RoleFit Privacy Policy

1. Data we process and why

Training joined through a public link without signing in still involves a session identifier and training records; a conversation is not anonymous merely because you are not signed in. RoleFit never collects or stores full card numbers or card security codes itself; they are handled in the Paddle checkout.

Data is provided by you during sign-up, training, uploads and support requests, or collected through an organization administrator's invitations and assignments, records generated while you use the service, and results returned by the payment service. Depending on the purpose, processing is based on entering into and performing a contract, a legal obligation, or consent where required. If optional data is collected separately, we tell you what is collected, why and for how long, and obtain the consent needed.

2. The organization's role and the Company's role

Participation and completion status, conversations and evaluation results of training assigned by an organization can be viewed by that organization's authorized operators. Records of training joined through a public link can be viewed by the person who runs that training. The organization decides who is trained, for what purpose and who may view records, and must inform its learners accordingly.

The Company processes the account and payment data needed to run the service and processes training data at the organization's request. You can direct privacy questions to your organization's administrator or to the Company contact below; the Company checks its role for the data concerned and either handles the request itself or coordinates with the organization.

Only where needed to operate the service, provide customer support, or respond to failures and misuse, the Company may allow authorized internal staff to view the conversation and evaluation records of training in an internal administration screen. When staff open the conversation or the evaluation details, the staff member, the session and the time are recorded.

3. AI and voice processing during training

In voice training, microphone audio is sent to a speech-recognition service (Soniox) and converted to text. AI conversation, hints and evaluations are generated by OpenAI's GPT models via the Lovable AI gateway from the conversation, the training settings and the reference material needed. Uploaded reference material may also be analysed through the same route to prepare key points and questions for conversations. The generated reply text is passed to the Company's (KLLEON) digital-human service, which renders it as voice and video.

AI evaluations are practice feedback; they do not automatically make hiring or other HR decisions. You can revoke the microphone permission in your browser, in which case features that use voice are unavailable. Do not enter data that training does not need — such as national ID numbers, payment details or health data — or material you are not authorized to share.

4. External services

The Company operates RoleFit with the services below. Each processes only the data needed for the task shown; details are in each service's own privacy notice.

Some of these services store or process data outside your country; the confirmed locations are listed in the table. The fact that an external service processes data directly does not exclude the Company's responsibility for the data it sends to or receives from that service. Questions about, or objections to, cross-border transfers can be sent to the contact below; if you object, the related features — such as speech recognition, AI conversation or paid purchases — may be unavailable to you.

5. Retention and deletion

Data is kept for as long as its purpose requires and destroyed without undue delay once the period ends or the purpose is fulfilled. Data with a separate basis — such as a statutory retention duty or an ongoing dispute — is kept separately, limited to the scope and period required.

Under the Enforcement Decree of the Korean Act on Consumer Protection in Electronic Commerce (Article 6), records of contracts and withdrawals and records of payment and supply are kept for 5 years, records of consumer complaints and dispute handling for 3 years, and records of labelling and advertising for 6 months. These periods are not retention periods for conversation content or learning records; only records subject to statutory retention are separated from ordinary service data and used solely for that purpose.

Deleting your account and deleting an organization's training records are different things. An organization's conversation and evaluation records may remain after the link to your account is removed, and names or other details inside a transcript are not deleted merely by removing that link. You can request deletion through the contact below; the Company and the organization check the basis for retention and the scope that can be deleted and let you know.

When material is deleted, the original file, the extracted text, the analysis results, the copies stored in published training and sessions and the record of its items' use in conversations are deleted together and are no longer referenced in later training. Deleting material does not by itself delete conversation or evaluation content already generated. Electronic files are destroyed in a way that prevents recovery.

6. Your rights and how to contact us

You can ask to access, correct or delete your personal data, to suspend its processing, and to withdraw consent. We verify that a request comes from you or your authorized representative to the extent necessary, and if the law limits a request we explain why and what can be done instead. Access is provided within 10 days of the request as a rule; for correction and deletion requests we likewise inform you within 10 days of the result, or of the legal reason we cannot comply and how to object. Requests concerning records managed by an organization are coordinated with that organization after we confirm the processing roles, and we tell you how the request will proceed.

For privacy complaints you may also use the reporting and dispute-mediation procedures described on the Korean Privacy Portal. A legal representative or a duly authorized agent may exercise these rights on your behalf. RoleFit training is intended for learners aged 19 or over, including when joining through a public link without signing in.

7. Browser storage and safeguards

Browser storage is used to keep you signed in, remember your language, and carry a training or checkout in progress. You can clear it in your browser settings, which may sign you out or interrupt a feature in progress. The published site uses the usage analytics of its hosting platform (Lovable), and the Paddle checkout is handled separately under Paddle's policy.

The Company applies safeguards such as permission-based access control, authentication, and encryption in transit (HTTPS).

8. Changes to this policy

When this policy changes, the changes and the effective date are announced in the service at least 7 days in advance and the previous version remains available. Changes that materially affect your rights — such as the data collected, purposes, recipients or cross-border transfers — are announced at least 30 days in advance and also sent to the registered email of account holders. Where separate consent is required, that procedure comes first.