Privacy Policy

Xakar (the “Company”) processes personal information for the following purposes. The personal information processed will not be used for any purpose other than those listed below, and if the purpose changes, prior consent will be obtained.

• User registration and identity verification
• Provision of the Service and operation of content packaging features
• Credit payments and transaction history management
• Customer inquiry response and dispute handling
• Service improvement and statistical analysis

Required items

• Email address (for registration and identity verification)
• Service usage records (packaging history and credit transaction records)
• Access IP, browser information, and access date/time

Items collected at payment

• Payment method information (processed by the card company or payment provider; not directly stored by the Company)
• Payment amount and transaction date/time

Automatically collected items

• Cookie and session information (to maintain authentication status)

Personal information is retained and used until membership withdrawal. However, when a certain retention period is required under applicable laws, the information is stored separately for the following periods.

• Records on contracts and withdrawal of subscription: 5 years (Electronic Commerce Act)
• Records on payment and supply of goods/services: 5 years (Electronic Commerce Act)
• Records on consumer complaints and dispute handling: 3 years (Electronic Commerce Act)
• Login records: 3 months (Protection of Communications Secrets Act)
• Learning records: completion outcomes (completed / passed / failed) and each learner's latest progress are retained until the service agreement ends; other learning activity records (playback, pause, etc.) for 24–36 months depending on plan

The Company does not, in principle, provide users' personal information to third parties. However, the following cases are exceptions.

• Where the user has given prior consent
• Where required by law or upon a lawful request from an investigative authority

The Company entrusts the following personal information processing tasks for the operation of the Service.

• Supabase Inc. — user authentication and database operation
• Vercel Inc. — service hosting and server operation
• Lemon Squeezy (Merchant of Record) — payment processing, tax calculation and remittance, and invoice issuance. Payment-related personal information (email, billing country, payment amount) is shared with Lemon Squeezy to the extent necessary for completing the transaction.

Users may exercise the following rights at any time.

• Request access to personal information
• Request correction of errors in personal information
• Request deletion of personal information (membership withdrawal)
• Request suspension of personal information processing

To exercise these rights, please submit a request via our contact form, and the Company will take action without delay.

Some rights can be exercised directly within the Service. Packaging history can be deleted at any time using the “Clear history” button on the My Packages screen, and membership withdrawal can be completed on the Settings screen. However, payment and credit transaction records subject to a statutory retention obligation are stored separately from other information for the periods stated in Article 3 and then destroyed.

All payments are processed by Lemon Squeezy, which acts as the Merchant of Record. Lemon Squeezy independently handles payment processing, tax calculation, and invoice issuance. The Company does not directly store sensitive payment information such as card numbers. Credit transaction records (top-up amount, deduction history, balance) are retained for the purpose of resolving disputes related to use of the Service.

As a general rule, topped-up credits are not refundable after purchase is completed, and transaction records related to such payments are retained for the period required by law.

The Service uses only essential cookies required for sign-in status maintenance and security. No marketing or analytics cookies are used. Essential cookies cannot be disabled as they are necessary for the Service to function.

The Company designates a person responsible for personal information protection who oversees the overall handling of personal information.

• Contact us

With respect to learners' personal information (completion records, learning activity records, and the like) generated on learning sites and learning content that a User operates through the Service, the Company acts as a processor, and the User who operates the site is the controller.

• The purposes and retention periods of such processing are determined by the User who operates the site, and the Company processes the information on that User's instructions.
• Learner requests for access, correction, deletion, or suspension of processing are received by the User who operates the site. If such a request is submitted directly to the Company, the Company will refer it to that User.
• The Company deletes learning records only at the request or on the instruction of the User, and does not modify or delete them on its own initiative.
• Even if a learner withdraws membership from the Company, learning records remaining on sites operated by other Users are maintained under those Users' control. To have them deleted, please contact the operator of the site concerned.
• If the User operating a site withdraws membership, the learning records of that site are deleted together with the site and its content.

This Policy may be revised in accordance with changes in laws or the Service. In the event of any revision, notice will be provided within the Service starting at least 7 days before the effective date.