Privacy Policy

In accordance with the PIPA, the Company collects and uses personal information within the minimum scope necessary to provide the Service. The processing and retention period for each category of personal information follows the tables in this Chapter, and records that must be preserved under other statutes are stored separately in accordance with Chapter 3.

1. Personal information processed with the consent of the data subject (mandatory items)

For the activities below, the Company informs you of the personal information required for that activity at the time you apply for it and processes that information with your consent. Consent for the items required for membership registration and consent for the items required for customer support are obtained separately.

If you do not enter a nickname, your registered name is used as your display name. If a member who signed up with an email address does not enter a name, the account part of the email address is used as the display name. Registration of a nickname and of additional contact details is explained under the optional items in paragraph 3 (additional profile and contact registration).

2. Personal information processed without the consent of the data subject

On the legal bases set out in the table below, the Company processes personal information for the conclusion and performance of contracts, compliance with legal obligations, its legitimate interests, and additional use within a scope reasonably related to the original purpose of collection.

Usage analytics is collected for all users of the SOLVE app regardless of consent and cannot be switched off in the app. It is not used for advertising and is not shared with advertisers.

Only notes linked to your account are synchronized. Notes you create while not signed in, and materials you import from your device (including while signed in, in regions where import is available), are stored only on your device and are not synchronized; notes created while not signed in may be moved to your account when you sign up. This device-only import is separate from Add > Photo or Scan in the knowledge bank, which uploads the final JPEG photos and PDF as described in paragraph 3, item 5 of this Chapter.

AI responses are generated automatically and may be inaccurate. Your member ID is not sent to the AI model providers.

The Company does not send your member ID to AI model providers with any request.

3. Personal information processed with the consent of the data subject (optional items)

1) The Company processes the following personal information with the consent of the data subject. You may register as a member and use the basic services even if you do not consent to the optional processing of personal information; however, you will not be able to use optional features that require such processing, such as saving study recordings. Whether you consent to marketing messages and ad measurement and personalized advertising through Meta has no effect on your use of the basic services.

When you upload a PDF through the “PDF upload (user textbooks)” feature in the table above, the Company sends an image of each page to Google LLC (Cloud Vision API) to recognize the text of every uploaded page (OCR). This is an entrustment of processing to provide the PDF upload feature and does not apply to materials you add to the knowledge bank; knowledge-bank text recognition (item 5 of this paragraph) is a separate process that sends only scanned pages without a text layer and only after knowledge-bank AI processing consent. For the entrustment and overseas transfer, see Chapters 6 and 7.

2) How to withdraw consent to receiving marketing messages

You may withdraw your consent to receiving marketing messages at any time by any of the following methods.

1. Turning off each channel (text message, app push, email) under [My Information > Notification settings] in the SOLVE app or on SOLVEBOOKS
2. Following the [unsubscribe] method indicated in the text message
3. Sending a request by email to the personal information department (contact@testbank.ai)

If you refuse to receive marketing messages or withdraw your consent, the Company stops sending marketing messages through that channel and informs you of the outcome in accordance with the applicable laws. Informational notices concerning transactions and services, such as orders, payments and verification, are not marketing messages and are therefore sent regardless of whether you have consented to marketing messages.

3) Usage analytics and app install attribution

Usage analytics and app install attribution are not based on consent; you may object to this processing by contacting contact@testbank.ai.

4) How to withdraw consent to ad measurement and personalized advertising (Meta)

You may request withdrawal of your consent to the provision to Meta as a third party and to the related overseas transfer from the personal information department (contact@testbank.ai). Upon receipt of the request, the Company stops any further provision to Meta. You can manage the link between information already provided and your Meta account under "Your activity off Meta technologies" in the Meta Accounts Center. Disconnecting may differ from the deletion of the data that Meta holds. To exercise privacy rights such as deletion, you may use Meta’s privacy rights request procedure, and the Company will guide you through that procedure on request. For how to change the advertising identifier and app tracking settings on your mobile device, please refer to Chapter 9.

5) Study materials you add (knowledge bank)

Materials you add to the knowledge bank are private to your account by default, and the Service does not provide a path for you to make them publicly available. Before the first use of knowledge-bank AI processing, the Company will show an AI processing notice stating what is sent and which providers (including overseas providers) receive it and obtain your separate consent in that notice (“knowledge-bank AI processing consent”). The providers that receive data, and what each of them receives, are listed in the table below and in Chapters 6 and 7 of this Privacy Policy. You may then withdraw that consent at any time in Settings. Withdrawal stops future AI processing, while the viewer and pen continue to work without AI. Unlike the AI study coach described in paragraph 2 of this Chapter, knowledge-bank requests to Google Gemini API and OpenAI are sent through an LLM gateway that the Company operates in the AWS Republic of Korea region; requests to TypeSafe and Google Cloud Vision are sent directly.

Each external AI provider receives only the items listed for it in the table above: extracted source text (including the text of notes and work in your materials, whether typed or recognized by OCR), your questions and retrieved text, and, for answer-equivalence checks, the question, the reference answer and your submitted answer. In the processing listed in this table, original PDFs and handwriting ink are not sent to any external AI provider. Photos added through Add > Photo or Scan may be sent as page images to Amazon Bedrock, as described below. Handwriting grading by the AI study coach is separate — images of your handwritten ink are sent to Google Gemini API and, for the verification before a correct verdict and as a fallback, to the routes in the AI study coach table in paragraph 2 of this Chapter (the Company’s own model on the B200 GPUs or OpenRouter). Summarizing and organizing your handwriting uses the same route and providers as handwriting grading; its inputs and processing in memory are described in that row. When reading material as described in this table, an image of a page leaves the Company’s servers only for pages of material you add that have no text layer (such as scanned pages and photos), and only to the providers named in the text-recognition rows of the table above: Amazon Web Services (Amazon Bedrock, a model operated by AWS) and, where the Company has turned that route on, Google Cloud Vision. Images of PDFs you upload through the PDF upload feature are sent to Google Cloud Vision, as described above. Page images are not sent to Google Gemini API, OpenAI or TypeSafe for the processing listed in this table; those providers receive only the text the table lists for them. Page images are sent only after knowledge-bank AI processing consent. Without that consent, only the text layer already in the file is used and pages without a text layer are not processed by AI; you can still view the material and write on it. Your member ID is not sent to these providers.

When you add material through Add > Photo or Scan in the app, the app removes metadata such as location from the final JPEG photos before uploading them together with the PDF. These uploaded JPEG photos are kept for the same period as the PDF and follow the same deletion rules: both are deleted when you delete the material or your account, as described above. If a photo page has no text layer, Amazon Web Services (Amazon Bedrock) reads the text in the photo for summaries and answers to your questions. Photos are sent one at a time, only after knowledge-bank AI processing consent. Without that consent, the photos are used only for storage, viewing and writing on them. For handwriting summaries, see the handwriting grading and summary row in paragraph 2 of this Chapter.

6) AI assistants you connect yourself

1. If SOLVE offers this feature and you choose to connect an AI service you already use, such as ChatGPT, Claude or Gemini, you may allow it to read your SOLVE notebooks through a personal, read-only, time-limited access token that you create and can revoke at any time in Settings.
2. Once connected, the service can read notebook names, extracted source text by page, the text of your notes, your attempts and mistakes, and your review queue. It cannot write to SOLVE, and nothing is sent until the service requests it on your behalf.
3. You initiate any such connection. The Company is not a party to that service’s processing. Read that service’s privacy terms for how it stores what it reads. Revoking the token stops further reads but does not delete information that the service has already stored.
4. If conversation import is offered, you can bring your own conversation exports from those services into SOLVE as materials; they are treated as materials you added to the knowledge bank under item 5) of this Chapter.

4. Google Classroom and school LMS (LTI) integrations

Google Classroom (teachers)

If a teacher chooses to connect Google Classroom, Solve requests these Google OAuth scopes: openid, classroom.courses.readonly and classroom.coursework.students. Solve uses them only to (1) confirm the teacher’s Google account identifier, (2) list the courses the teacher teaches so the teacher can choose one, (3) create and manage an assignment that links to a Solve problem set in the course the teacher chooses and read the submissions to it, and (4) return each student’s score for that assignment to Google Classroom as a draft grade and an assigned grade. Solve limits its requests to the courses, assignments and submissions needed for these features and does not retrieve class rosters.

Students

A student who opens a Solve assignment from Google Classroom signs in to Solve with Google. Through that sign-in Solve receives the student’s Google account identifier and name, and uses the identifier to match the student’s submission so the score can be returned to the teacher. Solve does not read students’ names or email addresses from Google Classroom. Before your score is first sent to your teacher, Solve asks for your consent. Where overseas transfer requires consent, Solve obtains separate overseas-transfer consent before transmission, in addition to consent to third-party provision.

Storage and protection

Solve stores the teacher’s Google refresh token only to create assignments and return scores on the teacher’s behalf. The token is encrypted at rest with a per-user key. When a teacher disconnects Google Classroom in Solve, Solve revokes the token at Google and deletes the stored token. Connection records (course and assignment identifiers and score-sending records) are kept until the teacher disconnects or the account is deleted and are then deleted; deleting a Solve account also deletes the Classroom connection and related records, except where retention is required by law. Assignments and scores already created in Google Classroom remain on Google’s side after you disconnect or delete your account, and the teacher must remove them in Classroom. Access can also be removed at https://myaccount.google.com/permissions.

Limits on use

Solve uses Google user data only to provide these features. Solve does not sell Google user data, and does not use it for advertising, profiling or credit decisions. Google user data (Google account identifiers, course and assignment information, and tokens) is not sent to any AI service, including AI-assisted grading, and is not used to develop, improve or train any AI or machine-learning model, including shared models. Solve does not share it with anyone except to return scores to Google Classroom, with service providers that host our service under contract (Chapter 6), for security investigations, or where required by law. People at TestBank may read Google user data only with your affirmative consent to view specific data, when necessary for security or abuse investigations, or when required by law. These limits also apply to our agents and contractors.

Solve’s use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy (https://developers.google.com/terms/api-services-user-data-policy), including the Limited Use requirements.

Schools using an LMS (LTI 1.3, e.g. Canvas)

When a school or district provides Solve through its learning management system, Solve receives from the LMS the LMS’s opaque user identifier (which can be linked to the user), the user’s role and course and assignment identifiers and, if the school provides them, name and email, which it stores, and returns scores to the LMS through LTI Assignment and Grade Services. The name is stored as the profile name and nickname, and the email is kept only in the LMS integration record and is not used as a Solve sign-in or account-recovery email. In this case TestBank processes the information on behalf of, and under the instructions of, the school, for the school’s educational purposes. Where a written agreement designates TestBank to perform an institutional service for a school and FERPA’s school-official requirements are met, TestBank processes education records under the school’s direct control and only for the purposes in that agreement. For students under 13, Solve collects personal information only as authorized by the school for educational purposes and not for any commercial purpose. Before collecting information under a school’s authorization, TestBank confirms that authorization and gives the school direct notice. Schools may ask us to review or delete their students’ information and to stop further collection. Where Korean law requires consent for a child under 14, Solve obtains and verifies the legal representative’s consent; a school’s authorization under COPPA does not replace it. TestBank remains responsible for protecting this information and gives the school the means to review and delete it. Schools may review or ask us to delete their students’ information by contacting contact@testbank.ai.

These changes take effect on 9 November 2026; we will not carry out this processing before then.

1. The minimum age for membership registration depends on the country or region in which you use the Service: 14 years of age in the Republic of Korea and 13 years of age in the United States and other countries and regions (or a higher age where required by local law). During sign-up you are asked to confirm that you meet the minimum age that applies to you, and registration cannot proceed without that confirmation. The knowledge bank is not offered to accounts below the applicable minimum age. The Company does not knowingly collect personal information from children under 13; if we learn that we have done so, we will delete it without delay. An exception applies where a school has authorized the processing for educational purposes (through its learning management system or Google Classroom): the Company then processes the information only on the school’s instructions and for educational purposes, and does not use it for any commercial purpose (Chapter 1, paragraph 4). Where Korean law requires consent for a child under 14, Solve obtains and verifies the legal representative’s consent; a school’s authorization under COPPA does not replace it. A parent or guardian who believes their child has provided us with personal information may contact us at contact@testbank.ai.
2. The Company does not collect dates of birth in this procedure. It retains the minimum records necessary, such as whether and when age was confirmed; the specific items processed and their retention periods are set out in Chapter 1.
3. If it is confirmed that a member is below the minimum age that applies to them, the Company restricts the use of that account without delay and destroys the personal information. However, information that must be preserved under other statutes is stored separately for the period prescribed by those statutes and processed only for that purpose. Accounts confirmed to belong to a person below the minimum age that applies to them are handled in accordance with this Chapter, and the standard for retaining evidentiary records after the withdrawal of an ordinary member is not applied uniformly to them.
4. If the Company provides services to children below the applicable minimum age in the future, it will put the privacy policy and the related procedures in place before it begins processing their personal information and, for processing that requires the consent of a legal representative under the applicable laws, will obtain that consent and then verify that it was actually given.
5. The Company may also ask existing members for additional verification where it is necessary to confirm that they meet the age requirement, and use of the Service may be restricted until that verification is completed.

1. The legal basis and retention period for each category of personal information follow Chapter 1. The Company processes personal information for the period necessary for each processing purpose, and preserves records subject to statutory retention in accordance with the table below.
2. The processing and retention period for each category of personal information is as follows.
   • Provision of the Service: until the member withdraws. However, where an investigation or inquiry into a violation of the applicable laws is under way, or where claims or obligations arising from use of the Service remain outstanding, only the minimum information necessary for that investigation or inquiry or for settling those claims or obligations is preserved for the necessary period, and only where there is a lawful basis for doing so.
   • Optional items: retained until the end of the period set out in Chapter 1, and then destroyed
   • Records that must be preserved under the statutes listed below are stored and managed separately from other personal information, limited to the necessary items, and used only for the statutory retention purpose.

1. Where personal information becomes unnecessary — for example, because the retention period has elapsed or the processing purpose has been achieved — the Company destroys it without delay.
2. When you delete your account in the app, the Company immediately deactivates the account and: deletes your mobile phone number and email address from your account record; deletes your social login link, sign-in tokens and push notification tokens so that the account can no longer be accessed; and deletes your marketing consent settings. Records of the consents you gave or withdrew (the subject, whether given, date and time, and version) are kept as evidence of consent for up to three years as described in Chapter 1, and order and payment records are kept for the periods required by law as described in Chapter 3.
3. When you delete your account, the Company, after deactivating the account, also deletes the following data associated with it: your name, nickname and profile image; handwriting, notes and notebooks synchronized to our servers; and your AI coach conversations and settings. Earlier versions of synchronized handwriting kept for recovery from failures are not removed at that time: those in our current handwriting storage are deleted automatically after 30 days, and those in our earlier handwriting storage remain until their separate deletion is completed. PDFs and final JPEG photos added through Add > Photo or Scan in the knowledge bank follow the deletion rules in Chapter 1, paragraph 3, item 5. At present, PDFs uploaded through the “PDF upload (user textbooks)” feature, together with the page images and text recognition results derived from them, are not yet deleted when you delete your account and remain associated with the deactivated account. You may request deletion of this data by contacting contact@testbank.ai.
4. Where personal information must continue to be preserved under other statutes even though the retention period consented to by the data subject has elapsed or the processing purpose has been achieved, the Company moves that personal information to a separate database or stores it in a different location. The items of personal information preserved under other statutes and the basis for their preservation can be found in "Chapter 3 Processing and Retention Periods of Personal Information".
5. The procedures and methods for destroying personal information are as follows.
   • Destruction procedure: the Company selects the personal information for which a ground for destruction has arisen and destroys it with the approval of the Company’s privacy officer.
   • Destruction method: personal information recorded and stored in electronic file form is destroyed so that the records cannot be restored, and personal information recorded and stored in paper documents is shredded or incinerated.

1. In order to provide the Service smoothly, the Company provides personal information in the following cases with the consent of the data subject pursuant to Article 17(1)1 of the PIPA, and only within the minimum necessary scope. The score and submission status of a student who enters Solve from a teacher’s Google Classroom assignment are sent to that teacher only if the student consents on the screen shown before the score is first sent (PIPA Article 17(1)1). If the student does not consent, the score is not delivered to the teacher, and the student can still work on problems in Solve. Returning a score to a school’s LMS for a student who arrived through LTI is not a provision to a third party but processing entrusted to us by the school (Chapter 1, paragraph 4).

The provision to Meta Platforms, Inc. takes place in the SOLVE iOS app and on the SOLVEBOOKS website (the Facebook SDK in the SOLVE iOS app and the Meta Pixel on the SOLVEBOOKS website); the SOLVE Android app does not include any Meta SDK. The consent items and the Company’s retention period follow the "Ad measurement and personalized advertising (Meta)" row in Chapter 1, paragraph 3, and the overseas transfer follows Chapter 7.

2. The Company processes the personal information of data subjects only within the scope of the processing purposes specified in Chapter 1, and provides personal information to third parties only where Article 17 or 18 of the PIPA applies, such as with the consent of the data subject or under special provisions of statute; otherwise it does not provide personal information to third parties. However, where necessary for statistical purposes, academic research or market research, the Company may, taking into account time, cost and technology on a reasonable basis, process personal information into anonymized information from which no individual can be identified even by using other information, and provide it in that form.
3. The Company does not use personal information beyond the scope of the purpose for which it was collected or provide it to third parties beyond that scope. However, where the requirements applicable to the Company under Article 18(2) of the PIPA are met — such as separate consent from the data subject, special provisions of another Act, or an urgent need to protect life, bodily safety or property interests, or for public safety and security including public health — the Company may process personal information within the minimum necessary scope. A request from an investigative authority is not acted on simply because it has been made; the Company verifies the applicable law and that lawful procedures have been followed.

1. In order to process personal information smoothly, the Company entrusts personal information processing work as set out below. A trustee processes personal information only within the scope of the Company’s purposes and instructions; a business operator that uses the personal information it collects for its own purposes (Meta Platforms, Inc.) is explained not as a trustee but as a recipient of a provision to a third party (Chapter 5) and of an overseas transfer (Chapter 7).

2. When entering into an entrustment agreement, the Company specifies in the contract or another document, pursuant to Article 26 of the PIPA, the prohibition on processing personal information for purposes other than performing the entrusted work, technical and administrative safeguards, restrictions on sub-entrustment, supervision of the trustee, and liability such as damages, and supervises whether the trustee processes personal information safely.
3. Pursuant to Article 26(6) of the PIPA, where a trustee sub-entrusts the Company’s personal information processing work, it obtains the Company’s consent, and the Company discloses the sub-trustee and the content of the sub-entrusted work through this Privacy Policy.
4. If the content of the entrusted work or the trustee changes, the Company will disclose this through this Privacy Policy without delay.

1. The Company uses the services of overseas business operators such as Google in order to analyse members’ use of the Service, send push notifications, provide social login and measure advertising performance, to provide the AI study coach, and, after separate consent, to process knowledge-bank materials: Amazon Bedrock (AWS) reads the text of knowledge-bank pages that have no text layer, Google Cloud Vision recognizes the text of such pages where the Company has turned that route on, the Gemini API summarizes and classifies extracted knowledge-bank text and generates answers from retrieved text, OpenAI creates document and question embeddings for search, and TypeSafe checks question scope, source support and answer equivalence. The Company also uses Google Cloud Vision to recognize the text of PDFs uploaded through the PDF upload feature.
2. The main databases and storage holding member information, usage records, study recording files, uploaded PDFs, knowledge-bank materials, and handwriting and notes are kept in the AWS Republic of Korea region and are not replicated to any region outside Korea. Access or retrieval from outside Korea is also not permitted, except if SOLVE offers connected-AI access and you authorize that service to read your data (see Chapter 1, paragraph 3, item 6). This describes the Company’s own databases and storage: the images of knowledge-bank pages without a text layer that are sent to Amazon Bedrock are processed, and any traffic flagged for abuse detection may be retained for up to 30 days, in the AWS Regions that Amazon Bedrock selects, including Regions outside Korea (see the Amazon Bedrock table below). Where an overseas business operator processes personal information, the items, country, purpose, period and basis of the transfer are set out in the tables below. Knowledge-bank materials and the data derived from them are transferred overseas only to the extent that they are sent to the providers in the tables below for the external AI processing described in Chapter 1, paragraph 3, item 5. PDFs uploaded through the PDF upload feature are transferred overseas only to the extent that an image of each page is sent to Google Cloud Vision for text recognition (see the “text recognition of uploaded PDFs” table below).
3. The legal bases for overseas transfers are classified as follows.
   • Overseas entrustment of processing for the provision of essential services (service notification push messages (FCM), ensuring the stability of the Service (Firebase Crashlytics — necessary for the stable provision of the contracted service), Google and Apple login, service usage analytics (Firebase Analytics and GA4), app install attribution (AppsFlyer), and the AI coach (OpenRouter, Google Gemini API)): the transfer is made after completing the statutory procedures, including disclosure in this Privacy Policy, to the extent that the requirements of Article 28-8(1)3 of the PIPA are met.
   • Overseas entrustment of processing for text recognition of uploaded PDFs (Google Cloud Vision): an entrustment of processing necessary to provide the PDF upload feature; the transfer is made after completing the statutory procedures, including disclosure in this Privacy Policy, to the extent that the requirements of Article 28-8(1)3 of the PIPA are met.
   • Overseas transfers based on separate consent (marketing push messages (FCM), Mixpanel and Clarity (SOLVEBOOKS website — not used in the SOLVE iOS app), and the provision to Meta Platforms, Inc. as a third party): the transfer is made where separate consent to the overseas transfer has been obtained under Article 28-8(1)1 of the same Act. Consent to the provision to Meta as a third party and to the related overseas transfer is obtained separately from consent to marketing push messages.
   • Overseas transfers for knowledge-bank AI processing (reading of knowledge-bank pages without a text layer by Amazon Bedrock, text recognition of such pages by Google Cloud Vision where that route is turned on, and processing of extracted knowledge-bank text by the Gemini API, the OpenAI embedding API and TypeSafe — entrustment of processing): before first use, the Company states in the AI processing notice what is sent and which providers (including overseas providers) receive it and obtains your consent (see Chapter 1, paragraph 3, item 5); the transfer is made under Article 28-8(1)1 of the same Act only where you have given that consent.

The corrected text and verdict you submit in a grading objection are not sent to Google or to any other AI model provider; they are recorded only in the Company’s server logs, as described in Chapter 1, paragraph 2.

4. There is no restriction on your use of the basic services if you do not consent, or withdraw your consent, to overseas transfers for optional marketing, advertising and analytics purposes. If you refuse an overseas entrustment of processing that is necessary to perform the contract, your use of the features requiring that transfer (such as service notification push messages and Google and Apple login) may be restricted; the features that would be restricted and how to refuse are explained for each item transferred. Consent to marketing messages, the provision to Meta as a third party and each related overseas transfer may be withdrawn by specifying the processing concerned in a request to the personal information department (contact@testbank.ai). The Company then stops the relevant collection, use, provision and transfer and takes the necessary measures, such as deletion, in accordance with the applicable laws and the basis of processing. The withdrawal procedures follow items 2) and 4) of Chapter 1, paragraph 3. In Settings, you may withdraw your knowledge-bank AI processing consent, which includes your permission to send data to the overseas providers listed in the tables above; this stops future AI processing, including text recognition of scanned pages by Google Cloud Vision that has not yet started, while the viewer and pen continue to work without AI. The return or deletion of page images already sent to Google is not guaranteed (see Chapter 1, paragraph 3, item 5). Service usage analytics and app install attribution are not based on consent; you may object to this processing as described in item 3) of Chapter 1, paragraph 3.

   You can manage the link between information already provided and your Meta account under "Your activity off Meta technologies" in the Meta Accounts Center. Disconnecting may differ from the deletion of the data that Meta holds. To exercise privacy rights such as deletion, you may use Meta’s privacy rights request procedure, and the Company will guide you through that procedure on request.

The Company takes the following measures to ensure the safety of personal information.

1. Administrative measures: establishment and implementation of an internal management plan, operation of a dedicated organization, regular staff training (personal information protection and information security training), and regular checks on compliance with security-related rules
2. Technical measures: management of access rights to the personal information processing systems, installation of an access control system and other related safeguards, encryption of personal information databases, retention and inspection of access records, installation and updating of security programs, and inspection and remediation of vulnerabilities in the personal information processing systems
3. Physical measures: access control for areas such as document storage rooms, storage of documents and auxiliary storage media in a secure place fitted with a lock, and periodic management of access records

[Devices installed and operated to automatically collect personal information]

1. The Company may use certain "cookies" to prevent abnormal access by data subjects and repetitive submission of support inquiries.
2. A cookie is a small piece of information that the server (http) used to operate a website sends to the data subject’s browser; it is stored on the data subject’s computer or mobile device and is automatically transmitted from the data subject’s browser to the server when the website is accessed.
3. Data subjects can allow or block cookies through their browser settings. Blocking third-party cookies and the setting for storing site data are separate items and must therefore be configured individually.
   • Blocking third-party cookies — Chrome: browser Settings > Privacy and security > Third-party cookies > Block third-party cookies / Edge: browser Settings > Cookies and site permissions > Manage and delete cookies and site data > Block third-party cookies / Chrome on mobile: Settings > Site settings > Third-party cookies / Samsung Internet: Settings > Privacy > Block cookies
   • Setting for storing site data — Chrome: Settings → Privacy and security → Site settings → Additional content settings → On-device site data, and set sites not to store data on your device / Edge: browser Settings > Cookies and site permissions > Manage and delete cookies and site data > turn off "Allow sites to save and read cookie data" / Safari: device Settings > Safari > Advanced > Block All Cookies

   Even in private (InPrivate or incognito) mode, cookies may be used and sites may collect usage information while you are browsing. Blocking cookies can be configured separately in your browser cookie settings.

4. In the course of using the Service or handling business, the following information may be automatically generated and collected.
   • Information automatically generated and collected through the web and the app: access IP address, cookies, date and time of visit, service usage records, browser information, device information (OS version, model name, UUID) — the minimum logs necessary to ensure the stability of the Service follow the "Ensuring the stability of the Service" row in Chapter 1, paragraph 2, and information processed for usage analytics purposes follows the "Service usage analytics" row in Chapter 1, paragraph 2.
   • The items, purposes and retention periods of the personal information used for app install attribution analysis follow Chapter 1, and the information is collected automatically when the app is installed or launched. The related entrustment and overseas transfer are explained in Chapters 6 and 7.

[Collection, use and provision of behavioral information, and refusal thereof]

1. In the course of providing the Service and handling business, the Company processes behavioral information using cookies, advertising identifiers and similar technologies in order to provide data subjects with optimized customized services and benefits, online customized advertising and the like.
2. The Company collects behavioral information on the websites and the mobile and PC apps it operates as follows.

Ad measurement and personalized advertising through Meta is explained separately from ordinary analysis of service usage behavior. The Company processes and provides the behavioral information it collects in the SOLVE iOS app and on the SOLVEBOOKS website for ad measurement and personalized advertising purposes only where it has obtained consent to that processing of personal information and to the provision to Meta as a third party and the overseas transfer. The items and retention periods follow the "Ad measurement and personalized advertising (Meta)" row in Chapter 1, paragraph 3, and Chapters 5 and 7.

2) Behavioral information collected by third parties — in order to allow you to use the Service smoothly and for advertising purposes, the Company uses tags and APIs, including SDKs provided by other companies. The behavioral information collected by third parties is as follows. The table below summarizes the main items processed. The full items and periods processed by AppsFlyer follow the "App install attribution analysis" row in Chapter 1 and the AppsFlyer table in Chapter 7; for Clarity, they follow the Clarity table in Chapter 7.

Among the companies listed above, those that process behavioral information only within the scope of the Company’s purposes and instructions under an entrustment of the Company’s work (Firebase Analytics and GA4 of Google LLC, Mixpanel, Inc., AppsFlyer Ltd. and Microsoft Corporation) are managed as trustees in accordance with Chapters 6 and 7. A company that uses the behavioral information it collects for its own purposes (Meta Platforms, Inc.) receives that information only where separate consent has been obtained, in accordance with Chapter 5 (provision to a third party) and Chapter 7 (overseas transfer), and its processing of that information is governed by Meta’s privacy policy.

3. The Company collects only the minimum behavioral information necessary for optimized customized services and benefits, online customized advertising and the like, and does not collect sensitive behavioral information that is liable to infringe individual rights, interests or privacy, such as ideology, beliefs or medical history.
4. Data subjects can restrict cookie-based tracking by changing their web browser cookie settings. App SDKs and account-based analytics are handled as described in items 3) and 4) of Chapter 1, paragraph 3. However, changing cookie settings may restrict the use of some services, such as automatic login on the website.

Blocking/allowing customized advertising through a web browser

▶ Chrome

• ① How to delete cookies stored in the web browser: in browser Settings, go to "Privacy and security" > "Delete browsing data" and select the items to delete (cookies and other site data).
• ② How to block third-party cookies in the web browser: in browser Settings, go to "Privacy and security" > "Third-party cookies" and select whether to "Block third-party cookies".
• ③ Setting for storing site data (blocking the storage of all cookies): go to Settings → Privacy and security → Site settings → Additional content settings → On-device site data, and set sites not to store data on your device. This setting applies separately from the blocking of third-party cookies in ②. A "New Incognito window" only deletes browsing history and cookies when the browser is closed; it does not prevent the use of cookies or the collection of information by sites while you are browsing.

▶ Edge

• ① How to delete cookies stored in the web browser: in Edge, click the "…" icon in the top right and then click "Settings". On the left of the settings page, click "Cookies and site permissions", then click "Manage and delete cookies and site data" and choose whether to remove all cookies and site data.
• ② How to block third-party cookies in the web browser: in Edge, click the "…" icon in the top right and then click "Settings". On the left of the settings page, click "Privacy, search, and services" and, in the "Tracking prevention" section, select whether to enable tracking prevention and its level (Balanced or Strict). Alternatively, click "Cookies and site permissions" on the left of the settings page, then click "Manage and delete cookies and site data" and select "Block third-party cookies".
• ③ Setting for storing site data (blocking the storage of all cookies): in Edge, click the "…" icon in the top right, then go to "Settings" > "Cookies and site permissions" > "Manage and delete cookies and site data" and turn off "Allow sites to save and read cookie data". This setting applies separately from the blocking of third-party cookies in ②. A "New InPrivate window" only deletes browsing history and cookies when the browser is closed; it does not prevent the use of cookies or the collection of information by sites while you are browsing.

5. Depending on the device settings, the SDKs used by the Company in its mobile apps may process advertising identifiers for customized advertising and app install attribution analysis. Data subjects can block or allow customized advertising and the use of advertising identifiers by apps by changing the settings on their mobile device, the way to object to app install attribution and usage analytics follows item 3) of Chapter 1, paragraph 3, and the method for withdrawing consent to Meta ad measurement and personalized advertising follows item 4) of Chapter 1, paragraph 3.

Menus and methods may differ slightly depending on the mobile OS version.

• (Android): ① Settings → ② Security and privacy → ③ Privacy → ④ Other privacy settings → ⑤ Ads → ⑥ Reset advertising ID or Delete advertising ID
• (iPhone): ① Settings → ② Privacy & Security → ③ Tracking → ④ turn off Allow Apps to Request to Track

6. Data subjects may use the contacts below to ask questions about behavioral information, to exercise their right to refuse, and to report harm.

1. Data subjects may at any time request access to, correction or deletion of, or suspension of the processing of their personal information, and may withdraw their consent (collectively, "exercise of rights"), and may request the transmission of their personal information in accordance with the requirements and scope prescribed by the applicable laws.

   The rights of a child below the applicable minimum age must be exercised by the child’s legal representative; a data subject who is a minor at or above the applicable minimum age may exercise the rights relating to their own personal information themselves or through their legal representative.

2. When export is available, you can export your original files, PDFs of pages with your writing, stroke data, and a CSV of your attempts and results at any time. Export is not limited by plan.
3. Rights may be exercised in relation to the Company by email consultation pursuant to Article 41(1) of the Enforcement Decree of the PIPA, and the Company will act on the request without delay.
4. Rights may also be exercised through an agent, such as the data subject’s legal representative or a person authorized by the data subject. In that case, a voluntary agent must submit documents evidencing their authority, such as a power of attorney in the form of Attachment No. 11 to the Public Notice on Methods of Processing Personal Information, and a legal representative must submit documents confirming that they are the legal representative.
5. A data subject’s right to request access to and suspension of the processing of personal information may be restricted under Article 35(4) and Article 37(2) of the PIPA.
6. Where another statute expressly specifies that the personal information is to be collected, deletion of that personal information cannot be requested.
7. The Company verifies whether the person exercising the rights is the data subject or a duly authorized agent.
8. Data subjects may exercise their rights with the department below. The Company will respond within 10 days of the date on which it receives the request. However, requests for the transmission of personal information are handled within the period and by the method prescribed by the applicable laws.

For knowledge-bank materials and AI processing, see Chapter 1, paragraph 3, item 5; the entrustment and overseas-transfer details are in Chapters 6 and 7. You may withdraw knowledge-bank AI processing consent in Settings; this stops future AI processing. Deletion and the retention of derived data are described in Chapter 1.

1. The Company has designated the privacy officer and dedicated organization below to take overall responsibility for personal information processing and to handle complaints and provide remedies for data subjects in relation to personal information processing.

2. Data subjects may direct to the privacy officer any matter relating to personal information protection, the handling of complaints or remedies for harm that arises while using the Company’s services. The Company will answer and handle such inquiries without delay. For all privacy requests, including requests from users in the United States, please contact contact@testbank.ai.

1. The Company seeks to guarantee data subjects’ right to informational self-determination and to provide consultation and remedies for harm caused by infringements of personal information; if you need to make a report or seek consultation, please contact the department in charge.
2. To obtain a remedy for an infringement of personal information, data subjects may apply for dispute resolution or consultation to bodies such as the Personal Information Dispute Mediation Committee and the Personal Information Infringement Report Center of the Korea Internet & Security Agency. For other reports of and consultations on personal information infringement, please contact the organizations below.
   • Personal Information Dispute Mediation Committee: 1833-6972 (no area code) (www.kopico.go.kr)
   • Personal Information Infringement Report Center: 118 (no area code) (privacy.kisa.or.kr)
   • Korean National Police Agency: 182 (no area code) (ecrm.cyber.go.kr)

1. This Privacy Policy was announced on 7 November 2026. The provisions on Google Classroom and school LMS (LTI) integrations take effect on 9 November 2026; the rest continues as announced and effective on 5 November 2026. (Established on 1 August 2022 → amended on 27 October 2025 → amended on 10 July 2026 → amended on 21 September 2026 → amended on 30 September 2026 → amended on 7 October 2026 (morning) → amended on 7 October 2026 → amended on 5 November 2026 → amended on 7 November 2026)
2. 7 October 2026 amendment: added Amazon Web Services, Inc. (Amazon Bedrock) as a processor that reads knowledge-bank pages without a text layer, and corrected the description of where page images are sent.
3. This edition also explains summaries and organization of your handwriting when you request them, the storage and deletion of final JPEG photos added through Add > Photo or Scan, and AI reading of photo pages for summaries and answers to your questions.
4. 5 November 2026 amendment: added FuriosaAI, Inc. (주식회사 퓨리오사에이아이) as a processor that provides the NPU server environment on which a model operated by the Company processes part of the AI study coach requests (Chapter 1, AI study coach table, and Chapter 6), and describes the data sent for dashboard insights and study briefings in more detail, to the edition announced and effective on 7 October 2026.
5. 7 November 2026 amendment: added Google Classroom and school LMS (LTI) integrations (Chapter 1, paragraph 4, with matching rows in the Chapter 1 tables, Chapter 2, Chapter 5 and Chapter 7). These provisions take effect on 9 November 2026, and we will not carry out this processing before then. The effective date was first set as 14 November 2026 and was brought forward to 9 November 2026 (effective date correction). The rest of this edition is the same as the edition announced and effective on 5 November 2026.
6. Previous versions of the Privacy Policy are available below.

• Applied from 5 November 2026 until this amendment (announced and effective 2026-11-05)
• Applied from 7 October 2026 until this amendment on 5 November 2026 (announced and effective 2026-10-07)
• Applied on the morning of 7 October 2026, until the amendment announced and effective on the same day (announced 2026-10-01 · effective 2026-10-07)
• Applied from 30 September 2026 to 6 October 2026 (announced 2026-09-23 · effective 2026-09-30)
• Applied from 21 September 2026 to 29 September 2026 (announced and effective 2026-09-21)
• Applied from 10 July 2026 to 20 September 2026 (announced 2026-07-03 · effective 2026-07-10)
• Applied from 27 October 2025 to 9 July 2026
• Applied from 1 August 2022 to 26 October 2025