Semestree 로고SemestreeBack

Privacy Policy

Effective date: 2026-08-05

Semestree (the “Service”) values your privacy and complies with the Korean Personal Information Protection Act and related laws. This policy explains what personal data we collect, why, and how we protect it.

The Service is currently a beta (trial) version: automatic analysis and AI processing of your uploaded materials may be inaccurate, may be used to improve the Service, and data may be lost during the beta period. See the beta service clause in the Terms of Service for details.

1. Information we collect

  • Required: email address, name (nickname), password (stored encrypted)
  • If you sign in or sign up with a Google account: instead of a password, we receive your email address, name, Google account identifier, and email-verified status from Google to create the account. Your Google password is entered on Google’s own screen and is never sent to or stored by the Service.See “4. Processing entrustment & overseas transfer” below.
  • Optional: school, student ID, major, year, referral code
  • Study materials you upload (syllabus / lecture files and their extracted text)
  • If you use LMS notification-email forwarding (optional): the sender address, subject, received time, and sender-authentication results of mail received at the forwarding address issued to you, schedule-related excerpts, and the original mail file (kept briefly). See “5. LMS notification-email forwarding” below.
  • Automatically collected: IP address, device/browser info, usage logs, the address and title of the pages you visit, and cookie / local-storage identifiers used for advertising measurement. See “10. Cookies and other automatic collection tools, and how to refuse them” below for details and opt-out.
  • For paid subscriptions: payment records (date, amount, plan, order ID) and a billing key identifying your payment method. Card numbers and expiry dates are handled by our payment processor and are never collected or stored by the Service.

2. Purpose of use

  • Account signup, verification, management, and login
  • Providing features: auto-sorting, summaries, quizzes, AI tutor for your materials
  • If you use LMS email forwarding: detecting course-schedule changes (cancellations, exams, rooms, deadlines) in LMS notification mail and proposing them to you
  • Service improvement, error and abuse response, customer support
  • Processing subscription payments, recurring renewals, and refunds; keeping transaction records
  • Advertising performance (conversion) measurement and remarketing — measuring whether a visit that came from an ad click led to an actual signup, and building remarketing audiences from visit history

3. Retention and deletion

Data is deleted without delay upon account withdrawal, except where retention is required by law. Uploaded study materials are deleted when you delete them or withdraw.

Korean e-commerce law requires us to retain the following even after withdrawal:

  • Records of contracts and withdrawal of subscription: 5 years
  • Records of payment and supply of goods/services: 5 years
  • Records of consumer complaints and dispute resolution: 3 years
  • Access logs under the Protection of Communications Secrets Act: 3 months

Only where such records exist do we keep account information to identify whom they belong to. In that case the account is kept in an anonymized state with every identifying field removed — name, email, social account identifier, school, student number — and it is destroyed together with those records once the retention period ends. If there is nothing to retain, the account record itself is destroyed immediately.

When you cancel a subscription, the stored billing key is destroyed without delay and the cancellation is reflected with the payment processor.

Original mail files received through LMS email forwarding are kept only briefly, independently of the periods above, and destroyed automatically — see “5. LMS notification-email forwarding” for the exact windows and immediate-destruction cases.

4. Processing entrustment & overseas transfer

To operate the Service, we entrust processing to the following:

  • Amazon Web Services (Seoul region, Korea): servers, database, file storage (hosting/infrastructure); mail receiving and short-term storage of originals (Amazon SES / S3) if you use LMS email forwarding
  • OpenAI (USA): AI processing (summaries, quizzes, tutor) based on your uploaded material text; and, if you use LMS email forwarding, extraction of schedule changes from the mail subject and body excerpt
  • Toss Payments Co., Ltd. (Korea): subscription payment processing, recurring charges, refunds
  • KakaoPay Corp. (Korea): subscription payment processing, recurring charges and cancellation — only when you choose KakaoPay as your payment method
  • Google LLC (USA): advertising performance (conversion) measurement and remarketing; verification of the sign-in token when you use Google account sign-in

Of these, OpenAI (USA) and Google LLC (USA) involve an overseas transfer. In both cases the transfer is made over the network.

  • OpenAI (USA) — items transferred: the study-material text needed for AI processing and, if you use LMS email forwarding, the subject and body excerpt of that mail. When: at the time you use those features (for forwarded mail, when it arrives).
  • Google LLC (USA) — advertising: items transferred: ad-click and cookie identifiers, IP address, browser and device information (including screen size), the address and title of the page you visit, and the address of the previous (referring) page. When: each time you open a web page of the Service. Account information such as your name and email, and the study materials you upload, are not transferred.
  • Google LLC (USA) — sign-in: applies only if you use Google account sign-in. Items transferred: the sign-in token issued by Google (which contains your email address, name, and Google account identifier), plus your IP address and browser information. When: when the sign-in page loads and shows the Google sign-in button, and when you sign in with it. We also query Google once more to confirm the token we received is genuine. If you sign up and sign in with an email address, this transfer does not occur.

By signing up and using the Service you consent to these overseas transfers. How to refuse differs per transfer:

  • OpenAI: if you do not consent, your use of those features (AI processing, mail forwarding) may be limited.
  • Google — advertising: you can refuse using the methods in “10. Cookies and other automatic collection tools, and how to refuse them” below, and refusing does not restrict your use of the Service.
  • Google — sign-in: if you sign up and sign in with an email address, this transfer never happens. If you already signed up with a Google account, you can delete your account yourself at any time in settings (see “7. Your rights”).

5. LMS notification-email forwarding (optional)

This feature finds course-schedule changes in announcement mail sent by learning management systems (Blackboard, Canvas, etc.). It is off by default and works only if you issue a dedicated forwarding address in settings and configure your school mail to forward to it. You can unlink it yourself at any time from the settings screen (see “How to stop”).

  • What we collect: the sender address, subject, received time, sender-authentication results (SPF / DKIM / spam verdict), schedule-related excerpts, and processing status. Full message bodies are not stored in your receiving history.
  • Restricted to LMS senders: we process only mail sent from LMS domains (blackboard.com, instructure.com) or forwarded copies of such mail. Mail from any other sender fails verification, its original is destroyed immediately, and its subject is not shown as-is in the app.
  • AI processing (overseas transfer): to extract schedule information we send the mail subject and a body excerpt (up to 8,000 characters) to OpenAI (USA). Daily-digest mail and mail with no schedule-related content are not sent.
  • Retention of originals: original mail files are stored in a dedicated bucket in the Seoul region and destroyed automatically within 72 hours once processed, or within 14 days if processing failed or the mail was not classified (a daily job, with a storage lifecycle rule of at most 15 days as a backstop). Mail that fails sender verification, exceeds intake limits, or is addressed to a withdrawn account is destroyed immediately.
  • Receiving history: the metadata above is kept while your account exists so you can see why something was not applied, and you can delete it yourself at any time from the settings screen. Deleting it also destroys any stored original mail and the change proposals created from it.
  • Never applied automatically: detected schedule changes appear only as proposals and take effect after you approve them.
  • How to stop: you can unlink at any time yourself under Settings > Email sync. Unlinking revokes the issued forwarding address immediately, and mail sent to it is no longer stored or processed. However, the forwarding rule in your school mail must be removed from your school account — if it stays, mail keeps arriving (it is discarded immediately without being stored) and we only count the arrivals so we can tell you on the unlink screen. Mail arriving after account withdrawal is likewise destroyed without being stored.

6. Third-party provision

We do not provide personal data to third parties except where required by law or with your separate consent.

7. Rights of users and legal guardians

You may request access, correction, deletion, or suspension of processing of your data at any time — via account settings or the contact below.

The Service is intended for university students and does not accept sign-ups from children under 14. If we learn that an account belongs to a child under 14, we delete the account and its data without delay. A legal guardianmay use the contact below to request access, correction, deletion, or suspension of processing of such a child’s data.

8. Security measures

  • One-way password hashing; HTTPS encryption in transit
  • Token-based access control
  • Internal administrator access — for user support and service operations, administrators authenticated with a company account can see account details (email, name, sign-up date, plan status) and usage statistics. However, the names and contents of uploaded files, the titles and contents of schedules and to-dos, and course names are not shown in the admin console and are not sent to administrators by the server.
  • Access logging — administrator access to member data (viewing, changes, deletion) is recorded with the account, timestamp, source IP, affected member, and the action performed.

9. Data protection contact

Data protection contact: Minjun Kwon (NUHYLabs Inc.)
Contact: mj@nuhylabs.com

10. Cookies and other automatic collection tools, and how to refuse them

To measure advertising performance and show ads that encourage return visits, we install and operate the Google Ads tag (gtag.js) on every web page of the Service. As soon as you open a page, the tag contacts Google LLC (USA) servers and sends the information below, storing a cookie (_gcl_au) and a local-storage value (_gcl_ls) in your browser or reading values already stored there.

  • Purpose: to measure whether a visit that came from an ad click led to an actual signup (conversion measurement), and to build remarketing audiences from visit history.
  • What is collected and sent: ad-click and cookie identifiers, IP address, browser and device information (including screen size), the address and title of the page you visit, and the address of the previous (referring) page. Account information such as your name and email, and the study materials you upload, are not sent by this tag.
  • How to refuse: block cookies in your browser settings or delete the values already stored. Note that this tag uses not only cookies on Google domains but also a cookie (_gcl_au) and a local-storage value (_gcl_ls) on the Service’s own domain, so blocking third-party cookies or clearing cookies alone does not remove all of it — you need to clear this site’s cookies and site data together(e.g. Chrome → Settings → Privacy and security → Delete browsing data → Cookies and other site data). To turn off only personalized ads tied to your Google account, opt out at adssettings.google.com.
  • Refusing does not restrict your use of the Service — no feature is locked and signup is not blocked. Note that we keep you signed in using browser storage, so clearing site data to remove the values above will also sign you out (you can simply sign in again); blocking or clearing cookies alone leaves you signed in. If you sign in with a Google account, the sign-in window provided by Google may itself use cookies.

Separately, only for visits that arrive through an ad or campaign link (an address carrying utm_ parameters), we create an anonymous browser-level identifier in browser storage and send it, together with the campaign information, the path visited, and the referring page address, to our own servers (Seoul region). This identifier is not transferred overseas and is removed when you clear your browser storage.

11. Changes

We will announce the effective date and details of any changes within the Service.