Skip to content

Privacy policy

This version applies during the free test run. It will be revised and announced again for the full or paid service.

Effective date: official launch date

1. Overview

Vita Language (the "Service") is an online language class site run by an individual instructor (the "operator"). This policy explains what personal information the Service collects and why, how long it is kept, who processes it on the operator's behalf, and what rights you have.

Users include minors such as high school students, and learners living in Korea and Spain. This policy was written with both the Korean Personal Information Protection Act (PIPA) and the EU General Data Protection Regulation (GDPR) in mind.

2. Information we collect

  • Sign-up and login: email address, name (the name on your Google account if you log in with Google; email link sign-ups have no name), display language, account status (waiting for approval, approved, suspended), sign-up date
  • Staying logged in and the one-device rule: login session token, browser information (user agent), time of last login
  • Applications and enrollment: course and plan applied for, the note you add (school year, level, preferred schedule and so on), the decision, access period, and notes the operator keeps to manage enrollment
  • Learning records: completed lessons, practice set and mock exam attempts (answers, scores, start and submit times), grading of written answers
  • Speaking call bookings: booking time, the name and email entered when booking, course, booking status, Google Meet link
  • Q&A board: your questions and comments, and when they were posted
  • Results and reviews (only if you agree): masked name (for example K**), course, result, year, review text. The operator enters these.
  • Generated automatically: when you visit the Service, the hosting providers may log access records (IP address, time, page requested).

We get this information through Google login (Google passes on your name and email), email login link requests, what you enter in applications and on the board, Cal.com bookings, and automatically while you use the Service.

The Service does not collect national ID numbers, payment details, postal addresses or phone numbers.

3. Why we use it

  • To identify you, log you in, approve applications and manage course access
  • To provide video lessons, grade practice sets and keep learning records
  • To run speaking calls and live classes
  • To answer Q&A questions
  • To prevent account sharing and keep the Service secure (one-device check, email shown over lesson videos)
  • To send necessary notices, such as changes to or suspension of the Service

Your information is not used for advertising or marketing emails.

4. How long we keep it

  • Account information, learning records, applications, posts and comments: kept until you close your account (ask for deletion), and deleted within 5 days of your request.
  • Login session information: replaced with a new value each time you log in, and deleted when your account is closed.
  • Speaking call bookings: when your account is closed, the operator deletes the records in the Service and the booking records in the operator's Cal.com account.
  • Results and reviews: taken down and deleted as soon as you ask or withdraw consent.
  • Access logs: the operator does not keep them separately. Logs held by the hosting providers are deleted automatically after the short period each provider sets (usually 30 days or less).
  • If the test run ends and the Service does not continue as a full service, all account information will be deleted within 30 days after the closure is announced.

There is no payment now, so no information must be kept under laws on transaction records. If payment is introduced, this policy will be updated in advance.

Electronic data is deleted so that it cannot be recovered. Copies in Service backups are removed automatically when the backup retention period ends.

5. Processors and international transfers

The following companies process personal information on the operator's behalf, or receive it when you use the related feature.

  • Supabase, Inc. (US company): database, login, and sending login link emails. Data is stored in Seoul, Korea (AWS ap-northeast-2).
  • Vercel Inc. (US company): website hosting and server functions. Server functions run in Seoul (icn1); page files may be delivered through the Vercel network location closest to you.
  • Google LLC (US): Google login (name, email), and Google Meet for speaking calls and live classes (attendee email, class time).
  • Cal.com, Inc. (US): speaking call booking. When you book, your name, email, member ID, course and booking time are sent to Cal.com and stored on its servers (in the US or elsewhere).
  • YouTube (Google LLC): lesson video playback. Videos are embedded in privacy-enhanced mode (youtube-nocookie.com); when you play a video, YouTube may process viewing information under its own policy.

Information sent abroad is transmitted over the network when you use the feature, and each company keeps it until the processing purpose ends or the operator asks for deletion, or for the period set by that company's policy.

If you do not want your information sent abroad, use an email login link instead of Google login and do not book speaking calls. In that case, you cannot use speaking calls.

6. Sharing with third parties

The operator does not sell or give your personal information to other people or companies, except when required by law through proper legal process, for example by investigative authorities.

7. Users under 14

Under Article 22-2 of the Korean PIPA, processing the personal information of a child under 14 requires consent from a parent or legal guardian. Spanish law (Article 7 of the Organic Law on Data Protection) also requires guardian consent for children under 14.

  • If you are under 14, say so in the note on your application.
  • Your parent or guardian should email the contact below with your name, the email you signed up with, their own name and contact details, and a statement that they consent.
  • The operator confirms consent through the guardian's contact details before approving the application. Without confirmed consent, the application is not approved, and the information received is deleted 30 days after the request for confirmation.
  • A parent or guardian can ask at any time to see, correct or delete the child's information, or withdraw consent.

8. Your rights

  • You can ask to see your personal information, correct it, delete it, stop its processing, or withdraw your consent.
  • You can delete your own questions and comments on the board yourself. For anything else, contact the operator below.
  • The operator will act on your request within 10 days and tell you the result. If a request cannot be met, for example because the law requires the information to be kept, you will be told why.
  • A parent or guardian can exercise these rights for a user under 14.

9. Users in the EU, including Spain

For users living in the European Union, the operator is the controller of their personal data under the GDPR.

  • Legal bases: processing needed to provide classes is based on performance of a contract (Art. 6(1)(b)); preventing account sharing and security on legitimate interests (Art. 6(1)(f)); publishing results and reviews on your consent (Art. 6(1)(a)).
  • Your rights: access, rectification, erasure, restriction of processing, objection, data portability (receiving your data in a machine-readable format), and withdrawal of consent. Requests are handled within one month.
  • International transfers: data is stored in Seoul, Korea. The Republic of Korea has an adequacy decision from the European Commission. Information sent to US companies is covered by the safeguards each company provides, such as Standard Contractual Clauses or the EU-US Data Privacy Framework.
  • Complaints: if you think your data has been handled improperly, you can complain to the data protection authority in your country. In Spain this is the Agencia Española de Protección de Datos (AEPD, www.aepd.es).

10. Cookies

The Service uses only cookies that are strictly necessary: to keep you logged in (Supabase login cookies), to check the one-device rule (vita_sid, 30 days), and to remember your display language. There are no advertising or analytics cookies.

You can block cookies in your browser settings, but you will not be able to log in.

11. Security

  • All traffic is encrypted with HTTPS.
  • The database uses row-level access control, so users can see only their own information, and only the operator can open the admin pages.
  • Admin secret keys stay on the server and are never sent to the browser.
  • The Service collects only the information it needs to run.

12. Privacy officer and contact

The privacy officer is the operator (the instructor) of the Service. Send privacy questions, requests to see or delete your information, and guardian consent to the contact below.

A contact email has not been posted yet. Enrolled students can leave a private question on their course Q&A board. Others can use the contact method given on the Notices board.

13. Help with privacy complaints in Korea

For advice or remedies regarding a privacy violation, you can contact these Korean bodies:

  • Personal Information Dispute Mediation Committee: 1833-6972, www.kopico.go.kr
  • Personal Information Infringement Report Center (KISA): 118, privacy.kisa.or.kr
  • Supreme Prosecutors' Office: 1301, www.spo.go.kr
  • Korean National Police Agency: 182, ecrm.police.go.kr

14. Changes to this policy

Changes to this policy will be announced on the Notices board at least 7 days before they take effect. Important changes, such as collecting more information or using it for new purposes, will be announced at least 30 days in advance, and consent will be asked for again where needed.