Privacy Policy
Version 2026.08 ยท Effective August 17, 2026
Nomadiq ('we', 'us', or the 'Company') operates nurio.kr and its related mobile applications ('nurio'). We process personal information in accordance with Korea's Personal Information Protection Act (PIPA) and other applicable laws. This policy explains our purposes, data categories, retention, sharing, processors, international transfers, and your rights. Using the service is not treated as blanket consent for optional processing; where consent is required, we provide a separate notice and obtain it.
1. Controller and Privacy Contact
- Controller
- Nomadiq
- Representative / privacy officer
- Eunseok Kang
- Address
- 77 Doandong-ro, Seo-gu, Daejeon, Republic of Korea, Apt. 1812-1602
- Privacy contact
- hello@nurio.kr ยท +82 10-3643-5451
2. Why We Process Information, What We Process, and How Long We Keep It
| Purpose | Data | Retention |
|---|---|---|
| Registration, sign-in, and account administration | Email, name (native, English, Korean, and first/last name), profile photo, social sign-in provider, unique identifier, authentication token, and language preference | Until account withdrawal or the purpose is fulfilled |
| Profile creation and language exchange partner matching | Nationality, date of birth or birth year, gender, languages and proficiency levels, biography, interests, onboarding survey responses and preferences, MBTI and TOPIK level (optional), external contact handle and its type (optional), and drinking preference (optional) | Until account withdrawal or the purpose is fulfilled |
| Meetup registration, participation, group assignment, and attendance | Registration, participation, attendance, and check-in records; group assignment and conversation history; seat and meal selections; waitlist entries; no-show records; and the name, email, and phone number of guests on a bulk ticket | Until withdrawal or the purpose is fulfilled; records required by law are kept separately for the applicable period |
| Payment, recurring billing, refund, and accounting | Order and payment identifiers, amount, date, status, limited payment-method information (card brand, last four digits, expiry), payment and billing tokens, refund bank account details (bank, account number, account holder), and bank-transfer depositor name | Five years for contract, withdrawal-of-offer, payment, and supply records; three years for consumer complaint and dispute records, under Korean e-commerce law |
| Messaging, community operations, and a safe environment | Chat messages, posts and comments, sent time and read state, reports and operational action records, block lists, and operator handling notes | Until the purpose is fulfilled or withdrawal; minimum records necessary for a dispute or safety response may be retained separately |
| Optional AI conversation practice, learning feedback, and placement assessment | Text you enter, voice recordings and transcripts, pronunciation assessment results, learning notes and feedback, and the learning-history summary we retain to generate responses | Until the purpose is fulfilled or withdrawal; guest assessment data is promptly destroyed once its purpose is complete |
| Host, leader, and buddy applications and review | Name, email, phone number, gender, nationality category, referrer, application responses, and review records | Promptly destroyed once the review is complete; retained until the end of the engagement if you are selected |
| Security, fraud prevention, and notices | Device and browser information, access logs and IP address, access country, cookies and session data, push token, and delivery preferences | Until the purpose is fulfilled or for the period required by applicable law and internal security standards |
| Marketing communications (optional) | Email, push token, and consent status and time | Until consent is withdrawn or the account is closed |
We process information where permitted by law or necessary to perform a contract. You can use the core service without providing optional fields or using optional features.
3. Disclosure to Others
We do not sell or disclose personal information to outside parties as a rule. The following information is visible to other users or your host because a language exchange meetup requires shared participation.
| Recipient | Data | Purpose and period |
|---|---|---|
| Participants assigned to the same meetup or group, and that meetup's host | Display name, profile photo, the language level, nationality, interests, and biography you publish on your profile, group assignment and participation status, and content you post in the room | Meetup operations and language exchange, for the participation or room-operation period |
We may also disclose information where required by law or upon a valid request from a competent authority, following the applicable legal procedure and scope. We do not sell or provide personal information for a third party's own marketing purposes.
4. Processors and International Transfers
We use the processors below and transfer information internationally only as needed to operate the service or when you use the relevant feature. Some processors are used only when that feature is enabled, and the AI provider for a given feature may vary within this list according to configuration. We contractually require processors to limit use to the agreed purpose, restrict onward processing, apply safeguards, and delete information when the processing ends.
| Processor / recipient | Service and data | Country, time, and method | Retention |
|---|---|---|---|
| PortOne Corp. (Korea) | Payment, recurring billing, and refund processing; order and payment identifiers and information needed for payment | Korea, upon payment request over encrypted transmission | For payment processing and the statutory retention period |
| Brevo SAS (France) | Email delivery; email address and delivery status | France, when an email is sent over encrypted transmission | Until delivery is complete or the processor contract ends |
| Google LLC (United States) โ Firebase Cloud Messaging | Push notifications; device token and the notification title and body needed for delivery | United States, when a push is sent over encrypted transmission | Until delivery is complete or the token is deleted |
| Google LLC (United States) โ AdSense | Ad delivery and performance measurement on pages that show ads; cookies and advertising identifiers, and device and browser information | United States, when a page showing ads is viewed | For the period set by Google's advertising service policies |
| Google LLC and OpenAI OpCo, LLC (United States) | AI conversation, learning, and placement features you choose to use; input text, voice file or transcript, and context necessary to generate a response | United States, when the feature runs over encrypted transmission | Until the response is generated or for the period in the processor policy and our processor agreement |
| Hangzhou DeepSeek Artificial Intelligence Co., Ltd. (China) | AI text generation and learning feedback; input text and the context necessary to generate a response | China, when the feature runs over encrypted transmission | Until the response is generated or for the period in that provider's policy and our processor agreement |
| Z.AI (Zhipu AI, China) | AI text generation and learning feedback; input text and the context necessary to generate a response | China, when the feature runs over encrypted transmission | Until the response is generated or for the period in that provider's policy and our processor agreement |
| Microsoft (Azure AI Speech) | When enabled, English pronunciation assessment; length-limited learner audio and a server-generated or server-held reference transcript | Processing location of the configured Azure Speech resource (not fixed in the application), transferred over encryption when pronunciation assessment runs | Under the applicable Microsoft Azure Speech service processing terms and configuration |
| Soniox, Inc. and ElevenLabs, Inc. (United States) | When enabled, speech recognition and speech synthesis; learner voice files and transcripts, and the text to be synthesized | United States, when the feature runs over encrypted transmission | Until recognition or synthesis is complete or for the period in each processor's policy |
| Inworld AI (United States) | When enabled, speech synthesis; the text to be synthesized | United States, when the feature runs over encrypted transmission | Until synthesis is complete or for the period in that provider's policy |
| Slack Technologies, LLC (United States) | Operational alerts; minimum account, registration, payment-status, and contact data needed for operations | United States, when an operational alert is generated over encrypted transmission | Until the operational check is complete or the processor contract ends |
| Discord, Inc. (United States) | Meetup registration, cancellation, and waitlist announcements; display name and the meetup involved | United States, when an announcement is generated over encrypted transmission | Until the announcement purpose is complete or the processor contract ends |
International transfers are made under the legal bases and procedures required by Article 28-8 of PIPA. You may refuse an international transfer, but a feature that necessarily uses that processor (for example, push notifications or AI conversation, learning, and pronunciation assessment) may not be available.
5. Destruction
When the retention period ends or the purpose is fulfilled, we destroy personal information without delay. On account withdrawal we delete your profile and its attachments, social sign-in connections, and participation records, and we irreversibly anonymize account identifiers. Transaction and settlement records we must keep by law are stored separately from other personal information for the required period and then destroyed. Electronic files are deleted using a method that prevents recovery; paper records are shredded or incinerated.
6. Your Rights and How to Exercise Them
You may request access, correction, deletion, suspension of processing, or withdrawal of consent. You can update your profile and communication preferences in the service settings, and you can delete your account yourself from the account settings menu. For any other request, email hello@nurio.kr with only the minimum information needed to verify your identity. We respond within the statutory period and explain any lawful restriction and how to appeal it. We process information of children under 14 only after confirming consent from a legal representative.
7. Cookies and Similar Technologies
We use cookies and session information for sign-in, security, and service delivery, and we automatically collect access logs, IP address, and device information. You can refuse or delete cookies in your browser settings, although some functions, such as staying signed in, may not work properly.
On pages that show ads, Google AdSense may use cookies and advertising identifiers for ad delivery and performance measurement. You can opt out of personalized advertising at Google Ad Settings (adssettings.google.com).
8. Safeguards
We use access-control management, encryption in transit, encrypted storage for protected fields, access-log management, security software and vulnerability checks, and privacy training for personnel. To prevent misuse, we may limit public details of our security controls.
9. Media and Photography
Photos and videos taken during an event may be used for documentation and promotional purposes related to nurio, such as our website or social media.
If you do not wish to be photographed or recorded, please tell our staff at any time and we will exclude you from recordings or from their use.
10. Complaints and Remedies
For a privacy complaint or consultation, you may contact the Korea Internet & Security Agency Privacy Infringement Report Center (privacy.kisa.or.kr, 118 in Korea), the Personal Information Dispute Mediation Committee (kopico.go.kr, 1833-6972), the Supreme Prosecutors' Office (1301), or the National Police Agency (182).
11. Changes to This Policy
We will post additions, deletions, or changes on this page or through a service notice at least seven days before they take effect. For changes that materially affect your rights, we will provide notice at least 30 days in advance where practicable.