-09-28: Initial establishment
   • 2026-09-28: Specification of automatic destruction after termination of academy and teacher accounts
   • 2026-10-09 (notice 2026-09-30; notification-related content first announced on 2026-09-29, content related to sales consultation evidence announced on 2026-10-01, and content related to AI Help questions announced on 2026-10-02): Addition of app push notification delivery processors (Google LLC — Firebase Cloud Messaging; Apple Inc. — Apple Push Notification service) and KakaoTalk AlimTalk sending processors (Solapi Inc.; Kakao Corp.); specification of the items and purposes processed when sending AlimTalk messages; specification of the information included in push notifications; addition of the purposes, items and retention periods of processing of information on sales consultation targets (academies) and sales representatives (commissioned) (including the legal basis for processing resident registration numbers); addition of collection of the academy main phone number (optional) at academy sign-up; addition of a processor for collecting and analyzing Service errors (Functional Software, Inc. — Sentry, United States) and specification of the items processed when an error occurs; specification that a photo of the academy signboard is required for in-person sales consultations, that the time of the director's confirmation is recorded, and that photo metadata is deleted; addition of the purposes of processing (generating answers, improving the Service and help), items and retention periods (identifiable records 6 months, anonymized copies 3 years) of AI Help questions (teachers' and directors' inquiries about using the Service) and the purposes and items of overseas transfer (Anthropic, United States) Version effective 2026-09-28
   • 2026-10-10 (notice 2026-10-02): Addition of attachment of a screen capture image (1 image) to AI Help questions — attached images added to the items processed (Article 3), the retention periods (6 months together with the question records, excluding anonymized copies - Articles 4 and 5), and the items of entrustment and overseas transfer (Anthropic, United States - Articles 7 and 8); specification that personal information in images is not automatically masked and of the user confirmation procedure. Version effective 2026-10-09

---

Company information: Trade name SSAMM (쌤) / Representative Christopher J. You (유재원) / Business registration number 232-59-00866 / Email support@ssamm-ai.com