Privacy Policy

1. Who We Are

Levly ("we", "our", or "us") operates the Levly Korean study application at levly.app. Levly is operated by Levly OPC, a corporation to be registered under the laws of the Republic of the Philippines (SEC registration pending).

This Privacy Policy explains how we collect, use, store, and protect your personal information in accordance with the Data Privacy Act of 2012 (Republic Act No. 10173, "DPA") and its Implementing Rules and Regulations, as enforced by the National Privacy Commission (NPC) of the Philippines.

We are a web-based application accessible globally. Where you access Levly from a jurisdiction with its own applicable data protection laws — including but not limited to South Korea, the European Union, or other regions — we are committed to respecting those laws to the extent applicable. If you have questions about your specific rights under your local law, contact us at hello@levly.app.

Data Protection Officer (DPO): N. Fajardo · hello@levly.app
A Data Protection Officer has been designated as required under the Data Privacy Act and is responsible for overseeing all personal data processing activities.

2. Information We Collect and Why

We collect only the information necessary to provide the Service. The table below describes each category of data, its purpose, and how long we retain it.

We do not collect sensitive personal information as defined under Section 3(l) of the DPA (e.g. health, biometric, religious, or financial account data).

3. Legal Basis for Processing

Under the Data Privacy Act, we process your personal information on the following legal bases:

Consent — You give us explicit consent when you create an account and tick the consent checkbox during sign-up. Consent is never pre-checked.
Contractual necessity — Processing your email address, payment confirmation, and lesson progress is necessary to deliver the Service you signed up for.
Legal obligation — Retaining payment records for the minimum period required by applicable tax law.
Legitimate interest — Aggregate, anonymised analytics to improve the product, where no individual is identified or profiled.

4. Consent and How to Withdraw It

When you create an account, we ask for your explicit consent to collect and use your personal information for the purposes listed above. Consent is given by ticking the consent checkbox during sign-up. It is never pre-checked.

You may withdraw your consent at any time by deleting your account or contacting us at hello@levly.app. Withdrawal of consent does not affect the lawfulness of processing carried out before withdrawal. Where we are legally required to retain certain data (e.g. payment records for tax purposes), we will retain only that data for the minimum required period, isolated from active use.

5. How We Use Your Information

We use your information only for the purposes stated at the time of collection: (a) to provide and personalise the Service; (b) to save and display your study progress; (c) to process purchases and grant access to paid content; and (d) to send transactional communications such as account confirmations and receipts.

We do not sell your personal information. We do not use your data for advertising, behavioural profiling, or any purpose unrelated to delivering the Service.

6. Cross-Border Data Transfers

Your data is processed using the following third-party service providers, which may store or process data outside of the Philippines. By creating an account, you consent to these transfers. All providers have been assessed to maintain appropriate safeguards.

Transfers outside the Philippines are made in compliance with Section 21 of the DPA and its Implementing Rules, including the use of contractual clauses or equivalent safeguards where required.

7. Cookies and Automatic Collection Tools

Levly uses session cookies solely to keep you logged in during an active session. These cookies expire when you close your browser.

We also use Vercel Analytics, a privacy-respecting analytics tool, to collect aggregated page view data. This helps us understand which parts of Levly are being used so we can improve the product. Vercel Analytics does not track you across other websites, does not build individual user profiles, and does not share data with advertisers.

We do not use advertising cookies, cross-site tracking cookies, or third-party analytics that profile you individually. You can disable cookies in your browser settings at any time; doing so may prevent you from staying logged in to the Service.

8. Your Rights Under the Data Privacy Act

As a data subject under RA 10173, you have the following rights, which you may exercise at any time by contacting us at hello@levly.app:

We will respond to all rights requests within 15 days. Account deletion requests will be processed within 30 days, after which your data will be permanently destroyed except where retention is legally required.

9. Data Security and Breach Notification

We implement appropriate technical and organisational measures to protect your personal information against unauthorised access, loss, or disclosure. These include encrypted data transmission (HTTPS), access controls limited to the DPO and authorised service providers, and regular review of third-party provider security practices.

In the event of a personal data breach, we will notify the National Privacy Commission (NPC) within 72 hours of becoming aware of the breach where required under NPC Circular No. 16-03, and will notify affected users within a reasonable period with a description of the breach, the data involved, and steps taken to address it.

10. Children's Privacy

The Service is not directed at persons under the age of 13. We do not knowingly collect personal information from children under 13. Under the DPA, collection of personal information from minors requires the consent of a parent or legal guardian. If you believe a child under 13 has provided us with personal information without appropriate consent, please contact us at hello@levly.app and we will delete it promptly.

11. Retention and Deletion

We retain your personal data only for as long as necessary to fulfil the purposes for which it was collected, or as required by law. Upon account deletion, all personal data is permanently destroyed within 30 days, except payment records retained for tax compliance (5 years). Anonymised, aggregated analytics data (which cannot identify you) may be retained indefinitely for product improvement.

12. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in the law, our data practices, or the Service. We will notify you of significant changes by updating the "Last updated" date at the top of this page and, where appropriate, by sending an email notification to your registered address. Continued use of the Service after changes are posted constitutes acceptance of the revised policy.