Privacy Policy

This Privacy Policy (the "Policy") explains how your personal information is handled in iStudyCloud, an AI-powered learning and creative workspace offered through istudycloud.com, our desktop and mobile applications, and related services (together, the "Service"). The Service has one brand but two companies that process personal information; Section 2 explains which company is responsible for which purposes.

iStudyCloud is currently in closed alpha — only invited users can access it, and features may change before general availability. This Policy describes the processing we perform today and will be updated with notice as the Service evolves.

In this Policy, "we" or "the company" means the company responsible for the purpose in question. The two companies are not jointly responsible for all processing, and sharing a brand does not make one company act in place of the other.

ISTUDYCLOUD INC. (a British Columbia, Canada corporation, registration no. BC1383084, the "Canadian company") develops the Service, holds the rights in the software and operates the platform. The Canadian company is responsible for processing for member accounts and authentication, security, storing and delivering workspace content, connecting AI features and operating the Service infrastructure.

아이스터디클라우드 주식회사 (a Republic of Korea corporation, the "Korean company") uses the Canadian company's software to sell the Service in Korea and handles marketing, customer acquisition and support for customers in Korea. The Korean company is not merely a collector of KRW payments or a settlement operator: it is responsible for processing to perform, charge and refund the products it sells, to support customers in Korea, and to collect and settle payments for marketplace sellers registered in Korea.

Each platform product (such as the Pro pass and Energy packs) has a designated selling company, which is shown before payment and on the receipt. That selling company is responsible for the order, payment, refund and receipt records of the transaction. Your display language, location or payment currency does not change the selling company.

Marketplace content and agent rentals are sold by the seller shown on the product. The seller may process the order information needed to fulfil the transaction, and the platform company (the Korean company for sellers registered in Korea, the Canadian company for other sellers) processes it as needed for intermediation, collection and settlement.

Each company uses only the information needed for its own purposes. Sections 5 and 6 describe when information moves between the two companies.

3.1 Account information

When you sign up we collect your email address, name, profile photo (if provided by your sign-in provider) and a unique authentication identifier. We do not store your password; authentication is handled by Firebase Authentication, and sign-in codes are sent by email.

If you sign in with a social account such as Google or Kakao, we receive from that provider the items you agreed to share with it: your email address (including whether it is valid and verified), profile, nickname and profile image. We only «receive» this information from the provider; we do not send your personal information to the provider.

Your account stores the interface language fixed at sign-up and, where your browser provides one, the two-letter country code described in Section 3.8. That code is derived from your browser's language setting and is not based on your IP address or any location measurement — it reflects the locale configured on your device and may differ from where you actually are. You can change the language in the product at any time, and neither the language nor the country code is used to choose the selling company.

3.2 Organization, school and center information

When you create or join an organization we process the organization's name and type (personal, sole proprietorship, educational institution or enterprise), each member's email address or an identifier assigned by the organization (for example an employee or student number), display name, role, and billing contact details.

Organization owners and administrators can see the member list and roles, and each member's AI and Energy usage records, in order to run the organization. When a school, center or other institution invites members to use the Service, that institution is itself responsible for using member information for its own purposes (such as classes, assignments or work management), and we process that information as needed to provide the Service.

3.3 Content you create

Content you create or upload — studios, documents, drawings, files — is stored on infrastructure operated by the Canadian company so that we can provide it to you and to collaborators you choose. We treat this content as confidential and do not use it to train our own AI models.

3.4 AI prompts and responses

When you use AI features, your prompts and the context you choose to share with the assistant (selected text, files, workspace content) are sent to the model provider you select. We keep AI conversation history so that you can return to your chats.

If you use the customer support chat, your question, text extracted from any attachments, and the information about your organization needed to answer (organization name, plan, Energy summary, recent receipt summary and diagnostic records) are sent to the support AI (Google Gemini). The support AI only looks up information about the organization that asked.

3.5 Payment and transaction information

Platform payments are processed by Stripe for US dollars (USD) and by Toss Payments (including Toss BrandPay) for Korean won (KRW). Payment method details such as card numbers are held by the payment provider; we never see or store your full card number. Payment method labels (for example the last four digits of a card) are fetched from the payment provider when needed and are not stored by us.

To manage purchases we keep receipt records (purchasing organization, product, quantity, amount, currency, payment rail, the payment provider's transaction reference, service period, and payment and refund times) and a selling-company record (the selling company and its registration details, and the versions of the Terms and this Policy that applied at the time of purchase). When you pay for a marketplace rental in US dollars, Stripe may collect your billing address to calculate tax; that address is held by Stripe.

3.6 Marketplace seller information

For organizations that sell on the marketplace, sellers registered in Korea submit their business type, settlement account (bank, account number and account holder) and supporting files such as a business registration certificate and bankbook copy for the Korean company's review and settlement; these files are kept in private storage. For sellers outside Korea, identity verification and payout details are collected and held directly by Stripe Connect, and we keep only the connected account identifier and its verification status.

3.7 Usage, diagnostic information and cookies

To operate and secure the Service we automatically collect IP address, browser or app version, operating system, language setting, and essential event and diagnostic records. We use cookies only to remember display settings (theme, sidebar and language), and we do not use advertising tracking or third-party analytics tools.

3.8 Pre-authentication context

When you submit a sign-in or email form before an authenticated session exists, we record the language your request indicates and, where your browser provides one, a two-letter country code taken from its language setting, in order to complete sign-in, send verification messages in the right language and diagnose delivery failures. We do not store your IP address for this purpose. This record is not linked to your account until sign-in succeeds, and it carries an explicit expiry time after which it is deleted automatically — see Section 7.

3.9 Alpha access requests

While the Service is in closed alpha, you can ask for access from the web, desktop or mobile app. When you do, the Canadian company records the email address and account identifier of the signed-in account, the use-case message you write (required, 10 to 280 characters), the app the request came from (web, desktop or mobile), how many times you have asked, the times of your first and latest request, and the review status together with any note our staff record when reviewing it.

We use this information only to review access requests, decide who may use the Service during the alpha, and apply that decision to your account. Your message is shown only to you and to the administrators who review alpha access.

If you withdraw a request while it is still under review, the request record, including your message, is deleted immediately. Otherwise it is kept with your account's alpha access status for as long as your account exists — see Section 7.

The Canadian company uses personal information to: (a) provide and maintain the Service; (b) authenticate members and protect accounts; (c) store, sync and share workspace content; (d) route AI requests to the model provider you select and return results; (e) send service notices and pass-expiry reminders; (f) detect abuse and keep the Service secure; (g) process payments, refunds and settlement for products sold by the Canadian company and for transactions of marketplace sellers outside Korea; and (h) comply with applicable law.

The Korean company uses personal information to: (a) perform, charge, refund and issue receipts for the products it sells; (b) review, collect for and settle marketplace sellers registered in Korea; (c) consult with and support customers in Korea; (d) inform people in Korea about the Service and market it (advertising messages are sent only with separate consent); (e) deliver additional services the Korean company contracts to provide directly; and (f) comply with the laws of the Republic of Korea.

Customer enquiries are answered by the company responsible for the account or transaction concerned. We do not sell personal information, and we do not use customer content or AI prompts to train our own AI models. The Service does not currently send advertising emails.

Because the Canadian company operates the platform, the order and payment records of products sold by the Korean company and the settlement records of Korean sellers are also stored in systems operated by the Canadian company. The Korean company uses only the information needed for the transactions it sells or settles and the enquiries it handles.

We use sub-processors to operate the Service. Each receives only the data needed for its function and is bound by data-protection commitments. The list is split into «those that process data for every user» and «those involved only when you use a particular feature».

Sub-processors involved for every user:

Google LLC (Firebase and Google Cloud) — user authentication, the primary application database and real-time sync (Cloud Firestore), server functions, regional file storage, and mobile app notification delivery (Firebase Cloud Messaging).

Cloudflare, Inc. — content delivery, web application firewall, R2 object storage for user files and media, Workers compute, and transactional email such as sign-in codes, invitations and pass-expiry reminders.

Sub-processors involved only when you use the related feature — if you do not use that feature, no information about you is shared with them:

AI model providers (OpenAI, Anthropic, Google) — when you use AI features, your prompts and the context you choose to share are sent to the model provider you select for inference. We do not send content to a provider you have not selected. If you connect your own ChatGPT subscription account, those requests are sent to OpenAI through the connected account. The customer support chat uses the support AI (Google Gemini) described in Section 3.4.

Soniox, Inc. — processes your voice and the related text when you use voice input (speech recognition) or read-aloud (speech synthesis).

Apple Inc. — notification delivery (APNs) if you allow notifications in the iOS app.

Stripe, Inc. — US dollar payments, and identity verification and payouts for marketplace sellers outside Korea (Stripe Connect Express). Each payment is processed through the payment account of the company that sells the product.

Toss Payments Co., Ltd. — Korean won payments (including Toss BrandPay) and transactions of marketplace sellers registered in Korea, processed through the Korean company's merchant account.

During the closed alpha some of these features may not be active. Sub-processors in the second group are involved only once the feature is actually offered and you use it.

We will update this list when sub-processors change and give notice of material changes under Section 12.

For organizations pinned to a specific region under Section 6, the database and file-storage sub-processors serve that organization through infrastructure in the pinned region.

By default, workspace data is stored in our primary region in the United States (Google Cloud us-west2, Los Angeles). An organization can ask to pin its workspace data to a specific region we operate — northamerica-northeast2 (Toronto, Canada) or asia-northeast3 (Seoul, Republic of Korea). Database records and uploaded files of a pinned organization are stored in the pinned region; organizations that are not pinned use the default region. A region assignment cannot be changed after creation.

Personal information of users in Korea is transferred abroad as follows. Recipient: ISTUDYCLOUD INC. (Canada, support@istudycloud.com). Items: the account, organization, content, AI, payment and usage records described in Section 3. Timing and method: transmitted over the network whenever you use the Service. Purpose: the Canadian company's purposes in Section 4 (operating the platform). Retention: Section 7. Transferred information may be stored and processed on infrastructure in the United States, Canada or other countries operated by the sub-processors listed in Section 5.

When a user outside Korea buys a product sold by the Korean company or contacts the Korean company, the related order, payment and enquiry information is processed by the Korean company in the Republic of Korea. We apply industry-standard safeguards to these transfers, including standard contractual clauses where applicable.

You may refuse the international transfer of your personal information by notifying us at the contact in Section 12. Where a transfer is essential to providing the Service, refusing it may limit some or all of the Service.

We keep personal information while your account is active or as long as needed to provide the Service. Workspace content and AI history remain until you delete them or close your account. Content, groups and AI conversations moved to the trash are permanently deleted one year after they were moved there. A deleted organization can be restored for 90 days and is cleaned up afterwards. Identity details of members removed from an organization or content are masked 30 days after removal.

Transaction records (receipts, payments, refunds and settlement) are kept separately from Service data by the company that sold the transaction, under the statutory record-keeping obligations that apply to that company. Records are currently kept for 10 years for Korean transactions (KRW payments via Toss Payments) and 7 years for other transactions; the period for Korean transactions includes the periods required by Korea's Act on the Consumer Protection in Electronic Commerce (5 years for payment and supply records, 3 years for consumer complaint and dispute records). These records remain for that period even if you delete your account and are not used for any other purpose.

Customer support conversation records are kept for 30 days after the conversation ends and then deleted.

You can request deletion of your account and personal information at any time at support@istudycloud.com. We complete eligible deletion requests within 30 days, subject to legal retention obligations.

Pre-authentication context (Section 3.8) expires 1 hour after the final verification message for that request is sent. If a code is resent, the expiry is renewed to 1 hour from the resend. Expiry and deletion are distinct: the record stops being valid the moment its expiry passes and is treated as expired from then on, while physical deletion is carried out by an automated process and is normally completed within 24 hours of expiry. Only the former is immediate, so we state both.

Alpha access requests (Section 3.9) are deleted immediately if you withdraw them while they are still under review; otherwise they are kept with your account's alpha access status for as long as your account exists, and you can ask for them to be deleted together with your account as described above.

Depending on applicable law, you may: request access to the personal information we hold about you, correct inaccurate information, request deletion, restrict or object to processing, withdraw consent, and request a copy in a portable format.

To exercise your rights, contact support@istudycloud.com. Your request is handled by the company responsible for the information, and if you are not sure which company that is, you can still use the same address and it will be passed to the responsible company.

Residents of Canada may complain to the Office of the Privacy Commissioner of Canada (OPC, priv.gc.ca), and residents of the EEA and UK may contact their local supervisory authority.

Users in the Republic of Korea may, in addition, file a complaint or apply for dispute mediation with the Personal Information Protection Commission (pipc.go.kr), the Personal Information Dispute Mediation Committee (kopico.go.kr, 1833-6972) or the KISA Privacy Infringement Report Center (privacy.kisa.or.kr, 118).

iStudyCloud is not directed to children, and we do not knowingly collect personal information from children below the age at which they can consent for themselves under applicable law. That age is 13 in Canada and the United States, 14 in the Republic of Korea and mainland China, and 16 in Vietnam and in EEA member states that have not set a lower age. In the Republic of Korea, we process personal information of children under 14 only with the consent of their legal representative.

Educational institutions planning to use the Service with minors should contact us in advance to put an appropriate data processing agreement in place. The institution is responsible for managing students' enrolment, grade and completion records, and we do not award credits or graduation qualifications.

We protect personal information with industry-standard safeguards, including TLS encryption in transit, encryption at rest in managed databases and object storage, role-based access control, least-privilege access, audit logs and infrastructure security monitoring.

No system is perfectly secure. If we become aware of a personal information breach that poses a risk of significant harm, we will notify affected members without undue delay and report to the authorities required by law — the Office of the Privacy Commissioner of Canada under Canadian law and, for personal information of users in the Republic of Korea, the data subjects and the Personal Information Protection Commission within 72 hours under the Personal Information Protection Act.

Under the Korean Personal Information Protection Act, the Korean company designates and publishes a privacy officer responsible for overseeing the handling of personal information. Privacy officer: YOO JEEWON (유지원), Chief Executive Officer. Contact: 02-717-1161 / support@istudycloud.com. You may contact the privacy officer with any questions, complaints or requests for remedies regarding personal information, and we will respond without delay.

For questions about the Canadian company's handling of personal information, and to reach the person accountable for it, contact support@istudycloud.com.

This Policy is provided in Korean, English, Japanese, Chinese (Simplified and Traditional) and Vietnamese. Every language edition carries the same version identifier and the same content. Changing the display language does not change the version of this Policy that applies or the responsible company, and the version in force when you pay is recorded on your receipt.

We may update this Policy as the Service changes. We will give notice of material changes by email or in-product notice at least 30 days before they take effect. Continuing to use the Service after the effective date means you accept the updated Policy.

Send privacy questions, access requests and complaints to support@istudycloud.com.