Privacy Policy

Nomadiq ("we", "us", or the "Company") operates study.nurio.kr and its related mobile applications ("nurio study"). We process personal information in accordance with Korea's Personal Information Protection Act (PIPA) and other applicable laws. This policy explains our purposes, data categories, retention, sharing, processors, international transfers, and your rights. Using the service is not treated as blanket consent for optional processing; where consent is required, we provide a separate notice and obtain it.

1. Controller and Privacy Contact

Controller: Nomadiq
Representative / privacy officer: Eunseok Kang
Address: 77 Doandong-ro, Seo-gu, Daejeon, Republic of Korea, Apt. 1812-1602
Privacy contact: hello@nurio.kr · +82 10-3643-5451

2. Why We Process Information, What We Process, and How Long We Keep It

Purpose	Data	Retention
Registration, sign-in, and account administration	Email, name or display name, profile image, social sign-in provider, unique identifier, and authentication token	Until account withdrawal or the purpose is fulfilled
Study application, level confirmation, matching, and operations	Language, level, goal, delivery mode, region, availability, preferred start date, application note, assignment, participation, attendance, and session-use records	Until withdrawal or the purpose is fulfilled; legally required records are kept separately for the applicable period
Optional placement assessment and consultation	Written response, voice file and transcript, assessment result and feedback, contact details, consultation preference, IP address, and session identifier	Until assessment, consultation, or matching is complete; guest assessment data is promptly destroyed when its purpose is complete
Group communication and safe operation	Group/direct-message content, sent time, read state, reports, and operational action records	Until the room purpose ends or withdrawal; minimum records necessary for a dispute or safety response may be retained separately
Payment, recurring billing, refund, and accounting	Order/payment identifiers, amount, date, status, limited payment-method information (card brand, last four digits, expiry), payment token, and billing history	Five years for contract/withdrawal and payment/supply records; three years for consumer complaints/disputes under Korean e-commerce law
Security, fraud prevention, and notices	Device/browser information, access log and IP address, cookies/session data, push token, and delivery preferences	Until the purpose is fulfilled or for the period required by applicable law and internal security standards
Marketing communications (optional)	Email/push token and consent status and time	Until consent is withdrawn or the account is closed

We process information where permitted by law or necessary to perform a contract. You can use the core service without optional fields or optional features where doing so does not prevent the core service from operating.

3. Disclosure to Others

We do not sell or disclose personal information to outside parties as a rule. The following information is visible to other users or your assigned leader because group learning requires shared participation.

Recipient	Data	Purpose and period
Your assigned Study leader and participants in the same Study group	Display name, profile image, language level/group participation status, and content you post in the group room	Group operations and learning communication, for the group participation or room-operation period

We may also disclose information where required by law or a valid request from a competent authority, following the applicable legal procedure and scope.

4. Processors and International Transfers

We use the following processors and transfer information internationally only as needed to operate the service or when you use the relevant feature. We contractually require processors to limit use to the agreed purpose, restrict onward processing, apply safeguards, and delete information when the processing ends.

Processor / recipient	Service and data	Country, time, and method	Retention
PortOne Corp. (Korea)	Payment, recurring billing, and refund processing; order/payment identifiers and information needed for payment	Korea, upon payment request over encrypted transmission	For payment processing and the statutory retention period
Brevo SAS (France)	Email delivery; email address and delivery status	France, when an email is sent over encrypted transmission	Until delivery is complete or the processor contract ends
Google LLC (United States)	Firebase push notifications; device token and notification title/body needed for delivery	United States, when a push is sent over encrypted transmission	Until delivery is complete or the token is deleted
Google LLC and OpenAI OpCo, LLC (United States)	AI learning and placement features you choose to use; input text, voice file or transcript, and context necessary for assessment	United States, when the feature runs over encrypted transmission	Until the assessment/response is complete or for the period in the processor policy and our processor agreement
Microsoft (Azure AI Speech)	When enabled, English pronunciation assessment; learner audio limited to 30 seconds and a server-generated or server-held reference transcript	Processing location of the configured Azure Speech resource (not fixed in the application), transferred over encryption when pronunciation assessment runs	Under the applicable Microsoft Azure Speech service processing terms and configuration
Slack Technologies, LLC (United States)	Operational alerts; minimum account, application, payment, consultation-status, and contact data needed for operations	United States, when an operational alert is generated over encrypted transmission	Until the operational check is complete or the processor contract ends

International transfers are made under the legal bases and procedures required by Article 28-8 of PIPA. You may refuse an international transfer, but a feature that necessarily uses that processor (for example, push notifications or AI assessment/learning) may not be available.

5. Destruction

When the retention period ends or the purpose is fulfilled, we destroy personal information without delay. Information required by law is stored separately. Electronic files are deleted using a method that prevents recovery; paper records are shredded or incinerated.

6. Your Rights and How to Exercise Them

You may request access, correction, deletion, suspension of processing, or withdrawal of consent. You can update account information and communication preferences in the service settings. For another request, email hello@nurio.kr with only the minimum information needed to verify your identity. We respond within the statutory period and explain any lawful restriction and appeal method. We process information of children under 14 only after confirming consent from a legal representative.

7. Cookies and Similar Technologies

We use cookies and session information for sign-in, security, and service delivery. You can refuse or delete cookies in your browser settings, although some functions, such as staying signed in, may not work properly.

8. Safeguards

We use access-control management, encryption in transit, encrypted storage for protected fields, access-log management, security software and vulnerability checks, and privacy training for personnel. To prevent misuse, we may limit public details of our security controls.

9. Complaints and Remedies

For a privacy complaint or consultation, you may contact the Korea Internet & Security Agency Privacy Infringement Report Center (privacy.kisa.or.kr, 118 in Korea), the Personal Information Dispute Mediation Committee (kopico.go.kr, 1833-6972), the Supreme Prosecutors' Office (1301), or the National Police Agency (182).

10. Changes to This Policy

We will post additions, deletions, or changes on this page or through a service notice at least seven days before they take effect. For changes that materially affect your rights, we will provide notice at least 30 days in advance where practicable.