개인정보처리방침

[EN] Privacy Policy

This English text is prepared separately for readers of that language. Where the two versions differ, the Korean version governs. Both state the same commitments — in particular, we do not use user content to train AI models (Article 10). This policy takes effect on 15 October 2026.

Article 1 — Who this policy covers

This policy applies to everyone who uses Habitus33, the Habitus Lens Chrome extension, reading links, Lens Studio and Timestamps ("the Service"), and describes four groups separately: members, readers (including non-members), authors and partners, and extension users. Third-party source pages and videos are not ours; we never alter them and never publicly redistribute them. Authoring source text explicitly saved by a user is kept privately as described in Article 13.

Article 2 — What we process

• Members — email address, password (stored in a form that cannot be decrypted), name or nickname; when signing in with Google, the account identifier, email address, name and profile image URL supplied by Google; optional profile details; and content created through use: notes, flashcards, challenge records, lenses and cards, timestamps and viewing positions, access times and usage records.
• Readers — when sending an intake: the phrase selected from the source page (up to 120 characters), the page address (excluding the query string), the reader's note (up to 300 characters), language, time and count. We do not store or join an account, name, email address or IP address to an intake record. Server access logs record access time, browser and device information and IP address separately.
• Extension users — a device token issued by our server so the extension works without signing in. It is stored only in the user's browser and is not joined to account information. See Article 13.
• Authors and partners — the name under which they publish, contact details, and qualifications they choose to state; plus the intakes delivered to them.
• Coaching report applicants — what you enter yourself in the request form: exam type, attempt history, exam date, target grade and section scores; study places and methods, weekday and weekend study hours, commute time; sleep and wake times, sleep quality, energy level and sources of distraction; and your answers to a metacognition self-assessment together with the trait scores computed from them. Separate consent is taken on the request screen. It is used only to produce the report you asked for and never to train AI models.
• Waitlist sign-ups — email address, area of interest (up to 200 characters), IP address, browser information, and whether you consented to receive marketing messages. That consent is a separate, optional choice; you can sign up without giving it.
• Collected automatically — IP address, browser/OS/device information, access times, usage records, and information collected through cookies and similar technologies.
• Not collected — we do not collect payment information; the Service currently has no paid checkout. When paid services are introduced, payment processing will be entrusted to a payment provider and we will not retain card or account numbers; we will amend this policy 30 days in advance. We do not collect resident registration numbers or other unique identifiers, or sensitive data.

Article 3 — Purposes and legal bases

Account management and Service provision (performance of contract); delivering an intake to the author of that lens (the reader's consent and performance of contract); generating explanations, summaries and flashcards with AI, within the limits of Article 10; improvement, statistics and research using anonymous aggregates only (Article 11 — not personal data); fraud prevention, incident response and security (legitimate interests and legal obligations); notices and support; marketing messages and personalized advertising (separate consent); and compliance with law.

Article 4 — Retention

(1) We erase personal data without delay once its purpose is achieved or you ask us to. (2) On withdrawal, a member's personal data, authored content and original intakes are deleted within 30 days; before that you may export your content and intakes in a machine-readable format. (3) The text of an intake note is irreversibly deleted 90 days after it is stored (30 days if the author asks); the phrase, page address, language, time and count are kept until the author deletes them or withdraws. (4) Access logs, including IP addresses, are kept for 90 days for stability and incident response and are then destroyed automatically; they are never joined to intake records. Hosting providers may keep their own server logs, destroyed under their policies (typically within 30 days). (5) Accounts unused for one year may be made dormant or terminated after 30 days' notice. (6) Where there is an infringement report, investigation or litigation, related material is held in isolation for as long as resolution requires and destroyed immediately afterwards. (7) Records we are required by law to keep are kept for the statutory period. (8) Coaching report data is anonymized — the account identifier is removed so it can no longer be traced to a person — one year after the last report is issued, or one year after the request if no report was ever issued. (9) Waitlist entries are destroyed once the feature has launched and the notice has been sent, or when consent is withdrawn, and in any event one year after sign-up.

Article 5 — Disclosure to third parties (delivery of intakes)

We do not disclose personal data to third parties, except that an intake is created by a reader in order to reach an author, and we therefore provide it to the author of that lens — the selected phrase, page address, note, language, time and count, for the purpose of answering the reader, retained until the author deletes it or withdraws (notes: 90 days). Before an intake is sent, we show the reader exactly what will be stored and that it goes to the author, and take their confirmation; without it nothing is sent. An author may not use the personal data learned from an intake for any purpose other than replying to that reader, and may not pass it on. Only that lens's author can read intakes; our staff access them only for incident response, legal requests or dispute handling, and each access is logged with who, when and why, kept for at least one year. We comply with lawful requests from authorities made under due process.

Article 6 — Processors

MongoDB, Inc. (database — stored in the Seoul region of Korea), Render Services, Inc. (server hosting), Vercel Inc. (web hosting), OpenAI, L.L.C. (AI explanations, summaries and embeddings), Tavily (web search used to answer questions), and Google LLC (sign-in, usage analytics, advertising measurement). We currently send no automated email from the Service; if we introduce a provider we will add it here and amend this policy. Processing agreements are in writing and processors are supervised.

Article 7 — Transfers outside Korea

Personal data is transferred to the United States for OpenAI (selected phrase and surrounding context, transcripts, user notes, language — for generating explanations, summaries, flashcards and embeddings, under terms that prohibit the provider from training its models on it), Tavily (search queries), and Google LLC (sign-in identifiers and email address; cookie identifiers, device information and usage records for analytics and advertising measurement); and to Render (Singapore) and Vercel (United States) for hosting, for the periods stated in Article 4. Our database (MongoDB Atlas) is located in the Seoul region of the Republic of Korea, so personal data is not transferred abroad for storage. You may refuse these transfers; because they are essential to the Service, refusing means the Service, in whole or in part, cannot be provided.

Article 8 — Destruction · Article 9 — Security measures

Electronic files are deleted irrecoverably; paper is shredded or incinerated; data we must retain under other laws is stored separately. We apply least-privilege access control with access logging, one-way encryption of passwords and encryption in transit (HTTPS), access logs for intake records, designation and training of staff who handle personal data, and notification and reporting without delay if a breach occurs.

Article 10 — Use of artificial intelligence

(1) We may use user content (cards, lenses, notes) and intakes to improve the Service, develop features, fix errors, prevent abuse, and to develop and train AI models (pre-training and fine-tuning) for those purposes. In doing so we remove information that identifies a person, do not attach the author's name, and do not sell or provide the material to third parties for training; a processor engaged for our own training that is contractually barred from training its own models on the material is not a third-party recipient. (2) You may exclude your content from training per lens, by a setting in the Service or by request to us; exclusion applies to new training from the time we confirm it, and deleted content is not used for new training. (3) We refer to content in real time to produce explanations and answers; answers generated inside an author's lens carry that author's name. (4) Where content is passed to an external AI provider for paragraphs (1) or (3), we use only providers contractually barred from training their models on it. (5) We do not use AI output to make decisions with a significant effect on your rights (eligibility determinations, entering into or refusing a contract). Should we introduce such automated decision-making, you may refuse it or request an explanation, and we will amend this policy beforehand.

Article 11 — Anonymization, pseudonymization and aggregates

(1) We aggregate and analyze intakes — the selected phrase, page address, count, language, time and the reader's note — after processing them so that no individual can be identified, and use the result for improvement, feature development, statistics, research and public reporting. (2) Readers' notes are stripped of direct identifiers (names, contact details, addresses, accounts, ID numbers) and processed together with other intakes in units where the remaining content cannot identify anyone; we follow an internal standard and keep a processing record. (3) Where personal data remains after that processing, we process it only as pseudonymized data for statistics and scientific research (including the development of AI technology) under Article 28-2 of the Personal Information Protection Act, never re-identify it, and apply the safeguards of Article 28-4 with a processing record. (4) Public reporting never identifies a particular author, firm or reader, and statistics built from a single author's material are not published without that author's consent. (5) Material that can no longer identify anyone is anonymous information under Article 58-2 and outside the Act.

Article 12 — Cookies, behavioral data and personalized advertising

We use cookies to keep you signed in and to measure use. We use Google Analytics 4 for usage statistics and the Google Ads tag for advertising measurement; these collect pages viewed, navigation paths, device and browser information and cookie identifiers, automatically as you open our screens, for analysis, improvement, advertising measurement and personalized advertising, retained for 14 months, after which they are deleted automatically. You may refuse them by changing your browser's cookie settings, installing the Google Analytics opt-out add-on, or turning off personalization at adssettings.google.com. Refusing cookies disables features such as staying signed in. Marketing email is sent only with prior consent and can be unsubscribed at any time.

Article 13 — The Chrome extension

When you select a phrase we send that phrase and its surrounding context, the page address, your language setting and the device token; on YouTube, the video identifier and playback position go with it. When you press "Scan" we send the full body text extracted from that page (including the transcript on YouTube) — a partial send would leave the rest of the page unexaminable — and only for the page you scanned. Scan retention: the phrase, up to 120 characters, needed to re-anchor a card; and the scanned page's body text, kept for 30 days so the same page need not be analyzed from scratch again, then deleted. No account is attached to that material and the page address is stored with its query string removed, so it does not record who opened the page; we never redistribute the source or offer it as a substitute for the original page. Not sent: your full browsing history, and passwords or form values you enter on other sites. Permissions: the only standing site permission is https://www.youtube.com/*; access to other sites and reading tab information are optional permissions, requested at the moment a feature needs them and used only if you allow them. Settings, the device token and your recent lens list stay in the browser's extension storage and are removed when you uninstall the extension. Server-stored authoring sources are not removed by uninstalling the extension.

Private authoring sources (Lens Studio and extension): when you import a URL, save pasted text, create a card from captured text in Studio, or publish an authored card in the extension, we store the extracted page text and structured blocks, title, input and final URLs (including document-identifying query strings), capture time and quote position with your account to restore and edit that card on another device. We do not store raw HTML. Only the author can retrieve these sources; public cards, reader bundles and shared exports exclude the source text, private URLs and references. Linked sources are retained while the lens exists and deleted when the lens is deleted. Temporary or unreferenced sources are cleaned up after 24 hours. In the extension, opening write mode or selecting text alone does not upload an authoring source. Ordinary reading and scanning do not create these authoring records. Uninstalling the extension does not delete them; delete the lens or request deletion through the contact below.

Article 14 — Your rights · Article 15 — Children under 14

You may at any time request access, correction, deletion or suspension of processing, withdraw consent, or delete your account; and you may export your content and intakes in a machine-readable format. Requests may be made in the Service's settings or through the contact in Article 16, and are answered within 10 days. Requests made through a representative require a power of attorney. Children under 14 may become members only with the consent of a legal representative; we verify that consent, explain the purpose of collection in terms a child can understand, and where consent is not verified we restrict the account and destroy the collected data without delay.

Article 16 — Data protection officer and contact

Data Protection Officer: Bongjin Seo (CEO), email camelus.tedin@gmail.com. Operator: Tedin Inc., representative Bongjin Seo (CEO), 60 Terminal-angil, Sejong, 30101, Republic of Korea, business registration number 348-88-02077. Designated recipient of takedown requests under Article 103 of the Copyright Act: /legal/notice.

Article 17 — Remedies · Article 18 — Changes

Personal Information Dispute Mediation Committee (1833-6972, kopico.go.kr); Privacy Infringement Report Center, KISA (118, privacy.kisa.or.kr); Cybercrime Investigation Division, Supreme Prosecutors' Office (1301); National Police Agency Cyber Bureau (182, ecrm.police.go.kr). Administrative appeals may be filed against our decisions under Articles 35, 36 and 37 of the Personal Information Protection Act. Changes to this policy are posted at least 7 days before they take effect, and 30 days before for changes that are significant or unfavorable to users, with individual notice to members through in-service notifications. We do not currently send automated email (Article 6); notice by email will begin only after we have such a means and have amended this policy to say so. Each version carries a version number and effective date, and previous versions remain available for at least three years.

종전 방침과 정정 안내

Previous version (effective 1 June 2024) and corrections — 제18조 ②에 따라 보관합니다.