Privacy Policy
PHconlab Inc. (주식회사 표현하다, hereinafter referred to as the "Company") operates PHconlab and processes personal data in accordance with applicable privacy laws. This Privacy Policy explains how the Company collects, uses, stores, and protects personal data.
1. Purposes of Processing
The Company processes personal data only as necessary for the following purposes.
- Account registration, identity verification, account administration, and fraud prevention
- Orders, payments, delivery, refunds, and support for products, digital content, courses, and gift passes
- Course access and learning-progress management
- Kakao login, KakaoTalk Channel integration, and service notifications
- Inquiries, reviews, comments, AI-assisted support, and dispute handling
- Service quality, traffic, usage, advertising, and campaign-performance analysis
- Personalized advertising, conversion measurement, and campaign attribution where the user has consented
- Compliance with legal obligations and retention of transaction records
2. Categories of Personal Data
Depending on the features used, the Company may process the following data.
| Category | Data processed |
|---|---|
| Account | Name, email address, mobile number, member ID, login method, registration and account-change history, and for new registrations, confirmation of age 14 or older, confirmation time, and registration source |
| Kakao login | Kakao user ID, name, email address, mobile number, KakaoTalk Channel relationship and consent history |
| Orders and payments | Order number, product, amount, currency, payment status and method, purchase, cancellation and refund history, billing and shipping details |
| Gift passes | Recipient name, email address, mobile number, and gift message |
| Courses and digital content | Access rights, progress, completion status, usage and download history |
| Inquiries and support | Messages, replies, session identifier, AI-response records, and related product or document references |
| Reviews and posts | Author details, rating, review or comment, and uploaded images or media |
| Voice and story creation | Uploaded voice or image files, selected story, generated output, creation and expiry timestamps |
| CRM and marketing | Subscription status, customer tags, campaign delivery and response history, source information, UTM values, gclid, fbclid, and landing path |
| Partners program participation and payouts | Application and approval status, partner code, referral-link clicks and order attribution records, commission settlement history, and — for payout purposes — full name, bank account held in the partner's own name, and resident registration number |
| Automatically collected data | IP address, browser, device and operating-system information, cookies, access time, page and button interactions, and error logs |
The Company does not collect government-issued unique identifiers unless required or expressly permitted by law. The one exception is the payment of commissions under the PHconlab Partners program: to meet its withholding and reporting obligations under Articles 145 and 164 of the Income Tax Act, the Company collects and uses the partner's resident registration number. This processing falls within what Article 24-2 of the Personal Information Protection Act permits, and the number is not used for any purpose other than filing with the National Tax Service. It is stored encrypted, is accessible only to settlement staff, and is not requested when a member applies to the program — only at the point an actual payout is made.
The Company's current website offerings primarily consist of digital content and online services. Before introducing physical delivery, a native app, location features, or push notifications, the Company will update this Policy to reflect the actual data and providers involved and obtain any required consent.
3. Retention Periods
The Company deletes personal data without undue delay when the purpose of processing has been fulfilled, unless retention is required by law.
| Record | Retention period |
|---|---|
| Account information | Until account deletion, except where a separately disclosed fraud-prevention or legal retention period applies |
| Contract and withdrawal records | 5 years |
| Payment and supply records | 5 years |
| Consumer complaint and dispute records | 3 years |
| Advertising records | 6 months |
| Gift-pass order and recipient data | Same period as the applicable order and supply records |
| Course progress and entitlements | Until account deletion or fulfillment of the access purpose, subject to legal retention requirements |
| Generated voice or story output files | Automatically deleted 14 days after creation; related order and entitlement records follow their own retention periods |
| General AI support and inquiry history | 1 year after the support session ends |
| Support records connected to a consumer complaint or dispute | 3 years after resolution |
| Partners commission payout and withholding records | 5 years from the end of the tax period in which the payout was made (retention required under the Framework Act on National Taxes and the Income Tax Act) |
| Cookie-consent record | While the preference remains valid or until the user changes or deletes it |
Until automated deletion is implemented for AI support records, the Company will periodically review and delete those records according to the periods above.
4. Disclosure to Third Parties
The Company does not sell personal data and does not disclose it to third parties except with prior consent, where required by law, or where legally permitted and necessary to provide payment, delivery, or another requested service.
The information shared with a payment provider and its retention period may vary according to the payment method and the provider's policies.
5. Service Providers
The Company engages the following providers to deliver the Service. Core customer, order, and course data used by FluentCRM, WooCommerce, and LearnDash is stored in the WordPress environment administered by the Company.
| Service provider | Processing activity |
|---|---|
| Toss Payments | Domestic payment authorization, cancellation, refund, and payment support |
| PayPal | International payment authorization, cancellation, refund, and payment support |
| Kakao | Kakao login, KakaoTalk Channel relationship checks, and account integration |
| SOLAPI | Kakao Alimtalk and SMS delivery |
| Naver Smart Store and Naver Commerce API | Store order, product and inquiry integration, and gift-pass processing |
| Google Analytics, Ads, Search Console, Merchant Center, YouTube, and Google Gemini-based AI support and embedding features | |
| Microsoft | Usage-flow and interaction analysis through Clarity |
| Meta | Advertising conversions and integrations for content, comments, and messages through Meta Pixel and Graph API |
| Modal Labs | Processing requested voice and story generation |
| bunny.net (BunnyWay d.o.o.) | Delivery of audio, video, VR, e-book, and product-detail content; CDN caching, access control, and security |
| Cloudways and Vultr | Website operation on a Tokyo, Japan server; storage and transmission of commerce data; security and incident response |
| Amazon Web Services (AWS) | Storage of Cloudways off-site backups and post-deletion recovery support |
| WordPress.com and Automattic | Integration of WordPress- and WooCommerce-related services |
The Company contractually requires service providers to protect personal data and monitors their processing as required by applicable law.
6. International Transfers
The Company may process personal data outside Korea to provide website hosting and backups, international payment, content delivery, analytics, advertising, and AI features.
| Recipient | Destination | Data and purpose | Timing and method | Retention |
|---|---|---|---|---|
| Google LLC | United States and countries where Google service infrastructure is located | Online identifiers, access, usage and ad-response data, AI support input and context; analytics, ad measurement, and Google Gemini-based AI responses and embeddings | Encrypted browser transfer after analytics or marketing consent, or API transfer when the user requests AI support | Google Analytics 4 detailed event data is retained for 2 months and user data for 14 months. The user-data retention period resets when new user activity occurs. Aggregated standard-report data is not affected by this setting and may be processed separately under Google policy. Other data is retained according to Company settings, contract, and Google policy |
| Microsoft Corporation | United States and countries where Microsoft service infrastructure is located | IP, device, browser, page and button interaction data; Clarity analytics | Encrypted browser transfer after analytics consent | Session playbacks for 30 days; click and heatmap data and labeled or favorited sessions for 9 months |
| Meta Platforms, Inc. | United States | Online identifiers, page, product, cart and checkout events, and campaign identifiers; conversion measurement and retargeting | Encrypted browser or API transfer after marketing consent | According to Company settings and Meta policy |
| PayPal Pte. Ltd. and PayPal affiliates | Singapore and countries where PayPal processing facilities are located | Order, payment, billing and contact details; authorization, cancellation, and refund | Encrypted transfer when the user selects PayPal | Statutory transaction retention and PayPal policy |
| bunny.net (BunnyWay d.o.o.) | Countries where the nearest available global CDN edge server is located | IP address (last octet removed in stored logs), browser and device information, access time, country code, requested content URL, and technical logs; delivery and security of audio, video, VR, e-book, and product-detail content | Encrypted browser transfer when the user views or plays the content | Standard CDN request logs for up to 3 days; external log forwarding and permanent log storage are disabled |
| Cloudways, Vultr, and Amazon Web Services (AWS) | Japan. The production server is in Vultr's Tokyo region, and off-site backups are stored in AWS Tokyo (ap-northeast-1) | Website operation data, including member, order, payment, course, support, and access-log data; hosting, security, incident recovery, and backup | Processed over encrypted connections during Service use; off-site backups are created daily | Active backups are retained for one week under the Company's settings. Recovery backups are retained for 14 days after a server or application is deleted and are then permanently deleted |
| Modal Labs, Inc. and subprocessors published by Modal | United States and global infrastructure locations of Modal subprocessors; the current execution region is not fixed | Uploaded voice, selected story and language, and generation request; voice and story generation | Encrypted API transfer when the user runs the generation feature. Default input routing passes through Virginia, United States (us-east), and object storage for inputs and outputs larger than 2 MiB is also located in us-east | Under the current implementation, voice inputs and generated outputs are processed as Modal Function inputs and outputs and deleted within a maximum of 7 days. User voice files are not stored in a Modal Volume. Output made available by the Company is retained for 14 days |
Under the current Modal implementation, the execution region is not fixed to one country, so each request may be dynamically placed on supported global cloud infrastructure in the United States, Europe, Asia, or another available region. Audio received by the Web Endpoint is passed to a Modal Function without being written to separate persistent storage. Temporary audio files created during processing are deleted immediately after processing. Modal Volumes contain only model caches and story templates supplied by the Company. Modal's terms state that Customer Data will not be used to train AI models without the Company's prior written consent. Modal's current subprocessor list is available at its Trust Center (https://trust.modal.com/subprocessors).
The PH AI Chatbot currently uses Google Gemini for support responses and embeddings. OpenAI and Anthropic are not currently used to process support requests. The Company will update this Policy and international-transfer notice before switching to or adding either provider.
bunny.net is used as delivery infrastructure for reliable and efficient delivery of digital content and product-detail files, not for advertising or behavioral analytics. Under the Company's current configuration, the last segment of IP addresses is removed from CDN logs, and log forwarding and permanent log storage are disabled.
Google Analytics, Microsoft Clarity, and Meta advertising features run only after the corresponding analytics or marketing consent. Users may refuse or withdraw optional consent through Cookie settings. Refusing an international transfer required for a user-requested feature, such as PayPal payment or AI generation, prevents use of that feature.
7. Cookies and Similar Technologies
The Company uses essential cookies for login, carts, security, and consent preferences, and optional analytics and marketing cookies only according to the user's choice.
| Category | Purpose | Example services | Default |
|---|---|---|---|
| Essential | Login, cart, checkout, security, language and consent settings | WordPress, WooCommerce, WP Consent API | Always active |
| Analytics | Traffic, navigation, interaction, and error analysis | Google Analytics 4, Microsoft Clarity | Active after consent |
| Marketing | Conversion measurement, retargeting, and campaign-to-order attribution | Meta Pixel, Google Ads identifiers, UTM order attribution | Active after consent |
On the first visit, users may choose Allow all or Essential only. Preferences can be changed at any time through Cookie settings in the site footer. Browser settings may also block or delete cookies, but doing so may affect login, cart, or other essential functions.
8. User Rights
Users may request access, correction, deletion, restriction of processing, withdrawal of consent, or account deletion. Requests may be submitted to the privacy contact below and will be handled after identity verification in accordance with applicable law.
Members may request account deletion through My Account > Account details. A request remains pending for seven days and may be canceled from the same screen during that period. Optional analytics and marketing tracking is disabled while the request is pending.
After seven days, login credentials, profile data, third-party login identifiers, and customer-management contact records are deleted or anonymized, and course entitlements are revoked. Order, payment, cancellation, refund, and tax records remain separately retained for the legally required period. Support records may remain for the retention period stated in this Policy after their identifying link to the account is removed.
A request may be restricted where retention is required by law or where fulfilling it would adversely affect another person's rights.
9. Deletion
The Company securely deletes personal data when its retention period ends or its purpose has been fulfilled. Electronic files are deleted using methods designed to prevent recovery, and paper records are shredded or incinerated. Data retained by law is stored separately from actively used data.
10. Security Measures
The Company applies access controls, credential protection, encryption in transit, security updates, log review, backups, and least-privilege access to protect personal data.
11. Children Under 14
The Company does not offer direct account registration or payment to children under 14 and does not collect children's personal data through those paths. Children's content must be purchased and administered through an account held by a legal guardian or educational institution. Before introducing direct account creation or payment for users under 14, the Company will implement legal-guardian consent, verification, and withdrawal procedures and update this Privacy Policy and the related user interfaces.
Age confirmation applies only when a new account is created and is not applied retroactively when an existing member signs in. The Company records the confirmation time and registration source but does not additionally collect date of birth or country information for this confirmation. Age confirmation does not change checkout, billing, shipping, or payment-method conditions.
12. Privacy Contact
- Company: PHconlab Inc. (주식회사 표현하다)
- Representative: Jinyoung An
- Privacy Officer: Jinyoung An, Chief Executive Officer
- Address: B1, 83 Sadang-ro 17-gil, Dongjak-gu, Seoul 07003, Republic of Korea
- Email: hello@phconlab.com
- Telephone: +82-70-8648-1616
Users may also seek assistance from the Korean Personal Information Infringement Report Center or the Personal Information Dispute Mediation Committee.
13. Changes to this Policy
The Company will announce changes to this Policy on the website before they take effect. Material changes affecting user rights will be separately notified as required by law.
- Previous policy effective date: May 1, 2025
- Publication date: June 15, 2026
- Effective date: July 15, 2026
and then