Kebijakan Privasi

We collect what you type or upload on the screens and the records created while you use the Service. Only the sign-up items are required; everything else is collected only when you use the related feature.

Sign-up (required)

Email, password (stored with one-way encryption), name, nationality, display language, time of agreeing to the terms (if you sign up with Google, you choose your nationality right after signing up)

Google sign-in

Email and name of your Google account (received from Google)

Account security

When you verified your email address, when you set or changed your password, when you first linked a Google account, and when you were last signed out of all devices (by “Sign out of all devices”, a password reset or a password reset caused by Google sign-in — used only to invalidate sign-ins issued before that time) / one-time tokens for email verification and password reset links (only a non-reversible hash is stored, never the original value — verification links expire after 24 hours and reset links after 1 hour, and each can be used only once)

Profile (optional)

Desired course, field of study, intake term and regions; education level, GPA, TOPIK level, English score; available funds, budget, dormitory/part-time preferences and lifestyle answers

Document vault (optional)

Application documents: passport, ID photo, diploma (or expected graduation), transcript, language score, bank balance certificate, education completion certificate and other documents (up to 3) / Visa documents (prepared after admission): copy of the application form, your national ID card, your parents’ ID cards (up to 3), birth certificate, certificate of residence, your parents’ business registration, tax payment certificate, bank transaction history, study-in-Korea expense deposit confirmation and tuition payment receipt — each file with its file name, type, size and upload time. Family documents such as your parents’ ID cards or business registration can be uploaded only after you tick that you told your parents or family

Applications

Name, date of birth, nationality, phone number, previous education, copies of documents at the time of submission, status history, and the certificate of admission (admission letter) issued by the university

Information for the university (optional, entered after submitting an application)

Name in Korean, gender, passport number, issue date and expiry date, hometown, social media account, high school name, location and graduation year, grades by year, average and grading scale, days absent, Korean study period, Korean and English qualifications, family members (relationship, name, occupation, phone number, monthly income), average balance over the last year, Korean visa refusal history, any record of family members overstaying in or being deported from Korea, preferred department, and the times you agreed and confirmed you had told your family. You enter it yourself on the “Information for the university” screen of a submitted application; profile values are copied only if you press “Load” and then save

Admission letter details (optional, entered after acceptance)

Country of birth, admission type (new, transfer or new graduate admission) and, for a transfer, your previous university, estimated yearly costs (living and other costs), how you will pay (amounts paid by you, by a guarantor, by scholarships and other sources), guarantor name, relationship and phone number, and the times you agreed and confirmed you had told your guarantor (family). You enter them yourself on the “Admission letter details” screen of an accepted application (the application channel and local referring agency are not entered — they are shown from the referral code you used at sign-up)

Consultation bookings

Booking time, type and status, cancellation reason

Messages and consultations

Messages exchanged with universities and the operations team, their automatic translations, and read times

Community

Posts, replies and attached photos; selected board, country and university; board-specific fields (rating, area, price, item condition, etc.); reports (reason, note) and blocks

Mentoring

Mentor application: university, major, entry year, introduction, chat languages, profile photo, proof-of-enrolment file, consent time and mentor-pledge agreement time / Mentor license (issued on approval): license number and issue time, and, if the operations team revoked your registration, the revocation record (reason, time and the staff member who handled it — the most recent one) / Using mentoring: requests and chat messages (including automatic translations), reports and ratings

Referral code

The referral code you entered and when, sign-up and admission counts for your own code, and referral payout records

Payment information (when you pay the document handling fee)

Payment method type, card company, masked card number (last 4 digits only), approval time, amount, order number, and payment status and refund details (refund reason and time). The full card number, CVC and expiry date are handled by the payment provider and are not stored by the Company.

App push notifications (Android app)

Device push token (registered when you sign in on the Android app — a value issued by Firebase Cloud Messaging that identifies the device to deliver notifications to), device type (android), registration time and last-seen time (updated at most once a day when you open the app). The token is deleted when you sign out on this device or delete your account, when the app has not been opened for more than 60 days, or when the token is no longer valid on the device (for example, after the app is uninstalled)

Usage records

Learning centre progress, journey progress (target programs, skipped steps, pause reason), in-app notifications and read status

Generated automatically

Sign-in tokens (kept in your device’s browser storage); server access logs (IP address, request time, etc. — kept by our hosting providers); IP address used to prevent sign-up abuse and guessing of mentor license numbers (processed briefly in server memory only, not stored — failed license checks are counted for one hour only); counts of attempts to sign up, sign in, request a password reset, resend a verification email or confirm your current password (keyed by a non-reversible form of the sign-in email, the IP address or the account — sign-in attempts are also counted per combination of email and IP address — processed in server memory only for up to one hour and not stored)

• ·Identifying members, keeping you signed in and managing accounts (verifying your email address, resetting and changing passwords)
• ·Protecting accounts: limiting repeated sign-up and sign-in attempts, sending password change alerts, and — when you sign in with a Google account whose email matches an account that has not completed email verification — resetting that account’s existing password and emailing you about it (so that an account someone else created with your email address first cannot be used)
• ·Providing university and program information and recommendations based on your profile
• ·Preparing and submitting applications, forwarding them to universities and reporting their progress
• ·Preparing and delivering the applicant lists (including the information for the university) that the universities you apply to require
• ·Delivering the details (admission letter details) the university that accepted you needs to request your standard admission letter on HiKorea (the Korean Ministry of Justice immigration system)
• ·Consultation bookings, messages with universities and the operations team, in-app notifications, Android app push notifications and emails
• ·Running the community and mentoring, handling reports and preventing misuse
• ·Issuing mentor licenses and letting people check them on the public license check page
• ·Checking referral codes and settling referral rewards
• ·Processing payment of the document handling fee, notifying you of payment details, and handling refunds and payment disputes
• ·Automatically translating posts and messages written in different languages

• ·Universities you apply to: when you submit an application it is reviewed by the operations team and then forwarded, with copies of the attached documents, to that university. When you book a consultation or message a university, its staff see your name, email and the booking or message.
• ·Universities you apply to (information for the university and applicant list files): once an application passes the operations team’s first review and is forwarded to the university, the operations team and that university’s staff (university managers) download applicant list files (Excel or CSV) that include the information for the university from the operations console and use them for admission and visa work. University staff can see only the applications forwarded to their own university. The full passport number appears only in the list file; on screens part of it is hidden. Every download is logged with who downloaded it, when, for which university and how many applicants. After you delete your account, you are not included in newly downloaded list files. The information for the university is never sent to AI services such as automatic translation or recommendations.
• ·The university that accepted you (admission letter details): once your application is accepted, the operations team and that university’s staff (university managers) see the admission letter details you entered in the operations console, and the university copies them into HiKorea (the Korean Ministry of Justice immigration system) when it requests your standard admission letter (OmniApply does not send anything to HiKorea itself). When university staff press “Copy in HiKorea form order”, your name, date of birth, nationality, full passport number and admission letter details are copied at once, and every copy is logged with who copied which application and when. Applicant list files also include your country of birth, admission type, yearly living costs, funding totals and guarantor name and relationship. Admission letter details are never sent to AI services such as automatic translation or recommendations.
• ·Community: posts, replies and photos can be read by anyone, including people who are not signed in. Authors are shown only as the first letter of their name followed by asterisks.
• ·Mentoring: once you are approved as a mentor, your name, profile photo, nationality, major, entry year, introduction, chat languages and rating are shown publicly on the university page. When you request or accept mentoring, the other person sees your name and nationality (and a mentor’s photo).
• ·Mentor license check: approved mentors are issued a license number, and anyone who knows the number (for example by scanning the QR code on the license card) can see the license status on the public check page without signing in. Only while the license is valid does the page show the name, profile photo, nationality, university, major, license number and issue date; for a suspended or revoked license it shows only the number and an "invalid" status. The check page offers no list or search of numbers and is set not to be indexed by search engines.
• ·Referral code owners (mentors and recruiting agents): if you sign up with a referral code, the owner of that code (and, for a recruiting agent, the agents above them) receives only aggregate counts of sign-ups, submitted applications, acceptances and completed payments, plus progress stages. Your name, contact details and documents are never provided to them.
• ·Apart from the cases above and requests made under the law, the Company does not provide personal information to third parties. We do not sell or share it for advertising.

We entrust processing to the companies below to run the Service. Some are located outside Korea, so information may be transmitted abroad over the network while you use the Service. Each provider processes the information for as long as the entrusted task requires and under its own policies.

Supabase, Inc.

Task:Database and storage of document and photo files

Location:Republic of Korea (Seoul region)

Cloudtype

Task:Running the API server

Location:Republic of Korea

Vercel Inc.

Task:Hosting and delivering the web app

Location:United States and other countries (global network including the Seoul region)

Resend, Inc.

Task:Sending notification emails (email address, name, notification content) and account emails (email address, email verification and password reset links, password change alerts, password reset notices)

Location:United States

PortOne Co., Ltd. (포트원)

Task:Relaying payment of the document handling fee and notifying us of the result (webhook) — the order number, amount, order name, name and email are passed when the payment window opens

Location:Republic of Korea

The payment service provider connected through PortOne (such as Toss Payments)

Task:Card approval (the card number, CVC and expiry date are typed by you directly into the payment window and do not pass through the Company’s servers)

Location:Republic of Korea

Google LLC (Firebase Cloud Messaging)

Task:Delivering push notifications to the Android app (device push token, notification title and a short summary — message and chat content, the other person’s name, and reasons or location notes written by universities or the operations team are not included, and the address of the screen to open when you tap the notification)

Location:United States

Vercel Inc. (AI Gateway) and the AI model provider reached through it (Anthropic, PBC)

Task:Automatic translation of posts, messages and mentor introductions; translation of personalised recommendation reasons (short sentences containing profile values such as TOPIK level, GPA, preferred region, field of study and intake term); automatic review of community posts and draft answers; writing journey-step tips (recommendation reasons and tips receive only profile items such as nationality, desired course, education, language and available funds — never your name or email)

Location:United States

If you choose Google sign-in, authentication is handled through Google LLC.

Some screens load resources directly from the external servers below. When they do, connection information such as your device’s IP address and browser details is sent to the operator of that server, and that operator’s policies apply. The Company does not otherwise hand your personal information to these providers.

• ·Learning centre videos (YouTube, Google LLC): when a learning item with a video is shown, its thumbnail image is loaded right away from YouTube’s server (i.ytimg.com); when you press play, the YouTube player (youtube.com) is loaded.
• ·Payment window (PortOne): only at the moment the payment window is opened, the payment script is loaded from PortOne’s CDN (cdn.portone.io), and connection information (IP address and browser details) is sent to PortOne.

We keep your information while you keep your account. When you delete your account from the Account screen in the app, the following is deleted or made unidentifiable immediately. Deletion cannot be undone.

Device push tokens for the Android app are also deleted while you keep your account, in these cases: when you sign out on that device, when the app has not been opened for more than 60 days (cleaned up the next time a notification is sent), and when the token is no longer valid on the device (for example, after the app is uninstalled — checked when a notification is sent). If someone signs in to another account on the same device, the token moves to that account, and each account can register up to 10 devices — beyond that, the token of the device unused for the longest time is removed first.

• ·Account details: your name, email, password and nationality are replaced with values that cannot identify you, and the account is deactivated. (You may sign up again with the same email, but the new account is not linked to the old records.) The times you verified your email, set or changed your password, were last signed out of all devices and linked a Google account are also deleted.
• ·Tokens for email verification and password reset links (used or not).
• ·Sign-in: you are signed out on every device immediately.
• ·Profile: study goals, education, language and finance details, personalised recommendations, and journey settings (target programs, skipped steps, pause reason).
• ·The answers in any application you had not yet submitted (drafts), including any information for the university entered for it.
• ·Upcoming consultation bookings: cancelled and the time slot is returned to the university (the university sees it as cancelled by a "Deleted user").
• ·Mentor activity: your mentor activity ends and your mentor card is removed from the university page. Your introduction is deleted and your profile photo is no longer shown. Ongoing mentoring chats are ended. Your mentor license stops being valid immediately, and the public check page shows it only as "invalid" (no name or photo).
• ·In-app notifications sent to you.
• ·Device push tokens registered to the account (for Android app notifications). After deletion, no notifications are sent to those devices.
• ·Your referral code can no longer be used.

The following is kept after the account is deleted.

• ·Files you uploaded to the document vault and their records (application documents such as your passport and transcripts, and visa documents such as your parents’ ID cards and birth certificate). Because the account is deactivated, you can no longer open them in the app.
• ·The proof-of-enrolment file submitted with a mentor application, and your university, major, entry year and chat languages.
• ·If you were a mentor, your profile photo file is kept as an operational record and is no longer shown on university pages or in the app (the file is in public storage, so anyone who already has its address can still open it).
• ·Submitted applications: the name, date of birth, nationality, phone number and previous education you entered, copies of the documents at the time of submission, the status history, the information for the university entered for a submitted application (passport number, education details, family members and income, visa history, etc.), and the admission letter details entered for an accepted application (country of birth, admission type, costs, funding and guarantor). The operations team (operations console) and the university that received the application can still see this after deletion (you are not included in newly downloaded applicant list files). Logs of list files already downloaded are also kept.
• ·Messages and consultation records exchanged with universities and the operations team, and past booking records.
• ·Community posts, replies and attached photos (the author is shown as "Deleted user"), and report and block records.
• ·Mentoring chat messages, reports, and ratings given and received.
• ·Mentor license history: license number, issue time and mentor-pledge agreement time (operational record). The same applies if the operations team revoked your registration or you withdrew as a mentor. If the operations team ever revoked your registration, the revocation record (reason, time and the staff member who handled it — the most recent one) is kept as well, even after you reapply and are approved again or delete your account, and only the operations team can see it.
• ·Records of sign-ups made with a referral code and of referral reward payouts.
• ·Payment and refund records: order number, amount, payment method type, card company, masked card number (last 4 digits), approval time, and refund reason and time (kept 5 years as required by law). The full card number, CVC and expiry date are never stored.
• ·Learning centre progress.
• ·Sign-up time, deletion time, terms-agreement time and display language (values that do not identify the account).
• ·Notifications and emails already delivered to the operations team before deletion (for example booking requests or message alerts — these may contain your name at that time). Names you typed yourself inside posts or messages also remain.

We keep only what is needed to process applications already submitted (their record as submitted is not changed), resolve disputes and handle reports, confirm referral reward settlements, prevent abuse, and confirm whom each mentor license number was issued to.

We keep the information above for 3 years from the date you delete your account and then destroy it. Information that a law requires us to keep longer is kept for that period.

However, payment and refund records are kept for 5 years under Article 6 of the Enforcement Decree of the Act on the Consumer Protection in Electronic Commerce, also after you delete your account.

How to delete your account, and how to ask for deletion if you cannot sign in, is explained on the account deletion page.

• ·You can check and correct your information at any time on the Account and profile screens, and replace files in the document vault. You can correct the information for the university on the “Information for the university” screen of the application, and the admission letter details on the “Admission letter details” screen (list files already downloaded and what the university has already copied do not change).
• ·You can delete your account yourself in the app.
• ·You can also request access, correction, deletion or suspension of processing by emailing the privacy officer below; we will handle it without delay.

The Service keeps your sign-in state and screen settings (language, whether you have seen the first-run guide, etc.) in your device’s browser storage. We do not use cookies or tracking tools for advertising or behavioural analytics. These values disappear when you sign out or clear your browser data.

In the Android app, this device’s push token is also kept in browser storage. The copy used while the app is running disappears when you close the app, and the copy used to remove the server registration when you sign out and to re-register this device at most once a day (token, account identifier and last registration time) is deleted once the registration is removed at sign-out (if it could not be removed, it is cleaned up the next time someone signs in on this device and then deleted).

• ·Passwords are stored with one-way encryption.
• ·Email verification and password reset links work only once and expire after a short time, and the server stores only a hash of each link, not its original value.
• ·If sign-in fails repeatedly within a short time, sign-in for that email or IP address is limited for a while, and we email you when your password changes. Resetting your password or choosing “Sign out of all devices” signs you out on every device immediately.
• ·If you sign in with a Google account whose email matches an account that has not completed email verification, that account’s existing password and sign-in sessions are all invalidated and we email you about it. You can set a password again through the password reset email.
• ·Document files are kept in private storage and are served only to you and authorised staff through links that expire after a short time.
• ·The passport number in the information for the university is partly hidden on app and operations console screens; the full number appears only in applicant list files and in the “Copy in HiKorea form order” text, both of which are logged. List files are not stored on the server — they are generated anew for each download.
• ·All communication uses encrypted connections (HTTPS).
• ·Access to the operations console is restricted by account and role.

Privacy officer: 윤수한 (Representative) · rebatekorea@gmail.com

Company

REBATEKOREA Inc.

Representative

윤수한

Address

10F #84, 25 Misagangbyeonseo-ro, Hanam-si, Gyeonggi-do, Republic of Korea

Business registration no.

876-88-03697

Contact

rebatekorea@gmail.com

For help with a privacy infringement you can also contact the Korean Personal Information Infringement Report Center (privacy.kisa.or.kr, 118) or the Personal Information Dispute Mediation Committee (kopico.go.kr, +82-1833-6972).

This policy is effective from 2026-10-18. If it changes, we will announce it in the Service before the change takes effect.