Privacy Policy

Your personal data is collected and processed by the following company (the data controller):

The Company collects and uses personal data within the minimum scope necessary to provide the Service. Depending on how you sign up and which features you use, the following categories of personal data are processed:

The Company does not collect your age or date of birth at sign-up.

The Company uses personal data for the following purposes:

• Membership management — verifying and authenticating your identity, maintaining and managing membership status, preventing fraudulent sign-up, and delivering notices
• Service provision — e-book reading, activation of purchased content, storage and syncing of learning records, study notes, and handwriting data, storage of uploaded files, and service quality improvement
• Payment and refunds (where applicable) — payment and settlement, cancellation and refunds, and checking fraudulent transactions
• Customer support — receiving and handling inquiries and complaints, and keeping records of consultations
• Statistics and analytics — traffic statistics, usage and crash analysis, and service improvement
• Marketing (only with your separate consent) — information about events, feature updates, and new services

In principle, the Company retains your personal data until you withdraw from membership (delete your account) or until the purpose of processing is achieved, and then destroys it without delay. The following data is retained for the specific period stated below:

• Verification-code sending and verification history — 6 months from the date of sending
• Customer consultation records — until a destruction request is made or the related dispute is resolved
• Marketing data collected with consent — until you withdraw consent or withdraw from membership

Exceptionally, where the laws of the Republic of Korea require continued retention, the relevant data is stored separately from other personal data for the statutory period and used only for the purpose of such retention:

When personal data becomes unnecessary — for example, upon expiry of the retention period or achievement of the processing purpose — the Company destroys it without delay with the approval of the Chief Privacy Officer. Electronic files are destroyed so that the records cannot be restored, and paper documents are shredded or incinerated.

Your personal data is stored and processed on servers located in the Republic of Korea (Amazon Web Services, Seoul Region).

If you use the Service from outside the Republic of Korea — including from Taiwan — your personal data is transmitted to, stored in, and processed in the Republic of Korea as described above.

The Company uses Amazon Web Services (AWS) for service operation, and some systems run on AWS’s global infrastructure. Important member personal data is stored in databases located in the Republic of Korea region and is not transferred abroad for storage; however, in the course of AWS’s operational and technical support, personal data may be accessed or processed from outside Korea (e.g., the United States). The Company also uses Google Firebase to analyze service-usage logs.

Overseas recipients (transfer for processing and storage)

Timing and method of transfer: transmitted over the network at the time of service use. Legal basis: Articles 26 and 28-8(1)3 of the Personal Information Protection Act of the Republic of Korea (outsourcing of processing / storage).

If you do not wish your personal data to be transferred as described above, you may withdraw from membership in the app or on the website, or request withdrawal by contacting the customer support e-mail. Please note that if you refuse the transfer described above, use of the Service is not possible.

1. Provision to third parties (with your consent)

The Company provides personal data to third parties only with your consent or where permitted by law, and only within the minimum necessary scope. The following provision applies when you use the corresponding features (currently offered for users in Korea):

In addition, where other laws specifically so provide (e.g., criminal procedure or telecommunications laws), where it is clearly necessary for the urgent protection of the life, body, or property of the data subject or a third party, where necessary for criminal investigation and prosecution, or where urgently required for public safety, the Company may provide the minimum necessary personal data to the competent authorities without consent, in accordance with the Personal Information Protection Act of the Republic of Korea.

2. Data processors (outsourcing of processing)

For the smooth handling of personal data processing work, the Company entrusts the following work to the following processors:

When concluding outsourcing contracts, the Company specifies in the contract documents, in accordance with Article 26 of the Personal Information Protection Act of the Republic of Korea, matters such as the prohibition of processing beyond the entrusted purpose, technical and managerial safeguards, restrictions on re-outsourcing, supervision of the processor, and liability for damages, and supervises whether the processor handles personal data safely. Where a processor re-entrusts the Company’s processing work, it obtains the Company’s consent, and the Company discloses the sub-processor and the re-entrusted work through this Privacy Policy. If the entrusted work or a processor changes, the Company will disclose the change through this Privacy Policy without delay.

You may exercise the following rights against the Company at any time. For users in Taiwan, these correspond to the rights guaranteed under Article 3 of the Personal Data Protection Act of Taiwan:

• The right to inquire about and review (access) your personal data
• The right to request a copy of your personal data
• The right to request supplementation or correction
• The right to request that collection, processing, or use be stopped (suspension of processing)
• The right to request deletion
• The right to withdraw consent at any time (including consent to marketing)

1. How to exercise: send your request to contact@testbank.ai. The Company will act on it without delay and respond within 10 days of receiving the request (for data transmission requests, without delay).
2. Rights may also be exercised through an agent, such as your legal representative or a person delegated by you. In that case, a power of attorney must be submitted.
3. For children under 14, rights must be exercised by the legal representative; a data subject who is a minor aged 14 or older may exercise rights personally or through a legal representative.
4. The Company verifies that the person exercising a right is the data subject or a legitimate agent.
5. Requests for access or suspension of processing may be limited under applicable laws (Articles 35(4) and 37(2) of the Personal Information Protection Act of the Republic of Korea). Deletion cannot be requested for personal data whose collection is required under other laws.
6. Withdrawing marketing consent: you may opt out of marketing messages at any time via the in-app [My Info > Notification Settings] menu (turning off individual channels) or the unsubscribe link included in messages.

   ※ Opt-out processing may take up to 3 business days.

You are free to choose whether to provide personal data. However, the items required for sign-up and service provision (account information and device/log information) are essential for concluding and performing the service contract; if you do not provide them, sign-up for or use of the Service may not be possible.

Choosing not to provide optional items (such as marketing consent or the push notification token) does not restrict your use of the core Service. If you do not consent to the storage and processing of your data in the Republic of Korea described in Section 5, the Company is unable to provide the Service; in that case you may refrain from signing up or withdraw from membership at any time.

The Company takes the following measures to ensure the security of personal data:

1. Managerial measures — establishing and implementing an internal management plan, operating a dedicated organization, regular staff training on privacy and information security, and periodic checks of compliance with security regulations
2. Technical measures — managing access rights to personal data processing systems, installing access-control systems and related safeguards, encrypting personal data databases, retaining and inspecting access records, installing and updating security software, and checking and remedying vulnerabilities of processing systems
3. Physical measures — controlling access to data storage rooms and similar facilities, keeping documents and auxiliary storage media in secure, locked locations, and periodically managing access records

1. The Company may use certain cookies to prevent abnormal access and repeated consultation requests. A cookie is a small piece of information that the server operating the website sends to your browser; it is stored on your computer or mobile device and automatically sent back to the server when you access the website.
2. You can allow or block cookies through your browser settings (e.g., blocking third-party cookies, deleting stored cookies, or using private/incognito browsing). Note that blocking cookies may limit some features, such as automatic sign-in.
3. In the course of using the Service, the following information may be generated and collected automatically: IP address, cookies, visit date and time, service usage records, browser information, and device information (OS version, model name, UUID).
4. To provide tailored services, benefits, and online tailored advertising, the Company processes behavioral information using cookies. The Company collects only the minimum behavioral information necessary and never collects sensitive behavioral information that could infringe rights or privacy (such as thought, beliefs, or medical history).

Third-party tools that collect behavioral information

Blocking tailored advertising on mobile devices

• Android: Settings → Security & privacy → Privacy → Other privacy settings → Ads → Reset or delete advertising ID
• iPhone: Settings → Privacy & Security → Tracking → turn off "Allow Apps to Request to Track"

※ Menus and steps may vary depending on the OS version.

1. The Company does not collect age or date-of-birth information at sign-up, and the Service is operated for general users.
2. If it is confirmed that a child under the age of 14 has used the Service without the consent of a legal representative, the Company may restrict or delete the relevant account.
3. Where a child’s personal data is needed for a specific service or event, the Company obtains the prior consent of the legal representative and collects and uses only the minimum information.

The Company has designated the following Chief Privacy Officer and department, which are responsible for personal data processing overall and handle complaints and remedies related to personal data. The Company will answer and handle your inquiries without delay:

You may also apply for dispute resolution or consultation to the following institutions of the Republic of Korea:

• Personal Information Dispute Mediation Committee: +82-1833-6972 (www.kopico.go.kr)
• KISA Personal Information Infringement Report Center: +82-118 (privacy.kisa.or.kr)
• Korean National Police Agency: +82-182 (ecrm.cyber.go.kr)

1. This Privacy Policy applies from July 10, 2026. (Established on August 1, 2022 → amended on October 27, 2025 → amended on July 10, 2026)
2. Previous versions of the Privacy Policy (in Korean) are available below:

• Applied from October 27, 2025 to July 9, 2026 (Korean)
• Applied from August 1, 2022 to October 26, 2025 (Korean)

This Policy is published in Korean, English, and Traditional Chinese. In the event of any inconsistency between the versions, the Korean version prevails.