Privacy Policy
Last updated: 5 September 2026
This policy explains what we do with information about you when you use learnkoreanonlinehub.com. We have written it in plain English rather than legal boilerplate, because a policy nobody reads protects nobody.
The short version
- You can use most of the site without an account and without telling us anything.
- If you create an account we hold your email address and your learning progress, so it follows you between devices.
- We never see your card details. Payments are handled by our payment provider.
- We do not sell personal data, we do not run advertising, and we do not share your data with advertisers.
- You can delete your account and everything in it at any time, from your account settings or by emailing us.
1. Who we are
Learn Korean Online Hub is a trading name of Lunar Interactive Arts Ltd, a company registered in England and Wales (company number 12044811), registered office 102 Lady Margaret Road, London N19 5EX. For data protection purposes we are the data controller for this site.
Questions about anything in this policy, or any request about your data: [email protected].
2. What we collect, and why
| What | When | Why | Lawful basis |
|---|---|---|---|
| Email address | You create an account | To identify your account, let you sign in, send you a password reset and tell you about anything important, such as a change to these terms or a problem with your payment | Contract |
| Password (hashed) or a sign-in token from Google | You create an account | To keep the account yours | Contract |
| Display name, if you set one | Optional | To greet you by name | Consent |
| Learning progress: lessons finished, review schedules, XP, rank, streak, settings | As you use the site with an account | To give you the product you signed up for, and to sync it across your devices | Contract |
| Subscription status and payment history | You subscribe | To know what you have access to, and to handle refunds and billing questions | Contract, and legal obligation for tax records |
| Support messages | You email us | To answer you | Legitimate interests |
| Usage analytics: pages viewed, country, device type, referrer | Every visit | To see which parts of the site work and which do not | Legitimate interests for privacy-friendly analytics, consent for anything using cookies |
| Server logs, including IP address | Every visit | Security, abuse prevention and diagnosing faults | Legitimate interests |
We do not collect special category data. We do not ask for your date of birth, your address or your phone number, and you should not send them to us.
3. Without an account
You can use the charts, the vocabulary, the grammar reference, the situation guides, the printables and the whole Hangul course and the open days of the other courses without signing up. If you do, your progress is stored only in your own browser, using localStorage. We cannot read it, we cannot restore it, and it disappears if you clear your browsing data or switch device. That is a deliberate trade: no account means no data with us. The one exception is the newsletter: if you choose to subscribe, we hold the address you gave us, and section 6 explains exactly what that means.
4. Payments
Subscriptions are processed by our payment provider, who acts as the merchant of record for the sale. That means we never receive or store your card number. It goes directly to the payment provider, who is a specialist regulated for exactly this.
What we receive back is limited to what we need to run your subscription: that a payment succeeded or failed, which plan you are on, when the current period ends, the country used for tax, and the last four digits and card type so you can recognise your own payment method. The provider handles the payment as an independent controller under its own privacy policy, which is linked from the checkout.
5. Cookies and local storage
We keep this deliberately small.
- Essential. A sign-in session cookie once you have an account, so you stay signed in. Local storage for your progress and your display settings, such as whether romanisation is showing. These cannot be turned off without breaking the site, and no consent is required for them.
- Analytics. Cloudflare Web Analytics, which sets no cookies and does not fingerprint or track you across sites. If we also run Google Analytics, it loads only after you consent, and you can withdraw that at any time from the cookie banner.
- Advertising. None. There are no advertising or social media tracking cookies on this site.
6. Email we send you
Two kinds, and they are separate.
- Service email you cannot unsubscribe from while you hold an account: sign-in links, receipts, renewal notices, changes to these terms, and security notices. There are few of them and they are all necessary to provide the service you asked for.
- The newsletter, which is one short Korean lesson a week, new guides, and occasionally an offer. It is entirely optional and we send it only to people who ticked the box to ask for it. Our lawful basis is your consent, and you can withdraw it at any time.
You can subscribe to the newsletter without an account. If you do, the only thing we hold is your email address, the date you subscribed, which page you subscribed from, and the wording of the consent you were shown. We do not link it to anything else and we do not use it to profile you.
To stop receiving it, use the unsubscribe link at the bottom of any newsletter. It works immediately, it does not ask you to sign in, and it does not ask you why. You can also email [email protected] and we will do it for you. Unsubscribing stops the emails; ask us to delete the address as well and we will.
We do not use your address for anything you did not ask for, we do not pass it to anyone other than the email provider named below, and there is no version of this where creating an account subscribes you by default.
7. Who else sees your data
We use a small number of service providers, each of which processes data only on our instructions and under a data processing agreement:
- Cloudflare, hosting, content delivery and privacy-friendly analytics.
- Our authentication and database provider, which stores your account and progress.
- Our payment provider, which handles subscriptions and tax.
- Resend, our email provider, which sends the messages described above and holds the newsletter list, including the record of who has unsubscribed.
We do not sell your data, rent it, or share it with advertisers or data brokers. We would disclose data if we were legally required to, and we would tell you unless we were prohibited from doing so.
8. Where your data is held
We prefer providers that hold data in the UK or the EEA. Some of our providers are based in the United States. Where personal data is transferred outside the UK, it is protected by the UK International Data Transfer Addendum, Standard Contractual Clauses, or a UK adequacy decision, depending on the provider.
9. How long we keep it
- Account and progress data: while your account is open. Delete the account and it is removed within 30 days, including from backups on their normal rotation.
- Payment and tax records: six years, because HMRC requires it. This is the one thing we cannot delete on request.
- Support email: two years.
- Server logs: up to 30 days.
- Analytics: aggregated, and not tied to your account.
10. Your rights
Under UK GDPR you have the right to access your data, correct it, delete it, restrict or object to how we use it, take it with you in a portable format, and to withdraw consent where consent is what we relied on.
Most of these you can exercise yourself from your account settings, which is faster than emailing us: export your progress, change your email, delete your account. For anything else, write to [email protected] and we will respond within one month. We will not charge you and we will not make it difficult.
If you are unhappy with how we have handled your data you can complain to the Information Commissioner’s Office at ico.org.uk, or to your local supervisory authority if you are in the EEA. We would rather you told us first so we can put it right.
11. Children
This site is not aimed at children under 13 and we do not knowingly collect their data. If you are under 18, please get a parent or guardian to agree before creating an account or subscribing. If you believe a child has given us personal data, email [email protected] and we will delete it.
12. Security
Passwords are hashed and never stored in a readable form. The site is served over HTTPS only. Access to the production database is limited to those who need it. No system is perfectly secure, and we will not pretend otherwise, but if there were a breach affecting your rights we would report it to the ICO within 72 hours and tell you without undue delay.
13. Changes
If we change this policy the date at the top changes with it. For anything that materially affects you, such as a new category of data or a new purpose, we will email account holders before it takes effect.