Privacy Policy
Last updated: 16 October 2026
This policy explains what we do with information about you when you use learnkoreanonlinehub.com. It is written in plain English, because a policy nobody reads protects nobody.
The short version
- You can use most of the site without an account and without telling us anything.
- Nothing is for sale yet, so we hold no payment data.
- With an account, we hold your email address and your learning progress so they follow you between devices.
- We never see your card details. Payments are taken by Link, Stripe's payments brand, which is the seller of record.
- We do not sell personal data, we do not run advertising, and we do not share your data with advertisers.
- You can have your account and everything in it deleted at any time, by emailing us.
1. Who we are
Learn Korean Online Hub is a trading name of Lunar Interactive Arts Ltd, a company registered in England and Wales under company number 12044811, with its registered office at 102 Lady Margaret Road, Flat D, London, England, N19 5EX. For data protection purposes we are the data controller for this site.
Questions about this policy, or any request about your data: [email protected] or [email protected].
2. What we collect, and why
| What | When | Why | Lawful basis |
|---|---|---|---|
| Email address | You create an account | To identify your account, send you the sign-in email, and tell you about anything important, such as a change to these terms or a problem with a payment | Contract |
| Learning progress: lessons finished, review schedules, XP, rank, streak, settings | As you use the site with an account | To give you the product and sync it across your devices | Contract |
| Subscription status and payment history | You buy Pro or Lifetime | To know what you have access to, and to handle refunds and billing questions | Contract, and legal obligation for tax records |
| Newsletter address and consent record | You subscribe to the newsletter | To send the newsletter you asked for, and to show when and to what wording you agreed | Consent |
| Support messages | You email us | To answer you | Legitimate interests |
| Visit statistics: pages viewed, referrer, browser and device type, city-level location, language, screen size, a visitor code that changes daily | When you visit | To see which parts of the site work | Legitimate interests |
| Server and security logs, including IP address | When you visit | Security, abuse prevention and diagnosing faults | Legitimate interests |
We do not collect special category data. We do not ask for your date of birth, your postal address or your phone number, and you should not send them to us.
3. Without an account
You can use the Hangul course, the open days of the other courses, the charts, the vocabulary, the grammar reference, the situation guides, the review deck, the games and the printables without signing up. Your progress is then stored only in your own browser, in localStorage, under names beginning lko_. We cannot read it, we cannot restore it, and it disappears if you clear your browsing data or switch device.
4. Payments
Paid plans are sold through Stripe Managed Payments. The seller of record is Link, Stripe's payments brand (it may appear as Onelink in the UK). Link runs the checkout, takes the payment, sends the receipt and handles the tax, so we never receive or store your card number. Your payment details are given to Link and Stripe, who hold them as controllers in their own right under their own privacy policies, linked from the checkout.
We receive only what we need to run your plan: which plan you are on, whether it is active, when the current period ends, and the reference numbers that tie your account to the payment. We send Stripe your account's email address and an account reference when you start a checkout, so the payment can be matched to you.
To show prices in the right currency, the site asks our host, Cloudflare, which country your connection is coming from. We use the answer to pick pounds, euros or dollars and do not store it.
5. Cookies, local storage and fonts
- Essential. When you sign in, a sign-in session kept in your browser (under
lko-auth) and a short-lived cookie,lko_at, that tells the site you are signed in, so the days your account opens can be shown to you. It lasts at most an hour and is renewed while you use the site. Local storage for your progress and settings, such as whether romanisation is showing, and the currency your prices are shown in for the length of a visit. These are needed for the site to work and do not require consent. - Analytics. We measure visits with Ahrefs Web Analytics, and may use Cloudflare Web Analytics as well. Neither sets cookies or tracks you across sites. Ahrefs discards your IP address and keeps the page address, the referring page, your browser type, a city-level location, your language, your screen size and a visitor code that changes every day, so it can count visits without knowing who you are. We will not add any analytics that uses cookies without asking for your consent first.
- Fonts. The site's fonts are loaded from Google Fonts, so your browser sends your IP address to Google when it fetches them. Google does not set cookies for this.
- Advertising. None. There are no advertising or social media tracking cookies on this site.
6. Email we send you
- Service email, which you cannot unsubscribe from while you hold an account: sign-in emails, changes to these terms and security notices. Receipts and renewal notices for a paid plan come from Link.
- The newsletter, which is not open yet: one short Korean lesson a week, new guides and the occasional offer. We send it only to people who ticked the box asking for it, and you can subscribe without an account. We hold the address, the date, the page you subscribed from and the wording you agreed to. Every newsletter has a one-click unsubscribe link, and you can also email [email protected]. Creating an account never subscribes you.
7. Who else processes your data
We use a small number of providers, each processing data only on our instructions and under a data processing agreement:
- Cloudflare: hosting, content delivery, security and visit statistics.
- Ahrefs: visit statistics, without cookies, as described in section 5.
- Supabase: stores your account, your email address and your progress, in the European Union (Ireland).
- Stripe and Link: checkout, payments, receipts and tax, as described in section 4.
- Resend: sends the sign-in emails and the newsletter, and holds the newsletter list including who has unsubscribed.
- Google: fonts only, as described in section 5. There is no Google sign-in.
We do not sell your data, rent it, or share it with advertisers or data brokers. We would disclose data if the law required it, and we would tell you unless we were prohibited from doing so.
8. Where your data is held
Your account, your email address and your progress are held by Supabase in Ireland, in the European Union, and the sign-in emails are sent through Resend's servers in Ireland. The UK treats the EU as giving personal data an adequate level of protection, so no further safeguard is needed for this.
Some of our other providers are based in, or process data in, the United States. Where personal data leaves the UK it is protected by the UK International Data Transfer Addendum, Standard Contractual Clauses or a UK adequacy decision, depending on the provider.
9. How long we keep it
- Account and progress data: while your account is open. Ask us to delete the account and it is removed within 30 days, including from backups on their normal rotation.
- Records of what you bought and when: six years, because company and tax records have to be kept that long. This is the one thing we cannot delete on request. Link and Stripe keep their own payment records under their own policies.
- Newsletter records: until you unsubscribe, then the address is deleted on request; the record that you unsubscribed is kept so you are never emailed again.
- Support email: two years.
- Server logs: up to 30 days.
10. Your rights
Under UK GDPR you have the right to access your data, correct it, delete it, restrict or object to how we use it, take it with you in a portable format, and to withdraw consent where consent is what we relied on. Write to [email protected] and we will respond within one month. We will not charge you and we will not make it difficult.
If you are unhappy with how we have handled your data you can complain to the Information Commissioner's Office at ico.org.uk, or to your local supervisory authority if you are in the EEA. We would rather you told us first so we can put it right.
11. Children
This site is not aimed at children under 13 and we do not knowingly collect their data. If you are under 18, please get a parent or guardian to agree before creating an account or subscribing. If you believe a child has given us personal data, email us and we will delete it.
12. Security
There are no passwords to leak: sign-in uses a link or a one-time code sent to your email address. The site is served over HTTPS only, and access to the production database is limited to those who need it. No system is perfectly secure, but if there were a breach affecting your rights we would report it to the ICO within 72 hours where required and tell you without undue delay.
13. Changes
If we change this policy the date at the top changes with it. For anything that materially affects you, such as a new category of data or a new purpose, we will email account holders before it takes effect.