Hopaesool

Hopaesool Inc. (the “Company”) processes personal information under the Korean Personal Information Protection Act and other applicable law. This Policy covers registration, online courses, the forum, goods transactions and customer inquiries on the Hopaesool website.

1. Information and purposes

Registration and account management

Information: email address, password, account identifier and verification status, first name, last name, display name, self-reported nationality (country code), document type, version, hash, consent language and time, and registration completion time.
Purposes: account creation, email verification and login, member identification and profile management, and registration and document-acknowledgement records.
Information provided optionally: profile image and submitted profile changes.

Passwords are handled by the authentication service and are not shown in administrator lists. Registration does not require a telephone number, gender, date of birth, Korean identity-verification CI/DI or martial-arts history. Nationality is separate from shipping address, residence and payment country. Missing required information may prevent registration or the relevant service.

Courses, transactions and delivery

Information: account-linked order number, product, amount, order/payment/refund status, payment transaction identifier, course entitlement and access period, completed lessons and completion times.
For physical delivery: recipient name, address, contact details and order information necessary for delivery.
Purposes: performance of purchases, payment confirmation, delivery, refunds, customer service, course access and completion progress.

Registration information is separate from information needed for a transaction. Available payment and shipping options are shown when ordering. The Company does not ask for card passwords or CVC by email. Current lesson completion progress is distinct from viewing duration, playback position or play counts.

Forum and administration

Information: account identifier, automatic alias, posts and comments, creation/update times, and records needed for reports and moderation.
Purposes: operating the forum, author management of content, and handling reports and rights complaints.
Visibility: public posts show an automatic alias without automatically publishing the member's name or contact details. Private posts and comments are visible only to the original post author and service administrators.

Administrators access member, course and transaction information with the permissions needed for their duties. Administrative actions such as identifying a forum author keep minimum records of the operator, target and time. Do not post passwords, verification codes or unnecessary sensitive information.

Inquiries and technical access

Inquiry information: reply address, submitted message and attachments, and correspondence.
Technical/security information: IP address, request time/path, browser/device details, and authentication, error and security records.
Purposes: answering inquiries, dispute resolution, website and video delivery, troubleshooting and preventing abuse.

Processing needed to conclude or perform a contract is distinguished from statutory obligations. Separate consent is obtained where required. Information beyond what is necessary is not required.

2. Retention

Account, profile and ordinary registration acknowledgement: until account closure or completion of the purpose. Only records subject to a separate legal retention requirement are retained for that requirement.
Course entitlement and progress: for course provision and account administration, with transaction evidence subject to the statutory periods below.
General inquiries and replies: one year after resolution. Actual consumer complaints and disputes: three years after resolution.
Under Korean e-commerce law: advertising records, six months; contract and withdrawal records, five years; payment and supply records, five years; consumer complaint and dispute records, three years.
Posts: until deleted by the author or under moderation rules. Section 3 explains account-closure handling.
Technical access, authentication and security records: under the relevant provider's retention and deletion policy for delivery, troubleshooting and security purposes. Statutory transaction periods are not automatically applied to every technical record.

Current tools provide one day of Supabase service-log history on the Free plan and at least 24 hours of basic Netlify function logs. These viewing windows do not mean every internal provider copy is irreversibly erased at the same time. Provider deletion procedures and legal exceptions are explained in section 4.

Legally retained information is access-restricted and used only for the retention purpose. Information is deleted without undue delay when the applicable period or purpose ends. Where an ongoing dispute, investigation or other legal duty requires retention, the basis and necessary scope are checked and the information is deleted when that reason ends.

3. Account closure and deletion

Users may close an account in account settings after identity verification. Contact the privacy officer if closure fails or a separate deletion request is needed. Account closure is separate from order cancellation or refunds.

On closure, the member's private posts and the comments on those posts, and their comments on other private posts, are deleted. Public posts and comments remain with the account connection and alias removed and the author shown as “Deleted member”. No separate lookup mapping is kept to reconnect the former author. Personal information typed into the text does not automatically disappear: delete it before closure or request deletion through the privacy contact. Content finally deleted through the service is not restored.

Electronic files are deleted to prevent recovery or reuse; paper records are shredded or otherwise appropriately destroyed. The Company does not currently use scheduled project backups. Provider internal replicas and security-recovery copies follow provider deletion cycles and legal retention duties. If restoration is needed, previously accepted deletion requests are reapplied.

4. Providers and international processing

The Company uses the following services as necessary to provide its service. Processors act within the entrusted purpose and applicable contracts and law.

Supabase Pte. Ltd. — authentication, database and file storage

Information/purpose: account, profile, acknowledgement, posts, transactions, course information and submitted files described in section 1, for authentication, storage, retrieval and service provision.
Countries: primary storage and processing is in Northern Virginia, United States. Service operations and support are provided under the safeguards of Singapore-based Supabase and its processors.
Timing/method: encrypted network transmission and storage during registration and service use.
Retention: the applicable information periods in section 2 and the Company's deletion instructions. Supabase's return/deletion procedures apply on service-contract termination.
Contact: privacy@supabase.io. Processing agreement and subprocessors, data-residency explanation.

Netlify, Inc. — hosting, server processing and content delivery

Information/purpose: IP address, browser, request path, technical records and information in service requests, for web delivery, processing requests, security and troubleshooting.
Countries: primary server processing is in Northern Virginia, United States. Netlify's published regular-CDN locations are the United States, Germany, Brazil, Singapore and Australia; routing depends on the visitor's location and network conditions.
Timing/method: encrypted network transmission on site access and service requests.
Retention: as necessary for delivery, service operations and security under the service's log and cache retention policies. Netlify's return/deletion procedures apply on contract termination or a deletion request.
Contact: privacy@netlify.com. Processing agreement, official network-location guidance.

Mux, Inc. — video streaming

Information/purpose: delivery information such as IP address, browser/device details and video identifiers, for delivering videos, transmission security and troubleshooting.
Countries: United States. Relevant processors listed in Mux's processing agreement are located in the United States, Germany and Sweden; videos are delivered through the provider's network.
Timing/method: encrypted network transmission when using video features.
Retention: for video delivery, security and the service contract, with deletion and isolated-storage procedures under the Mux processing agreement on deletion requests or contract termination.
Contact: privacy@mux.com. The Company does not use optional Mux viewing analytics or cookies, or send member account identifiers for viewing analytics.

PortOne (Korea PortOne) — payment integration

For transactions using payment integration, necessary order, amount, transaction-identifier and status information is processed to integrate payment and confirm the result. The selected payment institution's information categories and terms are shown separately in its payment screen. Applicable law and section 2 govern payment and transaction records. See PortOne's processing-role explanation. This notice does not replace any separate consent needed for third-party disclosure or payment.

Google Gmail for email inquiries

Messages to hopaesool@gmail.com or the privacy address are received and answered through Google LLC's Gmail. Sender/reply addresses, messages, attachments and mail-routing information are transmitted for receiving and handling the inquiry. The Company is the message recipient; Google's mail processing follows the Google Privacy Policy and retention/deletion explanation.

Google processes information in multiple countries. Its published operating data-center locations on November 10, 2026 are in the United States, Uruguay, Taiwan, Ireland, the Netherlands, Denmark, Finland, Germany, Japan, Chile, Singapore, Belgium and the United Kingdom. These are published infrastructure locations, not a statement that each email visits every country or is stored only in a particular country. The Company deletes general inquiries one year after resolution and consumer complaints/disputes after three years. Google describes system deletion as generally taking around two months after deletion, with encrypted backups retained for up to six months and legal/security exceptions. Google's privacy contact is available through Google privacy inquiries.

Transfer basis and refusal

Overseas entrusted processing and storage for authentication, storage, web and video delivery necessary to conclude or perform the service contract is disclosed under Article 28-8(1)(3) of the Korean Personal Information Protection Act. Separate consent or another applicable legal requirement is followed for transfers or independent third-party disclosures that require it.

To refuse international processing, stop registration or the relevant feature, or request restriction or account closure through the privacy contact. Refusing essential authentication/storage prevents account-based service; refusing video delivery prevents the relevant video. To avoid email transmission, contact the Company by telephone or post. Choosing not to email Support does not restrict account access.

5. Cookies and external services

Cookies support login sessions, authentication renewal and language selection. Browser settings can delete or block them, but essential features such as login may then be limited. Required signup acknowledgement is not used as consent to advertising or optional tracking.

YouTube videos in posts open only when an external link is selected. The service does not load YouTube for that video before the link is selected. External sites apply their own privacy and cookie policies; users may use other service features without opening those links.

6. Your rights

Users may request access, correction, deletion, restriction and withdrawal of consent. Requests unavailable in account settings can be sent to the privacy contact. Authorized representatives may act with the minimum information needed to establish their authority.

The Company verifies identity or authority and responds within applicable legal procedures and deadlines. If a legal retention duty prevents part of a request, it explains the reason and available procedure. Do not email full identity-document copies, passwords or authentication codes.

7. Children and safeguards

Account registration is intended for people aged 14 or older. Children under 14 should not register or submit personal information. When the Company learns that an under-14 child's information was submitted, it stops unnecessary processing and handles protection, deletion and guardian requests as required by law. Dates of birth are not collected and completed age verification is not assumed.

Safeguards include encrypted communications, authentication and administrator-access restrictions, and access to minimum necessary information. Staff permissions are limited to their duties. Keep passwords and verification links private.

8. Privacy contact and remedies

Privacy officer and access-request contact: Gihyeon Do
Email: hopaesooldev@gmail.com
Telephone: +82-2-733-2469
Post: Privacy officer, Hopaesool Inc., 4F, 37, Insadong 7-gil, Jongno-gu, Seoul, Republic of Korea.

General service questions can be sent through Support. Privacy complaints or mediation may also be requested through the Korea Privacy Infringement Report Center or the Personal Information Dispute Mediation Committee.

9. Effective date and history

First formal text, version 1.0 · published and effective November 10, 2026. This Policy explains current processing and rights without retrospectively changing existing consent records. New purposes requiring separate consent follow that process. Changes and application dates are published in Document versions and changes, with important changes announced through the service or individual notice.