GDPR Privacy Policy

The data controller responsible for your personal data is:

If you are located in the European Economic Area (EEA), the controller processes your data in accordance with Regulation (EU) 2016/679 (GDPR).

We process your personal data only when we have a lawful basis under Article 6 GDPR:

• •Consent (Art. 6(1)(a)) — for Google Analytics cookies and analytics data. You can withdraw consent at any time via the cookie settings.
• •Legitimate interests (Art. 6(1)(f)) — for Vercel Analytics (fully anonymous, aggregated data with no personal information) and for app preferences stored locally on your device.

• •To provide and improve the features of the Korean Easy app
• •To understand how visitors use the app and improve the user experience
• •To remember your app preferences such as font choice and theme

We use cookies only when you give consent. You can manage your preferences at any time via the cookie consent panel.

We share data with trusted third-party processors only as necessary to operate the service.

• •Vercel Analytics — privacy-focused, cookie-free, anonymous analytics for understanding aggregated usage patterns.
• •Google Analytics 4 — page view and session analytics, loaded only after you give explicit consent.
• •Vercel — hosting and infrastructure provider. See Vercel's Privacy Policy for details on data they process as a hosting provider.

We do not sell your personal data to any third party.

• •Data in localStorage is kept until you clear your browser storage or use the Clear Progress options within the app settings.
• •Vercel Analytics data is aggregated and fully anonymous — no personal data is retained.
• •Google Analytics data is retained for 14 months in accordance with Google's default retention period.

Some of our third-party processors are located outside the EEA (including the United States). Where data is transferred outside the EEA, we ensure adequate safeguards are in place:

• •Standard Contractual Clauses (SCCs) approved by the European Commission
• •Transfers to countries with an EU adequacy decision
• •Processor certifications (e.g. EU-US Data Privacy Framework where applicable)

If you are in the EEA, you have the following rights. To exercise any of them, contact us at the address in Section 13.

• •Right of access (Art. 15) — request a copy of the data we hold about you.
• •Right to rectification (Art. 16) — correct inaccurate or incomplete data.
• •Right to erasure (Art. 17) — request deletion of your data ("right to be forgotten").
• •Right to restriction (Art. 18) — limit how we process your data in certain circumstances.
• •Right to data portability (Art. 20) — receive your data in a structured, machine-readable format.
• •Right to object (Art. 21) — object to processing based on legitimate interests or for direct marketing.
• •Right to withdraw consent — withdraw any previously given consent at any time, without affecting the lawfulness of prior processing.
• •Right to lodge a complaint — file a complaint with your national data protection authority (e.g. UOOU in the Czech Republic, ICO in the UK, CNIL in France).

We will respond to requests within 30 days as required by GDPR.

We implement appropriate technical and organisational measures to protect your data against unauthorised access, loss, or disclosure. These include HTTPS encryption in transit and hosting on Vercel's secure infrastructure.

In the event of a personal data breach that poses a risk to your rights and freedoms, we will notify the relevant supervisory authority within 72 hours and inform affected users without undue delay where required by law.

Our service is not directed at children under the age of 16. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us and we will delete it promptly.

We may update this GDPR Privacy Policy from time to time. When we do, we will update the "Last updated" date at the top of this page.

Continued use of the service after the effective date constitutes acceptance of the updated policy.

For any privacy-related questions, requests, or complaints:

This policy was drafted for general informational purposes and does not constitute legal advice. For jurisdiction-specific compliance, consult a qualified data protection lawyer.