Privacy Policy

1. Who is responsible for your data

The company named on the Business and service information page is the controller of the personal data described here. Its registered name, registration number, representative and address are published there and in the footer of every page.

Requests about your personal data go to plyn.coo.lmw@gmail.com, and PLYN answers them within 10 days.

2. What is collected, why, and for how long

PLYN collects the following and nothing else. Each group is collected for the purpose beside it, and the purpose is the only thing it is used for.

• Account — your email address, your password, the name you choose to display and the language you read in. For creating the account, signing you in and writing to you about your own orders. Your password is held by the authentication service in hashed form; PLYN never sees it. Kept until you close the account.
• Recommendation answers — the level you are applying for, your nationality, the country you live in, your field of study, the intake year and term, your education level, and optionally your yearly budget, your TOPIK level, your English test and score, the conditions you said matter to you, and any note you write. For producing the recommendation and showing it back to you. Kept until you close the account; an unclaimed anonymous draft is deleted after 30 days.
• Residency declaration — whether you are in Korea now, as you declare it, and nothing more. For establishing which application process your case goes through. PLYN does not collect your visa number, your immigration record or any document about your status for this purpose. Kept until you close the account.
• Consulting case documents — the files you upload when a case asks for them, with their file name, size and type, and the operator’s record of what was accepted or sent back and why. For reviewing your application documents. Deleted when you close the account.
• Orders and payments — the order identifier, what was ordered, the amount, the currency, the payment state and the identifiers PayPal returns. For taking payment, issuing refunds and keeping the records the law requires a seller to keep. Kept for the statutory periods in section 6, with you anonymised out of them when you leave.
• Messages — the subject and text of an enquiry you send from your account, and the reply. For answering you. Anonymised when you close the account.
• Calendar entries — the dates you add for yourself, with their titles and notes. For showing them to you. Deleted when you close the account.
• Server logs — the hosting provider records requests, including the IP address a request came from. For operating and securing the service.

3. What is not collected

This list is as much a part of the policy as the one above it, because a disclosure of what is held is only meaningful next to what is not.

• Your card number, bank account or any payment credential. These are given to PayPal in PayPal’s own checkout and never reach PLYN.
• Your passport number, identity number or immigration record as a stored field. Where a document you upload contains one, PLYN holds the document you chose to send and does not extract the number out of it into a database column.
• Biometric data, health data, religion, political opinion or any other special category of data.
• Your location. There is no location permission, no map and no device identifier.
• Advertising or analytics identifiers. There is no analytics provider, no advertising network, no social login and no third-party tracking script anywhere on this site or in the application. Nothing follows you between pages beyond the session that keeps you signed in.

4. Automated processing

The recommendation is a ranking computed from the answers you gave against profiles that are already published. It is shown to you as information, and a person reviews a school profile before it is published at all.

No decision with a legal effect on you is made automatically. No language model or other artificial-intelligence service is run on your personal data: the service holds no credential for any such provider and contains no call to one. That is a statement about the software that handles your data, and it was checked against the code and the configured environment rather than assumed.

5. Who else processes it, and the transfer outside Korea

PLYN runs on infrastructure it does not own, which means the companies below hold your data on PLYN’s behalf. Each is listed with what it does, what it touches, where that data sits, and where the company itself is — the last two are different facts and this policy keeps them apart.

Your account, your answers, your documents and your orders are stored in the Republic of Korea, in the Seoul region. They do not leave it at rest. But the companies operating that infrastructure are not all Korean, and the scheduled jobs that produce your recommendation and render your report PDF run on machines abroad. So using PLYN does involve your personal data being handled outside the Republic of Korea, and your agreement to this policy is your agreement to that.

You may refuse the transfer. PLYN cannot then provide the service, because there is no version of it that runs without a database — and saying so plainly is more useful to you than an opt-out that silently breaks your account.

None of them is permitted to use your data for their own purposes, and PLYN adds none beyond this list without updating this policy first.

6. How long it is kept, and how it is destroyed

Your account data is kept until you close your account, and is then removed or anonymised without delay.

Some records a seller must keep for a fixed period under Korean e-commerce law, and those survive your departure with you taken out of them: records of a contract or a withdrawal of subscription for 5 years, records of payment and of the supply of goods or services for 5 years, and records of a consumer complaint or dispute for 3 years. Access logs are kept for 3 months under the Protection of Communications Secrets Act.

When a record is destroyed, a database row is deleted and a stored file is deleted from storage. Closing your account deletes your calendar entries, your consent records, your residency declaration and the files you uploaded, and clears the free text on your answers and your messages. Where a row cannot be deleted because a ledger depends on it — an order, a payment, a snapshot you were shown — the personal data in it is overwritten instead: your address is replaced with a reserved address that cannot reach a person, and your name and free text are cleared. What is left identifies nobody.

7. Your rights

You may ask what PLYN holds about you, correct it, have it deleted, have its processing suspended, or withdraw a consent you gave. Withdrawing a consent does not undo what was lawfully done while it was in force.

Most of it you can do yourself: your answers and your calendar are editable in My PLYN, and closing your account there removes or anonymises your personal data as described above.

For anything else, write to plyn.coo.lmw@gmail.com. PLYN answers within 10 days. If you are not satisfied, you may complain to the Personal Information Protection Commission of the Republic of Korea, or to the data protection authority of the country you live in.

8. How it is protected

Traffic is encrypted in transit. Uploaded files are in private storage and are reachable only through a signed link that expires shortly after it is issued; the storage is not public and a file has no guessable address.

Access to the database is restricted at the row level, so a query made with a customer’s own session cannot read another customer’s rows. Operator access is separately authenticated and recorded.

The keys the application holds are the narrowest that will do the job, and the key that can read everything is never sent to a browser.

9. Children

PLYN is for people aged 14 or over and does not knowingly collect data from a child under 14. If you believe a child under 14 has opened an account, write to the address above and it will be closed and the data deleted.

10. Changes to this policy

A change is published as a new version with its own number and effective date, and announced before it takes effect. Where the change affects what you agreed to, you are asked to agree again, and the previous version stays published so you can compare them.

The processors

Who to write to about your personal data

Officer

Lee Min-woo (이민우) · Director

Email

plyn.coo.lmw@gmail.com