Privacy Policy
Last Updated: April 17, 2026 · Effective Date: April 17, 2026
GoStudy AI ("GoStudy," "we," "our," or "us") operates the GoStudy mobile and web application (the "Service"), which helps international students discover, match with, and pre-apply to Korean universities. This Privacy Policy explains how we collect, use, disclose, store, and protect your personal information when you use the Service.
By creating an account or otherwise using the Service, you acknowledge that you have read and understood this Policy. If you do not agree, please do not use the Service.
1. Who We Are (Data Controller)
The entity responsible for processing your personal information is:
- Company: GoStudy AI
- App Bundle / Package:
com.gostudy.app - Privacy contact: [email protected]
- Support contact: [email protected]
If you are located in the European Economic Area, the United Kingdom, or any jurisdiction that requires a designated data protection officer or local representative, you may contact us at the email above and we will respond within applicable statutory timeframes.
2. Information We Collect
We collect only the information necessary to operate the Service.
2.1 Information You Provide Directly
| Category | Examples |
|---|---|
| Account data | Email address, hashed password (or Google OAuth identifier), display name, preferred language |
| Profile data | Full name, date of birth, gender, nationality, passport country, current country of residence |
| Korea residency data | Whether you currently reside in Korea, visa type, visa expiration, city/district of residence |
| Academic data | High-school/undergraduate GPA, graduation year, desired degree track, desired major(s) |
| Language test scores | TOPIK level, TOEFL score, IELTS score, other language certifications |
| Documents (sensitive) | Academic transcripts, language-certificate PDFs/images, financial statements, and any attachments you upload to consultation chats |
| Communication data | Messages, images, and attachments you send inside our consultation chat; posts and comments you publish in community boards |
| Preference data | Saved universities, pinned majors, application progress |
2.2 Information Collected Automatically
- Device & usage data: device model, operating system version, app version, language, crash logs, approximate session duration, in-app events.
- Network data: IP address, rough geolocation derived from IP (country/region level — we do not collect precise GPS location).
- Cookies / local storage (web only): strictly-necessary session tokens, language preference, and analytics identifiers (see Section 10).
2.3 Information from Third Parties
- Google sign-in: when you sign in with Google, we receive your email, name, and Google account ID only. We do not access your Gmail, Drive, or other Google services.
- Partner universities: if a partner university provides feedback on your pre-application, we receive that feedback and associate it with your account.
2.4 We Do NOT Collect
- Precise GPS location.
- Payment card numbers (the Service is currently free).
- Biometric data.
- Data about minors under 14 (see Section 9).
3. How We Use Your Information
- Provide the Service — create and authenticate your account; display your profile; store your uploaded documents; match you with universities; enable consultation chat; process pre-applications.
- AI matching and recommendations — run your profile through our AI models to suggest universities, estimate scholarship eligibility, and explain match reasoning.
- Communicate with you — send service-related notices, respond to support requests, and deliver push notifications you have opted into.
- Improve the Service — analyze aggregated, de-identified usage patterns to fix bugs, optimize features, and prioritize new functionality.
- Trust and safety — detect abuse, fraud, spam, impersonation, or violations of our Terms of Service.
- Legal compliance — respond to lawful requests from authorities, preserve records as required by law.
We do not sell your personal information. We do not use your personal information for third-party advertising. We do not use your uploaded documents to train publicly available AI models.
4. Legal Bases for Processing (GDPR / PDP)
- Your consent — when you create an account, upload documents, and submit pre-applications.
- Contract performance — to deliver the Service you signed up for.
- Legitimate interests — to secure the Service, prevent fraud, and improve reliability.
- Legal obligation — to retain certain records where required by law.
5. Who We Share Your Information With
5.1 Partner Universities
When you initiate a pre-application, we share your name, contact email, nationality, date of birth, profile data (GPA, test scores, desired major), uploaded documents, and message content with the specific partner university you choose.
As of the effective date, pre-applications are available to: Sungshin Women's University, Dankook University, Kookmin University, and Ajou University.
5.2 Service Providers (Processors)
| Provider | Purpose | Data region |
|---|---|---|
| Self-hosted (MySQL) | Database, authentication, file storage | Korea (Gostudy servers) |
| Google (Gemini API) | AI analysis and matching | Per Google's AI terms |
| Anthropic / OpenAI | Consultation AI responses | Per provider terms |
| Apple App Store / Google Play | App distribution, push notifications | Per their policies |
| Cloudflare / CDN | Content delivery, DDoS protection | Metadata only |
5.3 Legal Disclosures
We may disclose information to courts, law-enforcement, or regulators when compelled by a legally valid order or to prevent imminent harm.
5.4 Business Transfers
If GoStudy is acquired or merges, your information may transfer to the successor entity under the same protections. We will notify you before any such transfer.
6. International Data Transfers
The Service is operated from Korea, but data may be processed in other countries where our processors operate. We rely on Standard Contractual Clauses (SCCs) or adequacy decisions where applicable.
7. Data Retention
| Data type | Retention period |
|---|---|
| Account and profile data | While account is active + 30 days after deletion |
| Uploaded documents | While account is active; deletable at any time |
| Pre-application records | 5 years after submission |
| Chat messages | While account is active + 90 days after deletion |
| Community posts | Until deleted; anonymized within 30 days of account removal |
| Crash logs and device metadata | 90 days |
8. Your Rights
You can exercise these rights via the in-app Profile screen or by emailing [email protected]:
- Access — request a copy of your personal data.
- Rectification — correct inaccurate or incomplete data.
- Erasure — delete your account and associated data.
- Restriction — pause processing while a dispute is resolved.
- Portability — receive your data in a machine-readable format (JSON).
- Objection — object to processing based on legitimate interests.
- Withdraw consent — withdrawal does not affect prior lawful processing.
- Lodge a complaint — with your local data-protection authority.
9. Children and Minors
The Service is intended for users aged 14 years and older. We do not knowingly collect information from children under 14. If you believe your child has provided personal information, contact [email protected].
10. Cookies and Similar Technologies (Web)
- Strictly necessary cookies — session authentication, CSRF protection.
- Preference storage (localStorage) — chosen language, onboarding progress.
- Analytics cookies (if enabled) — aggregated event data; opt out via in-app settings.
11. Security
- Encryption in transit — TLS 1.2 or higher.
- Encryption at rest — database and file storage encrypted by our cloud providers.
- Access control — least-privilege IAM policies; two-factor authentication for staff.
- Row-Level Security (RLS) — database enforces user data isolation.
- Audit logging — all administrative access is logged.
No system is 100% secure. In the event of a data breach, we will notify you and relevant regulators within 72 hours where required by law.
12. Third-Party Services and Links
The Service may contain links to third-party websites. We are not responsible for their privacy practices.
13. Automated Decision-Making
Our AI-powered matching engine produces recommendations and scoring, not final admission decisions. Final decisions are made only by partner universities. You may request human review of any recommendation by contacting [email protected].
14. Disclaimers and Limitation of Liability
No guarantee of admission. The Service provides information, matching suggestions, and pre-application facilitation. We do not guarantee admission, scholarship amount, visa approval, or any specific outcome.
The Service is provided "as is" and "as available." To the maximum extent permitted by law, we disclaim all warranties and limit our aggregate liability to the greater of (a) fees you paid in the prior 12 months, or (b) USD 100.
15. Changes to This Policy
We may update this Policy from time to time. Material changes will be communicated in-app and by email at least 30 days before taking effect.
16. Governing Law and Jurisdiction
This Policy is governed by the laws of the Republic of Korea. Disputes shall be submitted to the Seoul Central District Court, except where mandatory local law grants you the right to bring a claim in your country of residence.
17. Contact Us
- Email: [email protected]
- Subject line convention:
[Privacy]followed by your request type - In-app: Profile → Settings → Contact Support
We aim to acknowledge every request within 3 business days and to resolve it within 30 days.
This Privacy Policy is provided in English as the authoritative version. Translations into Korean, Indonesian, Vietnamese, and Chinese are offered for convenience; in case of conflict, the English version prevails.