Privacy Policy

1. Personal data processed and purposes of use

• Account: email, Supabase user identifier and signup/terms-consent timestamps and versions, for identity verification, login, access checks and support, within what is necessary for the account and contract.
• Existing analysis: uploaded or recorded voice, original filename, chosen vocal-range reference and analysis results, for access to previously provided records and error support. The feature screen determines whether new analysis is available; this revision does not newly authorize uploads or AI training.
• Teacher-plan transactions: account/transaction references, order, product, amount and currency, payment identifiers/status, approval/access/refund times and amounts, refund requests and processing history, receipt URL and terms version, for purchase verification, access grants/revocation, duplicate-payment prevention, refunds, disputes and legal retention. Test orders are distinguished from real payments and access.
• Payment-method details entered in the Toss Payments checkout are processed by the payment provider. SongLab’s new teacher-plan ledger does not store full card numbers, CVC or card passwords. Earlier PayApp/Lemon Squeezy data is processed only for those transactions, refunds and legal retention; those services are not presented as payment methods for the new product.
• Private journals: teacher-entered student nicknames, goals, archive status, lesson date, focus, observations, practice goals, next checks and chosen materials, for that teacher’s records. No student account or academy membership is created automatically; records are not automatically disclosed or sent to students or other teachers. Existing academy roles, memberships, coach relationships and comments are separately processed for existing academy functions and permissions.
• Service improvement: account identifier, the selected purpose of use (trainer / academy operator / personal practice / skip), the dates and feature types of simulation and material use, voluntarily submitted feedback on classroom use — checking repeat usage and improving features. This aggregation does not collect recordings or student information. Providing a purpose of use and classroom feedback is optional.
• Connection and browser storage: hosting processes IP addresses, User-Agent and request URLs separately from the app’s abuse-prevention IP hashes, request times and error records. Login local storage remains until logout or browser deletion; the server-authentication HttpOnly cookie lasts up to 1 hour after issue/renewal; the duplicate-order-prevention request identifier in sessionStorage lasts for the tab session. Browser settings can delete or block cookies/site data, which may prevent login or checkout. These stores do not hold full payment-card details.
• Passwords are handled by Supabase Auth as encrypted authentication data and are not stored in plain text on SONGLAB servers or in operating logs.

2. Retention and use period

• Service-improvement records of usage dates and features, and classroom feedback: kept for the most recent 90 days, Korean time, then deleted automatically. The purpose of use and the date of first use are kept until membership withdrawal. When the account is deleted, this information is deleted with it. Deletion or suspension of processing can be requested through the contact below.
• Accounts, analysis results, pass records and private journals are retained while the account is maintained and deleted on account withdrawal. Teacher-pass expiry or refund leaves journals read-only; archiving a student retains earlier lessons. Legally required financial records are handled separately, and deletion-processing records are deleted when their purpose is complete.
• Academy affiliation, assigned-coach relationships, coach comments: until the affiliation ends or membership is withdrawn. When a student withdraws, the comments attached to that student's analyses are deleted as well.
• Voice audio consented to account storage: kept privately until you delete the voice and analysis record yourself or withdraw membership. For video analysis, only the audio is kept separately and the original video is deleted after analysis. Voice audio analyzed under the previous 30-day storage consent keeps the existing period unless you separately choose continued storage. Failed or cancelled uploads are deleted, and incomplete uploads are cleaned up after 3 hours.
• Result sharing: only the analysis result summary for which the user created a share link can be seen by people who receive the link. A link can be passed on by a recipient to other people. If sharing is turned off, or the related analysis record or account is deleted, the results can no longer be viewed through the link. Voice audio, original file names, and account information are not shared.
• Copies of analysis voice audio on the operator's PC: kept for up to 30 days for analysis quality checks and error reproduction, then deleted automatically; upon membership withdrawal they are deleted first through a deletion request queue.
• Statutory retention under Article 6 of the Korean e-commerce enforcement decree: contracts/withdrawals and payment/service-supply records, 5 years; consumer complaints/disputes, 3 years; advertisements, 6 months. After account deletion, only transaction identifiers needed for these purposes are retained separately from ordinary account data and destroyed when the applicable period ends.
• Where another law imposes a retention obligation, the relevant material is separated and kept only for the prescribed period.

3. Outsourcing of processing and overseas processing

• Supabase Pte. Ltd. (privacy@supabase.com) provides outsourced authentication, databases, private file storage and server functions. The database storage region is Seoul, Republic of Korea (ap-northeast-2). Information needed at signup, login, record saving and transactions is processed through encrypted connections for the applicable retention periods above. The database region does not mean all authentication, server-function and support processing is exclusively in Korea.
• Vercel Inc. (privacy@vercel.com) provides outsourced website hosting, deployment, server-request and security-log processing. Connection/request information is transmitted through encrypted connections when the site is used. The current server execution region is Virginia, USA (iad1), and a worldwide delivery network is used. Log retention and deletion depend on the applicable service configuration and provider policies. The current Hobby plan has no Observability Plus or external log drains, so application runtime logs are available/retained for 1 hour. This does not describe the retention of all separate security, support or backup data.
• Toss Payments Co., Ltd. handles electronic payments, approval checks, cancellations, refunds and related disputes for the new teacher plan. Order number, product name, amount and necessary payment identifiers are transmitted through encrypted connections, and SongLab receives approval/cancellation results and transaction identifiers. The checkout’s Toss Payments collection/use notice explains information collected directly there and related rights.
• Previous payment providers: if a transaction used PayApp or Sold through Link, LLC f/k/a Lemon Squeezy LLC, the previous notice remains relevant to verification, refunds and legal retention for that transaction. Earlier payment and overseas-processing notices are available in the archived document. This revision does not send new teacher-plan information to those providers.
• Plus Five Five, Inc. (Resend, privacy@resend.com) processes the delivery of account-confirmation and password-reset emails. Authentication-email requests send the necessary sender/recipient email addresses, subject and message body including confirmation/reset links, sending time and delivery/failure results from Supabase to Resend over encrypted connections. Authentication emails are sent from Tokyo, Japan (ap-northeast-1); Resend’s primary processing and storage country is the United States. Selecting Japan for sending does not move stored message content, email metadata or logs to Japan. According to Resend, Free-plan email/log data is retained for 30 days and backups for 7 days; remaining customer data is deleted within 90 days after SongLab terminates its Resend service account. Ending that service account is different from a SongLab member withdrawing, so member withdrawal does not mean every Resend record is immediately deleted. This integration does not send plaintext passwords, recordings or analysis results to Resend and does not obtain or change advertising or voice-use consent. Outsourced work is limited to contract performance and service operation. Material changes to providers, transferred information, processing countries or retention are reflected in the public notice, with any legally required information and consent procedures. Contact us below for overseas-processing access, suspension or withdrawal requests. Stopping essential authentication or hosting processing may prevent use of the related online service. SongLab's separate delivery-status records do not store raw email addresses, email bodies, authentication links or raw provider errors; they retain only HMAC identifiers, hashes of temporary request and browser values, delivery states, fixed error categories, related timestamps and lookup/rate-limit counts, and cleanup runs every 15 minutes to remove records older than 24 hours.

4. Destruction method

• Electronic files are deleted by methods that make recovery difficult, database relations are cleaned up, and then the authentication account is deleted.
• Material subject to statutory retention is separated from general member data and is not used for any other purpose.

5. User rights

• Users may demand access to, correction of, deletion of, and suspension of processing of their personal data, and may withdraw consent.
• After logging in, request account deletion in account management. Pending payments/refunds or an active paid pass are settled safely with support when needed. This does not constitute a blanket refusal of privacy rights for information outside mandatory legal retention.
• Sign-ups by children under 14 are not accepted. If we learn that a sign-up was made in error, we verify and then delete the account and the personal data.

6. Safeguards

• Voice storage is not public, and access is restricted through account ownership checks and short-lived signed URLs. Result share links do not include voice audio or a voice playback address. The feature that shares a recording with the assigned coach is provided only where separate consent has been given.
• Only publishable keys are provided to the browser; Supabase secret keys and GPU worker tokens are kept only in server and local environments.
• Passwords, authentication tokens, and payment-integration secrets are not written to application logs.

7. Breach response

• If we become aware of a personal data breach or similar incident, we notify the affected users without delay of the items involved, the time and circumstances, ways to minimize harm, our response, and a contact point, and we report it in accordance with applicable law.

8. Use of voice and acoustic features for AI improvement — separate opt-in planned

• When the analysis feature opens, we plan to ask for separate opt-in consent per upload on whether the uploaded voice and derived acoustic features may be used for vocal analysis and AI quality improvement. The items used, the purposes, the retention period, and the withdrawal method will be explained first, and not consenting causes no disadvantage in basic analysis use. This sign-in consent change does not permit or start voice training. Before the analysis feature resumes, a separate upload consent and processing procedure will be put in place.
• Existing recordings are not used retroactively. Anyone who uploads a third party's recording, such as a student's, must obtain that person's lawful consent; the account owner's marketing consent does not permit use of a student's voice.

9. Optional marketing use and receiving email advertising

• With optional consent, the account email is used for announcements of new features, the opening of analysis, teaching materials, and events and benefits. Consent to marketing use of personal data and consent to receiving advertising email are obtained separately, and both start as not consented. Receiving email can be selected only when marketing-use consent exists.
• Not consenting makes no difference to the use of the free simulation and teaching materials. You can change or withdraw it at any time in account management, and marketing use stops upon withdrawal or membership withdrawal. Existing members are not treated as automatically consenting.
• So that the consented and withdrawn items, the notice version, and the processing time can be checked, this history is kept until membership withdrawal. It is separate from voice-use consent; this choice alone does not put recordings or student material into AI improvement.

10. Privacy responsibility and contact

Privacy officer: Choi Sang-il (최상일) · Phone: +82-10-9936-3075. Contact us for access, correction, deletion, restriction and remedies. Korean privacy incident hotline: 118; Personal Information Dispute Mediation Committee: 1833-6972.
Email: hello@songlab.kr

11. Effective date and changes

Revised: 2026-10-30 (adds the Resend processor, overseas processing and retention for authentication emails). Previous revision record: First effective: 2026-07-16 · Revised: 2026-10-28 (teacher plan, private journals, Toss Payments transactions and statutory retention). Earlier documents are linked below. Important changes are announced before taking effect, with separate consent where required. Existing optional consent is not automatically changed and use of past recordings is not expanded.