Privacy Policy

ClassCanvas (the "Company") values users' personal information and complies with the Personal Information Protection Act and other related laws. Through this Privacy Policy, the Company explains for what purposes and in what ways the personal information provided by users is used, and what measures are taken to protect it.

1. Personal information collected

The Company collects the following personal information to provide the service.

- Required items: name, ID, password, mobile phone number, email address, name of affiliated academy (institution)

- For students: parent (guardian) contact details (for children under 14, including legal representative consent information)

- Information generated automatically while using the service: access logs, access IP, service usage records, attendance records

- When using payment-related services: payment records, depositor name, and other information needed to confirm payment

- When using the parent observation service: the student and class observed, observation join and leave times, observation duration, reason for ending (guardian left, disconnected, class ended, etc.), whether audio was transmitted, and a one-way transformed value used to distinguish devices (it can't be converted back to the original value). Observation records do not store the guardian's mobile phone number, IP address, or device and browser information.

- For parent observation verification: a verification code is sent by KakaoTalk message to the guardian's mobile phone number registered by the academy. The verification code is stored only in a form that can't be converted back to the original value and can't be used after 3 minutes. After verification, session information used to keep the observation active is stored on the device used (up to 12 hours).

- Parent observation records can be viewed only by the director of the academy and the lead teacher of that class.

- When submitting assignments: records of the solving process, such as time spent per page, paused time, and number of erasures

- Class reports and monthly reports: per-student summaries based on in-class participation records (question requests, presentations, live quiz responses, etc.) and attendance, test and assignment results, and comments left by teachers

- Class replay: if the lead teacher consents to audio recording, the lead teacher's class audio, board writing records from the teacher's board, recording segment information, and replay viewing records. Student audio and video are not recorded.

- Class focus level measurement (if used by the academy; excluding academies for adults): during live classes, the camera video on the student's device is analyzed only within the student's device to obtain whether a face is detected, head direction (left/right and up/down angles), and degree of eye openness, along with the resulting focus state (focused, distracted, drowsy, away) and score (recorded every 10 seconds and summarized every 5 minutes), and a per-student baseline value for eye openness. Camera video and photos are not sent to or stored on the Company's servers, and gaze (eye) tracking is not performed.

- Information sent externally when using AI features is described in 5-2 (Transfer of personal information overseas).

2. Purposes of collecting and using personal information

- Confirming intent to register, identifying and verifying users, and maintaining and managing membership

- Live classes, learning management (assignments, tests, attendance), and preventing misuse of the service

- Sending notices about classes, assignments, tests and accounts via KakaoTalk message and email

- Payment and settlement of fees for paid services

- Statistical analysis to improve the service and develop new services

- Confirming use of parent observation and handling observation-related inquiries and disputes (observation records), and verifying the identity of the observation link recipient (verification code)

- Creating class reports and monthly reports and providing them to students and guardians (including viewing links for guardians)

- Providing class replay (for review after class)

- Providing class focus level results (for teachers' and directors' learning guidance, for students to check their own results, and for guardians through monthly reports)

- Using AI to summarize assignment solving processes, analyze class focus level statistics, and draft answer sheets (assisting teachers' work)

3. Retention and use period of personal information

In principle, the Company destroys personal information without delay once the purposes of collection and use have been achieved. However, where retention is required under relevant laws, the Company keeps member information for the periods set by those laws, as follows.

- Records of contracts or withdrawal of offers: 5 years (Act on the Consumer Protection in Electronic Commerce, etc.)

- Records of payment and supply of goods: 5 years (Act on the Consumer Protection in Electronic Commerce, etc.)

- Records of consumer complaints or dispute resolution: 3 years (Act on the Consumer Protection in Electronic Commerce, etc.)

- Access records: 3 months (Protection of Communications Secrets Act)

- When a member withdraws, service data is destroyed immediately, and files uploaded to storage by students, such as assignment and test submissions, are also deleted right away (if deletion fails, they are deleted again during the next day's cleanup). Items subject to retention obligations under the laws above are kept separately for the applicable period.

- Parent observation records: kept for 1 year from the observation join date, then deleted automatically

- Class replay audio and board writing files: deleted automatically 90 days after the recording date (record rows are deleted within the following 30 days)

- Class replay viewing records: deleted automatically 1 year after the last viewing date

- In-class participation records (class events): deleted automatically after 1 year

- Guardian viewing links for class reports and monthly reports: these stop working after 30 days for class reports and 45 days for monthly reports

- Class focus level 10-second records: 7 days (after that, daily archived copies are kept for 365 days). Deleted immediately when a member withdraws; records remaining in daily archived copies are deleted during the next day's cleanup.

- Class focus level 5-minute summaries: 365 days (deleted immediately when a member withdraws)

- Per-student eye openness baseline values: destroyed when a member withdraws, and deleted automatically 1 year after the last measurement

- Pseudonymized copies of class focus level data (data altered so students can't be identified, used to improve assessment): 365 days from the date concerned (deleted during the next day's cleanup when a member withdraws)

- AI summary and analysis results: deleted together when the related assignment or class information is deleted or the member withdraws

4. Provision of personal information to third parties

In principle, the Company does not provide users' personal information to outside parties. However, the following cases are exceptions.

- When the user has given prior consent

- When required under laws and regulations, or when requested by an investigative agency for investigative purposes in accordance with the procedures and methods set by law

5. Outsourcing of personal information processing

To improve the service, the Company outsources personal information processing to the following specialized external companies.

- Cloud infrastructure and data storage: Amazon Web Services (AWS)

- Sending KakaoTalk messages: BAROBILL

- Payment processing: partner payment gateway (PG) companies (when an individual contract is signed)

- AI-based learning analysis (assignment solving summaries, class focus level statistics analysis) and assistance with writing service text (academy website introductions, academy matching recommendations): Anthropic PBC (USA) — see 5-2 for overseas transfer details

- Text recognition of answer keys (auto-filling answer sheets): DeepInfra, Inc. (USA) — see 5-2 for overseas transfer details

When entering into an outsourcing contract, the Company specifies in the contract or similar documents, in accordance with Article 26 of the Personal Information Protection Act, matters such as the prohibition on processing personal information for purposes other than performing the outsourced work, technical and administrative safeguards, restrictions on re-outsourcing, and the management and supervision of the contractor.

5-2. Overseas transfer of personal information

The Company outsources personal information processing to the companies in [1] and [2] below, and as a result, personal information is transferred overseas (Article 28-8(1)(3) of the Personal Information Protection Act).

[1] Anthropic PBC

A. Recipient: Anthropic PBC

- Country: United States

- Contact: privacy@anthropic.com, 548 Market St, PMB 90375, San Francisco, CA 94104, United States

B. Personal information transferred

- Assignment work summary: screen images of the assignment pages submitted by the student (questions and the student's handwriting, up to 3 pages), and per-page solving time, idle time and number of erasures

※ Student names, IDs and academy names are not sent. However, anything the student writes directly on the assignment sheet may appear in the images.

- Class focus level statistics analysis: focus level statistics by day of the week and time slot, aggregated per class (no information that can identify individual students is sent)

- Academy website copywriting: introductory information entered by the academy (teacher), such as the academy name, teacher names, teacher profiles, and subjects and curriculum

- Academy matching recommendations: the request the user writes directly in the matching application (free text), and profile information of candidate academies and teachers

C. Date, time and method of transfer

- Timing: each time the relevant feature runs (right after an assignment is submitted, when statistics are compiled early every Monday morning, when a website creation is requested, and when matching recommendations are made)

- Method: sent to the Anthropic API over encrypted communication (HTTPS)

D. Recipient's purpose of use

- Writing summaries and analyses so that teachers can quickly understand how students worked through assignments (where they got stuck) and trends in class focus levels

- Drafting academy website introductions, and ranking recommended academies based on the details of matching applications

※ Anthropic does not use information received through its API to train its AI models.

E. Retention and use period

- Anthropic: deleted within 30 days of receipt (up to 2 years if a review for usage policy violations is needed, or for the period required by law if there is a legal retention obligation)

- Results received by the Company are stored within the Company's service and destroyed together with the related assignment or class information when it is deleted, or when the member withdraws.

F. How to refuse the transfer and consequences of refusal

- Assignment work summary and class focus level statistics analysis: academies can turn these off at any time in the Director menu of Learning management under "AI & data settings". Students and parents can refuse through their academy or customer support (classcanvas.live@gmail.com).

- Academy website copywriting and academy matching recommendations: you can make a request to customer support (classcanvas.live@gmail.com).

- If you refuse, personal information is not transferred overseas for the relevant feature. You can still use basic services such as submitting assignments and attending classes; only the AI summaries, analyses and recommendations will not be provided.

[2] DeepInfra, Inc.

A. Recipient: DeepInfra, Inc.

- Country: United States

- Contact: 2625 Middlefield Road #460, Palo Alto, CA 94306, United States

B. Personal information transferred

- Answer sheet auto-fill: page images of the answer key file uploaded by the teacher (academy) (up to 6 pages)

※ No student information is sent. If a teacher's or academy's name is printed on the answer key, it may appear in the images.

C. Date, time and method of transfer

- Timing: when a teacher requests answer sheet auto-fill on the test registration screen

- Method: sent to the DeepInfra API over encrypted communication (HTTPS)

D. Recipient's purpose of use

- Drafting answer sheets by recognizing (transcribing) the text in answer keys

※ DeepInfra does not use information received through its API for model training.

E. Retention and use period

- DeepInfra: kept in memory only during processing and not stored; results are deleted immediately after delivery

- The Company keeps the original answer key only in a temporary folder on its server and deletes it when the task is complete (within 24 hours at the latest).

F. How to refuse the transfer and consequences of refusal

- Academies can turn this off at any time in the Director menu of Learning management under "AI & data settings".

- Even if it is turned off, tests can still be registered by entering the answer sheet manually or by pasting the correct answers in a single line.

6. Personal information of children under 14

As a rule, the Company obtains the consent of a legal guardian when collecting personal information from children under the age of 14. When a child signs up through an academy (institution), the academy (institution), as a rule, confirms the consent of the parent (legal guardian) before providing the information to the Company.

7. User rights and how to exercise them

Users may view or edit their registered personal information and request account termination at any time. To view, edit or delete personal information, you can make a request through the features in the service or through the contact details below.

8. Procedure and method for destroying personal information

Once the purpose of collecting and using personal information has been achieved, the Company destroys the information without delay. Information in electronic file form is deleted using technical methods that make the records unrecoverable, and personal information printed on paper is destroyed by shredding or incineration.

Previous copies that remain in storage so that accidentally deleted data can be restored are kept for up to 30 days for academy data such as assignments and tests, and for class board and class report records, and for up to 90 days for other data such as class videos and past lesson plans, after which they are permanently deleted. When a test is deleted, it is moved to an archive and kept there to preserve the test results.

9. Use of cookies

The Company may use cookies to provide customized services to users, for purposes such as keeping users logged in. Users can refuse to store cookies through their web browser settings, but in this case they may have difficulty using services that require logging in.

When you access the service through a parent observation link, a session cookie is stored to maintain the observation (up to 12 hours, used only for the observation feature).

10. Chief privacy officer

The Company has designated a chief privacy officer as follows, who is in overall charge of personal information processing and handles user complaints and remedies for damages related to personal information processing.

- Name: 홍기선

- Phone: 010-8968-4631

- Email: classcanvas.live@gmail.com

11. Duty to notify

This Privacy Policy may be supplemented, reduced or amended due to changes in laws, policies or security technology. Any changes will be announced on the service screen with the effective date specified.

Effective date: October 28, 2026

Revision history

- October 28, 2026: Added overseas transfer for AI features (5-2); added outsourced companies (Section 5); added collected items, purposes and retention periods related to class reports, class replays and monthly reports (Sections 1, 2 and 3); listed class focus level measurement items (previously omitted processing, Sections 1, 2 and 3); stated when storage files are deleted and how long recovery copies are kept (Sections 3 and 8)

- October 17, 2026: Added items related to parent observation (Sections 1, 2, 3 and 9) — View previous version