Pyeonggojae · Pyeongyejae · Pyeongeumjae · Pyeongyujae Privacy Policy
Announced: 2026-11-02 · Effective: 2026-11-09 (adds the shared account across four sites, the Pyeongyejae and Pyeongeumjae subscriptions, the Grand Pass, Goods delivery information, download records and on-device storage)
About this revision: the changes and the effective date are posted on the Service at least 7 days before they take effect. This revision replaces the Policy announced on 2026-10-30 (effective 2026-11-09).
This Policy is a translation for reference. If the Korean and English versions differ, the Korean version prevails.
Santa Croce Edu Firm (the "Operator") describes below how it processes personal information in Pyeonggojae, Pyeongyejae, Pyeongeumjae and Pyeongyujae (together, the "Service") under the Korean Personal Information Protection Act. The four sites share one member account (the Shared Account), and the Operator manages personal information in one place. A person aged 14 or older signs up as a Member and uses the Service as a reader themselves, and a Member may add children as readers on Pyeonggojae. Child Readers use the Service while the Member is logged in, on the Member's device ("Child Mode").
1. Personal Information We Process
| Category | Items |
|---|---|
| Member | Email address, display name, sign-in method (email/password or Google account identifier), timestamps of consent to the Terms, the Privacy Policy, and the age (14 or older) confirmation and legal-guardian consent |
| Reader Profile (Pyeonggojae) | Nickname and stage (we do not collect email or phone number) |
| Learning records (Pyeonggojae) | Lesson scores, time spent, number of times the Korean translation was opened, writing the reader types, answers to questions, conversations with the AI tutor Thomas |
| Subscription payments | Subscription product (Pyeonggojae, Pyeongyejae or Pyeongeumjae Subscription, Grand Pass), subscription status and period per site, payment amount and time, the payer email used to confirm the payment · we never receive card numbers or expiry dates |
| Download records (Pyeongyejae) | Number of original files downloaded each month |
| Goods orders (Pyeongyejae) | Order number, chosen product, artworks and options (such as phone model), amount and whether a discount applied, recipient's name, phone number, postal code, address and delivery request, time the made-to-order notice was confirmed, payment, production and delivery status, and the Production and Delivery Partner's order number |
| App notifications | Web push subscription, if the Member turns on app notifications on a device |
| Morning music alerts (Pyeongeumjae) | If a user turns on morning music alerts: the chosen region, the device's push address, a summary of pieces played on that device (piece and play count) and pieces sent · can be turned on without signing in; no name or email is collected, and the data is stored encrypted |
| Collected automatically | Basic access logs kept by the hosting provider (Vercel Inc.), such as IP address, access time, requested URL and browser information |
Passwords are handled by Google Firebase Authentication; the Operator does not store them in plain text.
2. Purposes
- Sign-up, sign-in and management of the Shared Account across the four sites
- Lesson progress, scoring, feedback, storage of learning records per Reader Profile, and display in "My library"
- Generating replies and feedback from the AI tutor Thomas
- Confirming subscription and Grand Pass payments, managing the period of use per site, cancellations, refunds and keeping payment records
- Checking the monthly number of Pyeongyejae original-file downloads
- Production and delivery of Goods, order status updates, and customer service for cancellations, exchanges and refunds
- Sending updates by web push to devices the user has enabled, and choosing pieces for Pyeongeumjae morning music alerts
- Service stability, error handling and prevention of misuse
3. Children Under 14
- Under Article 22-2 of the Personal Information Protection Act, the Operator obtains legal-guardian consent before processing the personal information of a child under 14. At sign-up, the Member confirms they are 14 or older and checks the item consenting, as legal guardian, to the processing of the learning records of any child under 14 they add as a reader.
- The Operator processes only the minimum information needed to provide the Service (nickname, stage and learning records). We do not ask for a child's real name, email or phone number.
- Members are asked to guide their Child Readers not to include personal information in their writing or in conversations with Thomas.
4. Retention
- Personal information is kept until the Member requests account deletion.
- After a deletion request, it is deleted within 30 days.
- The hosting provider's access logs are deleted according to that provider's retention policy.
- Where law requires retention, the information is stored separately for the required period. Under the Act on Consumer Protection in Electronic Commerce, records of contracts, withdrawals, payments and supply of goods (including subscription payments and Goods order and delivery records) are kept for 5 years, and records of consumer complaints and disputes for 3 years.
- Pyeongeumjae morning music alert information is kept until the user turns the alerts off, and is deleted then.
5. Processors and Transfers Outside Korea
The Operator entrusts processing to the following providers. Some of these providers' servers may be located outside the Republic of Korea.
| Processor | Task | Data transferred | Location |
|---|---|---|---|
| Google LLC (Firebase Authentication, Cloud Firestore) | Authentication, data storage | Member, Reader Profile, learning record, subscription, download, Goods order and notification information in Section 1 | Region set in the Firebase project configuration |
| Anthropic (Claude API) | Generating Thomas's replies and feedback | Text the reader types, lesson context (text range, questions) | Anthropic servers |
| Vercel Inc. | Website hosting | Access logs | Vercel servers |
| Groble (groble.im) | Processing subscription, Grand Pass and Goods payments and recurring payments, cancellations and refunds | Information the Member enters on Groble's checkout (name, email, phone, payment method, etc.), amount | Republic of Korea |
| Production and Delivery Partner (Marpple · Marpple Corporation) | Making and shipping Goods | Recipient's name, phone number, postal code, address and delivery request; ordered product, artworks and options | Republic of Korea |
- Timing and method: transmitted over the network when the Service is used. Goods delivery information is passed to the Production and Delivery Partner when production is ordered after the payment is confirmed.
- The Operator entrusts processing to Anthropic in accordance with Anthropic's API terms, and limits the information sent to Thomas to what is needed to generate a reply.
- If you do not want your information transferred outside Korea, you may request account deletion; in that case the Service cannot be used.
6. Provision to Third Parties
Apart from the processors in Section 5, the Operator does not provide personal information to third parties, except where required by law.
7. App Notifications
Notifications are sent by web push only to devices the user has turned on. We do not use SMS or KakaoTalk. You can turn notifications off at any time in the device or Service settings; the subscription is then deleted.
8. Rights of Data Subjects and Legal Guardians
A Member may request access to, correction of, deletion of, or suspension of processing of their own and their Child Readers' personal information, and may withdraw consent. Requests can be made through the account deletion feature or the contact email (info@santacroce.co.kr). The Operator will act without delay and inform you of the result.
9. Security Measures
We use encrypted connections (HTTPS), per-account access restrictions, minimal administrator access, no plain-text passwords, subscription and payment records that only administrators can write and only the Member and administrators can read, Goods orders that only the ordering Member and administrators can read, and encrypted storage of morning music alert information.
10. Cookies and On-Device Storage
- We use browser storage to keep you signed in and to save display settings. We do not use tracking tools for advertising.
- Paintings kept in Pyeongyejae's "My little museum", Pyeongeumjae's "My Music Diary" and play history, menu favorites and settings such as text size are stored only in your browser's storage (localStorage) on your device and are not sent to the Operator's servers. If you turn on Pyeongeumjae morning music alerts, however, a summary of pieces played (piece and play count) is stored encrypted as described in Section 1, to choose pieces for you.
- On-device information can be deleted at any time by clearing the site data in your browser, and it does not move to other devices or browsers.
11. Privacy Officer and Contact
- Operator: Santa Croce Edu Firm · Business registration number: 442-23-01819
- Address: 631-31 Sinsa-dong, Gangnam-gu, Seoul
- Privacy officer contact: info@santacroce.co.kr
For privacy complaints you may also contact the Korean Personal Information Infringement Report Center (118) or the Personal Information Dispute Mediation Committee (1833-6972).
12. Changes
We will post changes to this Policy at least 7 days before they take effect (30 days for significant changes). Payment information is processed only if the Member separately agrees on the subscription page when starting a subscription, and Goods delivery information only if the Member enters it on the order form.