Privacy Policy

The Company processes personal information for the following purposes. Personal information being processed is not used for any purpose other than those below, and if the purpose of use changes, the Company will take the necessary measures, such as obtaining separate consent in accordance with Article 18 of the Personal Information Protection Act (「개인정보 보호법」).

1. Member management — sign-up and withdrawal, identification and authentication, prevention of fraudulent use, verification of eligibility to use the Service
2. Service provision — running class sessions, providing courseware, quizzes, and learning materials, Gears simulation, AI tutor service, operating Arena and Challenges
3. AI learning analytics — creating and updating learner profiles, providing personalized hints and feedback, providing students' learning status for the teacher dashboard
4. Service improvement — analysis of service usage statistics (return visits by date, and whether key features such as creating a class, distributing materials, and opening a lesson are used), development of new features, bug fixes
5. Safety and security — detecting unauthorized access, protecting accounts, maintaining system stability
6. Email notices — password reset links, delivery of important service notices
7. News (only for teachers who opted in) — information on new features, training sessions, and events

Required items

• Name — member identification, management of teacher and student rosters
• Password (stored encrypted) — account protection
• Role (SCHOOL_ADMIN / TEACHER / STUDENT) — control of access rights to the Service

Optional items

• Email address — sign-in, password reset, sending notices (students may use a student code instead)
• Login ID (students) — assigned when a teacher registers students from a roster, or suggested or chosen by the student when signing up with an invitation code
• Class number (students) — if entered by the teacher when registering from a roster
• Whether the user agrees to receive news (teachers) — chosen at sign-up

Information generated or collected while using the Service

• AI tutor conversation history — providing and improving AI services
• Learner profile (strengths, weaknesses, learning style) — personalized learning support
• Coding practice code and submission records — managing learning history
• Quiz response records — learning assessment
• Real-time coding activity (telemetry) — supporting teachers during live classes
• Arena and mission submission and completion history — recording achievement
• Student observation notes left by teachers (special notes) — viewable only by the teachers in charge of the class and the school administrator. Not used on student or parent screens or in AI requests. Teachers are instructed not to record sensitive information such as health information
• Service usage records — whether the user accessed the Service on each date and whether key features were used. Recorded only with internal identification numbers and containing no names or written content

Automatically collected items

This is information that may be automatically generated and collected in the course of using the Service. It includes IP address, session ID, cookies, service usage records, and visit records. When a teacher signs up, the route by which they first arrived (the first page opened, the address of the site visited immediately before and the search terms, and advertising identifiers) is also recorded. No external analytics tools are used; this information is kept briefly in browser storage and sent to the server only at sign-up.

The Company processes and retains personal information within the retention and use period prescribed by law or the retention and use period consented to by the data subject at the time of collection.

The Company processes data subjects' personal information only within the scope specified in Article 1 (Purposes of Processing Personal Information), and provides personal information to third parties only in cases falling under Articles 17 and 18 of the Personal Information Protection Act (「개인정보 보호법」), such as with the data subject's consent or under a special provision of law. The Company does not currently provide personal information to any third party.

The Company entrusts personal information processing tasks as follows for the smooth provision of the Service.

When AI features are used, identifying information such as a student's name or login ID is not sent; instead it is replaced with a number, such as "Student 3", and converted back to the name only when shown on the teacher's screen. Information such as phone numbers and email addresses in text entered by students and teachers is masked before sending. When entering into entrustment contracts, the Company specifies the responsibilities required under Article 26 of the Personal Information Protection Act (「개인정보 보호법」) and supervises the trustees.

Cross-border transfer of personal information (Article 28-8 of the Personal Information Protection Act (「개인정보 보호법」))

• Recipient: Ollama, Inc. (contact: ollama.com)
• Destination country: United States
• Date, time, and method of transfer: transmitted over an encrypted network (HTTPS) each time an AI feature is used
• Items transferred: the content of requests sent to the AI — questions, code, answers, and summaries of learning records (excluding student names and IDs, with contact details masked)
• Purpose of transfer: generating AI responses
• Retention and use period: the period necessary to generate the response (subject to the trustee's data processing policy)
• How to refuse and its effect: if AI features are turned off in the class settings or are not used, no transfer occurs; in that case, the AI tutor, AI grading suggestions, school-record comment drafts, and similar features cannot be used.

When personal information becomes unnecessary, such as upon expiry of the retention period or achievement of the processing purpose, the Company destroys it without delay. Personal information for which a reason for destruction has arisen is destroyed with the approval of the Chief Privacy Officer; electronic files are permanently deleted in a way that makes recovery and reproduction impossible, and paper documents are shredded or incinerated. Where retention is required by law, the personal information is moved to a separate database or stored in a different location.

Data subjects may at any time exercise their rights to request access to, correction of, deletion of, or suspension of processing of their personal information. For children under the age of 14, the legal guardian may exercise these rights on the child's behalf. Rights may be exercised by email, in writing, or by telephone, and the Company will act on such requests without delay.

How to exercise

• Email: support@codebridge.ai.kr
• Online: after signing in, Account settings > Personal information management

The Company takes the following measures to ensure the security of personal information.

• Administrative measures: establishing and implementing an internal management plan, minimizing the number of staff handling personal information, regular internal audits
• Pseudonymization: in requests sent to external AI, student names are replaced with numbers, and phone numbers, email addresses, and the like are masked
• Technical measures: passwords stored with bcrypt encryption, httpOnly, Secure, and SameSite=Strict cookie settings, HTTPS (TLS) communication, security headers such as X-Frame-Options and X-Content-Type-Options, defense against SQL injection through the Prisma ORM
• Physical measures: access control for servers and databases (127.0.0.1 loopback binding, firewall settings)

The Company designates a Chief Privacy Officer as follows, who is responsible for overseeing work related to the processing of personal information and for handling complaints and providing remedies for damage to data subjects.

When the Company processes the personal information of children under the age of 14 (including elementary and middle school students), institutional delegation through the school administrator (principal or teacher in charge) substitutes for the consent of the legal guardian. The school administrator's act of creating student accounts or issuing invitation codes presupposes that the school's parental consent procedure has been completed. Even when a teacher registers students or hands out invitation codes through a personal (free) teacher account, the teacher in charge must register only students for whom the school's parental consent procedure has been completed.

Legal guardians may request the Company to provide access to, correct, delete, or suspend the processing of the child's personal information. Requests can be sent to support@codebridge.ai.kr.

In accordance with Article 37-2 of the Personal Information Protection Act (「개인정보 보호법」), the Company discloses that it makes the following automated decisions.

Exercise of data subjects' rights

• Request for explanation: you may request an explanation of the reasons and criteria for a decision (reply within 15 days)
• Refusal: you may refuse an automated decision, in which case the effect of that decision is suspended
• Request for reprocessing: you may request reprocessing with human involvement (result notified within 30 days, extendable up to 60 days)

How to exercise: support@codebridge.ai.kr

To obtain remedies for infringement of personal information, data subjects may apply for dispute resolution or consultation to the Personal Information Dispute Mediation Committee (개인정보분쟁조정위원회), the Privacy Infringement Report Center of the Korea Internet & Security Agency (KISA, 한국인터넷진흥원 개인정보침해신고센터), and others.

• Personal Information Dispute Mediation Committee: 1833-6972, no area code needed within Korea (www.kopico.go.kr)
• Privacy Infringement Report Center: 118, no area code needed within Korea (privacy.kisa.or.kr)
• Supreme Prosecutors' Office (대검찰청): 1301, no area code needed within Korea (www.spo.go.kr)
• Korean National Police Agency (경찰청): 182, no area code needed within Korea (ecrm.police.go.kr)

This Privacy Policy applies from its effective date. If there are additions, deletions, or corrections due to changes in laws or policy, the changes will be announced through the Service notices starting 7 days before they take effect. Changes that are unfavorable to users will be announced at least 30 days in advance.

Revision history: Initially enacted on May 14, 2026 · Amendment announced on September 24, 2026 (updating the AI trustee and cross-border transfer information, pseudonymization of AI requests, service usage statistics records and their retention period, student login IDs, consent to receive news) · Amendment announced on October 30, 2026 (effective November 6, 2026 — recording teachers' sign-up route)

This Privacy Policy takes effect on November 6, 2026.