隱私權政策 / Privacy Policy
草稿 — 上線前需經法律專業人士審閱 DRAFT — have a qualified lawyer review before going live. 本文件僅為初稿，尚未經律師確認，正式上線前務必請律師審閱，特別是關於個人資料保護法（PDPA）之具體條文適用。 This document is a working draft only, not reviewed by a lawyer. Confirm PDPA compliance specifics with counsel before publishing.
生效日期 / Effective date: 2026-07-11
1. 適用範圍 / Scope
本政策說明 Kurt Chen（個人賣家 / individual seller）（下稱「我們」）在您使用「外交特考 外國文」線上準備課程（下稱「本服務」）時，如何蒐集、處理、利用您的個人資料。本政策依台灣**個人資料保護法（個資法）**之精神訂定；具體條文適用請以律師確認為準。
This policy explains how Kurt Chen（個人賣家 / individual seller） ("we") collects, uses, and protects your personal data when you use this online exam-prep service. It is drafted with reference to Taiwan's Personal Data Protection Act (PDPA / 個人資料保護法); specific article-level compliance should be confirmed with counsel.
2. 我們蒐集哪些資料 / What we collect
| 資料類型 Data | 說明 Description | 來源 Source |
|---|---|---|
| 電子郵件 Email | 用於 magic-link 免密碼登入，並作為您的帳號識別 | 您註冊／Lemon Squeezy 結帳時提供 |
| 購買紀錄 Purchase record | 是否已購買、購買時間（不含卡號等付款細節） | Lemon Squeezy |
| 練習進度 Practice progress | 您在課程中的作答紀錄、完成度、答題正確率等學習資料 | 您使用本服務時產生，儲存於瀏覽器 localStorage；登入使用者之後可能同步至 Supabase 資料庫 |
| 基本使用分析 Minimal analytics | 例如頁面瀏覽、裝置類型等聚合式使用數據，用於了解產品使用狀況 | 自動蒐集（如有導入分析工具，將於此更新說明） |
我們不會蒐集或儲存您的信用卡號、銀行帳戶等完整付款資料——這些資料完全由 Lemon Squeezy 及其付款服務商處理（詳見 terms.md 第 2 節）。
We do not collect or store your credit card number or other full payment details — those are handled entirely by Lemon Squeezy and its payment processors (see terms.md §2).
We do not knowingly collect data from children; this Service is intended for adult exam candidates.
3. 為何蒐集 / Why we collect it
Email：驗證身分、提供 magic-link 登入、寄送購買確認與課程相關通知。
購買紀錄：確認您的存取權限（判斷是否已解鎖完整課程）。
練習進度：讓您跨裝置／跨次登入時能接續學習進度，並讓我們了解課程內容的使用狀況以持續改善。
使用分析：了解產品整體使用情形，用於除錯與產品改善，非用於對個別使用者做廣告投放。
Email: identity verification, magic-link login, purchase confirmation and course-related notices.
Purchase record: to determine your access/unlock status.
Practice progress: to let you resume progress across sessions/devices, and to help us understand how the course is used so we can improve it.
Analytics: to understand overall product usage for debugging and improvement — not for individual ad targeting.
4. 我們使用的處理者 / Processors we use
我們透過以下第三方服務處理您的資料，這些服務商各自依其隱私政策處理資料：
- Lemon Squeezy（付款、記錄商戶、發票、稅務、退款）— 詳見其隱私權政策。
- Supabase（資料庫代管，東京（Tokyo）機房）— 用於登入使用者的練習進度等資料儲存。
- Vercel（網站／應用程式代管與伺服器運算）。
We use the following third-party processors, each governed by their own privacy policies:
- Lemon Squeezy — payments, merchant-of-record functions, invoicing, tax, refunds.
- Supabase — hosted database (Tokyo region), used to store logged-in users' practice progress.
- Vercel — application hosting and server-side compute.
由於 Supabase 資料庫位於日本東京，您的部分個人資料（登入後之練習進度）可能涉及跨境傳輸至台灣境外。我們透過選用符合資料保護標準之服務商（Supabase、Vercel）以合理保護您的資料；若您對跨境傳輸有疑慮，歡迎聯繫我們。
Because the Supabase database is hosted in Tokyo, Japan, some of your personal data (post-login practice progress) may involve a cross-border transfer outside Taiwan. We rely on reputable processors (Supabase, Vercel) with their own data-protection safeguards; contact us if you have concerns about this.
5. 保存期限 / Retention
未登入使用者的練習進度：僅儲存於您瀏覽器的 localStorage，我們不會於伺服器端保存；清除瀏覽器資料即會刪除。
登入使用者的帳號與進度資料：於您帳號存續期間保存，以便您可隨時接續學習；您可要求刪除（見第 6 節）。
購買與交易紀錄：因稅務／會計法規要求，可能需保存較長期間（此部分主要由 Lemon Squeezy 依其記錄商戶義務保存）。
Guest (not logged-in) progress: stored only in your browser's localStorage; we don't retain it server-side. Clearing browser data deletes it.
Logged-in account & progress data: retained while your account is active, so you can resume learning; you may request deletion (see §6).
Purchase/transaction records: may be retained longer for tax/accounting compliance, primarily by Lemon Squeezy as MoR.
6. 您的權利 / Your rights
依台灣個資法，您就我們持有之個人資料，原則上享有以下權利（實際適用範圍請以律師確認）：
- 查詢或請求閱覽；
- 請求製給複製本；
- 請求補充或更正；
- 請求停止蒐集、處理或利用；
- 請求刪除。
如欲行使上述權利，請寄信至 chenkoyu@gmail.com，我們會於合理期間內回覆處理。
Under Taiwan's PDPA, you generally have the right to: request access to your data; request a copy; request correction/supplementation; request that we stop collecting/processing/using it; and request deletion. (Exact scope to be confirmed with counsel.)
To exercise these rights, email chenkoyu@gmail.com; we will respond within a reasonable time.
請注意：與付款、發票、退款相關的資料權利請求，可能需另向 Lemon Squeezy 提出，因該等資料由其作為記錄商戶所持有與處理。
Note: rights requests concerning payment, invoicing, or refund data may need to be directed to Lemon Squeezy separately, as it holds and processes that data as Merchant of Record.
7. 資料安全 / Data security
我們採取合理之技術與管理措施（如存取控管、加密傳輸）保護您的資料，但無法保證絕對安全。若發生資料外洩等事件，我們將依法通知受影響使用者及主管機關（如適用）。
We take reasonable technical and organizational measures (e.g., access controls, encrypted transport) to protect your data, but cannot guarantee absolute security. In the event of a data breach, we will notify affected users and relevant authorities as legally required.
8. Cookies 與追蹤 / Cookies & tracking
本服務可能使用必要性 cookies／本地儲存（localStorage）以維持登入狀態與練習進度；若導入第三方分析或行銷追蹤工具，將於此更新說明並視需要取得同意。
The Service may use essential cookies/localStorage to maintain login sessions and practice progress. If third-party analytics or marketing trackers are added later, this policy will be updated and consent obtained where required.
9. 政策修改 / Changes to this policy
我們可能不時修改本政策，修改後將更新「生效日期」。重大變更將盡力另行通知。
We may update this policy from time to time; the "Effective date" above will be updated, and we'll try to notify you of material changes.