Privacy Policy
개인정보 처리방침

Effective: 22 October 2026 (replaces the version dated 14 October 2026)

LucyESL ("we") operates lucyesl.com and complies with Korea's Personal Information Protection Act (PIPA). This policy explains what we collect, why, how long we keep it, and your rights.

1. What we collect

• Teachers (applicants): email, first name (optional), and any information you provide when applying to a job.
• Schools & academies: email, school/academy name, region/city, password (stored encrypted), and the job listings you post.
• Organisation verification (schools & academies): the business registration number, the representative's name and the opening date you enter when you ask to be verified, and the documents you upload (the business registration certificate or its equivalent for a school foundation, proof that you work there, and for a recruiter its 직업소개사업 registration). We never ask for a national ID card or a passport.
• Collected automatically: your IP address and a record of each visit (the pages you view and when, the referring site, and your browser's type and language); a session cookie to keep you signed in; and a first-party visitor cookie (lucy_v) so we can count unique visitors. The visitor cookie holds one random identifier and nothing else, lasts 400 days, and is set by this site only. It is not used for advertising and is not shared with anyone; our statistics tool receives only a one-way hash of it, never the identifier itself. The site's own records keep your IP address only as a salted hash; the web server's access log keeps the raw address for 52 days, then deletes it. Visit statistics are produced by a statistics tool we run on the same server in Seoul; the individual visit records it holds are deleted after 90 days, leaving only daily totals.
• How pages are used: the links and buttons you press and the sections you open, how far down a page you read and for how long, a form you stopped filling in and the name of the box you were in, and errors our scripts hit in your browser. For each request you make, the server also notes the page, how long it took, its status and where it redirected; when you send a form, it notes which form it was and which fields it refused (or why), by name only. Nothing you type is recorded, and none of the page's words. A tool of our own records it, and nobody else receives it. If you are signed in, only whether the account is a teacher's or a school's is kept, never which account. Neither your IP address nor the visitor cookie is stored with it: one person's notes are told apart from another's only by a tag made from the visitor cookie (or, without one, the address) under a random key that changes every day and is deleted after a day, so notes from different days cannot be joined. When you send a form, a first-party cookie (mux_v) links the form to that note for 3 seconds; it holds only a random value made for that page load and is never sent to another site. It is used only to find what is hard to use and fix it, and deleted after 180 days. Nothing is recorded, and no cookie is set, for a browser that sends the Global Privacy Control signal; with scripts blocked, only the server's note of each request is kept.
• Account activity (teachers): each step of the sign-up and how long it took, the days you sign in, and when a link in one of our emails brings you back. Kept to see whether the sign-up works, and deleted with the account.

2. How we use it

• To operate the job board — posting, searching, and applying to jobs.
• To confirm the organisation that posts a listing, and that the person posting works there (verification).
• To send launch and job-alert emails, where you have opted in.
• To prevent abuse and understand service usage.
• To find what is hard to use on the site, from how its pages are used, and fix it.

3. Retention & deletion

We delete personal data once its purpose is met or you request deletion. Waitlist data is kept until we have notified you of launch. Where the law requires retention, we keep data for that period only.

Verification documents are stored encrypted, where the web cannot reach them; only the reviewer can open them, and each opening is logged. The files are destroyed the moment the request is approved or declined, after which we keep only a record of which documents were checked and when. The business registration number, the representative's name, the opening date and the verification record are deleted with the account.

Records of paid services (the invoice, the institution's name and business registration number, the address its tax invoice is sent to, the amount, the payment date, the tax invoice number and the record of listing credits bought, used and returned) are kept for five years, as Korea's E-Commerce Act and Framework Act on National Taxes require. Deleting an account detaches these records from it; they are destroyed when the period ends.

4. Processing location & overseas transfer

Our service is hosted and processed on Amazon Web Services servers in the Seoul region, South Korea — as a rule, your personal information is stored and processed inside Korea.

• Processor: Amazon Web Services, Inc. — cloud infrastructure (Seoul region; data stored and processed in Korea)
• Overseas transfer (email delivery only): Google LLC (United States) — delivery of notification and verification email. Items: recipient email address and message content, retained until the delivery purpose is met.

We do not use AI features by default. If we introduce any further overseas processing (e.g. AI), we will notify you and obtain consent beforehand.

5. Sharing

We never sell your data and do not share it with third parties except as required by law or with your consent. Processors needed to run the service (hosting, email delivery) are covered by the processing and transfer notice above. To verify an organisation, we check its business registration status with Korea's National Tax Service using the registration number, the representative's name and the opening date.

6. Your rights

You may request access to, correction of, deletion of, or a halt to processing of your personal information, and withdraw consent, at any time. Reply to any email from us, or contact privacy@lucyesl.com, and we will act promptly.

7. Security

Passwords are stored with an irreversible hash, the site's records keep IP addresses only as salted hashes (the server's access log keeps the raw address for 52 days), and the site is served over HTTPS end to end.

8. Contact

Privacy questions: privacy@lucyesl.com