Privacy Policy
Effective date October 17, 2026 · 에어랩창의융합교육원
에어랩창의융합교육원 (the "Operator") operates AirReading (에어리딩), a reading-education service (airreading.kr · app.airreading.kr · manage.airreading.kr and related apps; the "Service"). Pursuant to Article 30 of the Personal Information Protection Act (PIPA), the Operator discloses in this Policy how personal information is processed in the Service.
The Service was formerly called 「리드온」 (ReadOn). Any reference to 「리드온」 that remains on consent screens or elsewhere refers to this Service.
Article 1 (Operator and Users)
The Operator publishes this Policy as the personal information controller of the personal information processed in the Service. The Service is used by the following persons:
- Learners — students who attend an academy and take classes through the Service. A learning account is issued by the learner's academy or, when a guardian submits an application for use, activated by that academy after it confirms the application.
- Academy directors and teachers — use accounts for academy work.
- Headquarters, distributor and branch staff — use accounts for academy management work. Headquarters is the Operator.
- Directors (representatives) who apply to register an academy — apply on the academy recruitment page (airreading.kr/academy/).
- Visitors — persons who view the introduction page and the academy and branch recruitment pages.
Work accounts are issued by the Operator or by an administrator to whom the Operator has granted authority. There is no way for users to create an account themselves. The academy a learner attends (the "Affiliated Academy") views its own students' information and learning records within the Service to the extent necessary to run classes (Article 5).
Article 2 (Purposes of Processing)
The Operator processes personal information only for the following purposes. If a purpose changes, the Operator will notify users in advance and obtain any necessary consent.
| Purpose | Details |
|---|---|
| Receiving applications for use | Receiving applications, forwarding them to the academy applied to, contacting guardians, activating learning accounts |
| Receiving academy applications | Reviewing applications, notifying results, contacting applicants for adoption consultations |
| Account management | Issuing accounts, login and identity verification, Sign in with Google, suspending accounts and reissuing passwords, preventing fraudulent use |
| Providing the learning service | Providing textbooks, writing and submitting activities, live classes and class sharing, teacher feedback, evaluation rubrics and overall learning reviews, AI features |
| Supporting academy operations | Managing classes and rosters, tallying attendance, billing and settling service fees |
| Academy and partner management work | Managing academies, recording adoption consultations, internal mail, bulletin boards and reports, records of training and site inspection visits |
| Service improvement and safety | Visit statistics, checking errors and responding to outages, responding to security incidents, proof of consent |
Article 3 (Personal Information Processed and Methods of Collection)
| Category | Items | Method of collection |
|---|---|---|
| Application for use | Student's name, grade and school name; guardian's mobile phone number | Entered on the application page |
| Learning account | Name, grade, Affiliated Academy and class, student number assigned by the academy (if any), login ID, password, email address (if entered by the academy at registration) | Created from the application or registered by the Affiliated Academy |
| Learning records | Answers, writing, concept maps, debate positions and arguments, plans, submission status, teacher feedback, evaluation rubrics and overall learning reviews, exchanges with the AI assistant, class participation records (attendance, progress stage, hand-raising, last access) | Generated while using the Service |
| Consent records | Consent or refusal for each consent item, version and unique value (hash) of the consent text, date and time of consent, IP address, browser information | Generated at the time of consent |
| Academy application | Director's (representative's) name, mobile phone number, email address, academy name, region (province or metropolitan city; city, county or district), range of enrolled students, message (optional) | Application form on the academy recruitment page |
| Academy director and teacher accounts | Name, login ID (an email address for academy directors; an ID set by the academy for teachers), password, affiliated academy and class, contact email address (if entered by the academy) | Academy directors are invited by the Operator and set their own password; teachers are registered by the academy |
| Headquarters, distributor and branch staff accounts | Name, ID (also used as the company email address), password, contact email address (the address the invitation was sent to), affiliation, profile photo (optional) | Invited by the Operator or an administrator granted authority, and the users set their own ID and password; photos are uploaded by the users themselves |
| Google account link (optional) | Google account unique ID, Google email address | Received from Google when a user links a Google account on the invitation acceptance screen or in My account (Article 9) |
| Academy information | Academy name, contact person's email address and phone number, academy director's name and email address, address and map coordinates, contract period | Entered when the academy is registered |
| Distributor and branch information | Company name; contact person's name, phone number and email address | Entered by the Operator |
| Adoption consultation records | Academy name and address; director's name, phone number and email address; details of the consultation | Entered by headquarters, distributor or branch staff during consultations |
| Billing and settlement | Names of the students subject to billing at each academy, the dates on which they became subject to billing and ceased to be subject to billing, billed amounts | Calculated from rosters and attendance |
| Internal work | Internal mail and attachments (between headquarters, distributor and branch staff), bulletin board posts, reports, training records, site inspection records | Generated while using the management console |
| Automatically generated information | Access IP address, access date and time, browser information, management console change logs (who, when, which function, result, IP), cookie and browser storage values (Article 13), AI feature usage records | Generated automatically while using the Service |
The Operator does not collect unique identification information such as resident registration numbers, or sensitive information such as information on health or ideology. Service fees are billed to academies, and the Operator does not collect payment information such as card numbers.
Article 4 (Retention Period and Destruction)
The Operator retains personal information only for the period necessary for the purposes of processing. Upon withdrawal of membership, termination of a contract or a request from the data subject, the Operator destroys the personal information without delay; information that laws require to be kept is stored separately only for the period so required.
| Personal information | Retention period |
|---|---|
| Learning account information and learning records | While the account is in use. Destroyed without delay upon withdrawal of membership, termination of the service agreement between the academy and the Operator, or a deletion request from the learner or guardian |
| Application details and consent records | For as long as necessary to process the application and to prove that consent was obtained |
| Academy applications | For as long as necessary to review the application and consult on adoption. If approved, transferred to the academy's contact information and kept for the term of the service agreement |
| Academy director, teacher and staff accounts | Until the account is deleted upon resignation or termination of the contract |
| Contact information of academies, distributors and branches; adoption consultation records | For as long as necessary for the service agreement and consultation work |
| Billing and settlement records | The term of the service agreement. If tax laws or other laws require retention, for the period so required |
| Google account link information | Until the link is removed or the account is deleted |
| Login persistence information | 14 days. Invalidated immediately upon logout |
| Failed login records | Up to 10 minutes |
| Live class connection status | Erased within a few hours after the class ends |
Method of destruction
- Electronic files are deleted from databases and storage.
- Deleted information may remain in database backup copies for some time. Backup copies are used only for disaster recovery and are not opened for any other purpose.
- Information retained pursuant to laws is kept separately from other information and used only for that purpose.
Article 6 (Entrustment of Processing)
To operate the Service, the Operator entrusts the following work.
| Entrustee | Entrusted work | Place of processing |
|---|---|---|
| Amazon Web Services | Operating servers and databases (Amazon Lightsail); storing textbook files and database backups (Amazon S3) | Republic of Korea (Seoul Region) |
| Kakao Corp. (주식회사 카카오) | Address search in the management console (Kakao Postcode Service); converting academy addresses into map coordinates (Kakao Local API) | Republic of Korea |
Work processed overseas is described in Article 7. If the entrustee or the entrusted work changes, the Operator will revise this Policy and give notice.
Article 7 (Overseas Transfer)
To the extent necessary to provide the Service, the Operator transfers personal information overseas as follows, and discloses the details in this Policy pursuant to Article 28-8 of the Personal Information Protection Act. All transmissions are made over encrypted communication (HTTPS).
| Recipient (contact) | Country | Items transferred | Purpose | Timing and method | Retention period |
|---|---|---|---|---|---|
| OpenAI, L.L.C. (Privacy Policy) | United States | Writing that learners produce in activities (answers, arguments, concept-map words, questions asked to the AI assistant) and textbook content. Names, IDs, student numbers and contact details are not attached | Generating the AI assistant's questions and feedback, draft overall learning reviews, class debate summaries and concept-map summaries | Sent via API each time an AI feature runs | In accordance with OpenAI's API data policy (data received through the API is not used for model training and is kept for up to 30 days for abuse monitoring) |
| Google LLC (Privacy Policy) | United States | Addresses of the pages visited, date and time of visits, device and browser information, IP address, cookie identifiers | Visit statistics (Google Tag Manager, Google Analytics) | Sent when the introduction page, the recruitment pages and the learning app screens are opened | In accordance with the Google Analytics retention settings |
How to refuse and the consequences of refusal
- OpenAI — Teachers can turn off the AI assistant for each class. If you do not want the transfer, please notify the Affiliated Academy or the Privacy Officer (Article 14). In that case, you will not be able to receive AI feedback or draft overall learning reviews, but you can continue to use the other learning features.
- Google — You can block cookies or Google Analytics collection by the methods described in Article 13. This does not affect your use of the Service.
Article 8 (Personal Information of Children Under 14)
Most learners using the Service are elementary, middle and high school students. The Operator processes the personal information of children under the age of 14 as follows.
- Consent of the legal representative is obtained. Applications for use are made by guardians. On the application page, the Operator obtains consent to the collection and use of the guardian's and the student's personal information, and collects the guardian's mobile phone number in order to contact the guardian.
- The account opens after the academy confirms it. When an application is received, a staff member of the Affiliated Academy contacts the guardian. The learning account cannot be used to log in until the academy activates it.
- The same applies when an academy registers students directly. The Affiliated Academy must register accounts only for students whose guardians have given consent.
- Only the necessary information is collected. At the application stage, only the student's name, grade and school name and the guardian's mobile phone number are collected.
- The legal representative exercises the rights. Guardians may request access to, correction, deletion and suspension of processing of the child's information, and may withdraw consent (Article 11).
Article 9 (Sign in with Google)
Users may, if they wish, sign in to AirReading with a Google account. The information the Operator receives from Google and how it is used are as follows.
| Category | Details |
|---|---|
| Where it is used | Used only to sign in to an AirReading account that has already been issued, and to link a Google account to that account. Google sign-in does not create new accounts. |
| When sign-in is allowed | Sign-in is allowed only with a Google account that has been linked in 「내 계정」 (My account) of the management console (manage.airreading.kr), or with a Google account whose Google-verified email address is the same as the email address of the AirReading account. |
| Information received | The Operator requests the openid, email and profile scopes from Google. Of the information received, only the Google account unique ID (sub), the email address and whether the email address is verified are used to confirm sign-in. Profile information such as the name and profile photo is neither stored nor used. |
| Information stored | When a user links a Google account in 「내 계정」 (My account), the Operator stores the Google account unique ID and the Google email address. When a user signs in because the email addresses match, no Google information is stored separately. Tokens sent by Google are used only to verify their authenticity with Google's public keys or Google's verification server, and are not stored. |
| No sharing | Information received from Google is not sold or provided to anyone else, and is not used for advertising. It is not used to train AI models and is not sent to the AI features (OpenAI). |
| Storage location | Stored on the Operator's servers in the Amazon Web Services Seoul Region (ap-northeast-2), Republic of Korea (Articles 6 and 12). |
| Limited Use | AirReading's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. |
| Retention period | Until the link is removed or the AirReading account is deleted |
| Unlinking and deletion | Pressing 「연결 해제」 (Unlink) in the Google account field of 「내 계정」 (My account) in the management console immediately deletes the stored Google account unique ID and email address. If the account email address and the Google email address are the same, the user can still sign in with that Google account after unlinking. Users may also ask the Privacy Officer (Article 14) to delete the stored Google information, or revoke the permissions granted to AirReading in their Google Account settings (myaccount.google.com). |
Article 10 (AI Features)
- The AI features of the Service are the AI assistant's questions and feedback, draft overall learning reviews, class debate summaries and concept-map summaries. Results produced by AI are reference material and may be wrong.
- Overall learning reviews are checked and finalized by teachers. Results produced by AI are not grades.
- The Operator does not make decisions that materially affect the rights or obligations of data subjects by AI alone.
- The Operator does not use learning records to train AI models and does not process pseudonymized information.
- For cost management, the Operator keeps records of AI feature use (feature, time, amount of usage, account and academy numbers). These records do not contain the content of any writing.
- Information that is transferred overseas because of AI features is described in Article 7.
Article 11 (Rights of Data Subjects and Legal Representatives)
Data subjects may at any time make the following requests with respect to their personal information. For the information of a child under the age of 14, the legal representative (guardian) may make the requests.
- Access
- Correction of inaccurate information
- Deletion (including withdrawal of membership)
- Suspension of processing
- Withdrawal of consent
Requests may be made to the Privacy Officer (Article 14) by phone or in writing. Learners and guardians may also make requests through the Affiliated Academy. After verifying that the requester is the data subject or a duly authorized representative, the Operator will process the request within 10 days and notify the result. If the Operator refuses or defers a request pursuant to laws, it will notify the reason.
Some actions can be taken directly in the Service.
- Change password — 「마이페이지」 (My Page) in the learning app; 「내 계정」 (My account) in the management console
- Unlink a Google account — 「내 계정」 (My account) in the management console
- Delete a profile photo — 「내 계정」 (My account) in the management console
Article 12 (Measures to Ensure Safety)
The Operator takes the following measures pursuant to Article 29 of the Personal Information Protection Act.
Administrative measures
- The Operator limits the persons who handle personal information to those who need it for their work, and divides the scope of information that can be viewed according to role.
Technical measures
- Academies can view only their own academy's information, and distributors and branches only the information of the academies in their charge. Accounts outside that scope are not retrieved.
- The management console masks names, contact details and student numbers with asterisks according to the viewer's role.
- Passwords are converted by an irreversible method (BCrypt) before being stored.
- All communications are encrypted with TLS 1.2 or higher.
- If login fails several times within a short period, login is blocked for a while.
- The login persistence cookie is set so that it cannot be read by JavaScript, and login tokens are renewed every 60 minutes.
- When information is changed in the management console, the Operator records who used which function, when, and with what result, together with the access IP.
- Databases are not exposed directly to the internet.
- Public access to textbook and backup storage is blocked, and servers are granted only the minimum necessary permissions.
- Databases are backed up regularly.
- Email addresses, phone numbers and authentication tokens are masked in error notifications.
Physical measures
- Servers and storage are located in data centers in the Amazon Web Services Seoul Region.
Article 14 (Privacy Officer)
| Category | Details |
|---|---|
| Privacy Officer | 박호석 (Representative) |
| Phone | 010-6330-6627 |
| In writing | 경기도 부천시 오정구 상오정로 64-1, 제비동 3층 301호(오정동, 성원골드스테이츠), Attn: Privacy Officer, 에어랩창의융합교육원 |
The Privacy Officer personally receives inquiries, complaints and requests for remedies relating to the processing of personal information, as well as requests for access, and will respond to and handle them without delay.
Article 15 (Remedies for Infringement of Rights)
If you need counseling or dispute resolution regarding an infringement of personal information, you may contact the following organizations.
- Personal Information Dispute Mediation Committee (개인정보분쟁조정위원회): 1833-6972 (no area code), www.kopico.go.kr
- Personal Information Infringement Report Center (개인정보침해신고센터): 118 (no area code), privacy.kisa.or.kr
- Supreme Prosecutors' Office (대검찰청): 1301 (no area code), www.spo.go.kr
- Korean National Police Agency (경찰청): 182 (no area code), ecrm.police.go.kr
Article 16 (Changes to this Policy)
If this Policy is changed, the Operator will give notice on this page and through Service notices from 7 days before the change takes effect. If important matters such as the items collected, the purposes of use or provision to third parties change, notice will be given from 30 days before. Changes are recorded in the revision history below.
Addendum
This Policy takes effect on October 17, 2026.
Operator: 에어랩창의융합교육원 · Representative 박호석 · Business registration no. 872-97-00313 · 경기도 부천시 오정구 상오정로 64-1, 제비동 3층 301호(오정동, 성원골드스테이츠) · Contact 010-6330-6627
Revision history
| Effective date | Changes |
|---|---|
| October 17, 2026 | First published · English summary of Google user data added · Personal information removed from work notifications (Discord), and Discord removed from the overseas transfer table |