Privacy policy

Ruleout (the "Company") establishes and discloses this Privacy Policy as follows, pursuant to Article 30 of the Personal Information Protection Act (Korea), in order to protect data subjects' personal information and to handle related complaints promptly and smoothly. This Policy applies to the Notely website (notely.kr) and the iOS and Android applications (the "Service").

At a glance

1. Purposes of processing personal information

The Company processes personal information for the following purposes. Personal information processed will not be used for any purpose other than those below, and if a purpose changes, the Company will take necessary measures, such as obtaining separate consent, pursuant to Article 18 of the Personal Information Protection Act.

1. Member registration and management — identifying members, verifying identity, linking social logins, restricting sign-up by children under 14, preventing fraudulent use, account security, notices and notifications, handling complaints
2. Providing the Service — storing study materials and syncing across devices, converting documents, audio and images to text, generating AI summaries, key concepts, quizzes, flashcards and mind maps, AI tutor Q&A based on study materials, managing spaced-repetition schedules and notifications, providing share links
3. Payment and settlement for paid services — subscription payments, auto-renewal, withdrawal of subscription and refunds, payment history management, issuing tax invoices and cash receipts
4. Customer support — responding to inquiries, handling reports of errors and AI-generated content, keeping records for dispute resolution
5. Service improvement and stability — statistical analysis of visit frequency and feature usage (in pseudonymized or statistical form), error and crash analysis, detecting security threats
6. Marketing and advertising (with optional consent) — announcements of new features and events, information about benefits

2. Personal information items processed

A. At sign-up

All methods: confirmation that you are 14 or older (required), consent to receive marketing information (optional)

B. While using the Service

C. When paying for paid services

• Web payments: payment approval number, payment method type, card issuer, partial card number (masked), payment amount and date/time, billing key (for automatic payments; issued and stored by [Payment gateway], and the Company does not store full card numbers)
• In-app payments: app store transaction identifier, subscription product and status, payment and renewal date/time (processed by Apple and Google; the Company does not receive payment method information)
• When issuing cash receipts: mobile phone number or cash receipt card number

D. Information generated and collected automatically

• IP address, access date/time, service usage records (access logs), cookies, device information (OS type and version, device model, app version), advertising identifier (ADID/IDFA, only if you allow it), error and crash records

3. Processing and retention period of personal information

The Company destroys personal information without delay when a member deletes their account or when the purpose of processing has been achieved. After an account deletion request, data is deleted from the operational database within 30 days and from disaster-recovery backups within up to 30 days thereafter (accounts can be restored if requested during the 30-day grace period). However, the following information is kept separately for the periods specified under applicable laws.

In addition, to prevent fraudulent use (such as payment theft or re-registration to evade usage restrictions), the Company may retain the account identifier (hash value) of members subject to usage restrictions for 1 year after account deletion. Members who have not used the Service for 1 year or more will be notified by email 30 days before the validity period expires.

4. Procedure and method for destroying personal information

1. Destruction procedure — Personal information for which grounds for destruction arise is selected and destroyed under the supervision of the Chief Privacy Officer. Information that must be retained under law is moved to a separate database with restricted access and destroyed once the retention period has passed.
2. Destruction method — Information in electronic file form is deleted using technical methods that prevent recovery or reproduction (such as destroying encryption keys or overwriting), and paper documents are shredded or incinerated.
3. Study materials sent to external AI model providers are automatically deleted after processing once each provider's contractual retention period has passed (see the table in Section 7).

5. Provision of personal information to third parties

The Company processes data subjects' personal information only within the scope of the purposes stated in Section 1 and in principle does not provide it to third parties. The following cases are exceptions.

• When the data subject has given separate prior consent
• When there are special provisions in law or it is unavoidable to comply with legal obligations (such as a lawful warrant from an investigative agency)
• When deemed necessary to protect the urgent life, physical safety or property interests of the data subject or a third party

When a member creates a share link, anyone who receives the link can view the materials the member chose to share and the member's nickname. This disclosure is the member's own choice, and the member can deactivate the link at any time.

6. Outsourcing of personal information processing

To provide the Service smoothly, the Company outsources personal information processing as follows. When entering into outsourcing contracts, pursuant to Article 26 of the Personal Information Protection Act, the Company specifies in the contract or other documents matters regarding prohibition of processing for purposes other than the outsourced work, technical and administrative safeguards, restrictions on re-outsourcing, management and supervision of the contractor, and liability such as compensation for damages, and supervises whether contractors process personal information securely.

If the outsourced work or contractors change, we will disclose this without delay through this Privacy Policy.

7. Overseas transfer of personal information

To provide the Service (perform our contract with data subjects), the Company transfers personal information overseas as follows, and discloses the details of the transfer through this Policy pursuant to Article 28-8(1)(3) of the Personal Information Protection Act.

How to refuse overseas transfer and its effects — Data subjects may refuse overseas transfer by notifying the Chief Privacy Officer (help@notely.kr) or by deleting their account. Transfers to analytics and crash tools can be turned off in app Settings > Privacy. However, because AI model and speech recognition processing are core features of the Service, if you refuse them you will not be able to use AI generation or recording transcription.

8. Rights and obligations of data subjects and legal representatives, and how to exercise them

1. Data subjects may at any time exercise their rights against the Company, including access to personal information, correction or deletion, suspension of processing, withdrawal of consent, and refusal of or requests for explanation of automated decisions.
2. Rights can be exercised directly through the in-service Settings menu (edit profile, delete materials, export data, delete account) or requested in writing or by email (help@notely.kr), and the Company will act within 10 days.
3. Members can download their study materials, AI-generated content and study history in a machine-readable format from Settings > Export data (right to data portability).
4. Rights may also be exercised through an agent, such as a legal representative or a person with delegated authority; in this case, a power of attorney in the form of Annex Form No. 11 of the Notice on Methods of Processing Personal Information must be submitted.
5. Requests for access to or suspension of processing of personal information may be restricted under Article 35(4) and Article 37(2) of the Personal Information Protection Act, and deletion cannot be requested for personal information specified as subject to collection under other laws.
6. The Company verifies whether the person exercising rights is the data subject or a legitimate agent.

9. Processing of personal information of children under 14

The Company does not allow children under 14 to sign up and does not collect children's personal information with the consent of a legal representative. We confirm at sign-up that users are 14 or older, and if we learn that personal information of a child under 14 has been collected, we will immediately terminate the account and destroy the related information.

10. Measures to ensure the security of personal information

Pursuant to Article 29 of the Personal Information Protection Act, the Company takes the following security measures.

• Administrative measures — establishing and implementing an internal management plan, minimizing personnel who handle personal information and training them regularly, confidentiality pledges
• Technical measures — encryption in transit (TLS 1.2 or higher), encryption at rest (AES-256), one-way password encryption (salted hashing), access control systems and multi-factor authentication (MFA), retention of access logs and protection against tampering, security updates and vulnerability checks, intrusion detection monitoring
• Access control — granting least privilege based on job duties, employees are in principle prohibited from viewing study materials (exceptions, such as when a member permits it for customer support, are logged), immediate revocation of access upon resignation or job change
• Physical measures — using certified cloud data centers, locking storage locations for documents and storage media

11. Installation, operation and refusal of automatic personal information collection tools

1. The Company uses cookies and similar in-app technologies (local storage, SDKs) to keep you logged in, save your settings such as language and theme (light/dark), and analyze usage statistics.
2. A cookie is a small piece of information sent by the server running a website to the user's browser and stored on the user's device.

3. Category	Purpose	Effect of refusal
   Essential cookies	Maintaining login sessions, security (CSRF protection)	Login and other services unavailable
   Functional cookies	Remembering settings such as theme and language	Settings reset on every visit
   Analytics cookies	Visit paths, feature usage statistics	No effect on using the Service

4. How to refuse — You can refuse or delete cookies in your web browser settings.
   • Chrome: Settings > Privacy and security > Third-party cookies
   • Safari: Settings > Privacy > Block all cookies
   • Edge: Settings > Cookies and site permissions > Manage cookies and site data
   • Mobile app: App settings > Privacy > Turn off usage statistics

12. Collection, use, provision and refusal of behavioral information

The Company does not collect behavioral information to provide targeted advertising tailored to data subjects while they use the Service, and does not allow third-party advertisers to collect behavioral information on the Service. If we introduce targeted advertising in the future, we will revise this Policy in advance and obtain separate consent.

Study recommendations provided within the Service (such as review reminders and suggestions for weak concepts) are processed within the Service using only the member's study history and are not provided externally.

13. Processing of pseudonymized information

Pursuant to Article 28-2 of the Personal Information Protection Act, the Company may pseudonymize personal information without the data subject's consent for statistics, scientific research (including research to improve service quality) and archiving in the public interest. In this case, the original text of study materials is excluded from pseudonymization; pseudonymized information is stored separately from additional information with restricted access, and processing records are created and kept. If pseudonymized information is provided to third parties or combined, the purpose, items, period and so on will be disclosed in this Policy. We currently do not provide or combine it with third parties.

14. Chief Privacy Officer

The Company has designated the following Chief Privacy Officer to take overall responsibility for personal information processing and to handle data subjects' complaints and remedies related to personal information processing.

Data subjects may contact the Chief Privacy Officer regarding any inquiries, complaints or remedies related to personal information protection arising from use of the Service, and the Company will respond and act without delay.

15. Department receiving and handling requests for access to personal information

Data subjects may submit requests for access to personal information under Article 35 of the Personal Information Protection Act to the department below. The Company will strive to process such requests promptly.

16. Remedies for infringement of data subjects' rights

To seek remedies for personal information infringement, data subjects may apply for dispute resolution or counseling to the Personal Information Dispute Mediation Committee, the Korea Internet & Security Agency (KISA) Personal Information Infringement Report Center, and others. For other reports or consultations on personal information infringement, you may contact the agencies below.

Anyone whose rights or interests have been infringed by a disposition or omission of the head of a public institution in response to a request under Article 35 (access to personal information), Article 36 (correction and deletion of personal information) or Article 37 (suspension of processing of personal information, etc.) of the Personal Information Protection Act may file an administrative appeal as prescribed by the Administrative Appeals Act (Central Administrative Appeals Commission 110, www.simpan.go.kr).

17. Changes to this Privacy Policy

This Privacy Policy takes effect on October 12, 2026. If any content is added, deleted or modified, we will notify you through Service announcements and email starting 7 days before the change takes effect (30 days before for material changes, such as adding collected items or changing third-party provision or overseas transfers).