READING & Privacy Policy
READING & Privacy Policy
iPortfolio Inc. (the "Company") establishes and discloses the following Privacy Policy in accordance with Article 30 of the Personal Information Protection Act, in order to protect the personal data of data subjects and to handle related grievances promptly and smoothly.
The Company's Privacy Policy may change from time to time in line with changes in government legislation and guidance and in the Company's terms and internal policies. Where the Company amends the Privacy Policy, it will announce the amendment through a notice on the Website (or by individual notice).
1. Personal data we collect
The Company collects the following personal data for purposes such as membership registration, consultation, and service applications.
| Purpose | Category | Personal data items |
|---|---|---|
| Membership registration | Membership registration (common) | [Required] Name, user ID, password, email, mobile telephone number |
| Membership registration and simple sign-in linkage (social accounts) | Kakao simple sign-up | [Required] Profile information (nickname / profile picture), sign-in identifier [Optional] Kakao account (email, mobile telephone number) |
| Membership registration and simple sign-in linkage (social accounts) | Apple simple sign-up | [Required] Email (where "Hide My Email" is enabled, the randomly assigned email is collected), sign-in identifier |
| Membership registration and simple sign-in linkage (social accounts) | Whale Space simple sign-up | [Required] User type (student / teacher), sign-in identifier [Optional] Whale Space account (email) |
| Provision of goods or services | Product orders | [Required] Payment information, payment records |
| Provision of goods or services | Product orders (where a delivered product is ordered) | [Required] Payment information, payment records, delivery information (recipient name, recipient mobile telephone number, recipient address) |
| Provision of goods or services | When using the Service (entering and editing member information) | [Required] Child's name, child's date of birth [Optional] Parent's name, name of school / kindergarten |
| Consultation and service applications | - | Name, mobile telephone number, email, date of birth, content of the consultation, order information |
| Use of AI services, and improvement of their performance and algorithms | - | Conversation information exchanged with the AI (conversation content including audio and the like), service usage behaviour information (input and outputs) |
| Information collected and generated automatically through use of the Service | - | Service visit and usage records, learning information, purchase history, browser information, device information (operating system, model name, device unique number, OS version, app version), IP address, and the user's voice information when recording |
2. How we collect personal data
The Company collects personal data by the following means.
- The website, the app, telephone, the consultation board, email, event entries, and use of AI services
3. Purposes of collection and use of personal data
The Company uses the personal data it collects for the following purposes.
- Performance of the contract for provision of the Service and settlement of charges for the Service provided: provision of content, provision of specific tailored services, purchase and payment of charges, identity verification for financial transactions, and financial services
- Member management: identity verification for use of membership-based services, individual identification, confirmation of intent to join, confirmation of whether the legal guardian has consented where the personal data of a child under the age of 14 is collected, handling of complaints and other grievances, and delivery of notices
- Use for new service development, marketing, and advertising: development of new services and provision of tailored services, provision of services and placement of advertising based on demographic characteristics, verification of service effectiveness, provision of event information and participation opportunities, provision of commercial information, measurement of access frequency, improvement of service quality, and service usage statistics
4. Retention and use period of personal data
In principle, once the purposes of collection and use of personal data have been achieved, the Company destroys the data without delay. However, where retention is required under applicable laws, the Company retains member information for the periods prescribed by those laws, as follows.
- Records on contracts or withdrawal of purchase: 5 years (Act on Consumer Protection in Electronic Commerce)
- Records on payment and the supply of goods: 5 years (Act on Consumer Protection in Electronic Commerce)
- Records on consumer complaints or dispute handling: 3 years (Act on Consumer Protection in Electronic Commerce)
- Records on identity verification: 6 months (Act on Promotion of Information and Communications Network Utilization and Information Protection)
- Records of visits: 3 months (Protection of Communications Secrets Act)
5. Procedure and method for destruction of personal data
In principle, once the purposes of collection and use of personal data have been achieved, the Company destroys the data without delay. The procedure and method are as follows.
- Destruction procedure
- Information you enter for purposes such as membership registration is, once the purpose has been achieved, moved to a separate database (or, in the case of paper, to a separate filing cabinet), stored for a certain period in accordance with internal policy and the information protection grounds under other applicable laws (see the retention and use period), and then destroyed.
- Personal data moved to a separate database is not used for any purpose other than being retained, except where required by law.
- Destruction method
- Personal data printed on paper is destroyed by shredding or incineration.
- Personal data stored in electronic file form is deleted using a technical method that makes the records unrecoverable.
6. Provision of personal data to third parties, and processing on our behalf
- Provision of personal data to third parties
- The Company does not provide a data subject's personal data to third parties without prior consent or a procedure prescribed by law.
- The Company processes a data subject's personal data only within the scope stated in the purposes of processing, and provides personal data to third parties only where Article 17 or Article 18 of the Personal Information Protection Act applies, such as the data subject's consent or a special provision of law; it does not provide personal data otherwise.
- Where personal data is to be provided to a third party, the Company will inform the data subject in advance of the recipient of the personal data, the purpose of provision, the items of personal data to be provided, and the period for which the third party will retain and use the personal data, obtain separate consent to this, and provide the data with due care.
- Entrusted processing of personal data (processing on our behalf)
For a smooth and convenient service, the Company entrusts the processing of personal data to external specialist providers, within a minimum and limited scope. When entering into an entrustment agreement, the Company separately stipulates the relevant matters so that personal data is managed securely.
| Processor | Entrusted work | Retention and use period |
|---|
- Overseas transfer of personal data in connection with AI services
The Company transfers personal data overseas in order to provide AI services smoothly. The Company uses more than one AI service provider in order to operate the service reliably and to improve quality, and may use any of the providers below selectively, depending on the circumstances of the AI service provider. You may refuse the overseas transfer, but use of AI features may then be restricted. The other basic learning services can still be used as normal.
- Services concerned: LAURA conversation activities, LAURA reports, Reading & Letters, AI-based learning feedback
- Personal data items transferred: text entered within LAURA activities, text converted by speech recognition, and conversations with the AI
- Country to which personal data is transferred: United States
| Overseas processor | Entrusted work | Retention and use period |
|---|---|---|
| OpenAI | Generating AI conversations, generating reports, generating letter content, providing AI learning feedback | Retained for up to 30 days for abuse monitoring purposes, then destroyed |
| Anthropic, PBC | Generating AI conversations, generating reports, generating letter content, providing AI learning feedback | Retained for up to 7 days for abuse monitoring purposes, then destroyed |
| Google LLC | Generating AI conversations, generating reports, generating letter content, providing AI learning feedback | Retained for up to 55 days for abuse monitoring purposes, then destroyed |
Note - Legal basis for the overseas transfer: Article 28-8(1)(3)(a) of the Personal Information Protection Act (entrustment of processing or storage overseas for the performance of a contract).
Note - Privacy policies of each processor: OpenAI Privacy Policy (https://openai.com/policies/privacy-policy), Anthropic Privacy Policy (https://www.anthropic.com/privacy), Google Cloud Privacy (https://cloud.google.com/terms/cloud-privacy-notice)
7. Rights of users and legal guardians, and how to exercise them
- Users and legal guardians may at any time view or amend the registered personal data of themselves or of the child under the age of 14 concerned, and may also request cancellation of membership.
- To view or amend the personal data of a user or of a child under the age of 14, click "Edit personal data" (or "Edit member information" and the like); to cancel membership (withdraw consent), click "Withdraw from membership". After completing identity verification you may view, correct, or withdraw directly.
- Alternatively, if you contact the Privacy Officer in writing, by telephone, or by email, we will act without delay.
- Where you request correction of an error in your personal data, we will not use or provide the personal data concerned until the correction is complete. Where incorrect personal data has already been provided to a third party, we will notify the third party of the outcome of the correction without delay so that the correction is made.
- Personal data terminated or deleted at the request of a user or legal guardian is handled by the Company as stated in "Retention and use period of the personal data we collect", and is processed so that it cannot be viewed or used for any other purpose.
8. Measures to secure personal data
To prevent users' personal data from being lost, stolen, leaked, altered, forged, or damaged, the Company implements the following technical and administrative protective measures in accordance with the Personal Information Protection Act and other applicable laws.
- Minimising and training personnel who handle personal data
- The Company limits the employees who handle personal data to those who need to do so for their work, and manages access by granting differentiated access rights to the Privacy Officer and responsible staff. The Company also establishes internal guidelines on personal data protection and continuously manages compliance with the Privacy Policy through regular training and inspection.
- Establishing and implementing an internal management plan
- The Company establishes and operates an internal management plan for the safe processing of personal data, checks in advance for risk factors that may arise in the course of processing personal data, and continuously supplements the necessary protective measures.
- Access control for the personal data processing system
- The Company has procedures for granting, changing, and revoking access rights to systems that process personal data, and implements administrative measures to prevent unauthorised access. The Company also controls unauthorised external access through security systems such as intrusion prevention systems.
- Encryption of personal data
- Among users' personal data, passwords are stored and managed in encrypted form, and a password may be checked and changed only by a user or administrator with legitimate authority over the account concerned. Other important personal data is processed securely by applying encryption or equivalent protective measures during storage and transmission.
- Technical countermeasures against hacking, malicious code, and the like
- To protect personal data from external intrusion such as hacking and computer viruses, the Company installs and operates security programs and maintains the safety of its systems through periodic checks and updates. The Company also operates a monitoring system so that it can respond promptly if abnormal signs occur.
- Retention of access logs, and prevention of alteration and forgery
- The Company retains and manages access logs for the personal data processing system in accordance with applicable laws, and applies security measures to prevent access logs from being altered or forged.
- Physical security measures
- The Company has access control procedures for physical storage locations where personal data is held, such as the computer room and the document storage room, and implements physical protective measures such as restricting access.
9. Protection of the personal data of children under the age of 14
- Obligation to obtain the legal guardian's consent
- Where the Company wishes to collect or use, or to provide to a third party, the personal data of a child under the age of 14, it must first obtain the consent of the legal guardian (a parent or the like) in accordance with applicable laws.
- Procedure for obtaining consent, by member type
- Individual members: at the sign-up stage, the Company identifies whether the applicant is under 14, and registration is approved only once identity verification of the guardian through a specialist agency (mobile telephone verification and the like) has been completed.
- Institutional members (schools, academies, libraries, and the like): where an institution creates student accounts, that institution lawfully obtains and retains the prior consent of the legal guardian in accordance with applicable laws. The Company confirms with the institution that consent has been obtained and may, where necessary, carry out verification steps such as requesting a copy of the consent form.
- Procedure for obtaining consent for institutional members (schools, academies, libraries, and the like)
Where an institution creates accounts for students under the age of 14, the Company has a duty under Article 22-2 of the Personal Information Protection Act to confirm that the legal guardian's consent has been lawfully obtained. To that end, the Company carries out the following steps.
- The institution must obtain the prior consent of the legal guardian in accordance with applicable laws before creating student accounts, and must retain the consent form.
- The Company requests the institution to confirm whether the legal guardian's consent has been obtained, and the institution must submit to the Company a copy of the consent form or material evidencing that consent was obtained.
- The Company may restrict provision of the Service, or hold the creation of an account, in respect of any student account for which it has not been confirmed that consent was obtained.
- The Company includes in its service agreement with the institution provisions on the duty to obtain the legal guardian's consent and on the verification procedure, and periodically confirms whether the institution has performed its obligations.
- Guaranteeing the rights of legal guardians
- The legal guardian of a child under the age of 14 has all rights to request access to, correction of, deletion of, and suspension of processing of the child's personal data, and the Company handles such requests without delay in accordance with Section 7 (Rights of users and legal guardians, and how to exercise them).
10. Installation, operation, and refusal of cookies and automatic collection devices
- Purposes for which cookies and automatic collection devices are used
- The Company uses cookies and similar automatic collection technologies for purposes such as operating the Service, analysing usage statistics, and measuring advertising effectiveness.
- List of cookies and tracking tools in use
| Category | Provider | Purpose | Cookie name | Retention period |
|---|---|---|---|---|
| Essential | The Company (first party) | Maintaining sign-in state and normal operation of the Service | JSESSIONID, SESSION, uuid | Session to 1 year |
| Functional | The Company (first party) | Recording whether cookie consent was given | acceptCookie | 1 year |
| Analytics | Google LLC | Analysis of service usage statistics (number of visitors, page views, time on site, and the like) | _ga, _gid, ga* | 24 hours to 2 years |
| Analytics | Microsoft Corp. | Analysis of user behaviour (clicks, scrolling, and other heat-map analysis) | _clck, _clsk, MUID | 1 day to 1 year |
| Advertising | Google LLC | Measurement of advertising conversions | _gcl_au | 90 days |
| Advertising | Meta Platforms, Inc. | Tracking and measurement of advertising conversions | _fbp | 90 days |
- How cookies are installed, operated, and refused
- Users may refuse the storage of cookies by changing their browser settings.
- Chrome: Settings > Privacy and security > Cookies and other site data
- Safari: Preferences > Privacy > Cookies and website data
- Edge: Settings > Cookies and site permissions > Manage and delete cookies and site data
- If you refuse strictly necessary cookies, some services such as signing in may be restricted.
11. Privacy grievance service
To protect customers' personal data and to handle complaints relating to personal data, the Company designates the following department and Privacy Officer.
- Privacy Officer details and contact information
- Name: Park Ji-ho
- Position: Head of Business Division
- Email: security@readingn.com
You may report any personal data protection grievance arising from your use of the Company's services to the Privacy Officer or to the responsible department. The Company will respond to reports from users promptly and fully.
12. Changes to this Privacy Policy
This Privacy Policy applies from 8 June 2026.
Announced 28 May 2026
Effective 8 June 2026
(Remainder of page intentionally left blank)
Annex: Sign-up consent forms
These are separate published documents linked from the sign-up screen, not part of the Privacy Policy body above. They are translated here because they are the consent documents users actually see, and because an English sign-up flow cannot go live without them.
Annex A. Consent to the collection and use of personal data (required)
Source: https://www.readingn.com/policy/collectedinfo
Consent to the collection and use of personal data (required)
| Purpose | Items | Retention period |
|---|---|---|
| Identity verification | Name, user ID, password, date of birth, telephone number, email | Until consent is withdrawn or membership is cancelled |
| Performance of the contract for provision of the Service and settlement of charges for the Service provided | User ID, password, date of birth, telephone number, email, service usage records | Until consent is withdrawn or membership is cancelled |
| Member management | User ID, password, date of birth, telephone number, email, service usage records and device information | Until consent is withdrawn or membership is cancelled |
| Development of new services and provision of tailored services | Name, user ID, telephone number, email, service usage records and device information | Until consent is withdrawn or membership is cancelled |
You have the right to refuse consent to the collection and use of your personal data; if you refuse, membership registration will be restricted.