Privacy Policy

The Company processes the following items of personal information.

· Membership registration and management (required): email address, display name, authentication information (Firebase UID).

· When using Google social login: Google account email address, Firebase UID.

· Information automatically generated or collected while using the Service: IP address, cookies, service use and access records.

· When using voice discussion and practice: real-time voice data and the speech transcripts (text) converted from it. Voice is processed for real-time recognition (STT); speech transcripts and coaching outputs (speech evaluations and reports) may be stored to provide the Service and to let you view them again.

· When paying for a Plan: payment-related information. Payment method information such as card numbers is processed by the payment service provider (PayPal), and the Company does not store it.

· Preventing duplicate trial practice time grants: a one-way hash (SHA-256) of the normalized email address. Before the Member closes their account, it is stored together with the normalized email address, the account identifier (UID) and the date and time the trial was granted; when the Member closes their account, the email address and the account identifier are deleted.

· Purpose of visit tagging (optional): the purpose of using the Service (interview, presentation, meeting) and the date of an upcoming event, entered optionally at sign-up. Leaving them blank places no restriction on sign-up or use of the Service.

The Company processes personal information for the following purposes and does not use it for other purposes. If the purpose of use changes, the Company will take necessary measures, such as obtaining separate consent under Article 18 of the Personal Information Protection Act.

· Membership registration and management: confirming intent to register, identification and authentication, maintaining and managing membership, preventing fraudulent use, and sending notices.

· Providing the Service: real-time voice discussion and presentation practice, speech evaluation, speaking coaching and reports, and personalized service.

· Providing practice time and paid services: granting and deducting trial practice time and preventing duplicate grants, payment and settlement for Plans, and refund processing.

· Customer support: responding to inquiries and handling disputes.

· Service improvement: analyzing use by purpose of visit (the optionally entered purpose of use and event date, and web analytics tools) and improving service quality.

The Company processes and retains personal information within the retention and use period required by law or the period to which the data subject has consented.

· Membership registration and management: until the Member closes their account. However, if an investigation or inquiry for violation of relevant laws is in progress, or a claim or debt remains outstanding, the information is retained until that ends.

· Electronic commerce records: under the Act on the Consumer Protection in Electronic Commerce, records of contracts and withdrawal of subscription are kept for 5 years, records of payment and supply of goods for 5 years, and records of consumer complaints and dispute handling for 3 years.

· Real-time voice data: destroyed immediately once the purpose of recognition (STT) processing is achieved, and not stored separately. Speech transcripts and coaching reports are retained until the Member closes their account or the user requests deletion.

· Records for preventing duplicate trial time grants: even after a Member closes their account, only the one-way email hash, the trial grant date and time, the account closure date and time, and a marker that prevents re-granting are kept for as long as the purpose of preventing fraudulent use continues; the email address and account identifier (UID) are deleted when the account is closed.

· Account deletion records: the processing record used to confirm that account closure was completed (a hash of the account identifier, the email hash, and the processing status and time) may be kept after account closure for as long as operationally necessary. Per-account entries in the daily usage totals kept for operations and cost management (which include the account identifier) are deleted when the account is closed, leaving only overall totals that cannot identify an account.

· Operator action records: audit records of actions an operator takes on a Member account (such as granting practice time), consisting of the target account identifier, the reason and the operator's email address, may be kept for operations management.

The Company processes personal information only within the scope stated in Section 2, and provides it to third parties only in cases covered by Articles 17 and 18 of the Personal Information Protection Act, such as with the data subject's consent or under special provisions of law. The Company does not currently provide personal information to third parties (see Section 5 for outsourcing of processing and overseas transfer).

To provide the Service smoothly, the Company outsources personal information processing as follows. The processors below are located overseas, so personal information is transferred abroad.

· Google LLC (United States) — member authentication (Firebase Authentication) and data storage (Firestore): email address, Firebase UID, service usage data.

· Deepgram, Inc. (United States) — speech recognition (STT): converting the user's real-time voice data into text (transferred when voice discussion or practice is used).

· ElevenLabs, Inc. (United States) — speech synthesis (TTS): generating AI persona voices (the speech text is transferred, not the user's voice).

· Roye and its downstream LLM providers — generating AI conversation, coaching and reports from speech transcripts and coaching context. Model execution is requested through the Roye API.

· PayPal — processing paid payments and settlement (payment-related information).

Notice of overseas transfer (Article 28-8 of the Personal Information Protection Act): the destination is the United States and other countries; the items, timing and purposes of transfer are as listed above; and the method of transfer is transmission over a network. Users may refuse overseas transfer by not using the Service, but in that case use of core features such as speech recognition, synthesis and AI conversation will be restricted.

When entering into outsourcing contracts, the Company states in writing, under Article 26 of the Personal Information Protection Act, the prohibition on processing beyond the purpose of the outsourced work, technical and managerial protective measures, limits on re-outsourcing, supervision of the processor, and liability such as compensation for damages.

A data subject may exercise the following rights against the Company at any time: requesting access to personal information, requesting correction of errors, requesting deletion, requesting suspension of processing, requesting transfer of personal information, and refusing or requesting an explanation of automated decisions.

These rights may be exercised in writing, by email or the like, and the Company will act on them without delay. Users can delete their profile within the Service by deleting their account.

When personal information becomes unnecessary, for example because the retention period has passed or the purpose of processing has been achieved, the Company destroys it without delay.

· Destruction procedure: unnecessary personal information is destroyed under the responsibility of the personal information protection officer.

· Destruction method: electronic files are deleted by a technical method that prevents the records from being restored, and paper printouts are shredded or incinerated.

The Company restricts membership registration by children under 14 years of age. Users confirm at sign-up that they are 14 or older, and if a child under 14 attempts to sign up, use of the Service is refused.

The Company takes the following measures to ensure the security of personal information: (managerial) establishing and implementing an internal management plan, and minimizing and training the staff who handle it; (technical) access rights management, access control, encryption of data in transit, and installation of security programs; (physical) access control to data storage locations.

The Company uses cookies that are essential to operating the Service (such as keeping login sessions) and cookies from web analytics tools to improve the Service.

· Web analytics tool: the Company uses Google Analytics, provided by Google LLC, to collect and analyze visit and usage records (behavioral information such as pages visited, referral sources and clicks). Google Analytics cookies are installed in the process, and the collected information is used only to analyze and improve service usage statistics.

· How to refuse: users can refuse to store cookies in their web browser options, or refuse web analytics collection through the Google Analytics opt-out browser add-on (tools.google.com/dlpage/gaoptout). However, if you refuse essential cookies, it may be difficult to use services that require login.

The Company has designated a personal information protection officer to oversee personal information processing and to handle data subjects' complaints and remedies.

· Privacy inquiries: support@talkingcurve.com

Data subjects may contact the following organizations for remedies and consultation about infringement of personal information: Personal Information Dispute Mediation Committee (1833-6972, www.kopico.go.kr), Personal Information Infringement Report Center (118 without area code, privacy.kisa.or.kr), Supreme Prosecutors' Office (1301), and National Police Agency (182).

This Privacy Policy applies from July 7, 2026. If anything is added, deleted or modified, the Company will announce it before it takes effect.