Beijing Diezhixinbian Technology Co., Ltd (the "Company") establishes and publishes this Privacy Policy in accordance with Article 30 of the Personal Information Protection Act of the Republic of Korea, in order to protect the personal information of data subjects and to handle related complaints promptly and smoothly.
| Item | Details |
|---|---|
| Effective date | 2026-09-24 |
| Last revised | 2026-09-28 |
| Service name | Uway — Chrome extension · website · account · paid subscription |
| Business operator | Beijing Diezhixinbian Technology Co., Ltd |
| Chief Privacy Officer | Privacy Team · admin@attraxi.com |
Chrome Web Store Limited Use
The use of information received from Google APIs will adhere to the Chrome Web Store User Data Policy, including the Limited Use requirements.
Uway has a single purpose: to help the member study English while watching a video, by showing sentence structure and vocabulary beside the player. The extension handles only the information that this single purpose requires.
The Company does not:
If the way personal information is handled changes, the Company will disclose the change clearly before it takes effect.
The Company processes personal information for the following purposes. Personal information being processed is not used for any purpose other than those set out below, and if the purpose of use changes, the Company will take the necessary measures, such as obtaining separate consent, in accordance with Article 18 of the Personal Information Protection Act.
Provision of service features — Used for sentence structure analysis, word lists, the learning map, review of saved words, and playback of the member's own recordings. These features run on the member's device, and the information processed is not transmitted to the Company's servers. (Basis: performance of a contract — Article 15(1)(4) of the Act)
Account creation and maintenance — Used for identity verification, sign-in and session management. (Basis: performance of a contract — Article 15(1)(4) of the Act)
Provision of the paid subscription — Used for payment, plan management, and refunds and cancellations. (Basis: conclusion and performance of a contract — Article 15(1)(4) of the Act)
Word lookup and sentence speech generation — Used only to the extent necessary to call external dictionary and speech services. (Basis: performance of a contract — Article 15(1)(4) of the Act)
Responding to customer enquiries — Used for receiving enquiries, replying, and handling disputes. (Basis: performance of a contract · legitimate interests — Article 15(1)(4) and (6) of the Act)
Service stability and security — Used for handling errors, preventing abusive use, and managing access logs. (Basis: legitimate interests — Article 15(1)(6) of the Act)
Compliance with legal obligations — Used for retaining transaction records under the Act on the Consumer Protection in Electronic Commerce, etc. (Basis: compliance with a legal obligation — Article 15(1)(2) of the Act)
The Company does not use members' information for marketing or advertising, does not carry out profiling for advertising purposes, and does not make automated decisions (including decisions using artificial intelligence) that have a significant effect on members' rights or obligations.
The Company processes the following items of personal information.
The Company does not collect passwords. The password exists only in the member's Google account and is never passed to the Company. Name and profile picture are neither requested nor stored.
This account record is stored on a server located in Singapore (Article 6). In addition to the items above, the record consists of the internal user identifier issued by the Company · the plan · the authentication method · the time of first registration · the time of last access. Learning data (wrong-answer notes, word lists, progress, etc.) is not included in this record — no such column exists in the server database at all.
The Company does not collect optional items.
The information below is stored only on the member's device and is not transmitted to the Company's servers. The Company holds no copy of this data and cannot access it.
The member's own recordings are used solely for the member's playback. The Company does not create voiceprints, and does not identify speakers or analyse voices.
This data is not linked to the account. Accordingly, if the member changes device or reinstalls the extension, it does not carry over. The Company keeps no copy on its servers.
The following information is generated automatically and collected in the course of using the service.
The items below are neither collected nor stored. This does not mean that the Company "endeavours not to collect" them; it means that there is no storage structure capable of holding them.
Article 15 of the Personal Information Protection Act separately sets out the cases in which personal information may be processed without consent. Dividing the information the Company processes on that basis gives the following. Below, consent not required means a case that may be processed without consent, and consent required means a case in which separate consent must be obtained.
| Category | Information concerned | Basis applied |
|---|---|---|
| Consent not required | Account information (email address and Google account identifier) and subscription and payment information | Article 15(1)(4) — necessary for the conclusion and performance of a contract |
| Consent not required | Information stored only on the member's device (learning data and so on) | The Company does not collect it, so it is not subject to consent |
| Consent required | Cross-border transfers that do not fall under Article 28-8(1)(3) — provision to Google at sign-in, and access by Company personnel from outside Korea | Article 28-8(1)(1) — separate consent |
| Not applicable | Sensitive information, unique identification information, consent to receive marketing, personalised advertising | The Company neither collects nor uses the items above |
For the items requiring consent, consent is obtained by means of a separate checkbox distinguished from other consents. Even if consent is refused, processing that does not require consent continues as before.
Many of Uway's core features run on the member's device, and the information processed in the course of doing so is not transmitted to the Company's servers.
Deletion criteria. ① Information processed only in memory (subtitles and analysis results) disappears immediately when the video is switched, the panel is closed or the tab is closed, and no separate deletion procedure is required. ② Information stored on the device (settings, learning records and the member's own recordings) is deleted immediately by clearing the browser storage or removing the extension. ③ Individual items can also be deleted directly within the extension.
However, word lookup and sentence speech playback involve requests sent to external services and are therefore not on-device processing (Article 6).
The Company processes and retains personal information within the period of retention and use prescribed by law, or within the period of retention and use consented to by the data subject at the time the personal information was collected.
| Processing activity | Retention period | Legal basis |
|---|---|---|
| Account information (identifier, email, plan, subscription status) | Until the member deletes their account. On receiving a deletion request the Company destroys it without delay (Article 7 · contact address admin@attraxi.com). | Conclusion and performance of a contract (Article 15(1)(4)) |
| Learning data and information stored on the device | Until the member deletes it or removes the extension | Not collected by the Company — exists only on the member's device |
| Session token | 30 days after issue, or immediately upon sign-out | Performance of a contract |
| Server access logs (IP, time, request) | 3 months | Legitimate interests · Standards for Measures to Ensure the Security of Personal Information |
| Customer enquiry emails | 24 months after the enquiry is closed | Performance of a contract · legitimate interests |
| Records of contracts or withdrawals of offers | 5 years | Article 6 of the Act on the Consumer Protection in Electronic Commerce, etc. |
| Records of payment and supply of goods, etc. | 5 years | Article 6 of the Act on the Consumer Protection in Electronic Commerce, etc. |
| Records of consumer complaints or dispute resolution | 3 years | Article 6 of the Act on the Consumer Protection in Electronic Commerce, etc. |
| Records of labelling and advertising | 6 months | Article 6 of the Act on the Consumer Protection in Electronic Commerce, etc. |
| Subtitle text, video files and audio, dictation results | Not retained | — |
For records retained under law, no information other than those records is kept together with them, and they are destroyed once the purpose has been fulfilled.
The Company does not sell members' personal information and does not provide it to third parties except in the cases below.
| Recipient | Purpose of provision | Items provided | Retention and use period |
|---|---|---|---|
| Paddle.com Market Limited (United Kingdom) | Processing payment for the paid subscription and performing the seller's obligations | Email address, plan, subscription status | Governed by Paddle's own policy |
| Google LLC (United States) | Identity verification and distribution of the extension through the Chrome Web Store | OAuth authentication token, Google account identifier | Governed by Google's own policy |
| Public authorities requiring disclosure under law | Compliance with legal obligations | The scope prescribed by law | The period prescribed by law |
The provisions above take place only to the extent necessary to use the paid subscription or to use Google sign-in. If the member does not use the paid subscription and does not use Google sign-in, these provisions do not occur.
The Company entrusts the processing of personal information as follows in order to carry out personal information tasks smoothly.
| Processor | Entrusted work | Entrustment period | Country |
|---|---|---|---|
| Tencent Cloud — Singapore region | Server hosting, database operation, backup | Until the entrustment agreement ends | Singapore |
| Paddle.com Market Limited (United Kingdom) | Payment processing, subscription management, VAT filing and invoicing | Until the entrustment agreement ends | United Kingdom |
When concluding an entrustment agreement, the Company specifies in the contract or other document, in accordance with Article 26 of the Personal Information Protection Act, matters concerning the prohibition of processing personal information for purposes other than the performance of the entrusted work, technical and managerial protective measures, restrictions on re-entrustment, the management and supervision of processors, and liability for damages, and it supervises whether processors handle personal information safely. If a processor changes the content of the entrusted work or re-entrusts it, the Company's prior approval must be obtained.
The operators of the word lookup and sentence speech services (Article 6) are not processors entrusted by the Company but independent recipients that handle the member's request under their own policies.
The Company is a legal entity established in China and manages personal information processing overall from outside the Republic of Korea. In addition, account information and subscription information are stored on a server located in Singapore. Learning data is stored only on the member's device and is not transferred abroad.
Article 28-8(1) of the Personal Information Protection Act treats storage (retention) as a cross-border transfer. Accordingly, storing the information above in Singapore is itself a cross-border transfer, and the Company processes it under subparagraph 3 of the same paragraph (where necessary for the performance of a contract) and discloses the matters required by this Article. The physical servers are located in a cloud data centre in Singapore, and the Company has entered into an entrustment agreement with the infrastructure operator (Article 5).
In accordance with Article 28-8(2) of the Personal Information Protection Act, all of the following matters are disclosed.
| Item | Details |
|---|---|
| Items of personal information transferred | ⓪ Storage: account information (internal user identifier · Google account identifier (sub) · email address · plan · authentication method · registration time · time of last access) ① Sign-in: OAuth authentication token and Google account identifier ② Payment: email address, plan, subscription status ③ Word lookup: the word or phrase the member looked up ④ Sentence speech: the example sentence for which speech was requested ⑤ the access IP address contained in every web request |
| Countries to which it is transferred | Singapore (storage of account and subscription information) · China (word lookup and example sentence speech) · United States (sign-in and extension distribution) · United Kingdom (payment) · Republic of Korea (word lookup — a domestic transfer) |
| Timing and method of transfer | Sent over an encrypted HTTPS connection at the moment the member requests sign-in, subscription payment, word lookup or sentence playback |
| Purpose of use by the recipient | Identity verification / subscription payment and management / dictionary lookup / speech synthesis / extension distribution |
| Recipient | See the table in 6.3 below |
| Retention and use period of the recipient | Governed by each operator's own privacy policy; the Company does not control this |
| How to refuse, the procedure, and the consequences of refusal | See the table in 6.3 below. Even if the member refuses, the extension's sentence structure analysis, word saving and learning map features remain fully available |
| Recipient | Country | Contact | How to refuse |
|---|---|---|---|
| The Company itself — Uway Singapore data centre (Tencent Cloud Singapore region) | Singapore | Chief Privacy Officer (Article 11) admin@attraxi.com | Do not create an account. In that case, however, account features such as the subscription cannot be used. The extension's remaining features stay fully available. |
| Google LLC | United States | Policy: policies.google.com/privacy / Address: 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA | Do not use Google sign-in. In that case, however, account features (such as the subscription) cannot be used. |
| Paddle.com Market Limited | United Kingdom | privacy@paddle.com / Address: 30 Old Bailey, London, EC4M 7AU, United Kingdom | Do not apply for the paid subscription. Free features remain available. |
| Beijing NetEase Youdao Computer System Co., Ltd (Youdao/NetEase Youdao) | China | yddictservice@163.com / Tel. 400-900-4163 / Address: Room 2, Floor A, Building 7, Zhongguancun Software Park West, No. 10 Yard, Xibeiwang East Road, Haidian District, Beijing, China (postcode 100193) | Do not use the word lookup feature. |
| Beijing Baidu Netcom Science Technology Co., Ltd (Baidu) | China | Policy: help.baidu.com/personalinformation / Address: Legal Department, No. 10 Shangdi 10th Street, Haidian District, Beijing, China (postcode 100085) | Do not use the example sentence speech playback button. |
| NAVER Corporation (Naver) | Republic of Korea | Policy: privacy.naver.com / Main line 1588-3820 | Do not use the Korean meaning lookup feature. This is a transfer within the Republic of Korea and is therefore not a cross-border transfer. |
Notice of a change of source (21 September 2026). The Company previously used dictionaryapi.dev (United States) as a secondary source for English meaning lookup. That source was not a commercial service operated by a company but an open-source community project run by an individual, and it did not publish an official personal information controller name or contact details; as a result, the Company was unable to provide members with the name and contact details of the recipient required by Article 28-8(2) of the Act. The Company discontinued use of that source entirely as of 21 September 2026.
For each transferred item the Company applies one of the grounds set out in the subparagraphs of Article 28-8(1) of the Personal Information Protection Act, as shown below. In no case does a transfer occur that the member has not requested.
| Item transferred | Type of operation | Basis applied |
|---|---|---|
| Storage of account and subscription information in Singapore | Storage | Subparagraph 3 — where necessary for the performance of a contract |
| Word lookup (Youdao) · example sentence speech (Baidu) | Entrusted processing | Subparagraph 3 — entrusted processing for the performance of a contract |
| Payment and subscription (Paddle) | Provision · entrusted processing | Subparagraph 3 |
| Sign-in (Google OAuth) | Provision | Subparagraph 1 — separate consent |
| Access by Company personnel from outside Korea | Access | Subparagraph 1 — separate consent (the principle is to operate so that such access does not occur) |
Why subparagraph 3 applies. Storing account information and subscription information in Singapore is processing necessary for the performance of the contract to provide the member with the Uway account features and the Pro plan. Subparagraph 3 requires that this be disclosed in the privacy policy, and the disclosures in this Article satisfy that requirement.
Note on the scope of subparagraph 3. Whether Article 28-8(1)(3) refers only to entrusted processing and storage, or to all of the transfers defined in the same paragraph (including provision and access), is a matter of interpretive dispute. The Company therefore applies subparagraph 3 to entrusted processing and storage, and subparagraph 1 (separate consent) to other provision and access, and will amend this Article in line with the scope of subparagraph 3 once it is settled.
How separate consent is obtained. Separate consent under subparagraph 1 is obtained at sign-in or when applying for the paid subscription by means of a separate checkbox distinguished from other consents, and together with the items transferred, the countries, the timing and method, the recipient and its contact details, the purpose of use, the retention period, and the how to refuse and the consequences of refusal are notified. Even if consent is refused, the extension's sentence structure analysis, word saving and learning map features remain fully available.
The Company does not access information capable of identifying individuals from outside the Republic of Korea without separate consent. Article 28-8(1) of the Personal Information Protection Act treats access as a cross-border transfer, so the Company operates according to the following principles.
These principles apply equally where the data is already stored in Singapore. Under the Personal Information Protection Act, pseudonymised information remains personal information. Replacing email addresses with internal identifiers alone therefore does not satisfy these principles, and the Company treats such processing as a cross-border transfer.
The Company retains access logs of the personal information processing system for one year or more (applicable once the system is in operation) in accordance with Article 8 of the Standards for Measures to Ensure the Security of Personal Information, and the access logs contain the person accessing, the time of access, the location of access, and the identifier of the data subject whose information was accessed.
When the member watches a video on YouTube, the extension reads subtitle data within that page. This request is sent by the member's browser directly to YouTube, so it is not a case of the Company providing the member's personal information to YouTube. The Company does not store that request or response on its own servers, nor does it send information to YouTube at a time the member has not requested.
The member should nonetheless be aware that the request reaches YouTube (Google LLC, United States) and that the member's YouTube sign-in session may be sent along with it. YouTube's processing is governed by Google's privacy policy (policies.google.com/privacy). How to refuse: use Uway on a page other than YouTube (in that case the extension reads no video information at all), or do not use the extension, and this request will not occur. Even if the member refuses, Uway's other features remain fully available.
Even if this relationship were found to be a cross-border transfer under Article 28-8(1) of the Personal Information Protection Act, all of the matters required by paragraph 2 of that Article (the items of personal information transferred · the countries to which it is transferred · the timing and method of transfer · the recipient and its contact details · the recipient's purpose of use and retention and use period · how to refuse, the procedure and the consequences of refusal) are disclosed in this sub-Article.
When personal information becomes unnecessary — for example because the retention period has elapsed or the purpose of processing has been achieved — the Company destroys it without delay.
Destruction procedure
Method of destruction
Data subjects may at any time exercise against the Company the rights to access, correct, delete or suspend the processing of their personal information, and to request its transmission. Rights may be exercised in writing, by email or by other means under Article 41(1) of the Enforcement Decree of the Personal Information Protection Act, and the Company takes action without delay.
Members have the following rights under the Personal Information Protection Act and may exercise them at any time.
How to exercise them (guidance provided in Korean)
The Company replies within 10 days and, where unavoidable, extends that period by 10 days once and informs the requester of the reason. Requests for access, correction and deletion are handled within that period, and other personal information enquiries are handled without delay. All guidance on exercising rights is provided in Korean.
Right to request transmission of personal information
Data subjects may request that their personal information be transmitted to another personal information controller or to a management institution. The information subject to transmission is information meeting the requirements prescribed by law (such as information processed on the basis of consent), and the Company explains both the method of request and the progress and outcome of processing, and replies with the outcome within 10 days.
Exercise through a representative
A member's legal representative, or an agent acting under a power of attorney, may also exercise these rights. In that case the Company may request documents such as a power of attorney to confirm authority.
Information required when making a request
The Company may request the following in order to verify identity: ① the account email address ② the content of the request ③ a means of confirming the requester's identity. The Company does not restrict use of the service on the ground that a right has been exercised.
The Company does not use cookies for advertising, tracking or profiling. It operates no analytics tools, does not fingerprint browsers, and does not build profiles of members.
| Storage method | What is stored | How to refuse |
|---|---|---|
| Extension storage (chrome.storage) | Sign-in session token (uway:session) · the original learning data · settings · dictionary cache | At chrome://extensions → Uway → Details, clear the storage or remove the extension |
| Browser local storage (website) | Four items of display-only identity information (user identifier · email · plan · issued-at time — no token) · interface language · six mirrors of learning data (words · lexicon · voice · shelf · tense · usage) | Clear the browser storage. The display information and mirrors disappear, but the sign-in state lives in the extension's storage, so this deletion alone does not sign you out. |
The extension does not set cookies.
To refuse or delete cookies (the Company sets none, but if you wish to tidy up cookies set by other sites): in Chrome settings > Privacy and security > Clear browsing data you may choose one of ① delete cookies and site data ② block third-party cookies ③ use incognito mode. Because the Company uses no advertising or tracking cookies, Uway works without any restriction even if you block all cookies.
The Company does not collect or use behavioural information for online personalised advertising.
The Company takes managerial, technical and physical measures to ensure the security of personal information.
Managerial measures
Technical measures
Physical measures
What is protected by not storing it
Subtitle text, video files, video audio and voiceprints are never stored in the first place. Because no central store exists that could leak, no risk of leakage arises for that information.
Response to security incidents
If personal information is lost, stolen or leaked, or is forged, altered or damaged, or if the possibility of any of these is identified, the Company without delay notifies the data subjects and the Personal Information Protection Commission and the Korea Internet & Security Agency (KISA) in accordance with the Personal Information Protection Act, and explains the remedies available, including claims for damages and applications for dispute mediation.
Artificial intelligence and personal information
The Company does not use members' personal information to train or develop artificial intelligence models. Members' learning records, voice and subtitles are never provided as AI training data or sold to third parties. The AI features that run on the member's device (sentence structure analysis, speech recognition, translation) exist for the member's convenience in learning and produce no legal effect for the member. The Company does not make decisions that have a significant effect on members' rights or obligations based solely on fully automated processing, including artificial intelligence (Article 37-2 of the Act). The Company does not pseudonymise personal information for statistical compilation, scientific research or archiving in the public interest.
The Company has overall responsibility for matters concerning the processing of personal information and has designated a Chief Privacy Officer as follows, in order to handle members' complaints and provide relief in connection with the processing of personal information.
| Category | Details |
|---|---|
| Personal information controller | Beijing Diezhixinbian Technology Co., Ltd (registered address: Room 505, 5/F, Building 1, Courtyard No. 1, Danling Street, Haidian District, Beijing 100080, China) |
| Chief Privacy Officer | Privacy Team |
| Contact | Email admin@attraxi.com |
| Complaint handling department | Privacy Team · admin@attraxi.com |
In accordance with Article 30(1)(6) of the Personal Information Protection Act, the name of the officer or the name and contact details of the responsible department are disclosed. The Company does not operate a telephone support line and handles enquiries received at the email address above without delay.
As an overseas personal information controller without a place of business in the Republic of Korea, the Company is not subject to the obligation to designate a domestic agent under Article 31-2 of the Personal Information Protection Act and Article 32-2 of its Enforcement Decree. The obligation arises where any one of the following applies: ① worldwide revenue of KRW 1 trillion or more in the previous year; ② an average of one million or more data subjects in Korea per day over the three months preceding the end of the previous year; ③ the Personal Information Protection Commission has required the submission of materials and resolved that designation is necessary. The Company currently meets none of these requirements.
If the Company's scale comes to meet the statutory requirements, it will designate a domestic agent without delay and disclose that information in this Policy.
Data subjects may apply to the following bodies for consultation or dispute mediation in order to obtain relief from an infringement of personal information. This is available independently of the right to lodge a complaint with a supervisory authority.
Where damages are claimed for an infringement of personal information, statutory damages of up to KRW 3 million may be claimed under Article 39-2 of the Personal Information Protection Act.
This Privacy Policy applies from its effective date. If this Policy is changed, the Company publishes the changes and the effective date on this page. Changes that have a material effect on members' rights are notified before they take effect through this page and an in-service notice (where possible, at least 30 days before they take effect), and other changes are notified at least 7 days before they take effect.
Changes that carry little risk to members' rights, such as a change to the list of processors, may be notified collectively in this Policy within four weeks after the change. Even in that case the changes and the date of application can be confirmed on this page.
Previous versions are provided on request. The version and the effective date are shown at the top of this page.
The Korean version of this Privacy Policy is the authoritative text and prevails in the event of any discrepancy. The Chinese version is a translation provided for convenience.