Privacy Policy

Last updated: May 19, 2026

Morld School (movie.unood.me, hereinafter "the Platform", "we", "our") takes your privacy seriously. This policy describes how we collect your personal data, how it is processed and used, and how you can manage and control the information we collect about you through the Platform.

We recommend that you read this Privacy Policy and our Terms of Service carefully before using the Platform, purchasing courses, or entering into any transaction with us. By continuing to use the Platform, you accept the practices described in this policy and consent to our collection, processing, and use of your personal data.

The rights and obligations between instructors, course partners, and the Platform are separately governed by their respective contracts.

1. Categories of Personal Data We Collect

When you visit, register, or use the Platform, we may collect the following categories of personal data, including but not limited to:

• Personal identifiers: name, email, mobile phone, third-party social login IDs (when using Google / Facebook / Apple sign-in)
• Financial identifiers: last four digits of credit card numbers, bank account number and account holder name (instructors only, used for revenue share payouts)
• Financial transactions: amounts received and paid, payment methods, order history, invoice title and tax ID
• Security details: passwords (stored as one-way bcrypt hashes; we cannot recover them in plaintext)
• Device and technical data: hardware and software specs, device identifiers, IP address, cookies, browser language, device country
• Learning interaction data: HLS video playback timestamps, lesson completion rate, course comments, course reviews, learner questions
• Instructor data: legal name, tax identification information, bank account (required to fulfill our revenue share obligations), trilingual instructor bio
• Unclassified data: files, comments, or reviews you proactively provide via course content, support emails, or activities

When you purchase any course on the Platform, your credit card information is collected, processed, and used by our payment partner ECPay (Green World FinTech Service Co., Ltd.). The Platform stores only the last four digits for reconciliation and does not retain full card numbers or security codes.

For any giveaways or feedback campaigns we may run, the contact information you provide is used solely for the execution of that campaign and is handled in accordance with our retention rules after the campaign ends.

2. Cookies and Local Storage

We set and access cookies and browser local storage in your browser. Cookies are small data files stored by your browser in your device's memory.

By retention:

• Session cookies: have no fixed expiry and are deleted when you close your browser
• Persistent cookies: have a defined expiry and remain until the expiry date or until you manually delete them

By function:

morldSchoolCart, morldSchoolOwned, and morldSchoolProgress are stored in browser localStorage and synced to your account upon login.

Analytics cookie disclosure: The Platform uses Google Analytics 4 (GA4) to understand user browsing behavior and improve the website experience. GA4 is provided by Google LLC and its cookies (including _ga, _ga_*, _gid) collect anonymized IP addresses, device type, browser, pages viewed, and time on page. For details, see Google's privacy policy: https://policies.google.com/privacy. You may opt out of GA4 tracking using the Google Analytics Opt-out Browser Add-on.

You can manage or delete cookies via your browser settings, but deleting strictly necessary cookies will break parts of the service.

3. Purposes and Means of Personal Data Use

Personal data collected by the Platform is used for the following purposes:

• Performance of contract: course purchase, invoice issuance, course content delivery, learner identity verification
• Learning services: course playback progress sync, lesson completion tracking, posting comments and reviews, instructor interaction
• Customer support: refund processing, technical troubleshooting, account anomaly handling
• Financial operations: reconciliation, refunds, instructor revenue payouts, tax filing
• Marketing: within the scope of your consent, sending new course announcements and promotional information (you may unsubscribe in account settings at any time)
• Anti-fraud and security: detecting abnormal logins, blocking automated attacks, ensuring platform and account safety
• Legal compliance: responding to legally mandated disclosure and inquiries from competent authorities

When you start watching a course, we will collect, process, and use your learning interaction data for course management purposes, including but not limited to playback timestamps, lesson completion rate, assignment submissions, and instructor interactions.

4. Third-Party Services and Outsourcing

To provide a stable and high-quality service, the Platform entrusts the following third-party providers with specific business scope. These providers may only process your personal data within the entrusted scope and are bound by confidentiality obligations:

• Cloud infrastructure: Google Cloud Platform (backend API hosted on Cloud Run, Asia region)
• Object storage and CDN: Cloudflare (video files stored in R2; HLS streams distributed via cdn-school.unood.me through global edge nodes)
• Payment service provider: ECPay (Green World FinTech Service Co., Ltd.) (credit card processing for VISA / MasterCard / JCB). Full card numbers and security codes are collected, processed, and used by ECPay. The Platform does not retain full card numbers or security codes.
• E-invoice service: ECPay (Green World FinTech Service Co., Ltd.) issues and delivers e-invoices in accordance with the R.O.C. Regulations Governing the Use of Uniform Invoices.
• Website analytics: Google Analytics 4 (GA4) (IP anonymized, used only for aggregated site usage analysis)
• Social login: when you choose to sign in with Google / Facebook / Apple, the Platform only collects your email and necessary profile fields to create an account.

When the Platform works with third parties, the third party's own privacy terms also apply. Except as otherwise provided in this policy, required by law, or necessary to protect you or other users from harm, we will not share your personal data with third parties without your consent.

In the event of a merger, acquisition, or sale of part or all of our assets, we will notify you before transferring your personal data, and the acquirer's privacy policy will then apply.

5. HLS Video Streaming and Technical Tokens

The Platform uses HLS (HTTP Live Streaming) to deliver course videos. To prevent unauthorized hotlinking, each video segment carries a short-lived JWT query token.

• Video segments (.ts or .m4s) are served by cdn-school.unood.me with a short-lived JWT in the URL, used solely to validate request legitimacy. Tokens do not identify individuals.
• Tokens are issued by morld-api and verified at the cdn-school.unood.me edge. Tokens are invalidated upon expiry.
• Your playback timestamps and lesson completion rate are sent back to morld-api for progress sync, cross-device resume, and course completion certification.
• Learning progress data is stored in morld-api's backend database and is deleted together with your account upon deletion.

6. Instructor Sensitive Data

To fulfill revenue share payouts, the instructor dashboard additionally collects the following sensitive data:

• Legal name (matching government-issued ID)
• Tax identification (Taiwan National ID number or foreign resident ID number)
• Bank account information (account holder, bank code, account number)

This data is used only for:

1. Revenue share payout
2. Tax withholding and issuance of withholding certificates under the Tax Collection Act
3. Disclosure as legally required by competent authorities

The Platform applies the following safeguards to instructor sensitive data:

• At-rest encryption
• Need-to-know access by engineering and finance staff
• Audit logging of all access
• Retention for 7 years per the Tax Collection Act, then deleted

7. Personal Data Sharing Policy

Except as otherwise provided in this policy, required by law, or necessary to protect you or other users from harm, we will not share your personal data with third parties without your consent.

When the Platform works with third parties, their privacy terms apply. The Platform is not responsible for data processing performed by third parties.

In the event of a merger, acquisition, or sale of part or all of our assets to a third party, we will transfer your personal data per the transaction terms and notify you prior to the transfer. After the transfer, the acquirer's privacy policy will apply.

We will use reasonable technical and procedural measures to safeguard all personal data, but no transmission over the internet or data storage can be guaranteed 100% secure.

8. Retention Period and Geographic Location of Use

The Platform will use your personal data throughout the term of service, or until you request deletion, within the regions where we provide service.

Personal data is processed in the following locations:

• Taiwan (the Platform's operating base)
• Google Cloud Platform data centers in the Asia region (backend API and database)
• Cloudflare global edge nodes (HLS video CDN distribution)
• ECPay data center (payment and e-invoice processing)
• Google Analytics 4 global data processing centers
• Locations of other outsourced service providers

You understand and agree that, where necessary for the performance of our contract, the Platform may process your personal data outside the European Economic Area (EEA) and transfer it to regions that have not been recognized by the European Commission as having adequate data protection. The Platform will, however, adopt appropriate safeguards in accordance with applicable local law to protect your personal data.

9. Data Retention Periods

Retention periods vary by data category and legal requirement:

Where law mandates longer retention, the legal requirement prevails.

10. Data Security Measures

The Platform applies the following technical and managerial safeguards:

• Site-wide HTTPS (TLS 1.2 or higher)
• Login token school_token delivered as HTTP-only cookie, verified via JWT HS256
• Passwords stored as one-way bcrypt hashes; we cannot recover them in plaintext
• Video content served via private R2 binding; file URLs are not publicly accessible
• HLS segments protected by short-lived JWT tokens against hotlinking
• Admin dashboard guarded by JWT middleware with role-based access (learner / instructor / admin)
• Instructor sensitive data (ID number, bank account) encrypted at rest
• Least-privilege principle: engineering and operations staff access personal data only within business necessity; access is audit-logged
• Regular backups and disaster recovery drills

That said, no transmission over the internet or data storage is 100% secure. If you notice anomalous account activity, please email privacy@unood.me immediately.

11. Information You Share Publicly

Some features of the Platform allow you to share content publicly. By using these features, you agree and understand that the content you post will be viewable by the public, including but not limited to:

1. Course reviews and ratings
2. Course discussion forum posts
3. Publicly visible profile information
4. Submissions to public assignment boards

Please consider what you share carefully, and avoid disclosing sensitive information you do not want to be public. To remove already-public content, you may edit or delete it via account settings, or request removal at privacy@unood.me.

12. Children and Minor Privacy

The Platform protects the personal data rights of minors as required by law:

• Children under 14 may not register an account on the Platform
• Minors aged 14 to under 18 must obtain consent from their legal guardian (parent or guardian) before registering or purchasing paid courses
• If we discover a minor account without legal guardian consent, the Platform will proactively suspend the account and notify the legal guardian
• A legal guardian may, at any time, email privacy@unood.me to access, correct, or delete the personal data of their minor

13. Your Rights Over Personal Data

Under Article 3 of the Personal Data Protection Act, you have the following rights regarding the personal data we collect:

1. Inquire about or request to review your data
2. Request a copy of your data
3. Request correction or supplementation
4. Request that we stop collecting, processing, or using your data
5. Request deletion

You may modify or correct your data at any time via account settings, or email privacy@unood.me from your registered address to exercise these rights.

Within the scope permitted by law (including but not limited to protection of free speech, freedom of information, and the public interest), we may still retain certain data. Please note that exercising these rights may prevent the Platform from providing some or all of its functionality. Once you have provided verifiable identification and assisted us in verifying your identity, and after performing any legal obligations applicable to you, we will fulfill your request as soon as practicable.

If you reside within the European Economic Area (EEA) while using the Platform, then in accordance with the EU General Data Protection Regulation (GDPR), unless other applicable law or the GDPR provides otherwise, you may exercise the following rights:

• Right to Access
• Right to Rectification
• Right to be Forgotten / Data Erasure
• Right to Restriction of Processing
• Right to Data Portability
• Right to Object

You also have the right to lodge a complaint with a supervisory authority. Contact details for the supervisory authorities can be found at: https://edpb.europa.eu/about-edpb/about-edpb/members_en

14. Third-Party Links

The Platform may provide third-party external links within the service (including but not limited to instructor websites, social media, and partner pages). If you click such a link and visit a third-party site, the collection, processing, and use of your personal data is governed by that site's own privacy policy or related agreements.

We recommend you read the privacy policy of any third-party site before using it. The Platform is not involved in or responsible for how third-party sites handle your personal data.

15. Privacy Policy Updates and Contact Us

This Privacy Policy may be updated as our business requirements evolve. Unless otherwise stated, all amendments take effect upon posting. Please review this policy periodically. We will notify you of any material changes by email or in-platform announcement before they take effect.

If you have any questions about this Privacy Policy, wish to exercise your data rights, or need other assistance, please contact us:

• Personal data protection inbox: privacy@unood.me
• General support and refunds: service@unood.me
• Legal matters: legal@unood.me

We respond on business days.

Questions about this Privacy Policy? Email privacy@unood.me.