Privacy Policy of Haru Platform

The Company processes personal information for purposes including website sign-up, provision of goods and services (Lesson matching), handling of user complaints, and service improvement.

1. Identifiers: Name, email address, country, time zone, profile picture, etc.
2. Commercial Information: Transaction records of Lessons and Haru Credits, purchase history, and billing address (processed via PayPal, Toss Payments, or NICE Payments).
3. Sensory Data: Microphone activity and camera access for real-time Lesson delivery.
4. Lesson Recordings: Real-time video lessons are recorded and stored for a period of one (1) month. This data is processed specifically to verify that Lessons were delivered appropriately and to review any complaints or disputes that may arise between Students and Tutors.
5. Access Logs: While you use the service, your IP address, access time, request path, and browser/device information (User-Agent) are generated and recorded automatically. This information is used only for account security (detecting fraudulent sign-ins and account takeover), abuse prevention, and incident response. Only authorized administrators may view it, and every access is recorded in an internal audit log.
6. Promotional Link (QR) Visits: When you open Haru through a QR link on a pamphlet or other promotional material, we record the visit time, an approximate location (country, region, city) and network (network operator and, where your browser provides it, the connection type such as mobile data or Wi-Fi) estimated from your IP address, your device, operating system, and browser type, the referring page, and a random per-browser identifier. Location is estimated with an IP location database kept on our own servers; the raw IP address is not stored for this purpose and is never sent to a third party. If you sign up within 30 days of that visit, your new account is linked to that promotional material. This information is used only to measure promotional effectiveness.
7. Chat Messages: Messages exchanged through the Platform's chat and the names of attached files are stored. This data is used to provide the service, and authorized administrators may review it solely to resolve disputes between users, verify reported issues, check for prohibited conduct, and respond to requests made under applicable law. Administrators may only view conversations and cannot send messages; every access is recorded in an internal audit log. See Article 10 of the Terms of Service for details.
8. Google User Data: Collected only when you choose to use Google Sign-In or the Google Calendar integration. The items collected, how they are used, and how they are protected are set out in Article 7.

1. Lesson Recordings: 1 month (for dispute resolution and quality monitoring).
2. Payment Records: 5 years (as required by statutory law).
3. Access Logs (sign-in history): 90 days (for account security and abuse prevention). Records older than that are deleted automatically.
4. Promotional Link (QR) Visits: 1 year (to measure promotional effectiveness). Records linked to a sign-up are kept until the account is closed; all other records are deleted automatically after that period.
5. Service Operation Logs: 1 year (for incident response and abuse investigation). They record the request time, path, outcome, IP address, and user identifier, and are deleted automatically once the retention period passes. We do not record behaviour unrelated to service requests, such as what you clicked on a screen.
6. Chat Messages: Retained for the duration of service use (for dispute resolution and safety review). Users may request deletion under Article 6; where a dispute is ongoing or retention is required by law, the data is destroyed once that basis no longer applies.
7. Google Calendar Integration Data: Retained only while the integration is connected, and destroyed immediately upon disconnection (Articles 7 and 8).

The Company entrusts the processing of personal information to the following providers, limited to what is necessary to deliver the service.

1. Payment processing: PayPal, Toss Payments, NICE Payments — depending on the payment method you use.
2. Tutor payouts and remittance: PayPal, Payoneer.
3. Service hosting and operation: Cloudtype.
4. File storage and backup: Cloudflare (R2 — uploaded files and service logs), Google (Drive — database backups).
5. Email delivery: Resend (verification and notification email).
6. Live video lessons: Zoom, 8x8 (Jitsi as a Service).
7. Error and log monitoring: Sentry — to diagnose incidents and keep the service stable.
8. Social sign-in and usage analytics: Google (Google Sign-In, Google Analytics).
9. Automatic translation of tutor profiles: Google (Gemini API).
10. Customer inquiries: Google (Gmail — harumeet.support@gmail.com).

The Company supervises these processors under written agreements so that they handle personal information securely, and announces any change of processor through this policy. The Company never sells personal information to third parties and never provides it for advertising or marketing purposes.

Among the processors listed in Article 4, those located outside the Republic of Korea receive the personal information necessary to provide the service. The transfer happens automatically over the network at the moment you use the relevant feature, and the recipient retains the data until the purpose of the entrusted work is fulfilled or the agreement ends.

1. Recipients and countries: PayPal, Payoneer, Cloudflare, Google, Resend, Sentry, Zoom, 8x8 (United States and others).
2. Items transferred: Email address, name, payment and payout details, access logs (IP address, time, request path, device information) — limited to the minimum each processor needs.
3. Purpose: Payment and payout processing, file storage and backup, email delivery, live video lessons, incident response and log monitoring, sign-in authentication, usage analytics, and automatic translation.

You may refuse the transfer of your personal information overseas, in which case the related features (such as payment, video lessons, or social sign-in) may be unavailable. To refuse, contact harumeet.support@gmail.com. Information handled by domestic processors (Cloudtype, Toss Payments, NICE Payments) is stored on servers located in the Republic of Korea.

Users may, at any time, exercise their rights to access, correct, delete, or restrict the processing of their personal information by contacting us at harumeet.support@gmail.com. We respond within 10 days of receiving the request, and on a deletion request we destroy all information except what we are legally required to retain.

The Company processes the following data through Google APIs only when you choose to. Haru's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

1. Google Sign-In: When you sign in with Google, we receive your email address, name, and profile picture (openid, email, and profile scopes) and use them solely to identify you and to create or sign in to your Haru account.
2. Google Calendar integration (optional, tutors only): When a tutor approves “Connect Google Calendar”, we receive access limited to viewing, creating, editing, and deleting events in the calendars the tutor owns (the calendar.events.owned scope), and, if the tutor additionally allows it, permission to view their calendar list (calendar.calendarlist.readonly) and their busy times (calendar.freebusy). We use this access only to (1) create an event in the tutor's primary calendar for each confirmed lesson booking, (2) update that event when the lesson is rescheduled, (3) delete it when the booking is cancelled, and (4) while “Block bookings when I'm busy on Google Calendar” is on (it is on by default and can be turned off at any time on the My Lessons page), check which times in the primary calendar have events marked as busy and, where the tutor has allowed the calendar-list and busy-time permissions, read the calendar list and also check the busy times of calendars the tutor subscribes to by URL (such as another platform's lesson feed), so that Haru bookings cannot be made at those times. For (4) we request, from the primary calendar, only each event's identifier, status and type, its start and end time, its busy/free setting, the tutor's own response status, and the calendar's time zone; from the calendar list, only each calendar's identifier, display name, visibility, access role and time zone; and from other calendars, only busy time ranges (start and end). We never request or store event titles, descriptions, locations, or other attendees, and we do not check calendars shared with the tutor by other people, secondary calendars the tutor created, or Google-provided calendars such as holidays and birthdays. We do not modify or delete any events we did not create, and we never access anyone else's calendar. The event we create contains only the lesson title, the lesson time, and the link to join the lesson room.
3. What we store: The refresh token issued by Google, the connected Google account email, and the calendar identifier, and which permissions the tutor allowed. If “Block bookings when I'm busy” is on, we also store the time ranges to block (start and end times only) and the display names of the calendars we include, and delete them as soon as the tutor disconnects or turns the feature off. We do not collect or store any other information from your Google Calendar.
4. How we protect it: The refresh token is encrypted at rest with AES-256-GCM, and the encryption key is injected only through a server environment variable — it is never kept in source code or in the repository. Only the server logic that synchronises bookings can decrypt the token; it is never shown in any operational or administrative screen and never written to logs. All traffic to Google is encrypted with TLS. Further technical and organisational safeguards are described in Article 8.
5. Sharing and use limits: Data received from Google is never used for advertising, never sold or provided to third parties, never used to train artificial intelligence or machine learning models, and never used for purposes other than those described above. Humans access it only with your consent or when necessary for security review, incident response, or legal compliance.
6. Disconnecting and deletion: Tutors can disconnect at any time from the My Bookings page. On disconnection we immediately delete the stored token and ask Google to revoke our access. You can also revoke access from your Google Account's third-party app access settings. Stored tokens are also deleted when you request deletion of your personal information under Article 6.

The Company applies the following technical and organisational safeguards so that personal information is not lost, stolen, leaked, forged, altered, or damaged. Sensitive information — Google user data (the Calendar access token), payment and payout details, passwords, and access logs — is additionally covered by the encryption, access control, and automatic destruction measures below.

1. Encryption in transit: Every page and API is served exclusively over HTTPS (TLS). Unencrypted requests are redirected to HTTPS, and an HSTS header instructs browsers to use encrypted connections from then on.
2. Encryption at rest: Google Calendar refresh tokens and tutor payout account numbers are stored encrypted with AES-256-GCM, using a random initialisation vector and an authentication tag for each value. Passwords are stored as one-way bcrypt hashes, so even the Company cannot read them. Encryption keys are injected only through server environment variables and are never kept in source code or in the repository. Database backups carry these values in the same encrypted or hashed form, so refresh tokens, account numbers, and passwords never appear in plain text in a backup file.
3. Access control and least privilege: Access is restricted by role-based permissions; administrative functions are available only to separately authorised accounts, and every administrator view or action is recorded automatically in an internal audit log. Operators access only the minimum data their work requires.
4. Authentication and session protection: Sign-in attempts are rate-limited per IP address and per account to block brute-force attacks. Access tokens expire after 30 minutes, and refresh tokens are delivered only in HttpOnly, Secure cookies that JavaScript cannot read, and cannot be reused once spent.
5. No sensitive values in logs: Error and performance monitoring is configured not to send personal information, and secrets such as passwords, access tokens, and refresh tokens are never written to any log.
6. Data minimisation and automatic destruction: Access logs (90 days) and service operation logs (1 year) are deleted automatically by scheduled jobs once the retention periods in Article 3 pass. Google integration tokens are destroyed immediately on disconnection or on a deletion request under Article 6, and we ask Google to revoke our access as well.
7. Breach response: If we become aware of a breach of personal information, we notify affected users and report to the relevant authorities without delay as required by law, analyse the cause, and apply measures to prevent recurrence.

For questions regarding this Privacy Policy or personal information processing, please contact: Email: harumeet.support@gmail.com