Privacy Policy of Stellup Co., Ltd. (Mockee)
Stellup Co., Ltd. (the "Company") operates Mockee, an AI Korean mock interview service for foreigners (https://mockee.hangling.kr, the "Service"). The Company establishes and discloses this Privacy Policy under Article 30 of the Personal Information Protection Act of the Republic of Korea to protect the personal information of data subjects and to handle related complaints promptly and smoothly.
Structure: This is the service-specific privacy policy for Mockee. It applies together with the Stellup Co., Ltd. Privacy Policy (company-wide). Where this Policy is more specific, it prevails for Mockee. This Policy is provided in Korean and English. If the two versions differ, the Korean version prevails. Published at: https://mockee.hangling.kr/privacy.html
Article 1 (Purposes of Processing)
The Company processes personal information for the purposes below. It is not used for other purposes, and if a purpose changes, the Company takes the measures required by law.
- Sign-up and account management: identification and authentication, member management, prevention of misuse, notices, handling inquiries
- Providing mock interviews: generating and tailoring interview questions, reading questions and model answers aloud, recording answers and converting speech to text, AI evaluation and feedback, saving, viewing, translating and downloading (PDF) results, sharing results, study features (bookmarks, practice)
- Credits and purchase requests: granting and using sign-up bonus, coupon and purchased credits; contacting you to confirm a purchase request and give payment instructions
- Organization service: running the education program of the organization you belong to (its administrators view your progress and results)
- Checking the quality of AI evaluation and covering failures: scoring the same answers with two AI models (Anthropic Claude and OpenAI) to compare the accuracy and consistency of evaluation, and using one model's result when the other fails.
- Improving the Service and analytics: usage statistics, error analysis
- Security and abuse prevention: daily usage limits per feature, detecting abnormal use
Article 2 (Personal Information Processed)
- Account
- Email sign-up: email, password (encrypted and kept by the authentication service; the Company cannot see it)
- Google sign-up: the email, name and profile photo of your Google account
- Both: member number, authentication identifier (Firebase UID), sign-up method, sign-up date, nickname (by default your Google name or the part of your email before "@"), profile photo (a copy of your Google photo or a photo you upload)
- Interview profile: nationality (required before your first interview), name (required for organization members, optional otherwise), school, major, experience summary, Korean level (optional)
- Interviews and practice
- Interview settings: target company, industry, job function, interview format and difficulty
- Job posting (only if you paste one to get tailored questions; it is not stored)
- Recordings of your answers, speech-to-text transcripts, speaking metrics (answer length, speech ratio, long pauses, filler words, speaking rate)
- Questions, AI evaluation results (scores, answer types, feedback, model answers, summary), translations, study bookmarks
- Credits: history of credits granted and used (package, price, interview used for), coupon redemptions
- Purchase requests: phone number. It is not stored in the Company's database; it is passed to staff through the internal messenger (Article 5).
- Organization members: organization, role (administrator or student)
- Information generated or collected automatically while you use the Service
- Usage records: page paths, feature-use events, interview settings (such as the target company), parts of error messages
- Browser and device information, IP address (hosting and security logs; approximate location estimated by the analytics tool), cookies and browser storage (Article 10)
- Usage-limit records: your member identifier, or for visitors who are not signed in a one-way transformed (hashed) value of the IP address, the feature and the time
※ The Company does not ask you to enter your age, gender, address or visa information. However, anything you say when answering interview questions (for example about residence or visa plans, or life in Korea) is part of your answer and is processed with it. Do not say anything in your answers that you do not want to share.
Article 3 (Processing and Retention Periods)
① The Company keeps personal information for the periods below and destroys it without delay when the period ends or the purpose is achieved.
| Item | Retention period |
|---|---|
| Account, interview profile, interview and practice records, recordings, credit history | Until you withdraw (your deletion request is processed) |
| Comparison records for checking AI evaluation quality (answer text and both evaluation results) | 30 days after creation |
| Usage-limit records | Deleted progressively once they are more than 7 days old |
| Notifications passed to the internal messenger (sign-up: nickname, email, sign-up method; purchase request: phone number, etc.) | Until the sign-up is confirmed and the request is handled (payment instructions given and credits granted) |
| Usage records in the analytics tool | Until you withdraw or the outsourcing contract ends |
② Where the law requires the information to be kept, it is kept for the periods below.
| Law | Records kept | Period |
|---|---|---|
| Act on the Consumer Protection in Electronic Commerce, etc. | Contracts and withdrawal of offers, payment, supply of goods and services | 5 years |
| Act on the Consumer Protection in Electronic Commerce, etc. | Consumer complaints and dispute resolution | 3 years |
| Protection of Communications Secrets Act | Access records (such as sign-in records) | 3 months |
③ When you withdraw, only your paid credit purchase records (purchase date and time, package, amount, number of credits, your email to identify the party to the transaction, and the credits you had left when you withdrew) are kept, separately from other personal information, for 5 years from the purchase date, and are then destroyed.
Article 4 (Provision to Third Parties)
① The Company does not provide personal information to third parties except where the Personal Information Protection Act allows it, such as with the data subject's consent or under a specific provision of law.
② When you join an organization by entering its organization code, the Company provides personal information to that organization as follows. The organization's administrators view it in the Service.
| Recipient | Purpose | Items | Retention |
|---|---|---|---|
| The organization (company, school, etc.) you joined with its organization code | Running the organization's education program; checking members' progress | Name, nickname, email, school, major, nationality, credit balance, interview results (questions, answer text, evaluation and recorded answers, including results from before you joined), average practice scores | Until you leave the organization or the contract between the Company and the organization ends |
③ To leave an organization, ask the Company as described in Article 8. After you leave, the organization can no longer see your information.
Article 5 (Outsourcing of Processing)
① To provide the Service, the Company outsources processing of personal information as follows.
| Processor | Outsourced work |
|---|---|
| Google LLC (Firebase Authentication; contracting party: Google Cloud Korea LLC) | Member authentication (sign-in) |
| Supabase Pte. Ltd. | Database and file storage, running server functions |
| OpenAI OpCo, LLC | Generating and tailoring questions, follow-up questions, reading questions and model answers aloud, AI evaluation of answers (comparison scoring, and evaluating in place of Claude when Claude fails) |
| OpenRouter, Inc. (processed by Microsoft Azure) | Converting recorded answers to text (speech recognition) |
| Anthropic, PBC | AI evaluation of answers |
| Google LLC (Cloud Translation; contracting party: Google Cloud Korea LLC) | Translating interview results |
| Mixpanel, Inc. | Usage analytics |
| Netlify, Inc. | Hosting the website and the Service |
| Toss Lab, Inc. (JANDI) | Internal messenger that receives sign-up and purchase request notifications |
| Channel Corporation (Channel Talk) | Customer support when you contact us with "Contact Us" |
② In the outsourcing contracts the Company sets out that processors may not process personal information beyond the outsourced work, must take security measures, may only subcontract within limits, and are liable for damages, and the Company supervises whether they process personal information safely.
③ If the outsourced work or a processor changes, the Company discloses it in this Policy without delay.
Article 6 (Transfer of Personal Information Abroad)
① To provide the Service (perform the contract), the Company transfers personal information abroad as follows. Transfers happen whenever you use the Service, over encrypted connections (HTTPS).
| Recipient (contact) | Country | Items transferred | Purpose | Retention |
|---|---|---|---|---|
| Supabase Pte. Ltd. (privacy@supabase.com) | Japan (stored in the AWS Tokyo region) | All member data in the Service (Article 2, items 1–4, 6 and 7) | Database and file storage, server functions | The periods in Article 3 |
| Google LLC (privacy contact) | United States | Email, password, Google account information, authentication records / result text to translate | Authentication / translating results | Until you withdraw / held in memory only while translating, not stored |
| OpenAI OpCo, LLC (privacy@openai.com) | United States | Nationality, interview settings, experience summary, Korean level and job posting (if entered), questions, answer text, model answers | Generating questions, speech synthesis, AI evaluation (comparison and backup) | Kept under OpenAI's API data policy (30 days by default), then deleted. Not used for model training |
| OpenRouter, Inc. (privacy@openrouter.ai), processed by Microsoft Azure | United States | Recorded answers (audio only, no information identifying you) | Speech recognition | Not kept after conversion (except where needed for abuse prevention, security or legal compliance). Not used for model training |
| Anthropic, PBC (privacy@anthropic.com) | United States | Nationality, interview settings, questions, answer text | AI evaluation of answers | Deleted within 30 days (content flagged for policy violations may be kept longer). Not used for model training |
| Mixpanel, Inc. (compliance@mixpanel.com) | United States | Member number, authentication identifier, sign-up information, nationality, Korean level, organization membership, usage records (Article 2, item 7), browser and device information, approximate location from IP | Usage analytics | Until you withdraw or the outsourcing contract ends |
| Netlify, Inc. (privacy@netlify.com) | United States | IP address, browser information (access logs) | Hosting the website and the Service | The hosting provider's log retention period |
| Toss Lab, Inc. (privacy@tosslab.com) | Japan (a Korean company storing data in the AWS Tokyo region) | Nickname, email, sign-up method / purchase request details (member number, package, price, phone number) | Sign-up and purchase request notifications (internal messenger) | Until the sign-up is confirmed or the purchase request is handled |
② These transfers are necessary to provide the Service. To refuse them you must withdraw (request deletion), and you will no longer be able to use the Service.
Article 7 (Destruction of Personal Information)
① The Company destroys personal information without delay once its retention period ends or the purpose of processing is achieved. Where the law requires it to be kept, it is stored separately.
② Procedure: information to be destroyed is identified and destroyed with the approval of the Chief Privacy Officer. When you withdraw, your account, interview profile, interview and practice records, recordings, profile photos, credit history and your profile in the analytics tool are deleted immediately. Paid purchase records under Article 3 ③, however, are kept separately.
③ Method: electronic files are deleted so that they cannot be recovered.
Article 8 (Rights of Data Subjects and Legal Representatives and How to Exercise Them)
① You may at any time ask to access, correct or delete your personal information, to suspend its processing, or to withdraw consent.
② You can edit your nickname, profile photo and interview profile yourself on the profile screen of the Service.
③ You can withdraw (delete your account) yourself on the profile screen of the Service (Account Information > Delete account). When you withdraw, the information in Article 7 ② is deleted immediately and cannot be restored, links to results you shared stop working, and any remaining credits are lost (Terms of Use, Article 15).
④ For other requests (deleting interview results or recordings, leaving an organization, etc.), or if you cannot sign in to withdraw in the Service, email the Chief Privacy Officer (Article 14). The Company handles the request without delay (within 10 days) after verifying your identity and tells you the result.
⑤ You may also exercise these rights through a legal representative or a person you authorize, who must submit a power of attorney.
⑥ You must not infringe your own or others' personal information or privacy in violation of the law.
Article 9 (Children Under 14)
The Service is intended for adult foreigners preparing for jobs in Korea. The Company does not knowingly collect personal information from children under 14 and deletes it without delay if it learns that such information has been collected.
Article 10 (Automatic Collection Tools: Installation, Operation and Refusal)
① The Company uses:
- Analytics cookie: the Mixpanel cookie (starting with `mp_`), which distinguishes visitors to produce usage statistics.
- Browser storage: sign-in state (Firebase), display language, interview settings, profile display information and cached translations. Signing out removes the profile display information and interview settings.
② You can delete or block cookies and site data in your browser settings. If you block storage, some features such as signing in will not work.
Article 11 (Voice Recording and AI Processing)
① Mock interviews and practice record your answers with your microphone. Recordings are stored in the Company's private storage, and playback uses an address that is valid for 5 minutes only.
② Recordings are converted to text by a speech recognition service, and AI evaluates the text. The information sent to AI services is listed in Article 6; account information such as your name or email is not sent.
③ The Company uses these AI services on terms under which they do not use the data the Company sends to train their own models (each provider's default API policy).
④ AI evaluation: your answers are evaluated by Anthropic's Claude model. The Company also scores the same request with an OpenAI model; if Claude's result fails or is late, the OpenAI result is shown instead, and the two results are compared to check evaluation quality. Comparison records are deleted after 30 days.
⑤ AI evaluation and speech recognition may contain errors.
Article 12 (Sharing Interview Results)
① Each interview result has its own hard-to-guess address (share link). Anyone with the address can view the result (questions, answer text, evaluation) and play your recorded answers without signing in.
② The address is not known to others unless you give them the link or QR code from the result screen. Shared pages are blocked from search engines.
③ Share links do not expire. To stop others from viewing a result you have shared, ask for that result to be deleted as described in Article 8.
Article 13 (Measures to Ensure the Security of Personal Information)
The Company takes the following measures.
- Administrative: keeping the number of staff who handle personal information to a minimum; internal management procedures
- Technical: encryption in transit (HTTPS), per-member access control (row-level security in the database), private storage of recordings, blocking access to server-only data, passwords encrypted and kept by the authentication service
- Physical: the Company runs no servers of its own; data is kept in cloud data centers operated by the processors in Article 5
Article 14 (Chief Privacy Officer)
▶ Chief Privacy Officer
Name: Jang Ji-woong
Position: Operations / Management Planning
Email: stellup.contact@gmail.com
▶ Department: Operations Team
Contact: stellup.contact@gmail.com
Service inquiries: stellup24@stellup.co.kr
For privacy inquiries, complaints and remedies, contact the officer or department above. The Company responds and acts without delay.
Article 15 (Remedies for Infringement of Rights)
If you need to report or get advice about an infringement of personal information, you can contact the following organizations (in Korea).
- Personal Information Dispute Mediation Committee: 1833-6972 (www.kopico.go.kr)
- Personal Information Infringement Report Center: 118 (privacy.kisa.or.kr)
- Supreme Prosecutors' Office: 1301 (www.spo.go.kr)
- Korean National Police Agency: 182 (ecrm.police.go.kr)
Article 16 (Changes to This Policy)
This Privacy Policy takes effect on November 3, 2026. The version that applied earlier the same day did not include withdrawing in the Service (Article 8 ③) or keeping paid purchase records after withdrawal (Article 3 ③). The version before that took effect on November 2, 2026, when OpenAI evaluated answers and Anthropic was used only to compare evaluations. Before that, the Stellup Co., Ltd. Privacy Policy (company-wide, effective July 30, 2026) applied. Changes are announced in the Service from 7 days before they take effect, and important changes unfavorable to members from 30 days before.