Privacy Policy (draft for review)

1. Controller and contact information

Data controller and tutoring operator: 편훈찬 (Pyun Hoonchan), an individual freelance mathematics tutor. The operator confirmed publication of this name and the privacy-contact email on October 20, 2026.

Applicable business-registration, private-tutoring notification, and any required business disclosures remain under separate review. This page does not claim to represent a registered business.

Questions and requests for access, correction, deletion or restriction: [email protected].

2. Intended purposes

Once authorized and activated, the service is planned to use limited adult requester information to reply to tutoring inquiries, understand curriculum and course requirements, discuss pre-class diagnostics and arrange trial-lesson conversations. Marketing consent is not part of this initial inquiry.

3. Intended data categories

An adult requester's own email address or phone number (one selected contact method), requester type (parent/legal guardian or adult student), curriculum, school-year designation, current math subject, preferred lesson format, consent confirmation and a technical duplicate-request identifier.

Student names, children's personal contact details, dates of birth, school names, grades/reports, written student profiles and recorded solutions, audio or video are not collected through the initial online inquiry API. Any later teaching-material workflow requires a separate notice and consent process. School name and learning goals entered in the current local preview are not sent to the real inquiry API.

4. Planned retention

The planned service stops owner access to an inquiry 21 days after receipt and uses a daily job to remove it from the active D1 database. This account's D1 Time Travel can restore a pre-deletion state for up to seven further days, so deletion from the active database does not mean every recoverable copy disappears immediately. Actual scheduled execution and Cloudflare's other retention and deletion terms still require verification before launch. Any later contract or legal retention duty needs a separate basis and notice. The current preview stores no submitted inquiry.

5. Rights and choices

Data subjects can request information about processing and exercise applicable rights of access, correction, deletion or restriction by contacting the address above. Requests will be handled after appropriate identity and authority checks. Consent may be declined, but this may prevent the online consultation workflow.

6. Children and guardians

The initial form is limited to adults providing their own contact information. Before collecting information about children under 14, an independently checked legal-guardian consent and rights mechanism must be established. Simply selecting "I am a parent" does not by itself verify guardian consent.

7. Planned security safeguards

Pre-launch code includes provisions for HTTPS, AES-GCM encryption at rest, Cloudflare Access for administrators, access restrictions, bot verification, rate limits, duplicate-request detection and scheduled deletion. These are subject to deployment and end-to-end review; this statement does not mean that the live collection system is currently operational or approved.

8. Processors and international transfers

The website and planned consultation system use Cloudflare Pages, Workers, D1, Access and Turnstile. The principal service provider is Cloudflare, Inc. (United States); see its Data Processing Addendum and sub-processor list. Proposed processed categories are the adult requester's contact, general lesson choices and technical security metadata, for storing and responding to inquiries and preventing abuse. Active database retention and recovery are described in section 4.

The isolated D1 database currently reports an Asia-Pacific (APAC) region, no jurisdiction restriction and read replication disabled. A Hong Kong (HKG) query is evidence of one processing location at one time, not a guarantee of permanent storage there. Cloudflare runs a global network and processing may occur outside South Korea, including the United States. We have not yet established the precise D1 storage country or every possible processing country. Live intake remains disabled until country-level transfer disclosures, consent and applicable legal grounds under Korean law are finalized. You may decline overseas processing; in that case this website cannot receive the online request and you can use the existing external inquiry channel.

We do not provide adult contact data for unrelated third-party advertising.

9. Cookies, technical logs and security services

The static inquiry preview includes no dedicated marketing tracking script or local browser persistence of contact data. However, the hosting provider may process technical access logs. Hosting details, cookie behavior, retention and any future Turnstile usage must be reviewed and disclosed appropriately before live collection begins.

10. Questions and changes

Data controller: 편훈찬 · Email: [email protected]. A finalized, effective policy will be published after confirmation of processors/transfers, retention procedures and launch date.