1. Personal information collected

• Email address (required): content delivery and payment receipts.
• Name (required at payment): receipt issuance.
• Payment information: processed through PortOne and not stored on the Company’s servers.
• Automatically collected: IP address, access time, and browser information, for security and prevention of misuse.

1-1. Limited collection in the Lounge parent network

• Account email and nickname: login, prevention of misuse, and attribution of posts and comments.
• Optional information: founding-member interest, up to two broad education-journey tags, and consent to a public badge.
• Email magic-link verification time: confirmation of email ownership.
• Posts, comments, and reports: community operations and dispute handling.
• Extracurricular decision information: broad grade bands, activity types, time and budget ranges; selected, on-hold, completed, or discontinued status; and consent to anonymous aggregation.
• Optional consent: reply and decision notifications, and search-engine visibility. All are off by default.

The Lounge does not collect the real names, contact details, report cards, passports, school IDs, acceptance letters, consultation records, or messenger screenshots of students, school staff, or other parents. If a post includes this information, it may be blocked before storage or deleted afterward.

2. Purposes of collection and use

• Sales of paid content and delivery of download links.
• Email newsletters, with separate consent.
• Lounge account access, safe community operations, and handling of reports and disputes.
• Checking response delays for real questions, consented follow-up on decisions, and anonymous experience aggregation only across at least five distinct families.
• Responding to customer inquiries.
• Meeting legal obligations, including tax invoice issuance and retention of transaction records.

3. Retention and use periods

• Member email: from registration until account withdrawal or a deletion request.
• Lounge posts, comments, and operational records: until a deletion request or for the period needed to operate the service. Where retention is legally required, records are kept for that period.
• Extracurricular decision updates and automation audit records: until a deletion request or for the period needed for operations. Withdrawal of consent to public aggregation excludes the information from subsequent public aggregates.
• Payment records: five years under Korea’s electronic commerce law.
• Log records: three months under Korea’s Protection of Communications Secrets Act.

4. Disclosure to third parties

The Company does not provide personal information to third parties without your consent, except:

• When an investigative authority requests it under applicable law.
• When you have consented to disclosure in advance.

5. Service providers processing information

• PortOne (payment processing): payment information.
• Resend (email delivery): email address.
• Google Cloud (service hosting): all information listed above.

6. Third-party advertising (Google AdSense) and advertising cookies

The Company may display third-party advertising through Google AdSense. Third-party advertising providers, including Google, may use cookies to personalize ads based on previous visits. The existing policy states that information obtained through these cookies does not include personally identifying information such as names or email addresses.

• You can disable personalized advertising in Google Ads Settings.
• You can also opt out of cookies used for personalized advertising at www.aboutads.info.
• Third-party advertising providers’ use of cookies is governed by their own policies and is outside the Company’s control.

7. Your rights

You may access, correct, or delete your personal information at any time. Requests sent to hello@haea.app are processed within three business days.

8. Privacy officer

Name: Seung-hye Jeong (Representative)

Email: hello@haea.app

Operator: ACROS R&D Co., Ltd. (ACROS · Korean business registration number 830-81-03784)