Basic principles
LSLABS Inc. (the "Company") establishes and discloses this Privacy Policy as follows in order to comply with relevant laws, including the Personal Information Protection Act, while providing the Timetable Expert service, and to process the personal information of users and school members safely.
The Company processes personal information only within the scope specified in the purposes of processing, and does not use it for other purposes or provide it to third parties without the consent of the data subject or a legal basis.
Data processing when connecting AI services
If a user agrees to connect ChatGPT or Claude, the following may be passed to the requesting service within the selected school and the permitted scope of work: timetable names, lesson placements, teacher names, subjects taught, periods by class, assignment restrictions, daily schedules by grade, and school data validation messages. Student names, student ID numbers and individual option block placement tables are not included in the values returned by the connection tools.
Generating timetables, running diagnostics, moving lessons, and registering or modifying school data (teachers, periods, lesson conditions, etc.) can be requested, after prior review, through a connection for which separate consent to edit permissions has been given. The Company stores user, school, client, permission and expiry information and hashed tokens for connection authentication and permission checks, and does not store the original text of conversations in the AI service through this connection feature.
A connection is valid for up to 30 days and can be removed at /oauth/connections. Once it is removed, further viewing and changes are blocked. The storage and deletion of information already passed are governed by the settings and privacy policy of the relevant AI service. Connection information is deleted, usually within 2 days, by a regular cleanup job after expiry or removal.
Article 1. Purposes, items, legal grounds and retention periods of personal information processing
The Company processes the minimum personal information necessary to provide the service, as follows.
| Category | Purpose of processing | Items processed | Legal ground or basis for processing | Retention period |
|---|---|---|---|---|
| Teacher and administrator accounts | Member identification, login, confirmation of school affiliation, permission management, customer support, security and prevention of fraudulent use | Name, email, mobile phone number, school of affiliation, role and permissions, access information | Article 15(1)4 of the Personal Information Protection Act (conclusion and performance of a contract) | Within 1 year after membership withdrawal, termination of the school's contract, or achievement of the purpose of processing |
| School work data | Support for school education and academic affairs work, provision of outputs | School name, school year and semester, grade and class, teachers and classrooms, timetables and staffing, student choices and option block data, and other school work data | The service agreement between the school and the Company and the relationship of entrustment of personal information processing, Article 26 of the Personal Information Protection Act | Retained during the contract period, and deleted or returned within 1 year after a deletion request from the school, termination of the contract, or achievement of the purpose of processing |
| Done-for-you service and customer support materials | Performing done-for-you work, responding to inquiries, handling failures, responding to complaints, providing usage guidance | Done-for-you request materials provided by the school, attachments, inquiry content, processing history, intermediate outputs, final outputs | Article 15(1)4 of the Personal Information Protection Act (conclusion and performance of a contract), and Article 26 of the Personal Information Protection Act where there is a relationship of entrustment of personal information processing between the school and the Company | Within 1 year after the work or the handling of the inquiry is completed |
| Contract and settlement information | Application for paid services, contracts, tax invoices, settlement, refund processing | Name of the person in charge, contact number, email, payment history, tax invoice information, business registration number or unique number, refund account information | Article 15(1)4 of the Personal Information Protection Act (conclusion and performance of a contract), compliance with obligations under relevant laws | The retention period under relevant laws, or within 1 year after completion of the contract and settlement |
| Teacher mobile app notifications | Sending notifications from the teacher mobile app (iOS, Android), managing the devices that receive notifications | Device type (iOS, Android), device name, notification token, last used date and time | Consent of the data subject (allowing notifications in the app) | Deleted when notifications are turned off, when the device is logged out, upon membership withdrawal, or upon termination of the school's contract |
| Service usage records | Service security, failure analysis, prevention of fraudulent use, management of access records, website visit statistics | Access IP, access date and time, usage records, device and browser information, logs, website visit statistics | Article 15(1)4 of the Personal Information Protection Act (conclusion and performance of a contract), relevant laws such as the Protection of Communications Secrets Act | 3 months for visit records under the Protection of Communications Secrets Act; other records within 1 year after the purpose is achieved |
School work data is not information that students or parents provide directly to the Company. It is data that the school enters or uploads to the service, or provides to the Company, to carry out its education and academic administration work.
The Company does not recommend uploading sensitive or unnecessary information that is not needed to provide the service, such as resident registration numbers or health information.
Article 2. Retention under laws
Where there is information that must be retained for a certain period under relevant laws, the Company stores that information separately and does not use it for other purposes.
| Information retained | Retention period | Legal basis |
|---|---|---|
| Records on contracts or withdrawal of subscriptions, etc. | 5 years | Act on the Consumer Protection in Electronic Commerce, etc. |
| Records on payment and the supply of goods, etc. | 5 years | Act on the Consumer Protection in Electronic Commerce, etc. |
| Records on consumer complaints or dispute resolution | 3 years | Act on the Consumer Protection in Electronic Commerce, etc. |
| Tax evidence such as electronic tax invoices | 5 years | Value-Added Tax Act and other tax laws |
| Communication confirmation data such as website visit records | 3 months | Protection of Communications Secrets Act |
Article 3. Methods of collecting personal information
The Company collects personal information by the following methods.
- Entered directly by users during sign-up, login, school creation and the granting of permissions
- Entered or uploaded directly to the service screens by the school's person in charge
- Provided by the school by email, customer support channels or attachments (Excel, PDF, etc.) for done-for-you work
- Access records, logs and device information generated automatically while using the service
- Device type, device name and notification token passed by the teacher mobile app when notifications are allowed
- Information provided in the course of customer support inquiries
- Information provided in the course of applying for paid services, contracts, confirming bank transfers and issuing tax invoices
Article 4. Students and children under the age of 14
The service does not offer direct sign-up for students or parents, and the Company does not collect personal information directly from students or parents to create accounts.
Where a school enters or uploads student information to carry out its work, the Company processes that information within the scope of the service agreement with the school and the entrustment of personal information processing. Requests to access, correct, delete or suspend the processing of student information that the school processes as a personal information controller are, in principle, received and handled through that school.
Where the Company collects personal information of children under the age of 14 directly, it obtains the consent of their legal representative, and may collect the minimum information necessary to confirm that consent, such as the legal representative's name and contact details.
Article 5. Provision of personal information to third parties
The Company processes the personal information of data subjects only within the scope of the purposes specified in Article 1, and does not provide personal information to third parties except where permitted by relevant laws, such as with the consent of the data subject or under special provisions of law.
School administrators and staff viewing or processing student, staff and school operation information in the service according to their permissions is part of the school carrying out its work.
If the Company is to provide personal information to a third party, it gives prior notice of the recipient, the purpose of provision, the items provided, and the retention and use period, and obtains the necessary consent or confirms the legal basis.
Article 6. Entrustment of personal information processing
The Company entrusts part of its personal information processing to outside companies in order to provide the service reliably.
| Trustee | Entrusted work | Retention and use period |
|---|---|---|
| Vercel Inc. | Web application hosting and deployment | Until the entrustment contract ends or the service ends |
| Railway Corporation | Operation of servers, databases and storage | Until the entrustment contract ends or the service ends |
| Google LLC | Operation of domain email, sending, receiving and storing email | Until the entrustment contract ends or the service ends |
| Google LLC (Firebase Cloud Messaging) | Sending teacher mobile app notifications | Until notifications are turned off, the device is logged out, or use of the service ends |
| Channel Corp. | Receiving customer inquiries, consultation and managing customer support history through Channel Talk | Within 1 year after the inquiry is handled |
| Plausible Insights OÜ | Website visit statistics analysis | Until the purpose of statistical analysis is achieved or use of the service ends |
When concluding an entrustment contract, the Company states in the contract or other documents matters such as the prohibition of processing personal information for purposes other than the entrusted work, technical and administrative safeguards, restrictions on re-entrustment, management and supervision of the trustee, and liability for damages, and manages and supervises the trustee.
If the content of the entrusted work or the trustee changes, the Company discloses it through this Policy.
Article 7. Overseas transfer of personal information
To provide the service and perform contracts with data subjects, the Company stores and entrusts personal information processing overseas as follows.
- Type of transfer
- Entrustment of processing and storage
- Legal basis
- Articles 26 and 28-8(1)3 of the Personal Information Protection Act (entrustment of processing and storage overseas to perform a contract)
- Recipient and contact
- Vercel Inc. / privacy@vercel.com
- Destination country
- United States, Singapore, and the countries where the trustee and sub-trustees process data
- Items transferred
- Account information, access information, and information transmitted while using the service
- Purpose of transfer
- Web application hosting and deployment
- Time and method of transfer
- Encrypted network transmission when using the service
- Retention and use period
- For the period the service is provided, or until the entrustment contract ends
- How to refuse the transfer and the effect of refusal
- You may refuse the overseas transfer, but if you do, your use of the service may be restricted.
- Type of transfer
- Entrustment of processing and storage
- Legal basis
- Articles 26 and 28-8(1)3 of the Personal Information Protection Act (entrustment of processing and storage overseas to perform a contract)
- Recipient and contact
- Railway Corporation / privacy@railway.com
- Destination country
- United States, Singapore, and the countries where the trustee and sub-trustees process data
- Items transferred
- Account information, school work data, service logs
- Purpose of transfer
- Operation of servers, databases and storage
- Time and method of transfer
- Encrypted network transmission when using the service and storing data
- Retention and use period
- For the period the service is provided, or until the entrustment contract ends
- How to refuse the transfer and the effect of refusal
- You may refuse the overseas transfer, but if you do, your use of the service may be restricted.
- Type of transfer
- Entrustment of processing and storage
- Legal basis
- Articles 26 and 28-8(1)3 of the Personal Information Protection Act (entrustment of processing and storage overseas to perform a contract)
- Recipient and contact
- Google LLC / https://support.google.com/contact/privacy
- Destination country
- United States and the countries where Google LLC provides services
- Items transferred
- Email addresses, email body text, attachments
- Purpose of transfer
- Sending, receiving and storing domain email
- Time and method of transfer
- Encrypted network transmission when sending and receiving email
- Retention and use period
- For the period the service is provided, or until the entrustment contract ends
- How to refuse the transfer and the effect of refusal
- You may refuse the overseas transfer, but if you do, consultation by email and requests for done-for-you work may be restricted.
- Type of transfer
- Entrustment of processing
- Legal basis
- Articles 26 and 28-8(1)3 of the Personal Information Protection Act (entrustment of processing and storage overseas to perform a contract)
- Recipient and contact
- Google LLC (Firebase Cloud Messaging) / https://support.google.com/contact/privacy
- Destination country
- United States and the countries where Google LLC provides services
- Items transferred
- Notification token, device type, notification title and content
- Purpose of transfer
- Sending teacher mobile app notifications
- Time and method of transfer
- Encrypted network transmission when notifications are sent
- Retention and use period
- Until notifications are turned off, the device is logged out, or use of the service ends
- How to refuse the transfer and the effect of refusal
- If you do not allow notifications in the app, no transfer takes place. You can use the app's other features without receiving notifications.
- Type of transfer
- Entrustment of processing and storage
- Legal basis
- Articles 26 and 28-8(1)3 of the Personal Information Protection Act (entrustment of processing and storage overseas to perform a contract)
- Recipient and contact
- Plausible Insights OÜ / privacy@plausible.io
- Destination country
- Estonia, Germany and other countries within the European Union where the service is provided
- Items transferred
- Website visit statistics
- Purpose of transfer
- Analysis of website usage statistics
- Time and method of transfer
- Encrypted network transmission when visiting the website
- Retention and use period
- Until the purpose of statistical analysis is achieved or use of the service ends
- How to refuse the transfer and the effect of refusal
- Refusing the overseas transfer does not affect your use of the core service.
If you wish to refuse the overseas transfer, you may make a request to customer support or the Chief Privacy Officer. However, if you refuse overseas entrustment of processing or storage that is essential to providing the service, your use of the service may be restricted. If the details of overseas transfers change, the Company discloses them through this Policy.
Article 8. Destruction of personal information
When personal information is no longer needed, such as when the retention period has passed, the purpose of processing has been achieved, the school has requested deletion, a member has withdrawn, or a contract has ended, the Company destroys that personal information without delay.
- Electronic files are deleted so that they cannot be restored or reproduced.
- Paper documents are shredded or incinerated.
- Backup data is deleted or overwritten according to the backup cycle.
Information that must be retained for a certain period under laws is stored separately and is not used for other purposes.
Article 9. Rights and obligations of data subjects and legal representatives, and how to exercise them
Data subjects may request the Company to provide access to, correct, delete, or suspend the processing of their personal information, or withdraw their consent.
- Rights regarding teacher and administrator account information collected directly by the Company can be exercised by making a request to the Company's customer support or the Chief Privacy Officer.
- Requests to access, correct, delete or suspend the processing of student, staff and school operation data that a school processes for its work are, in principle, received and handled through that school.
- If the Company directly receives a request concerning school data, it handles the request in consultation with the school after verifying the requester's identity and authority.
- Rights regarding the personal information of children under the age of 14 may be exercised by their legal representative. However, where the Company does not currently offer direct sign-up for students and parents, requests concerning student information for which the school is the processing entity are handled through that school.
- On receiving a request to exercise rights, the Company takes action without delay in accordance with relevant laws and, in principle, replies with the result within 10 days. However, if there is a ground for restriction under law, the Company may inform you of that ground.
Requests to exercise rights can be made to support@timetable.expert.
Article 10. Measures to ensure the security of personal information
The Company takes the following measures to ensure the security of personal information.
- Minimizing the number of personnel who process personal information and managing access rights
- Protecting passwords and encrypting data in transit
- Retaining access records and managing logs of key actions
- Restricting access to done-for-you work materials and managing their deletion
- Operating security incident response procedures
Article 11. Cookies, automatic collection tools and usage statistics
The Company may use cookies or similar technologies to keep users logged in, for security, and to check service usage statistics. Users can refuse to store cookies through their browser settings, but in that case some features, such as staying logged in, may be limited.
The Company does not currently collect or use behavioral information to provide personalized advertising.
The teacher mobile app stores the notification token issued by the operating system and the device name in order to send notifications. Notifications can be turned off in the device settings or the app's notification settings, and the notification token for that device is deleted when you log out. The app does not access other device information such as location, contacts or photos.
The Company may use Plausible Analytics to check website visit statistics. Plausible Analytics provides aggregate statistics without using cookies, and does not directly identify visitors or track them across multiple websites.
Article 12. Sensitive information, pseudonymized information and automated decisions
The Company does not request the entry or upload of sensitive information or unique identification information that is not necessary to provide the service. It also does not offer features, such as public bulletin boards or social network features, through which sensitive information entered by users is disclosed to the general public.
The Company does not use school data or original done-for-you work files to train external AI models, and does not separately create pseudonymized information to process it for statistics, scientific research or archiving in the public interest.
The Company does not make automated decisions under Article 37-2 of the Personal Information Protection Act. If it carries out processing that constitutes an automated decision, it gives prior notice and takes the necessary measures.
Article 13. Chief Privacy Officer
The Company designates a Chief Privacy Officer as follows to take overall responsibility for work related to personal information processing, and to handle inquiries, complaints and remedies for damages related to personal information processing.
| Item | Details |
|---|---|
| Chief Privacy Officer | Jaebok Lee |
| Department in charge of privacy | Customer Support |
| Main phone number | +82-70-4138-0149 |
| support@timetable.expert | |
| Customer support | Channel Talk customer support channel |
Article 14. Remedies for infringement of rights
If data subjects need to report or seek advice on an infringement of personal information, they may contact the organizations below.
| Organization | Contact | Website |
|---|---|---|
| Personal Information Infringement Report Center | 118 (no area code) | https://privacy.kisa.or.kr |
| Personal Information Dispute Mediation Committee | 1833-6972 | https://www.kopico.go.kr |
| Supreme Prosecutors' Office | 1301 (no area code) | https://www.spo.go.kr |
| Korean National Police Agency Cyber Crime Reporting System | 182 (no area code) | https://ecrm.police.go.kr |
Article 15. Changes to this Privacy Policy
If the Company changes this Privacy Policy, it announces the changes and the effective date through service notices or the website.
If important matters such as the purposes of processing, items, retention periods, provision to third parties, entrustment or overseas transfer change, the Company announces them sufficiently in advance of the effective date.
| Version | Effective date | Main changes |
|---|---|---|
| 260608 | June 8, 2026 | Initial version |
| 261014 | October 14, 2026 | Added teacher mobile app notification items (device type, device name, notification token); added Firebase Cloud Messaging as a trustee and as an overseas transfer |
Previous versions of this Privacy Policy are made available on the website or upon request to customer support.