개인정보 처리방침

Reading the last seven days of lessons, downloading their PDFs, and browsing the pattern and vocabulary pages require no account and no personal data. We only collect personal data when you register an account or subscribe.

• —Account data. Your email address; if you sign in with Google, also the name Google provides.
• —Subscription and payment records. Plan, subscription status, service period, amount, payment time, and the last four digits and expiry of the card. We do not store the full card number or the security code.
• —Attribution data. The UTM parameters, referral code, referring URL and landing page from your first visit, used to measure advertising.
• —Download records. When a lesson was downloaded and which issue it was, plus a hashed IP address (not reversible to the original), used to detect abnormal bulk downloading.
• —Newsletter list. The email address you enter yourself, and the attribution data at that moment.
• —Technical data. Browser and device type, pages visited and when (via analytics — see section 5).

We do not collect the special categories of personal data defined in article 6 of the Personal Data Protection Act.

As required by article 8 of the Personal Data Protection Act:

• —Purpose. Providing the learning service; account verification and management; subscriptions and collecting payment; issuing invoices; customer service; sending the newsletter; measuring marketing; preventing abuse and abnormal use.
• —Period. For as long as the account exists. After the account is deleted, data is removed within a reasonable period, except where the law requires retention (tax vouchers, transaction records). See section 7.
• —Territory. Within the Republic of China (Taiwan), and wherever the servers of the providers in section 4 are located. In particular, PayPal’s payment processing involves international transfer of personal data (Singapore, the United States and elsewhere); choosing to pay by PayPal means consenting to the transfer necessary to complete that transaction. Other providers’ servers may also sit outside Taiwan.
• —Recipients. Us, and the providers we engage or work with as listed in section 4.
• —Method. Collected, processed and used electronically through this website.

We use the following third parties to run the service. Each has its own privacy policy covering the data it receives.

• —Supabase (cloud database and authentication): stores accounts, subscriptions and payment records.
• —Google (third-party sign-in): receives your email and name only if you choose to sign in with Google.
• —PayPal (PayPal Pte. Ltd., payment processing): handles authorisation and recurring charges on the PayPal route. We receive only the subscription identifier, amount, currency and payment time. The account, password and card details you enter at PayPal never pass through this website.
• —LINE Pay (LINE Biz Plus Taiwan, payment processing): handles payments on the LINE Pay route. We receive only the transaction identifier, amount and payment time. The account and payment details you enter at LINE Pay never pass through this website.
• —HiTRUST Inc. (payment processing): handles local card authorisation and recurring charges.
• —Whaleny Technology Co., Ltd. (invoicing): issues and delivers electronic invoices.
• —Google Analytics 4 and Meta Pixel (traffic and advertising measurement): see section 5.
• —Resend (newsletter delivery): receives only the recipient address and the message content.

Lesson audio is generated by a text-to-speech service. That service processes only the lesson text and never handles your personal data.

• —Essential cookies. Needed to keep you signed in. They cannot be turned off; without them you cannot sign in.
• —Analytics and advertising cookies. Used to measure traffic and advertising. This site uses Google Consent Mode v2 and defaults to denied — these only switch on if you choose “Accept” on the consent banner.

You can withdraw consent at any time by clearing this site’s data in your browser; the banner will then appear again.

Under article 3 of the Personal Data Protection Act, you may exercise the following rights over the personal data we hold:

• —enquire about it or ask to review it
• —ask for a copy
• —ask for it to be supplemented or corrected
• —ask us to stop collecting, processing or using it
• —ask for it to be deleted

Your account, subscription and payment records are visible directly on the account page. For anything else, write to brikkorean@pineryn.com; we reply within five days of receiving the request.

You may choose not to provide personal data, but then you cannot register an account or subscribe. Use of the free plan is unaffected.

• —Account data: deleted when the account is deleted.
• —Transaction and invoice vouchers: kept for five years under the Business Entity Accounting Act and tax law.
• —Download records: deleted after 12 months; the IP is stored only as a hash.
• —Newsletter list: deleted when you unsubscribe; we keep a record of the unsubscribe so we don’t email you again.

We protect your data with encryption in transit throughout (HTTPS), access control at the database layer (row-level security, so a user can only reach their own rows), by not storing passwords or full card numbers, and by serving paid content through short-lived signed URLs.

No transmission over the internet can be guaranteed absolutely secure. If a data breach occurs, we will investigate and notify you appropriately, as article 12 of the Personal Data Protection Act requires.

The service is not directed at children. Anyone under 18 needs their legal guardian’s consent to use the paid features. If we learn we have collected a minor’s data without that consent, we delete it.

When we revise this policy we update the date at the top of the page. Significant changes are also announced by email or on the site.

Data protection contact: brikkorean@pineryn.com

Pineryn Co., Ltd., 2F, No. 195, Qingsong St., Zhongli Dist., Taoyuan City, Taiwan