RoleFit Privacy Policy

KLLEON (주식회사 클레온, the “Company”) processes personal data as described below in order to provide RoleFit. This policy applies to account holders and to participants of public training alike.

1. Data we process and why

Situation	Data	Purpose
Sign-up and sign-in	Email, authentication data, display name, account identifier	Creating, authenticating and recovering the account; telling users apart
Organization invitations and training operation	Invitation email, organization and role, training assignments, participation and completion status	Managing members and training
Taking part in training	Conversation text, speech-recognition results, start and end time and duration, AI scores and feedback, training identifier	Running the conversation, practice feedback, progress tracking, usage calculation
Voice features	Microphone audio stream	Real-time speech recognition
Creating content	Scenarios, reference materials, uploaded files and the information contained in their extracted text	Building training; supplying material for the conversation and feedback
Paid purchases	Buyer email, the payment service's customer, transaction and subscription identifiers, product, amount, currency, payment status and period	Linking the purchase, granting entitlements, managing subscriptions and refunds
Support requests	Reply contact details, the content of the request, material you provide with it	Answering requests, handling disputes
Operation and security	Access and error records generated during authentication and server processing	Protecting sign-in, preventing abuse, resolving incidents
Usage analytics	Pages visited and events, approximate region, device and browser type, and referral source collected by the analytics of the hosting platform (Lovable) of the published site	Understanding and improving how the service is used

Training joined through a public link without signing in still involves a session identifier and training records; a conversation is not anonymous merely because you are not signed in. RoleFit never collects or stores full card numbers or card security codes itself; they are handled in the Paddle checkout.

Data is provided by you during sign-up, training, uploads and support requests, or collected through an organization administrator's invitations and assignments, records generated while you use the service, and results returned by the payment service. Depending on the purpose, processing is based on entering into and performing a contract, a legal obligation, or consent where required. If optional data is collected separately, we tell you what is collected, why and for how long, and obtain the consent needed.

2. The organization's role and the Company's role

Participation and completion status, conversations and evaluation results of training assigned by an organization can be viewed by that organization's authorized operators. Records of training joined through a public link can be viewed by the person who runs that training. The organization decides who is trained, for what purpose and who may view records, and must inform its learners accordingly.

The Company processes the account and payment data needed to run the service and processes training data at the organization's request. You can direct privacy questions to your organization's administrator or to the Company contact below; the Company checks its role for the data concerned and either handles the request itself or coordinates with the organization.

3. AI and voice processing during training

In voice training, microphone audio is sent to a speech-recognition service (Soniox) and converted to text. AI conversation, hints and evaluations are generated by OpenAI's GPT models via the Lovable AI gateway from the conversation, the training settings and the reference material needed. The generated reply text is passed to the Company's (KLLEON) digital-human service, which renders it as voice and video.

AI evaluations are practice feedback; they do not automatically make hiring or other HR decisions. You can revoke the microphone permission in your browser, in which case features that use voice are unavailable. Do not enter data that training does not need — such as national ID numbers, payment details or health data — or material you are not authorized to share.

4. External services

The Company operates RoleFit with the services below. Each processes only the data needed for the task shown; details are in each service's own privacy notice.

Service	Task	Data involved	Notice
Lovable Cloud	App hosting, database, authentication, file storage, account emails, usage analytics	Account, organization and training data, uploaded files, usage analytics. Data storage location: Australia (Sydney)	Lovable privacy policy
Lovable AI gateway and OpenAI	Generating AI conversation, hints and evaluations	Conversation content, training settings, reference material needed	Lovable · OpenAI
Soniox	Real-time speech recognition	Microphone audio stream and recognition results. The service currently uses Soniox's default API endpoint, which Soniox's official documentation describes as processed in the United States.	Soniox security and privacy
KLLEON digital human	Rendering reply text as the digital human's voice and video	Generated reply text	Operated by the Company; this policy applies.
Paddle	Merchant of Record for paid products: payment, tax, receipts, subscriptions and refunds	Buyer email and purchase-linking data. Payment details are entered directly in the Paddle checkout.	Paddle privacy policy

Some of these services store or process data outside your country; the confirmed locations are listed in the table. The fact that an external service processes data directly does not exclude the Company's responsibility for the data it sends to or receives from that service. Questions about, or objections to, cross-border transfers can be sent to the contact below; if you object, the related features — such as speech recognition, AI conversation or paid purchases — may be unavailable to you.

5. Retention and deletion

Data is kept for as long as its purpose requires and destroyed without undue delay once the period ends or the purpose is fulfilled. Data with a separate basis — such as a statutory retention duty or an ongoing dispute — is kept separately, limited to the scope and period required.

Data	Retention
Account and authentication data	Kept while the account is in use; destroyed when the account is deleted.
Conversation content and AI evaluation content	Kept for one year from the end of the training, then destroyed. This covers the transcript text, scores, reasoning and feedback, and the reference-material copies stored with the session.
Training assignments, completion status, session times and usage	Kept while the organization's service is in use, for training management and usage calculation; not covered by the one-year purge above. Handled on deletion of the organization or workspace, on a personal-data request, or under a statutory exception.
Uploaded reference materials and extracted text	Kept until an authorized administrator asks for the material or the workspace to be deleted. Not deleted merely because the uploader deletes their account or the paid subscription ends.
Copies of reference materials in published training and sessions	Deleted together with the original and extracted text when the material or workspace is deleted on request. Conversation and AI evaluation content already generated follows the one-year rule above.
Support request records	Kept for three years after the request is closed, then destroyed.
Minimum records needed to respond to abuse	Kept for one year from collection, then destroyed.
Purchase, subscription and refund records	Only the items that fall under the statutory records below are kept for the stated period.

Under the Enforcement Decree of the Korean Act on Consumer Protection in Electronic Commerce (Article 6), records of contracts and withdrawals and records of payment and supply are kept for 5 years, records of consumer complaints and dispute handling for 3 years, and records of labelling and advertising for 6 months. These periods are not retention periods for conversation content or learning records; only records subject to statutory retention are separated from ordinary service data and used solely for that purpose.

Deleting your account and deleting an organization's training records are different things. An organization's conversation and evaluation records may remain after the link to your account is removed, and names or other details inside a transcript are not deleted merely by removing that link. You can request deletion through the contact below; the Company and the organization check the basis for retention and the scope that can be deleted and let you know.

When material is deleted, the original file, the extracted text and the copies stored in published training and sessions are deleted together and are no longer referenced in later training. Deleting material does not by itself delete conversation or evaluation content already generated. Electronic files are destroyed in a way that prevents recovery.

6. Your rights and how to contact us

You can ask to access, correct or delete your personal data, to suspend its processing, and to withdraw consent. We verify that a request comes from you or your authorized representative to the extent necessary, and if the law limits a request we explain why and what can be done instead. Access is provided within 10 days of the request as a rule; for correction and deletion requests we likewise inform you within 10 days of the result, or of the legal reason we cannot comply and how to object. Requests concerning records managed by an organization are coordinated with that organization after we confirm the processing roles, and we tell you how the request will proceed.

Role	Contact
Privacy officer	Seunghyuk Jin, Representative of KLLEON
Department receiving and handling rights requests	Management Support Team
Email	partnership@klleon.io (same as customer support)
Phone	070-4367-6094
Address	B1, 561 Seolleung-ro, Gangnam-gu, Seoul, Republic of Korea (Yeoksam-dong, RUBINA)

For privacy complaints you may also use the reporting and dispute-mediation procedures described on the Korean Privacy Portal. A legal representative or a duly authorized agent may exercise these rights on your behalf. RoleFit training is intended for learners aged 19 or over, including when joining through a public link without signing in.

7. Browser storage and safeguards

Browser storage is used to keep you signed in, remember your language, and carry a training or checkout in progress. You can clear it in your browser settings, which may sign you out or interrupt a feature in progress. The published site uses the usage analytics of its hosting platform (Lovable), and the Paddle checkout is handled separately under Paddle's policy.

The Company applies safeguards such as permission-based access control, authentication, and encryption in transit (HTTPS).

8. Changes to this policy

When this policy changes, the changes and the effective date are announced in the service at least 7 days in advance and the previous version remains available. Changes that materially affect your rights — such as the data collected, purposes, recipients or cross-border transfers — are announced at least 30 days in advance and also sent to the registered email of account holders. Where separate consent is required, that procedure comes first.