SOLVE · SOLVEBOOKS
Privacy Policy
- Announced
- Effective
- Contact
- contact@testbank.ai
Testbank Inc. (the "Company") complies with the Personal Information Protection Act of the Republic of Korea (the "PIPA") and other applicable laws in order to protect the freedom and rights of data subjects, processes personal information lawfully, and manages it safely. Accordingly, pursuant to Article 30 of the PIPA, the Company establishes and discloses the following Privacy Policy to inform data subjects of the procedures and standards for the processing and protection of personal information, and to handle related grievances promptly and smoothly.
Purposes of Processing Personal Information, Items Processed, and Processing and Retention Periods
In accordance with the PIPA, the Company collects and uses personal information within the minimum scope necessary to provide the Service. The processing and retention period for each category of personal information follows the tables in this Chapter, and records that must be preserved under other statutes are stored separately in accordance with Chapter 3.
1. Personal information processed with the consent of the data subject (mandatory items)
For the activities below, the Company informs you of the personal information required for that activity at the time you apply for it and processes that information with your consent. Consent for the items required for membership registration and consent for the items required for customer support are obtained separately.
| Legal basis | Category | Purpose of processing | Items processed | Processing and retention period |
|---|---|---|---|---|
| PIPA Article 15(1)1 (consent) | Membership registration and management | Maintenance and management of membership, identification and authentication, notices and communications | Social login (Kakao, Google, Apple): name, user identifier issued by the relevant platform Sign-up with a mobile phone number: mobile phone number, name Sign-up with an email address: email address | Until the member withdraws. For the data that is not deleted when you delete your account, see Chapter 4 |
| PIPA Article 15(1)1 (consent) | Customer support and inquiries | Receipt and handling of inquiries, handling of complaints, record management | Name, mobile phone number, content of the inquiry, support history | Until the inquiry is closed, after which it is destroyed without delay. However, records of consumer complaints or dispute resolution relating to electronic commerce are stored separately for three years pursuant to Article 6 of the Act on the Consumer Protection in Electronic Commerce, Etc. and Article 6(1)4 of its Enforcement Decree |
If you do not enter a nickname, your registered name is used as your display name. If a member who signed up with an email address does not enter a name, the account part of the email address is used as the display name. Registration of a nickname and of additional contact details is explained under the optional items in paragraph 3 (additional profile and contact registration).
2. Personal information processed without the consent of the data subject
On the legal bases set out in the table below, the Company processes personal information for the conclusion and performance of contracts, compliance with legal obligations, its legitimate interests, and additional use within a scope reasonably related to the original purpose of collection.
| Legal basis | Category | Purpose of processing | Items processed | Processing and retention period |
|---|---|---|---|---|
| PIPA Article 15(1)4 (conclusion and performance of a contract) | Contact verification (mobile phone number and email address) | Verifying whether a mobile phone number or email address is in use at sign-up, log-in or when contact details are changed | Mobile phone number or email address, verification code, one-way transformed value of the verification code (up to 24 hours) | The verification code itself is destroyed when the relevant verification procedure is completed or its validity period expires. The one-way transformed value needed to re-verify the sign-up procedure is used for verification only for up to five minutes immediately after verification, is deleted as soon as the verification procedure is completed, and is deleted no later than 24 hours from the time it was created. |
| PIPA Article 15(1)6 (legitimate interests) | Management of verification history | Detection of fraudulent sign-ups and abuse of verification | Recipient of the message (mobile phone number or email address), dates and times of sending and verification, sending channel, purpose of verification | The minimum history necessary to detect fraudulent sign-ups and abuse of verification is retained for up to six months from the date of sending, and any information that becomes unnecessary once that purpose is achieved is destroyed before then |
| PIPA Article 15(1)4 (conclusion and performance of a contract) | Provision of products and services | Verification of e-book entitlements and processing of activation, e-book viewing, synchronization of usage records, and identification and resolution of errors reported by the user, and storage and synchronization across your devices of handwriting, notes and notebooks you create | User ID, mobile phone number, activation token and history, content ID, usage records (viewing and synchronization), device identifier (UUID), app and OS version, access IP address Handwriting and drawing data (strokes and shapes) on textbook and note pages, images and files you insert into notes, notebook titles and structure, note templates you upload | Until the member withdraws. However, where a member requests deletion of a specific record, until that record is deleted. For the data that is not deleted when you delete your account, see Chapter 4 |
| PIPA Article 15(1)4 (conclusion and performance of a contract) | Ensuring the stability of the Service | Diagnosis of the causes of errors and failures and prevention of their recurrence | The minimum logs necessary to diagnose the causes of errors and failures and to prevent their recurrence (access IP address, device and app environment, request path and error details, and the member identifier where it is necessary for error diagnosis) | The minimum logs necessary to diagnose errors and failures and to prevent their recurrence are retained for up to one year from the date of collection, and any information that becomes unnecessary once that purpose is achieved is destroyed before then. |
| PIPA Article 15(1)4 (conclusion and performance of a contract) | Service notification push messages | Notifications requested by the user, such as exam schedules and study reminders | Push token, device identifier | Until notifications are turned off or the member withdraws |
| PIPA Article 15(1)4 (conclusion and performance of a contract) | Transaction and service notification messages | Informational notices on transactions and services requested by the user, such as orders, payments and verification (by SMS or Kakao Alimtalk) | Mobile phone number, order, payment and verification details required for the notice | Until the relevant notice has been sent. However, records relating to transactions are stored separately for the statutory retention periods set out in Chapter 3 |
| PIPA Article 15(1)2 (compliance with legal obligations) and Article 15(1)4 (conclusion and performance of a contract) | Payment and refunds | Payment and settlement, cancellation and refunds, verification of fraudulent transactions | Name, mobile phone number, order number, date and time of payment, payment method, payment amount | Until payment, cancellation and refund processing is completed. Thereafter, records on contracts or withdrawal of subscription and records on payment and the supply of goods are each stored separately for five years pursuant to Article 6 of the Act on the Consumer Protection in Electronic Commerce, Etc. and Article 6(1)2 and 6(1)3 of its Enforcement Decree |
| PIPA Article 15(1)4 (conclusion and performance of a contract) | Verification of the age requirement for sign-up | Verification of whether the requirement of being at least the applicable minimum age (14 in Korea, 13 elsewhere) is met | Member identifier, whether and when the member confirmed being at least the applicable minimum age (14 in Korea, 13 elsewhere) | Until the member withdraws |
| PIPA Article 15(1)2 (compliance with legal obligations — handling of consent and withdrawal under Articles 22 and 37 of the same Act) | Management of consent and withdrawal | Receipt and reflection of choices to give or withdraw consent to the processing of personal information, and management of their current status | Member identifier, subject of the consent or withdrawal, whether given and when, version of the notice, processing channel | Until the member withdraws |
| PIPA Article 15(1)2 (compliance with legal obligations — verification of the authenticity of a consent or withdrawal request) | Verification of consent and withdrawal requests | Verifying that a request to give or withdraw consent was made by the data subject themselves (verification of the authenticity of the processing) | Access IP address and device and browser information (User-Agent) at the time of the request | Retained until the earlier of 90 days from the date of collection or the withdrawal of membership, and then destroyed. Excluded from the "retention of evidence of consent" below |
| PIPA Article 15(1)6 (legitimate interests) | Retention of evidence of consent | Response to disputes concerning the lawfulness of personal information processing | The minimum records necessary to respond to disputes concerning the lawfulness of personal information processing (member identifier, subject, whether given, date and time, version). Access IP addresses and device and browser information are excluded from this retention of evidence | Retained for up to three years from the date of withdrawal of membership and then destroyed. This is not a statutory retention period but a period set by the Company taking into account the need to respond to disputes concerning the lawfulness of personal information processing and the rights of data subjects, and the records are not used for any purpose other than that retention purpose. |
| PIPA Article 15(3) and Article 14-2 of its Enforcement Decree (additional use within a scope reasonably related to the original purpose of collection), together with the verification duty under Article 22-2 of the PIPA | Study profile collected in the past (school grade) | Having reviewed the relationship with the original purpose, the predictability for users, the possibility of infringement of rights and the safeguards in place, the Company makes temporary additional use of school grade information originally collected for study recommendations and profile display in order to re-verify that existing members meet the age requirement for sign-up. A past school grade alone is not used to determine a member’s current age. | Member identifier, school grade previously entered | Destroyed on the earlier of the completion of re-verification or 31 October 2026. |
| PIPA Article 15(1)6 (legitimate interests) | Service usage analytics | Statistical analysis of how the Service is used, measurement of feature adoption, and service improvement (Firebase Analytics and Google Analytics 4 (GA4)) | App usage events (screens and features used) App version, build and platform A device identifier generated for the app (not an advertising identifier) Your member ID when you are signed in | The retention period applied in each tool, not exceeding 14 months; aggregated statistics are kept only in anonymized form |
| PIPA Article 15(1)6 (legitimate interests) | App install attribution analysis | Measurement of advertising contribution and attribution analysis | Items stored on the Company servers: AppsFlyer identifier, app platform and version, inbound advertising media and campaign information, click and install timestamps, access IP address and device environment (User-Agent) Items processed by the SDK: app install and launch records, advertising identifier (ADID/IDFA — only where permitted in the device settings; not stored on the Company servers) App install attribution is processed for all installs of the SOLVE app as an entrustment of processing to AppsFlyer Ltd. Advertising identifiers (IDFA) are processed only where you allow app tracking in your device settings, and are not stored on the Company servers. | Up to one year from the date of collection. If the analysis purpose is achieved or the member withdraws earlier, the data is destroyed without delay |
| PIPA Article 15(1)4 (conclusion and performance of a contract) | AI study coach | Answering questions you ask the AI coach, giving hints and explanations for the problem you are working on, reading text from a page area you select, and transcribing and grading handwritten answers | Text of your questions and the preceding messages in the same conversation The problem, passage and explanation you are viewing and your previous answers to it Images of the page area you select Images of your handwritten answers For a grading objection, the corrected text and the verdict you claim (recorded in server logs only and not sent to AI model providers) Learning statistics used for study briefings (such as attempts, wrong answers and weak concepts) | Conversations, coach settings and daily usage records are retained without a fixed period and, at present, are not deleted when you delete your account (see Chapter 4); you may request their deletion at contact@testbank.ai. Page-area images used for text recognition are processed in memory and are not stored. |
Usage analytics is collected for all users of the SOLVE app regardless of consent and cannot be switched off in the app. It is not used for advertising and is not shared with advertisers.
Only notes linked to your account are synchronized. Notes you create while not signed in, and materials you import from your device (including while signed in, in regions where import is available), are stored only on your device and are not synchronized; notes created while not signed in may be moved to your account when you sign up.
AI responses are generated automatically and may be inaccurate. Your member ID is not sent to the AI model providers.
| Processing | Processor and model | Data sent to the model | Country of processing | Retention by the processor | Retention on the Company servers |
|---|---|---|---|---|---|
| AI coach conversation — default route (about 80% of requests) | The Company’s own model google/gemma-4-31B-it, served with vLLM on NHN Cloud B200 GPUs (National AI Computing Resource support program), relayed through Amazon Web Services (AWS) EC2 | All messages in the conversation thread (the original text of your questions), together with the problem text recognized by OCR, your previous answers to the problem and whether they were correct, the passage and explanation, and textbook search excerpts attached by the Company | Not yet confirmed (no document specifies the physical location) | Not yet confirmed (NHN infrastructure logs) | See "AI study coach — retention on the Company servers" below |
| AI coach conversation — external route (about 20% of requests) | OpenRouter, Inc. — google/gemma-4-31b-it:free (free tier, up to 200 requests per day) and, as a fallback, paid google/gemma-4-31b-it (spending capped at USD 5 per day). The model provider behind OpenRouter (such as Google AI Studio) may vary from request to request | Same as the default route | Not yet confirmed (no region or provider is fixed in the Company’s settings) | Not yet confirmed — the Company has not configured OpenRouter’s data collection restriction (provider.data_collection) or zero data retention (ZDR); the free (:free) tier is in use | See "AI study coach — retention on the Company servers" below |
| Text recognition of a selected page area (page capture OCR) | The Company’s own model PaddlePaddle/PaddleOCR-VL on the NHN Cloud B200 GPUs — no external provider. For textbooks you own, text recognition results already stored by the Company (Amazon S3) are used first | The cropped page image (base64-encoded) | Same as the B200 GPUs above (not yet confirmed) | Not applicable (not sent to an external provider) | The image is processed in memory only and is not stored. Logs of successful requests record your member identifier together with the image size, the number of characters and words recognized, the book and page and the processing time — these logs are linked to your membership (the recognized text itself is not logged). The recognized text is included in the next AI coach conversation turn and is then processed on the two routes above, including OpenRouter |
| Transcription and grading of handwritten answers | Google LLC — Gemini API: gemini-3.5-flash-lite for transcription and meaning-based grading; for the demo tier, an ensemble with gemini-3.5-flash. Connected directly to Google (not through OpenRouter). If it fails, the B200 or OpenRouter routes above are used as a fallback | Images of your handwritten ink and of the problem area; for meaning-based grading, the problem text, passage and explanation (up to 6,000 characters) | Not yet confirmed (no processing region is specified for the Gemini API) | Not yet confirmed (whether a paid key or the free tier is used and the provider’s retention settings are not confirmed) | Handwriting images are stored only for user IDs on an allowlist (currently one internal demonstration account), in the Company’s Amazon S3 storage (contents.testbank bucket, hw-debug path); the storage lifecycle is not yet confirmed. Server logs record the first 200 characters each of the transcribed text, the grading reason and any text you corrected, together with your user ID and the problem ID |
| Grading objection | None — not sent to any AI model provider (the request is validated and only logged) | Not sent | — | — | Recorded only in server logs (the Company’s monitoring system): the first 200 characters of the corrected text, the verdict you claim, the grading ID and your user ID; for any memo, only its length. Not stored in a database |
| Dashboard insights and study briefings / wrap-ups | Same routes as the AI coach conversation (B200 / OpenRouter) | Exam group, days remaining, number of attempts and wrong answers, and the top three weak concepts (name and proficiency) — your user ID is not sent | Same as the route used | Same as the route used | Cached in memory for 600 seconds |
| All of the above | Your user ID is not sent with model requests (no user parameter or header) | — | — | — | — |
| Not used | AWS Bedrock, Anthropic, direct calls to OpenAI and the LiteLLM gateway are not used in the AI coach production path | — | — | — | — |
| Data | Location | Retention and destruction |
|---|---|---|
| AI coach conversation thread messages (question text, book, page and problem, session) | The Company’s service database (Amazon Web Services, Republic of Korea region) | No fixed retention period and no deletion function; at present, not deleted when you delete your account (see Chapter 4). You may request deletion at contact@testbank.ai |
| AI coach settings and daily usage records | The Company’s service database (Amazon Web Services, Republic of Korea region) | No fixed retention period |
| AI coach server logs | Amazon CloudWatch (log group /ecs/solve-agent, Republic of Korea region, ap-northeast-2) and the Company’s monitoring system (HyperDX) | A 365-day retention setting is applied only when the log group is newly created; the retention period actually applied in CloudWatch and the retention period in HyperDX are not yet confirmed |
The Company does not send your member ID to AI model providers with any request.
3. Personal information processed with the consent of the data subject (optional items)
1) The Company processes the following personal information with the consent of the data subject. You may register as a member and use the basic services even if you do not consent to the optional processing of personal information; however, you will not be able to use optional features that require such processing, such as saving study recordings. Whether you consent to marketing messages and ad measurement and personalized advertising through Meta has no effect on your use of the basic services.
| Legal basis | Category | Purpose of processing | Items processed | Processing and retention period |
|---|---|---|---|---|
| PIPA Article 15(1)1 (consent) | Additional profile and contact registration | Setting up the user profile and managing contact details | Nickname Name additionally entered when signing up with an email address Email address or mobile phone number not provided at sign-up | Until the earlier of deletion of the information, withdrawal of consent, or withdrawal of membership. For the data that is not deleted when you delete your account, see Chapter 4 |
| PIPA Article 15(1)1 (consent) | Marketing messages, events and new service announcements | Sending text messages (SMS/LMS) | Mobile phone number | Until consent is withdrawn or the member withdraws |
| PIPA Article 15(1)1 (consent) | Marketing messages, events and new service announcements | Announcements of marketing information, events and feature updates through app push notifications | Push token | Until consent is withdrawn or the member withdraws |
| PIPA Article 15(1)1 (consent) | Marketing messages, events and new service announcements | Email newsletters and promotional announcements (to be sent where consent is given) | Email address | Until consent is withdrawn or the member withdraws |
| PIPA Article 15(1)1 (consent) | Study recordings | Saving and playing back voice recordings made while studying, and linking them to textbook pages | Voice recording files, recording titles, recording date and time and playback duration, file size, linked textbook and page information | Until the earlier of deletion of the recording, withdrawal of consent to the processing of recordings, or withdrawal of membership |
| PIPA Article 15(1)1 (consent) | PDF upload (user textbooks) | Registration, display, storage and management of PDFs uploaded by the user | PDF files uploaded by the user and their metadata (file name, size) | Until the earlier of deletion of the file, withdrawal of consent, or withdrawal of membership |
| PIPA Article 15(1)1 (consent) | Study materials you add (knowledge bank) | Organizing, summarizing and searching materials you add; answering questions about those materials; and reviewing your own solutions through "Check my work" | Materials you add, including files, links, photos of pages, handwritten notes and scanned paper, and the text extracted from them (including OCR of handwriting and scanned pages) Page images, your questions, your written or typed work on a page, grading results, and the notebook to which you assign the material | While your account and the item exist. When you delete an item, the Company deletes the summaries, search-index entries, answers and cached copies derived from it together with the item, and any job still in progress re-checks that the item exists before writing a result. For the data that is not deleted when you delete your account, see Chapter 4 |
| PIPA Article 15(1)1 (consent) | Customer support and inquiries | Receipt and handling of inquiries, handling of complaints, record management | Email address, attachments (such as screenshots) | Until the inquiry is closed, after which it is destroyed without delay. However, records of consumer complaints or dispute resolution relating to electronic commerce are stored separately for three years pursuant to Article 6 of the Act on the Consumer Protection in Electronic Commerce, Etc. and Article 6(1)4 of its Enforcement Decree |
| PIPA Article 15(1)1 (consent), Article 17(1)1 (consent to provision to a third party) and Article 28-8(1)1 (consent to overseas transfer) | Ad measurement and personalized advertising (Meta) | Ad measurement and personalized advertising through Meta Platforms, Inc. (Facebook SDK and Pixel) in the SOLVE iOS app and on the SOLVEBOOKS website (for the provision to a third party see Chapter 5; for the overseas transfer see Chapter 7) | Advertising identifier (only where app tracking is allowed in the iOS app) App and web usage events (SDK in the SOLVE iOS app, pixel on the SOLVEBOOKS website) Access IP address and device environment Member identifier set on app events (internal ID — provided as part of the event data; contact information is not provided) | Until consent is withdrawn or the member withdraws (for Meta’s retention and use period, see Chapter 5) |
2) How to withdraw consent to receiving marketing messages
You may withdraw your consent to receiving marketing messages at any time by any of the following methods.
- Turning off each channel (text message, app push, email) under [My Information > Notification settings] in the SOLVE app or on SOLVEBOOKS
- Following the [unsubscribe] method indicated in the text message
- Sending a request by email to the personal information department (contact@testbank.ai)
If you refuse to receive marketing messages or withdraw your consent, the Company stops sending marketing messages through that channel and informs you of the outcome in accordance with the applicable laws. Informational notices concerning transactions and services, such as orders, payments and verification, are not marketing messages and are therefore sent regardless of whether you have consented to marketing messages.
3) Usage analytics and app install attribution
Usage analytics and app install attribution are not based on consent; you may object to this processing by contacting contact@testbank.ai.
4) How to withdraw consent to ad measurement and personalized advertising (Meta)
You may request withdrawal of your consent to the provision to Meta as a third party and to the related overseas transfer from the personal information department (contact@testbank.ai). Upon receipt of the request, the Company stops any further provision to Meta. You can manage the link between information already provided and your Meta account under "Your activity off Meta technologies" in the Meta Accounts Center. Disconnecting may differ from the deletion of the data that Meta holds. To exercise privacy rights such as deletion, you may use Meta’s privacy rights request procedure, and the Company will guide you through that procedure on request. For how to change the advertising identifier and app tracking settings on your mobile device, please refer to Chapter 9.
5) Study materials you add (knowledge bank)
Materials you add to the knowledge bank are private to your account by default, and the Service does not provide a path for you to make them publicly available. If knowledge-bank AI processing is offered, before its first use the Company will obtain separate consent and show the provider names in the app and under [Settings > Providers]. You may then withdraw that consent at any time in Settings. Withdrawal stops future AI processing, while the viewer and pen continue to work without AI.
| Processing | Processor and model service | Data sent for processing | Country of processing | Retention by the processor | Retention on the Company servers |
|---|---|---|---|---|---|
| Text and handwriting extraction, page rendering and search indexing | The Company’s own processing on NHN Cloud B200 GPUs and Amazon Web Services (AWS) servers | The original material, page images and handwriting necessary for extraction, rendering and indexing | Not yet confirmed (no document specifies the physical location) | Not applicable (not sent to an external AI provider) | While your account and the item exist. When you delete an item, the Company deletes the summaries, search-index entries, answers and cached copies derived from it together with the item, and any job still in progress re-checks that the item exists before writing a result. For the data that is not deleted when you delete your account, see Chapter 4 |
| Summaries, answers and step-by-step feedback | Google LLC — Gemini API | Only the extracted text of the source you are working on and your typed or OCR-transcribed work; original files, page images and handwriting ink are not sent | Outside the Republic of Korea; no processing region has been designated for this integration | Only for service operation, security, abuse monitoring and legal compliance as permitted under the provider’s applicable API terms; those terms do not permit the provider to use the transferred data to train its models | While your account and the item exist. When you delete an item, the Company deletes the summaries, search-index entries, answers and cached copies derived from it together with the item, and any job still in progress re-checks that the item exists before writing a result. For the data that is not deleted when you delete your account, see Chapter 4 |
| Summaries, answers and step-by-step feedback | OpenAI, L.L.C. — OpenAI API | Only the extracted text of the source you are working on and your typed or OCR-transcribed work; original files, page images and handwriting ink are not sent | Outside the Republic of Korea; no processing region has been designated for this integration | Only for service operation, security, abuse monitoring and legal compliance as permitted under the provider’s applicable API terms; those terms do not permit the provider to use the transferred data to train its models | While your account and the item exist. When you delete an item, the Company deletes the summaries, search-index entries, answers and cached copies derived from it together with the item, and any job still in progress re-checks that the item exists before writing a result. For the data that is not deleted when you delete your account, see Chapter 4 |
For Google LLC and OpenAI, L.L.C.: Only the extracted text of the source you are working on and your typed or OCR-transcribed work; original files, page images and handwriting ink are not sent. Your member ID is not sent to those providers.
6) AI assistants you connect yourself
- If SOLVE offers this feature and you choose to connect an AI service you already use, such as ChatGPT, Claude or Gemini, you may allow it to read your SOLVE notebooks through a personal, read-only, time-limited access token that you create and can revoke at any time in Settings.
- Once connected, the service can read notebook names, extracted source text by page, the text of your notes, your attempts and mistakes, and your review queue. It cannot write to SOLVE, and nothing is sent until the service requests it on your behalf.
- You initiate any such connection. The Company is not a party to that service’s processing. Read that service’s privacy terms for how it stores what it reads. Revoking the token stops further reads but does not delete information that the service has already stored.
- If conversation import is offered, you can bring your own conversation exports from those services into SOLVE as materials; they are treated as materials you added to the knowledge bank under item 5) of this Chapter.
Processing of the Personal Information of Children
- The minimum age for membership registration depends on the country or region in which you use the Service: 14 years of age in the Republic of Korea and 13 years of age in the United States and other countries and regions (or a higher age where required by local law). During sign-up you are asked to confirm that you meet the minimum age that applies to you, and registration cannot proceed without that confirmation. The knowledge bank is not offered to accounts below the applicable minimum age. The Company does not knowingly collect personal information from children under 13; if we learn that we have done so, we will delete it without delay. A parent or guardian who believes their child has provided us with personal information may contact us at contact@testbank.ai.
- The Company does not collect dates of birth in this procedure. It retains the minimum records necessary, such as whether and when age was confirmed; the specific items processed and their retention periods are set out in Chapter 1.
- If it is confirmed that a member is below the minimum age that applies to them, the Company restricts the use of that account without delay and destroys the personal information. However, information that must be preserved under other statutes is stored separately for the period prescribed by those statutes and processed only for that purpose. Accounts confirmed to belong to a person below the minimum age that applies to them are handled in accordance with this Chapter, and the standard for retaining evidentiary records after the withdrawal of an ordinary member is not applied uniformly to them.
- If the Company provides services to children below the applicable minimum age in the future, it will put the privacy policy and the related procedures in place before it begins processing their personal information and, for processing that requires the consent of a legal representative under the applicable laws, will obtain that consent and then verify that it was actually given.
- The Company may also ask existing members for additional verification where it is necessary to confirm that they meet the age requirement, and use of the Service may be restricted until that verification is completed.
Processing and Retention Periods of Personal Information
- The legal basis and retention period for each category of personal information follow Chapter 1. The Company processes personal information for the period necessary for each processing purpose, and preserves records subject to statutory retention in accordance with the table below.
- The processing and retention period for each category of personal information is as follows.
- Provision of the Service: until the member withdraws. However, where an investigation or inquiry into a violation of the applicable laws is under way, or where claims or obligations arising from use of the Service remain outstanding, only the minimum information necessary for that investigation or inquiry or for settling those claims or obligations is preserved for the necessary period, and only where there is a lawful basis for doing so.
- Optional items: retained until the end of the period set out in Chapter 1, and then destroyed
- Records that must be preserved under the statutes listed below are stored and managed separately from other personal information, limited to the necessary items, and used only for the statutory retention purpose.
| Legal basis | Type of personal information | Retention period |
|---|---|---|
| Article 33 of the Commercial Act | Personal information contained in commercial books and important documents relating to business | 10 years |
| Article 33 of the Commercial Act | Personal information contained in slips or similar documents | 5 years |
| Article 85-3 of the Framework Act on National Taxes | Personal information contained in books and supporting documents relating to transactions (name, transaction details, payment details, etc.) | 5 years |
| Article 6 of the Act on the Consumer Protection in Electronic Commerce, Etc. and Article 6(1)2 of its Enforcement Decree | Records on contracts or withdrawal of subscription | 5 years |
| Article 6 of the Act on the Consumer Protection in Electronic Commerce, Etc. and Article 6(1)3 of its Enforcement Decree | Records on payment and the supply of goods | 5 years |
| Article 6 of the Act on the Consumer Protection in Electronic Commerce, Etc. and Article 6(1)4 of its Enforcement Decree | Records on consumer complaints or dispute resolution | 3 years |
| Article 6 of the Act on the Consumer Protection in Electronic Commerce, Etc. and Article 6(1)1 of its Enforcement Decree | Records on labelling and advertising | 6 months |
Procedures and Methods for Destroying Personal Information
- Where personal information becomes unnecessary — for example, because the retention period has elapsed or the processing purpose has been achieved — the Company destroys it without delay.
- When you delete your account in the app, the Company immediately deactivates the account and: deletes your mobile phone number and email address from your account record; deletes your social login link, sign-in tokens and push notification tokens so that the account can no longer be accessed; and deletes your marketing consent settings. Records of the consents you gave or withdrew (the subject, whether given, date and time, and version) are kept as evidence of consent for up to three years as described in Chapter 1, and order and payment records are kept for the periods required by law as described in Chapter 3.
- At present, the following data is not deleted when you delete your account and remains associated with the deactivated account: your name, nickname and profile image; handwriting, notes and notebooks synchronized to our servers; and your AI coach conversations and settings. You may request deletion of this data by contacting contact@testbank.ai.
- Where personal information must continue to be preserved under other statutes even though the retention period consented to by the data subject has elapsed or the processing purpose has been achieved, the Company moves that personal information to a separate database or stores it in a different location. The items of personal information preserved under other statutes and the basis for their preservation can be found in "Chapter 3 Processing and Retention Periods of Personal Information".
- The procedures and methods for destroying personal information are as follows.
- Destruction procedure: the Company selects the personal information for which a ground for destruction has arisen and destroys it with the approval of the Company’s privacy officer.
- Destruction method: personal information recorded and stored in electronic file form is destroyed so that the records cannot be restored, and personal information recorded and stored in paper documents is shredded or incinerated.
Provision of Personal Information to Third Parties
- In order to provide the Service smoothly, the Company provides personal information in the following cases with the consent of the data subject pursuant to Article 17(1)1 of the PIPA, and only within the minimum necessary scope.
| Recipient | Personal information items | Purpose of use by the recipient | Retention and use period of the recipient |
|---|---|---|---|
| Partners (㈜해커스; ㈜와이비엠넷 (YBM NET)) | User identifier, order/entitlement number, entitlement status (active/inactive) | Verification of content entitlements, cooperation in customer support | Until the content entitlement expires and settlement is completed; customer support information until the support is completed |
| Payment gateways (㈜토스페이먼츠 (Toss Payments); 네이버파이낸셜㈜ (NAVER Financial Corp.)) | Name, mobile phone number, order number, payment amount and date and time, payment method | Payment processing, cancellation and refunds, prevention of fraudulent transactions | Until payment, cancellation and refund processing is completed. However, pursuant to Article 22 of the Electronic Financial Transactions Act and Article 12 of its Enforcement Decree, records falling under each subparagraph of Article 12(1) are preserved for five years and records falling under each subparagraph of Article 12(2) for one year. |
| Meta Platforms, Inc. (Facebook SDK and Pixel — only for users who have consented to the provision to Meta as a third party and to the related overseas transfer) | Advertising identifier (only where app tracking is allowed in the iOS app) App and web usage events (SDK in the SOLVE iOS app, pixel on the SOLVEBOOKS website) Access IP address and device environment Member identifier set on app events (internal ID — provided as part of the event data; contact information is not provided) | Ad measurement and personalized advertising | The event data provided is retained for up to two years from the date of receipt in accordance with the Meta Business Tools Terms. Upon withdrawal of consent, the Company stops any further provision. You can manage the link between information already provided and your Meta account under "Your activity off Meta technologies" in the Meta Accounts Center. Disconnecting may differ from the deletion of the data that Meta holds. To exercise privacy rights such as deletion, you may use Meta’s privacy rights request procedure, and the Company will guide you through that procedure on request. |
The provision to Meta Platforms, Inc. takes place in the SOLVE iOS app and on the SOLVEBOOKS website (the Facebook SDK in the SOLVE iOS app and the Meta Pixel on the SOLVEBOOKS website); the SOLVE Android app does not include any Meta SDK. The consent items and the Company’s retention period follow the "Ad measurement and personalized advertising (Meta)" row in Chapter 1, paragraph 3, and the overseas transfer follows Chapter 7.
- The Company processes the personal information of data subjects only within the scope of the processing purposes specified in Chapter 1, and provides personal information to third parties only where Article 17 or 18 of the PIPA applies, such as with the consent of the data subject or under special provisions of statute; otherwise it does not provide personal information to third parties. However, where necessary for statistical purposes, academic research or market research, the Company may, taking into account time, cost and technology on a reasonable basis, process personal information into anonymized information from which no individual can be identified even by using other information, and provide it in that form.
- The Company does not use personal information beyond the scope of the purpose for which it was collected or provide it to third parties beyond that scope. However, where the requirements applicable to the Company under Article 18(2) of the PIPA are met — such as separate consent from the data subject, special provisions of another Act, or an urgent need to protect life, bodily safety or property interests, or for public safety and security including public health — the Company may process personal information within the minimum necessary scope. A request from an investigative authority is not acted on simply because it has been made; the Company verifies the applicable law and that lawful procedures have been followed.
Entrustment of Personal Information Processing
- In order to process personal information smoothly, the Company entrusts personal information processing work as set out below. A trustee processes personal information only within the scope of the Company’s purposes and instructions; a business operator that uses the personal information it collects for its own purposes (Meta Platforms, Inc.) is explained not as a trustee but as a recipient of a provision to a third party (Chapter 5) and of an overseas transfer (Chapter 7).
| Trustee | Entrusted work |
|---|---|
| ㈜채널코퍼레이션 (Channel Corporation) | Receipt of customer inquiries and operation of customer support through Channel Talk |
| ㈜알리는사람들 (Alipeople Inc. — "Aligo") | Sending text messages (SMS/LMS) and informational Kakao Alimtalk messages on behalf of the Company — marketing text messages only to those who have consented to receive them Sub-entrustment for Kakao Alimtalk: ㈜카카오 (Kakao Corp.) |
| ㈜토스페이먼츠 (Toss Payments) | Payment processing |
| 네이버파이낸셜㈜ (NAVER Financial Corp. — Naver Pay) | Payment processing |
| Amazon Web Services, Inc. (AWS) | Operation of cloud infrastructure and storage of member information, usage records, study recording files, uploaded PDFs, knowledge-bank materials, and handwriting and notes The data is stored in the AWS Republic of Korea region and is not replicated to any region outside Korea. Access or retrieval from outside Korea is also not permitted, except if SOLVE offers connected-AI access and you authorize that service to read your data (see Chapter 1, paragraph 3, item 6). |
| Google LLC | Sending service notification push messages and marketing push messages (only to those who have consented to receive them) using Firebase Cloud Messaging (FCM) Analysis of app crash information through Firebase Crashlytics (ensuring the stability of the Service) Analysis of app and web usage behavior through Firebase Analytics and GA4 Processing of Google login (OAuth authentication information) Transcription and grading of handwritten answers using the Gemini API Generating summaries, answers and step-by-step feedback from extracted knowledge-bank text using the Gemini API, after separate consent |
| OpenAI, L.L.C. | Generating summaries, answers and step-by-step feedback from extracted knowledge-bank text using the OpenAI API, after separate consent |
| OpenRouter, Inc. | Routing part of the AI coach requests to AI model providers and returning generated responses |
| NHN Cloud Corp. | Provision of GPU computing resources on which the Company’s AI models run |
| Mixpanel, Inc. | Usage behavior analysis and service improvement (SOLVEBOOKS website — not used in the SOLVE iOS app) |
| AppsFlyer Ltd. | Measurement of mobile app advertising contribution and attribution analysis |
| Microsoft Corporation (Clarity) | User experience (UX) analysis and improvement of the service interface (SOLVEBOOKS website — not used in the SOLVE iOS app) |
| Apple Inc. (Apple login) | OAuth-based user identification and provision of federated service login |
- When entering into an entrustment agreement, the Company specifies in the contract or another document, pursuant to Article 26 of the PIPA, the prohibition on processing personal information for purposes other than performing the entrusted work, technical and administrative safeguards, restrictions on sub-entrustment, supervision of the trustee, and liability such as damages, and supervises whether the trustee processes personal information safely.
- Pursuant to Article 26(6) of the PIPA, where a trustee sub-entrusts the Company’s personal information processing work, it obtains the Company’s consent, and the Company discloses the sub-trustee and the content of the sub-entrusted work through this Privacy Policy.
- If the content of the entrusted work or the trustee changes, the Company will disclose this through this Privacy Policy without delay.
Collection and Overseas Transfer of Personal Information
- The Company uses the services of overseas business operators such as Google in order to analyse members’ use of the Service, send push notifications, provide social login and measure advertising performance, to provide the AI study coach, and, after separate consent, to generate summaries, answers and step-by-step feedback from extracted knowledge-bank text.
- The main databases and storage holding member information, usage records, study recording files, uploaded PDFs, knowledge-bank materials, and handwriting and notes are kept in the AWS Republic of Korea region and are not replicated to any region outside Korea. Access or retrieval from outside Korea is also not permitted, except if SOLVE offers connected-AI access and you authorize that service to read your data (see Chapter 1, paragraph 3, item 6). Where an overseas business operator processes personal information, the items, country, purpose, period and basis of the transfer are set out in the tables below.
- The legal bases for overseas transfers are classified as follows.
- Overseas entrustment of processing for the provision of essential services (service notification push messages (FCM), ensuring the stability of the Service (Firebase Crashlytics — necessary for the stable provision of the contracted service), Google and Apple login, service usage analytics (Firebase Analytics and GA4), app install attribution (AppsFlyer), and the AI coach (OpenRouter, Google Gemini API)): the transfer is made after completing the statutory procedures, including disclosure in this Privacy Policy, to the extent that the requirements of Article 28-8(1)3 of the PIPA are met.
- Overseas transfers based on separate consent (marketing push messages (FCM), Mixpanel and Clarity (SOLVEBOOKS website — not used in the SOLVE iOS app), the provision to Meta Platforms, Inc. as a third party, and processing of extracted knowledge-bank text by the Gemini API or OpenAI API): the transfer is made where separate consent to the overseas transfer has been obtained under Article 28-8(1)1 of the same Act. Consent to the provision to Meta as a third party and to the related overseas transfer is obtained separately from consent to marketing push messages. Knowledge-bank text is transferred only after the separate AI processing consent described in Chapter 1.
| Item | Details |
|---|---|
| Personal information items transferred (entrustment) | Mandatory — service notification push messages (FCM): push token, device identifier Mandatory — ensuring the stability of the Service (Firebase Crashlytics): app crash information (device and app environment, error details) Mandatory — Google login: OAuth authentication information Mandatory — service usage analytics (Firebase Analytics and GA4): App usage events (screens and features used); App version, build and platform; A device identifier generated for the app (not an advertising identifier); Your member ID when you are signed in Optional (with consent) — marketing push messages (FCM): push token |
| Country of transfer | United States |
| Address and contact | 1600 Amphitheatre Parkway Mountain View, CA 94043, USA / googlekrsupport@google.com |
| Timing and method of transfer | Service notification push messages: transmitted over the network when required to deliver a notification Crashlytics: transmitted over the network when error and failure information is collected Google login: transmitted over the network when the user requests Google login Service usage analytics: Transmitted over the network when the Service is used Marketing push messages (optional): Transmitted over the network when the Service is used, only for users who have consented |
| Purpose of use | Mandatory: sending service notification push messages such as exam schedules and study reminders, ensuring the stability of the Service through app crash analysis, OAuth-based user identification and provision of federated service login, and statistical analysis of service usage and service improvement Optional: sending marketing and event push messages |
| Retention and use period | Service notification push messages: Until notifications are turned off or the member withdraws Ensuring the stability of the Service (Crashlytics): The minimum logs necessary to diagnose errors and failures and to prevent their recurrence are retained for up to one year from the date of collection, and any information that becomes unnecessary once that purpose is achieved is destroyed before then. Google login: Until the end of the retention period for the relevant item set out in Chapter 1 (destroyed without delay when the member withdraws) Marketing push messages: Until consent is withdrawn or the member withdraws Service usage analytics: Retained until the end of the period set out for "Service usage analytics" in Chapter 1, paragraph 2 |
| Relevant basis | Mandatory items: PIPA Article 28-8(1)3 (entrustment of processing or storage for the performance of a contract) — entrustment of processing under Article 26 of the same Act — Firebase Crashlytics is an entrustment of processing necessary for the stable provision of the contracted service; Firebase Analytics and GA4 are an entrustment of processing for service usage analytics Optional items: PIPA Article 28-8(1)1 (separate consent to the overseas transfer) |
| Item | Details |
|---|---|
| Personal information items transferred (entrustment) | App and web usage events (records of screens and features used), device and app environment analytics user and device identifiers (excluding advertising identifiers) |
| Country of transfer | United States |
| Address and contact | One Front Street, 28th Floor, San Francisco, CA 94111, USA / compliance@mixpanel.com |
| Timing and method of transfer | Transmitted over the network when the Service is used, only for users who have consented |
| Purpose of use | Usage behavior analysis and service improvement (entrustment of processing within the scope of the Company’s purposes and instructions) |
| Retention and use period | The retention period applied in each tool, not exceeding 14 months, and destroyed without delay upon withdrawal of consent to that analysis or to the overseas transfer |
| Relevant basis | PIPA Article 28-8(1)1 (separate consent to the overseas transfer) |
| Item | Details |
|---|---|
| Personal information items transferred (provision) | Advertising identifier (only where app tracking is allowed in the iOS app) App and web usage events (SDK in the SOLVE iOS app, pixel on the SOLVEBOOKS website) Access IP address and device environment Member identifier set on app events (internal ID — provided as part of the event data; contact information is not provided) |
| Country of transfer | United States |
| Address and contact | 1 Meta Way, Menlo Park, CA 94025, USA / dpfinquiry@support.facebook.com |
| Timing and method of transfer | Transmitted through the SDK and the pixel when the SOLVE iOS app or the SOLVEBOOKS website is used, only for users who have consented |
| Purpose of use | Ad measurement and personalized advertising (used by Meta for its own purposes — provision to a third party under Chapter 5) |
| Retention and use period | The event data provided is retained for up to two years from the date of receipt in accordance with the Meta Business Tools Terms. Upon withdrawal of consent, the Company stops any further provision. You can manage the link between information already provided and your Meta account under "Your activity off Meta technologies" in the Meta Accounts Center. Disconnecting may differ from the deletion of the data that Meta holds. To exercise privacy rights such as deletion, you may use Meta’s privacy rights request procedure, and the Company will guide you through that procedure on request. |
| Relevant basis | PIPA Article 28-8(1)1 (separate consent to the overseas transfer) — provision to a third party under Article 17 of the same Act |
| Item | Details |
|---|---|
| Personal information items transferred (entrustment) | Items stored on the Company servers: AppsFlyer identifier, app platform and version, inbound advertising media and campaign information, click and install timestamps, access IP address and device environment (User-Agent) Items processed by the SDK: app install and launch records, advertising identifier (ADID/IDFA — only where permitted in the device settings; not stored on the Company servers) App install attribution is processed for all installs of the SOLVE app as an entrustment of processing to AppsFlyer Ltd. Advertising identifiers (IDFA) are processed only where you allow app tracking in your device settings, and are not stored on the Company servers. |
| Country of transfer | Israel (AppsFlyer Ltd. headquarters and support) and the EU (data hosting: Amazon Web Services and Google Cloud — based on the AppsFlyer sub-processor list as of 24 August 2026) |
| Address and contact | 14 Maskit St., Herzliya, Israel / privacy@appsflyer.com |
| Timing and method of transfer | Transmitted through the SDK when the app is installed or launched |
| Purpose of use | Measurement of mobile app advertising contribution and attribution analysis (entrustment of processing within the scope of the Company’s purposes and instructions) |
| Retention and use period | Up to one year from the date of collection. If the analysis purpose is achieved or the member withdraws earlier, the data is destroyed without delay |
| Relevant basis | PIPA Article 28-8(1)3 (entrustment of processing or storage for the performance of a contract) — entrustment of processing under Article 26 of the same Act |
| Item | Details |
|---|---|
| Personal information items transferred (entrustment) | Screen interaction records (session replay), click and scroll history Device and browser environment, analytics user and device identifiers (excluding advertising identifiers) |
| Country of transfer | United States |
| Address and contact | One Microsoft Way, Redmond, WA 98052, USA / privacy@microsoft.com |
| Timing and method of transfer | Transmitted over the network when the Service is used, only for users who have consented |
| Purpose of use | User experience (UX) analysis and improvement of the service interface (entrustment of processing within the scope of the Company’s purposes and instructions) |
| Retention and use period | The retention period applied in each tool, not exceeding 14 months, and destroyed without delay upon withdrawal of consent to that analysis or to the overseas transfer |
| Relevant basis | PIPA Article 28-8(1)1 (separate consent to the overseas transfer) |
| Item | Details |
|---|---|
| Personal information items transferred (entrustment) | AI coach question text, preceding conversation messages, and the problem content and previous answers attached by the Company |
| Country of transfer | Not yet confirmed — to be updated once confirmed with the provider |
| Timing and method of transfer | Transmitted over the network when you use the AI coach (a portion of requests) |
| Purpose of use | Generation of AI coach responses |
| Retention and use period | Not yet confirmed — to be updated once confirmed with the provider |
| Relevant basis | PIPA Article 28-8(1)3 (entrustment of processing or storage for the performance of a contract) — entrustment of processing under Article 26 of the same Act |
| Item | Details |
|---|---|
| Personal information items transferred (entrustment) | Images of handwritten answers and of the related problem area, problem text, passage and explanation |
| Country of transfer | Not yet confirmed — to be updated once confirmed with the provider |
| Address and contact | 1600 Amphitheatre Parkway Mountain View, CA 94043, USA / googlekrsupport@google.com |
| Timing and method of transfer | Transmitted over the network when you submit a handwritten answer for grading |
| Purpose of use | Transcription and grading of handwritten answers |
| Retention and use period | Not yet confirmed — to be updated once confirmed with the provider |
| Relevant basis | PIPA Article 28-8(1)3 (entrustment of processing or storage for the performance of a contract) — entrustment of processing under Article 26 of the same Act |
| Item | Details |
|---|---|
| Personal information items transferred (entrustment) | Only the extracted text of the source you are working on and your typed or OCR-transcribed work; original files, page images and handwriting ink are not sent |
| Country of transfer | Outside the Republic of Korea; no processing region has been designated for this integration |
| Address and contact | 1600 Amphitheatre Parkway Mountain View, CA 94043, USA / googlekrsupport@google.com |
| Timing and method of transfer | Transmitted over the network after separate AI processing consent, when you request a knowledge-bank summary, answer or review of your work |
| Purpose of use | Generating summaries, answers and step-by-step feedback from extracted knowledge-bank text |
| Retention and use period | Only for service operation, security, abuse monitoring and legal compliance as permitted under the provider’s applicable API terms; those terms do not permit the provider to use the transferred data to train its models |
| Relevant basis | PIPA Article 28-8(1)1 (separate consent to the overseas transfer) |
| Item | Details |
|---|---|
| Personal information items transferred (entrustment) | Only the extracted text of the source you are working on and your typed or OCR-transcribed work; original files, page images and handwriting ink are not sent |
| Country of transfer | Outside the Republic of Korea; no processing region has been designated for this integration |
| Timing and method of transfer | Transmitted over the network after separate AI processing consent, when you request a knowledge-bank summary, answer or review of your work |
| Purpose of use | Generating summaries, answers and step-by-step feedback from extracted knowledge-bank text |
| Retention and use period | Only for service operation, security, abuse monitoring and legal compliance as permitted under the provider’s applicable API terms; those terms do not permit the provider to use the transferred data to train its models |
| Relevant basis | PIPA Article 28-8(1)1 (separate consent to the overseas transfer) |
The corrected text and verdict you submit in a grading objection are not sent to Google or to any other AI model provider; they are recorded only in the Company’s server logs, as described in Chapter 1, paragraph 2.
| Item | Details |
|---|---|
| Personal information items transferred (entrustment) | OAuth authentication information |
| Country of transfer | United States |
| Address and contact | One Apple Park Way, Cupertino, CA 95014, USA / dpo@apple.com |
| Timing and method of transfer | Transmitted over the network when Apple login is used |
| Purpose of use | OAuth-based user identification and provision of federated service login |
| Retention and use period | Until the end of the retention period for the relevant item set out in Chapter 1 (destroyed without delay when the member withdraws) |
| Relevant basis | PIPA Article 28-8(1)3 (entrustment of processing or storage for the performance of a contract) — entrustment of processing under Article 26 of the same Act |
- There is no restriction on your use of the basic services if you do not consent, or withdraw your consent, to overseas transfers for optional marketing, advertising and analytics purposes. If you refuse an overseas entrustment of processing that is necessary to perform the contract, your use of the features requiring that transfer (such as service notification push messages and Google and Apple login) may be restricted; the features that would be restricted and how to refuse are explained for each item transferred. Consent to marketing messages, the provision to Meta as a third party and each related overseas transfer may be withdrawn by specifying the processing concerned in a request to the personal information department (contact@testbank.ai). The Company then stops the relevant collection, use, provision and transfer and takes the necessary measures, such as deletion, in accordance with the applicable laws and the basis of processing. The withdrawal procedures follow items 2) and 4) of Chapter 1, paragraph 3. If knowledge-bank AI processing is offered, you may withdraw the separate consent for overseas transfer of extracted knowledge-bank text in Settings; this stops future AI processing, while the viewer and pen continue to work without AI (see Chapter 1, paragraph 3, item 5). Service usage analytics and app install attribution are not based on consent; you may object to this processing as described in item 3) of Chapter 1, paragraph 3.
You can manage the link between information already provided and your Meta account under "Your activity off Meta technologies" in the Meta Accounts Center. Disconnecting may differ from the deletion of the data that Meta holds. To exercise privacy rights such as deletion, you may use Meta’s privacy rights request procedure, and the Company will guide you through that procedure on request.
Measures to Ensure the Safety of Personal Information
The Company takes the following measures to ensure the safety of personal information.
- Administrative measures: establishment and implementation of an internal management plan, operation of a dedicated organization, regular staff training (personal information protection and information security training), and regular checks on compliance with security-related rules
- Technical measures: management of access rights to the personal information processing systems, installation of an access control system and other related safeguards, encryption of personal information databases, retention and inspection of access records, installation and updating of security programs, and inspection and remediation of vulnerabilities in the personal information processing systems
- Physical measures: access control for areas such as document storage rooms, storage of documents and auxiliary storage media in a secure place fitted with a lock, and periodic management of access records
Installation and Operation of Devices that Automatically Collect Personal Information, and Refusal Thereof
[Devices installed and operated to automatically collect personal information]
- The Company may use certain "cookies" to prevent abnormal access by data subjects and repetitive submission of support inquiries.
- A cookie is a small piece of information that the server (http) used to operate a website sends to the data subject’s browser; it is stored on the data subject’s computer or mobile device and is automatically transmitted from the data subject’s browser to the server when the website is accessed.
- Data subjects can allow or block cookies through their browser settings. Blocking third-party cookies and the setting for storing site data are separate items and must therefore be configured individually.
- Blocking third-party cookies — Chrome: browser Settings > Privacy and security > Third-party cookies > Block third-party cookies / Edge: browser Settings > Cookies and site permissions > Manage and delete cookies and site data > Block third-party cookies / Chrome on mobile: Settings > Site settings > Third-party cookies / Samsung Internet: Settings > Privacy > Block cookies
- Setting for storing site data — Chrome: Settings → Privacy and security → Site settings → Additional content settings → On-device site data, and set sites not to store data on your device / Edge: browser Settings > Cookies and site permissions > Manage and delete cookies and site data > turn off "Allow sites to save and read cookie data" / Safari: device Settings > Safari > Advanced > Block All Cookies
Even in private (InPrivate or incognito) mode, cookies may be used and sites may collect usage information while you are browsing. Blocking cookies can be configured separately in your browser cookie settings.
- In the course of using the Service or handling business, the following information may be automatically generated and collected.
- Information automatically generated and collected through the web and the app: access IP address, cookies, date and time of visit, service usage records, browser information, device information (OS version, model name, UUID) — the minimum logs necessary to ensure the stability of the Service follow the "Ensuring the stability of the Service" row in Chapter 1, paragraph 2, and information processed for usage analytics purposes follows the "Service usage analytics" row in Chapter 1, paragraph 2.
- The items, purposes and retention periods of the personal information used for app install attribution analysis follow Chapter 1, and the information is collected automatically when the app is installed or launched. The related entrustment and overseas transfer are explained in Chapters 6 and 7.
[Collection, use and provision of behavioral information, and refusal thereof]
- In the course of providing the Service and handling business, the Company processes behavioral information using cookies, advertising identifiers and similar technologies in order to provide data subjects with optimized customized services and benefits, online customized advertising and the like.
- The Company collects behavioral information on the websites and the mobile and PC apps it operates as follows.
| Legal basis | Items collected | Method of collection | Purpose of collection | Retention and use period |
|---|---|---|---|---|
| PIPA Article 15(1)6 (legitimate interests) | App and web visit and usage history (the items in the "Service usage analytics" row of Chapter 1, paragraph 2 — App usage events (screens and features used); App version, build and platform; A device identifier generated for the app (not an advertising identifier); Your member ID when you are signed in) | Automatically collected when the app or website is used | Statistical analysis of service usage, user experience analysis and service improvement | Follows the period set out in the "Service usage analytics" row of Chapter 1. The retention period applied in each tool, not exceeding 14 months; aggregated statistics are kept only in anonymized form |
Ad measurement and personalized advertising through Meta is explained separately from ordinary analysis of service usage behavior. The Company processes and provides the behavioral information it collects in the SOLVE iOS app and on the SOLVEBOOKS website for ad measurement and personalized advertising purposes only where it has obtained consent to that processing of personal information and to the provision to Meta as a third party and the overseas transfer. The items and retention periods follow the "Ad measurement and personalized advertising (Meta)" row in Chapter 1, paragraph 3, and Chapters 5 and 7.
2) Behavioral information collected by third parties — in order to allow you to use the Service smoothly and for advertising purposes, the Company uses tags and APIs, including SDKs provided by other companies. The behavioral information collected by third parties is as follows. The table below summarizes the main items processed. The full items and periods processed by AppsFlyer follow the "App install attribution analysis" row in Chapter 1 and the AppsFlyer table in Chapter 7; for Clarity, they follow the Clarity table in Chapter 7.
| Name of collection tool | Company collecting | Type of collection tool | Behavioral information items collected | Purpose of collection |
|---|---|---|---|---|
| Google Firebase Analytics / GA4 | Google LLC | Tag, SDK, API | App and web usage events, device and app environment, analytics user and device identifiers (excluding advertising identifiers) | Statistical analysis of service usage and service improvement (entrustment) |
| Mixpanel (SOLVEBOOKS website — not used in the SOLVE iOS app) | Mixpanel, Inc. | Tag, SDK, API | App and web usage events, device and app environment, analytics user and device identifiers (excluding advertising identifiers) | Usage behavior analysis and service improvement (entrustment) |
| Facebook SDK (SOLVE iOS app) / Meta Pixel (SOLVEBOOKS website) | Meta Platforms, Inc. | Tag, SDK, API | Advertising identifier (only where app tracking is allowed in the iOS app) App and web usage events (SDK in the SOLVE iOS app, pixel on the SOLVEBOOKS website) Access IP address and device environment Member identifier set on app events (internal ID — provided as part of the event data; contact information is not provided) | Ad measurement and personalized advertising (provision to a third party — used by Meta for its own purposes, separate consent) |
| AppsFlyer SDK | AppsFlyer Ltd. | SDK, API | App install and launch records, inbound advertising media and campaign information, advertising identifier (only where permitted in the device settings) | Measurement of mobile app advertising contribution and attribution analysis (entrustment) |
| Clarity (SOLVEBOOKS website — not used in the SOLVE iOS app) | Microsoft Corporation | Tag, API | Screen interaction records (session replay), click and scroll history, device and browser environment | User experience (UX) analysis and improvement of the service interface (entrustment) |
Among the companies listed above, those that process behavioral information only within the scope of the Company’s purposes and instructions under an entrustment of the Company’s work (Firebase Analytics and GA4 of Google LLC, Mixpanel, Inc., AppsFlyer Ltd. and Microsoft Corporation) are managed as trustees in accordance with Chapters 6 and 7. A company that uses the behavioral information it collects for its own purposes (Meta Platforms, Inc.) receives that information only where separate consent has been obtained, in accordance with Chapter 5 (provision to a third party) and Chapter 7 (overseas transfer), and its processing of that information is governed by Meta’s privacy policy.
- The Company collects only the minimum behavioral information necessary for optimized customized services and benefits, online customized advertising and the like, and does not collect sensitive behavioral information that is liable to infringe individual rights, interests or privacy, such as ideology, beliefs or medical history.
- Data subjects can restrict cookie-based tracking by changing their web browser cookie settings. App SDKs and account-based analytics are handled as described in items 3) and 4) of Chapter 1, paragraph 3. However, changing cookie settings may restrict the use of some services, such as automatic login on the website.
Blocking/allowing customized advertising through a web browser
▶ Chrome
- ① How to delete cookies stored in the web browser: in browser Settings, go to "Privacy and security" > "Delete browsing data" and select the items to delete (cookies and other site data).
- ② How to block third-party cookies in the web browser: in browser Settings, go to "Privacy and security" > "Third-party cookies" and select whether to "Block third-party cookies".
- ③ Setting for storing site data (blocking the storage of all cookies): go to Settings → Privacy and security → Site settings → Additional content settings → On-device site data, and set sites not to store data on your device. This setting applies separately from the blocking of third-party cookies in ②. A "New Incognito window" only deletes browsing history and cookies when the browser is closed; it does not prevent the use of cookies or the collection of information by sites while you are browsing.
▶ Edge
- ① How to delete cookies stored in the web browser: in Edge, click the "…" icon in the top right and then click "Settings". On the left of the settings page, click "Cookies and site permissions", then click "Manage and delete cookies and site data" and choose whether to remove all cookies and site data.
- ② How to block third-party cookies in the web browser: in Edge, click the "…" icon in the top right and then click "Settings". On the left of the settings page, click "Privacy, search, and services" and, in the "Tracking prevention" section, select whether to enable tracking prevention and its level (Balanced or Strict). Alternatively, click "Cookies and site permissions" on the left of the settings page, then click "Manage and delete cookies and site data" and select "Block third-party cookies".
- ③ Setting for storing site data (blocking the storage of all cookies): in Edge, click the "…" icon in the top right, then go to "Settings" > "Cookies and site permissions" > "Manage and delete cookies and site data" and turn off "Allow sites to save and read cookie data". This setting applies separately from the blocking of third-party cookies in ②. A "New InPrivate window" only deletes browsing history and cookies when the browser is closed; it does not prevent the use of cookies or the collection of information by sites while you are browsing.
- Depending on the device settings, the SDKs used by the Company in its mobile apps may process advertising identifiers for customized advertising and app install attribution analysis. Data subjects can block or allow customized advertising and the use of advertising identifiers by apps by changing the settings on their mobile device, the way to object to app install attribution and usage analytics follows item 3) of Chapter 1, paragraph 3, and the method for withdrawing consent to Meta ad measurement and personalized advertising follows item 4) of Chapter 1, paragraph 3.
Menus and methods may differ slightly depending on the mobile OS version.
- (Android): ① Settings → ② Security and privacy → ③ Privacy → ④ Other privacy settings → ⑤ Ads → ⑥ Reset advertising ID or Delete advertising ID
- (iPhone): ① Settings → ② Privacy & Security → ③ Tracking → ④ turn off Allow Apps to Request to Track
- Data subjects may use the contacts below to ask questions about behavioral information, to exercise their right to refuse, and to report harm.
| Category | Person in charge | Contact |
|---|---|---|
| Privacy officer | Jihun Kim, CTO | contact@testbank.ai |
| Personal information department | Development Department | contact@testbank.ai |
| Officer in charge of personal information access requests | Jihun Kim, CTO | contact@testbank.ai |
Rights and Obligations of Data Subjects and Their Legal Representatives, and How to Exercise Them
- Data subjects may at any time request access to, correction or deletion of, or suspension of the processing of their personal information, and may withdraw their consent (collectively, "exercise of rights"), and may request the transmission of their personal information in accordance with the requirements and scope prescribed by the applicable laws.
The rights of a child below the applicable minimum age must be exercised by the child’s legal representative; a data subject who is a minor at or above the applicable minimum age may exercise the rights relating to their own personal information themselves or through their legal representative.
- When export is available, you can export your original files, PDFs of pages with your writing, stroke data, and a CSV of your attempts and results at any time. Export is not limited by plan.
- Rights may be exercised in relation to the Company by email consultation pursuant to Article 41(1) of the Enforcement Decree of the PIPA, and the Company will act on the request without delay.
- Rights may also be exercised through an agent, such as the data subject’s legal representative or a person authorized by the data subject. In that case, a voluntary agent must submit documents evidencing their authority, such as a power of attorney in the form of Attachment No. 11 to the Public Notice on Methods of Processing Personal Information, and a legal representative must submit documents confirming that they are the legal representative.
- A data subject’s right to request access to and suspension of the processing of personal information may be restricted under Article 35(4) and Article 37(2) of the PIPA.
- Where another statute expressly specifies that the personal information is to be collected, deletion of that personal information cannot be requested.
- The Company verifies whether the person exercising the rights is the data subject or a duly authorized agent.
- Data subjects may exercise their rights with the department below. The Company will respond within 10 days of the date on which it receives the request. However, requests for the transmission of personal information are handled within the period and by the method prescribed by the applicable laws.
| Category | Person in charge | Contact |
|---|---|---|
| Personal information department | Development Department | contact@testbank.ai |
Privacy Officer
- The Company has designated the privacy officer and dedicated organization below to take overall responsibility for personal information processing and to handle complaints and provide remedies for data subjects in relation to personal information processing.
| Category | Person in charge | Contact |
|---|---|---|
| Privacy officer | Jihun Kim, CTO | contact@testbank.ai |
| Personal information department | Development Department | contact@testbank.ai |
| Officer in charge of personal information access requests | Jihun Kim, CTO | contact@testbank.ai |
- Data subjects may direct to the privacy officer any matter relating to personal information protection, the handling of complaints or remedies for harm that arises while using the Company’s services. The Company will answer and handle such inquiries without delay. For all privacy requests, including requests from users in the United States, please contact contact@testbank.ai.
Remedies for Infringement of Rights
- The Company seeks to guarantee data subjects’ right to informational self-determination and to provide consultation and remedies for harm caused by infringements of personal information; if you need to make a report or seek consultation, please contact the department in charge.
- To obtain a remedy for an infringement of personal information, data subjects may apply for dispute resolution or consultation to bodies such as the Personal Information Dispute Mediation Committee and the Personal Information Infringement Report Center of the Korea Internet & Security Agency. For other reports of and consultations on personal information infringement, please contact the organizations below.
- Personal Information Dispute Mediation Committee: 1833-6972 (no area code) (www.kopico.go.kr)
- Personal Information Infringement Report Center: 118 (no area code) (privacy.kisa.or.kr)
- Korean National Police Agency: 182 (no area code) (ecrm.cyber.go.kr)
Changes to This Privacy Policy
- This Privacy Policy was announced on 23 September 2026 and takes effect on 30 September 2026. (Established on 1 August 2022 → amended on 27 October 2025 → amended on 10 July 2026 → amended on 21 September 2026 → amended on 30 September 2026)
- Previous versions of the Privacy Policy are available below.