Privacy Policy

Last Updated: April 14, 2026
Effective Date: April 14, 2026

1. Data Controller & Contact Information

This Privacy Policy governs the processing of personal data by [Your Full Legal Name / Registered Company Name] (“we”, “us”, “our”, the “Controller”), the operator of the educational website [Your Website Name], accessible at [yourdomain.com] (the “Site”).

We are the sole data controller, responsible for determining the purposes and means of processing your personal data, in compliance with global data protection laws.

For all privacy-related inquiries, contact us at:

Email: [gwang4821@gmail.com]
Physical Address: [Your Full, Mailable Physical Address (PO Boxes are not accepted for EU/UK compliance)]
Data Protection Officer (DPO): [gwang4821@gmail.com] (if applicable)

2. Scope & Global Compliance

This policy applies to all visitors, users, and subscribers of the Site, regardless of geographic location. It is designed to achieve full compliance with all applicable global data protection regulations, including but not limited to:

General Data Protection Regulation (GDPR) (EU/EEA)
UK GDPR (United Kingdom)
California Consumer Privacy Act (CCPA/CPRA) (California, USA)
Personal Information Protection and Electronic Documents Act (PIPEDA) (Canada)
Lei Geral de Proteção de Dados (LGPD) (Brazil)
Protection of Personal Information Act (POPIA) (South Africa)
Privacy Act 1988 & Australian Privacy Principles (APPs) (Australia)
ePrivacy Directive (EU Cookie Law)
Children’s Online Privacy Protection Act (COPPA) (USA)
EU-US Data Privacy Framework (DPF) & UK-US Data Bridge

By accessing or using the Site, you acknowledge that you have read, understood, and agreed to the terms of this policy.

3. Key Definitions

Personal Data: Any information that relates to an identified or identifiable natural person (the “Data Subject”), including but not limited to email addresses, contact details, and online identifiers.
Processing: Any operation performed on personal data, including collection, storage, use, disclosure, restriction, or deletion.
Data Processor: A third-party service provider that processes personal data on our behalf, under our written instructions.
Consent: Any freely given, specific, informed, and unambiguous indication of your agreement to process your personal data.
Sensitive Personal Data: Data revealing racial or ethnic origin, religious beliefs, political opinions, health status, sexual orientation, or financial information (we do not collect this data unless explicitly required for paid services).

4. Core Data Processing Principles

We process all personal data in strict adherence to the following globally recognized principles:

Lawfulness, Fairness, Transparency: All processing is legal, justified, and fully disclosed to you.
Purpose Limitation: Data is collected only for the explicit, stated purposes in this policy.
Data Minimization: We collect only the minimum data necessary to fulfill the stated purposes.
Accuracy: We take reasonable steps to ensure your personal data is accurate and up to date.
Storage Limitation: Data is retained only for as long as necessary for the stated purposes.
Integrity & Confidentiality: We implement industry-standard security measures to protect your data.
Accountability: We take full responsibility for complying with the principles above and applicable laws.

5. Personal Data We Collect

We collect only data necessary to operate, improve, and deliver our educational services (book breakdowns, lecture summaries, study guides, and related content). We never collect data without a valid legal basis.

5.1 Data You Voluntarily Provide to Us

Newsletter Subscription: Your email address, when you opt in to receive our newsletter, new content alerts, or free study resources.
Contact Form Submissions: Your name, email address, and message content, when you submit an inquiry or feedback via our contact form.
Account Data (if applicable): Your username, email address, and hashed password, if you create a user account on the Site.
Paid Service Data (if applicable): Billing details, transaction history, and delivery information, if you purchase paid study materials or memberships.

5.2 Data Automatically Collected

When you visit the Site, we may collect non-identifiable and limited identifiable data via cookies and server logs, including:

IP address (anonymized where required by law)
Device type, browser version, and operating system
Referral source (the website that directed you to our Site)
Pages visited, session duration, time spent on content, and click behavior
Approximate geographic location (country/region level, not precise GPS coordinates)
Aggregate, anonymized usage analytics data

5.3 Data We Do NOT Collect

We do not intentionally collect:

Sensitive personal data (race, religion, health, political opinions, biometric data, or financial information outside of optional paid transactions)
Personal data from children under the age of 13 (in compliance with COPPA)
Any data not explicitly listed in this policy
Data through deceptive or misleading means

6. Lawful Bases for Processing (GDPR/UK GDPR)

We only process your personal data when we have a valid legal basis, as required by GDPR and UK GDPR:

Consent: We process your data when you give explicit, opt-in consent, including:
- Sending newsletter and marketing communications
- Placing non-essential cookies (analytics, advertising)
- Providing free study resources in exchange for your email
You may withdraw your consent at any time, without affecting the lawfulness of processing before withdrawal.
Legitimate Interests: We process data for our legitimate business interests, where these do not override your privacy rights, including:
- Ensuring Site security, fraud prevention, and spam protection
- Improving Site performance, content relevance, and user experience
- Conducting anonymized analytics to understand content engagement
- Enforcing our Terms of Service and copyright policies
Legal Obligation: We process data to comply with applicable laws, regulations, court orders, or valid legal requests from governmental authorities.
Contractual Necessity: We process data to fulfill our contractual obligations to you, including delivering paid study materials or membership services you have purchased.

7. Purposes of Processing Your Personal Data

We use your personal data exclusively for the purposes disclosed in this policy, and never for unrelated or secondary purposes without your explicit consent. Our core processing purposes are:

Deliver our educational content, including book breakdowns, lecture summaries, and study guides
Send newsletter updates, new content alerts, and free educational resources (only with your opt-in consent)
Respond to your inquiries, support requests, and feedback
Analyze user behavior to improve Site design, content quality, and user experience
Ensure Site security, prevent spam, fraud, and abusive activity
Comply with legal obligations and enforce our Terms of Service
Process and fulfill paid service orders (if applicable)
Comply with copyright and fair use requirements, including responding to valid intellectual property requests

We will never sell, rent, lease, or share your personal data with third parties for their own marketing purposes, without your explicit written consent.

8. Data Sharing & Third Parties

We share your personal data only in the limited circumstances outlined below, in full compliance with global data protection laws.

8.1 Authorized Data Processors

We share data only with vetted, GDPR/CCPA-compliant third-party service providers (Data Processors), who process data solely on our written instructions, to deliver core Site functionality. All processors are bound by written Data Processing Agreements (DPAs) that enforce strict data protection obligations.

Our authorized processors include:

Email Delivery Services: [e.g., Mailchimp, Amazon SES] – to send newsletters and transactional emails
Analytics Providers: [e.g., Google Analytics 4] – to measure Site traffic and user engagement (only with your consent)
Hosting & CDN Providers: [e.g., AWS, Cloudflare] – to securely host the Site and deliver content
Security Providers: [e.g., Cloudflare] – to provide DDoS protection, web application firewall, and threat prevention
Form & Survey Tools: [e.g., Typeform, WP Forms] – to process contact form and subscription submissions
Payment Processors (if applicable): [e.g., Stripe, PayPal] – to process paid service transactions (we do not store full payment card details)

8.2 Legal & Safety Disclosures

We may disclose your personal data only if required to do so by law, or in the good faith belief that such action is necessary to:

Comply with a valid court order, subpoena, or regulatory request
Protect our legal rights, property, or safety, and that of our users or the public
Prevent or investigate fraud, illegal activity, or violations of our Terms of Service
Fulfill obligations under applicable international, national, or local laws

8.3 No Sale of Personal Data

We do NOT sell, rent, lease, or share your personal data to third parties for monetary or other valuable consideration, and have not done so in the preceding 12 months. This is in full compliance with CCPA/CPRA, LGPD, and other global regulations.

9. International Data Transfers

Your personal data may be transferred to, stored, and processed in countries outside of your country of residence, including the United States, EU/EEA, and the United Kingdom.

We ensure all international data transfers comply with applicable laws, with the following safeguards:

EU-US Data Privacy Framework (DPF): For transfers from the EU/EEA to the United States, we rely on the EU-US DPF, approved by the European Commission as providing an adequate level of data protection.
UK-US Data Bridge: For transfers from the United Kingdom to the United States, we rely on the UK-US Data Bridge, approved by the UK Information Commissioner’s Office (ICO).
Standard Contractual Clauses (SCCs): For all other international transfers, we use the European Commission’s approved SCCs, which enforce binding data protection obligations on the receiving party.
Additional Safeguards: All transfers are protected by end-to-end encryption, and we only transfer data to countries with recognized adequate data protection laws where possible.

10. Cookies & Similar Technologies

We comply fully with the EU ePrivacy Directive and global cookie laws. We only use non-essential cookies with your explicit, opt-in consent.

10.1 Types of Cookies We Use

Cookie Type	Purpose	Consent Required
Strictly Necessary Cookies	Required for core Site functionality, including navigation, security, and access to restricted areas.	No – these are essential for the Site to operate.
Performance/Analytics Cookies	Measure Site traffic, user engagement, and content performance (e.g., Google Analytics 4).	Yes – only enabled with your explicit consent.
Functional Cookies	Remember your preferences, including language settings and layout preferences.	Yes – only enabled with your explicit consent.
Advertising/Targeting Cookies	Deliver relevant ads (e.g., Google AdSense) and measure ad performance.	Yes – only enabled with your explicit consent.

10.2 Your Cookie Control Rights

You can manage your cookie preferences at any time:

Accept or decline non-essential cookies via our first-visit Cookie Banner
Update your preferences at any time via the Cookie Preferences page, permanently linked in the Site footer
Block or delete cookies via your browser settings
Withdraw consent for non-essential cookies at any time, with no impact on your ability to use the core Site

11. Data Retention

We retain your personal data only for as long as necessary to fulfill the explicit purposes for which it was collected, and to comply with legal, accounting, or reporting obligations.

Our standard retention periods are:

Newsletter Subscription Data: Retained until you unsubscribe. After unsubscription, we retain your email address for 30 days to process your withdrawal request, then permanently delete it.
Contact Form Inquiries: Retained for 3 years from the date of your last interaction, to resolve follow-up inquiries and comply with legal obligations, then permanently delete it.
Analytics & Server Log Data: Retained for 12 months, after which it is fully anonymized. Anonymized aggregate data may be retained indefinitely for statistical purposes.
Paid Service Data: Retained for 7 years from the date of transaction, to comply with tax, accounting, and consumer protection laws.
Legal & Compliance Data: Retained for the period required by applicable law, up to 10 years, to meet regulatory obligations.

At the end of the retention period, we either permanently delete, anonymize, or irreversibly encrypt your personal data.

12. Your Data Subject Rights

You have the following rights under applicable global data protection laws. You may exercise any of these rights by contacting us at [gwang4821@gmail.com]. We will verify your identity before processing any request, and respond within the legally required timeframe (30 days for GDPR/UK GDPR, 45 days for CCPA/CPRA).

12.1 Rights for EU/EEA & UK Residents (GDPR/UK GDPR)

Right of Access: Request a copy of the personal data we hold about you.
Right to Rectification: Request correction of inaccurate or incomplete personal data.
Right to Erasure (Right to be Forgotten): Request permanent deletion of your personal data, where legally permitted.
Right to Restriction of Processing: Request that we restrict processing of your data, in specified circumstances.
Right to Data Portability: Receive your personal data in a structured, machine-readable format, or request transfer to another controller.
Right to Object: Object to processing of your personal data based on our legitimate interests.
Right to Withdraw Consent: Withdraw your consent for any processing based on consent, at any time.

12.2 Rights for California Residents (CCPA/CPRA)

Right to Know: Request disclosure of the personal data we collect, use, disclose, or share about you.
Right to Delete: Request deletion of the personal data we hold about you, subject to legal exceptions.
Right to Opt-Out of Sale/Sharing: We do not sell or share your personal data; this right is not applicable, but we maintain a dedicated opt-out page for full compliance.
Right to Non-Discrimination: We will not discriminate against you for exercising your CCPA rights, including by denying service, charging different prices, or reducing service quality.
Right to Correct: Request correction of inaccurate personal data.

12.3 Rights for Global Residents

Canadian Residents (PIPEDA): Right to access, correct, and request deletion of your personal data, and to withdraw consent for processing.
Brazilian Residents (LGPD): All rights under GDPR, plus the right to anonymize, block, or delete unnecessary data, and to challenge automated decision-making.
Australian Residents (APPs): Right to access and correct your personal data, and to make a complaint about a breach of the Australian Privacy Principles.
South African Residents (POPIA): Right to access, correct, and request deletion of your personal data, and to object to processing based on legitimate interests.

13. Data Security

We implement industry-leading technical and organizational security measures to protect your personal data from unauthorized access, disclosure, alteration, or destruction. Our measures include:

End-to-end encryption of all data in transit via TLS 1.3
AES-256 encryption of all personal data at rest
Strict least-privilege access controls, with only authorized staff able to access personal data
Regular security audits, vulnerability scans, and penetration testing
Web Application Firewall (WAF) and DDoS protection
Comprehensive data breach response plan, with mandatory notification to you and regulators within legally required timeframes
Mandatory data protection training for all staff with access to personal data

While no system is 100% secure, we maintain compliance with global security standards to protect your data.

14. Children’s Privacy (COPPA Compliance)

The Site is intended for a general audience, and is not directed at children under the age of 13. We do not knowingly collect or process personal data from children under 13.

If we become aware that we have collected personal data from a child under 13, we will take immediate steps to permanently delete that data. If you are a parent or guardian and believe we have collected data from your child, please contact us immediately at [privacy@yourdomain.com].

15. Affiliate Disclosure (FTC Compliance)

The Site contains affiliate marketing links, including but not limited to Amazon Associates, Audible Affiliate Program, Bookshop.org, and online course platforms.

When you make a purchase through these affiliate links, we may earn a commission at no additional cost to you. All recommendations, book and lecture breakdowns, and editorial content are based on our independent, objective assessment. We do not accept payment for positive reviews or biased content.

This disclosure complies with the U.S. Federal Trade Commission (FTC) Guides Concerning the Use of Endorsements and Testimonials in Advertising.

16. Changes to This Privacy Policy

We may update this Privacy Policy periodically to reflect changes in our business practices, legal requirements, or Site functionality.

Material changes will be posted on the Site homepage with a prominent notice 30 days prior to the effective date, and will be sent to all active newsletter subscribers.
Minor updates (clarifications, typo corrections) will be posted on this page with an updated “Last Updated” date.
Your continued use of the Site after the effective date of the updated policy constitutes your acceptance of the revised terms.

17. Complaints & Supervisory Authorities

If you have a complaint about our processing of your personal data, please first contact us at [gwang4821@gmail.com]. We will respond to all complaints within 30 days.

If you are unsatisfied with our response, you have the right to lodge a complaint with your local data protection supervisory authority, including:

EU/EEA: European Data Protection Board (EDPB) or your national data protection authority
United Kingdom: Information Commissioner’s Office (ICO)
United States: Federal Trade Commission (FTC) or California Attorney General’s Office
Canada: Office of the Privacy Commissioner of Canada (OPC)
Brazil: Autoridade Nacional de Proteção de Dados (ANPD)
Australia: Office of the Australian Information Commissioner (OAIC)
South Africa: Information Regulator of South Africa (IRSA)