Privacy Policy
Effective 2026-11-01
(to be registered) (the "Company") processes personal information in providing XRWorld as described below, in compliance with the Korean Personal Information Protection Act and other laws. XRWorld is designed to handle little personal information: students have no accounts, in-class data stays on the classroom teacher PC, and content originals stay in teachers' own Google Drive. If the Korean and English versions differ, the Korean version prevails.
1. Information we process
| Category | Items | How collected |
|---|---|---|
| Member (teacher) sign-up | Google account ID, email, name (display name) | Google sign-in |
| Using the Service | Teacher code (generated), linked Drive folder ID, registered content info (title, type, category, hashtags, Drive file ID, checksum, size, thumbnail), class lists and co-editors, reports | Created or entered during use |
| Opening a class | Teacher PC private IP and port, public IP, room number, PIN (hash only) | When the teacher app opens a class |
| Library | Download records, content-key issue records (teacher, time) | Created during use |
| Payment | Order number, amount and currency, payment method type, provider payment ID, email at order time, school name for school plans | At checkout. Card numbers are handled by the payment provider; the Company never receives them |
| Schools | School name, member teachers (added by email) and roles | Entered by school administrators or the operator |
| Contact | Name or institution, email, subject, message | Contact form |
| Automatic | Sign-in session cookies, access logs (IP, time, URL), anonymous per-class diagnostics (app version, OS, student count, bytes sent, etc.) | During use |
Students: the Company does not collect students' names, accounts, or contact details. Information student devices send during class (such as device names) is used only on the classroom teacher PC and is not sent to the Company. Viewing public material by teacher code leaves only an access log (IP address).
2. Purposes
- Identifying members, sign-in, and account management
- Providing the Service, including content registration, class lists, opening classes, and letting student devices find a class
- Payments, refunds, plans, and usage rights
- Protecting library copyrights (download and key records) and vendor settlement
- Handling inquiries and reports, sending notices
- Preventing abuse and improving reliability (anonymous diagnostics)
3. Retention and deletion
| Items | Retention |
|---|---|
| Member, content, class-list, download and key records | Until account deletion, then deleted without delay (originals in the teacher's Google Drive remain theirs) |
| Class rooms (IPs, PIN hash) | Deleted when the class ends or when a class is opened after 3 hours |
| Records of contracts, withdrawals, payments and supply (orders) | 5 years (Korean E-Commerce Act), kept separately from member identity after account deletion |
| Consumer complaint and dispute records | 3 years (E-Commerce Act) |
| Access logs | 3 months (Protection of Communications Secrets Act) |
When retention ends, electronic files are deleted irrecoverably and paper is shredded.
4. Provision to third parties
The Company does not provide personal information to third parties without consent or legal basis. When a member shares a class list or adds co-editors, the list and the member's name are visible to other teachers within the scope the member chooses.
5. Processors and international transfer
The Company uses the following processors, some outside Korea. Transfers occur over the network during use and are retained until the contract ends or the periods in section 3.
| Recipient (country) | Task | Items |
|---|---|---|
| Supabase, Inc. (USA; data stored in the Seoul region) | Database and sign-in | Member, service, payment, and school information in section 1 |
| Vercel Inc. (USA; runs in the Seoul region) | Website hosting | Access logs and request contents |
| Cloudflare, Inc. (USA) | Library content storage | Access logs (IP) when downloading items |
| Telegram Messenger Inc. (country [to be confirmed]) | Forwarding contact messages to the operator | Contact form items |
| Payment provider [after contract] | Payment processing | Order number, amount, payment information |
6. Google user data
- XRWorld uses only Google sign-in (name, email, account ID) and the Google Drive drive.file scope, which gives access only to files XRWorld created or the member selected.
- Drive access is used only to upload content, list it, download class copies to the teacher PC, and set link sharing to match the visibility the member chooses.
- Google tokens are not stored on the Company's servers; they live only in the browser's and teacher app's memory and disappear on sign-out or when the app closes.
- XRWorld's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. It is not used for advertising or sold.
7. Your rights
You may request access, correction, deletion, or suspension of processing, and withdraw consent (delete your account), at any time. You can edit your name and delete your account ("Delete account") in the dashboard; other requests are handled without delay through the privacy officer below or the contact form, including via a legal representative.
8. Children under 14
Only persons 14 or older may become members. Students join classes without accounts, and the Company does not collect their personal information.
9. Cookies
Only cookies essential for keeping you signed in are used (session, list of signed-in slots). No advertising or analytics cookies are used. Blocking cookies prevents sign-in.
10. Security measures
- Encryption in transit (HTTPS), row-level access control in the database, minimal administrator privileges
- PINs stored only as hashes, Google tokens not stored on servers, payment data handled by the payment provider
- Class content copies on teacher PCs and student devices are encrypted
- Minimal staff access to personal information with access records
11. Privacy officer
Officer: (to be registered) · Email: (to be registered) · Phone: (to be registered)
You may also contact the Personal Information Infringement Report Center (privacy.kisa.or.kr, 118) or the Personal Information Dispute Mediation Committee (www.kopico.go.kr, 1833-6972).
12. Changes
Changes are announced in the Service at least 7 days before they take effect (30 days for important changes to your rights).