1. Scope and roles
This Policy explains how TEX Vietnam Technology JSC ("we", "us") handles personal data processed on CLASSQR. It is written in the style of the EU General Data Protection Regulation (GDPR) and the UK GDPR.
- For the account data of the person who registers (a center owner or teacher), we are the data controller.
- For student and parent data that a center or teacher enters into the Platform, the center/teacher is the data controller; we are the data processor, acting only on the center's instructions and only to provide the service.
2. Data we collect
| Category | Details | Source |
|---|---|---|
| Account | Full name, email, phone number, avatar, password (hashed, never stored in plain text), role. | Entered by the User, or via Google/Facebook sign-in (name, email, photo only). |
| Student | Full name, class, student code, date of birth (if entered), attendance history, test/practice results, teacher feedback. | Entered by the center/teacher; generated by learning activity on the Platform. |
| Parent | Full name, phone number, email, relationship to the student. | Entered by the center/teacher. |
| Biometric (special category data) | Facial images and derived feature vectors, only if the center enables face-based attendance/exam check-in. | Captured when a user registers their face, after being informed and giving consent. |
| Payment | Amount, timestamp, transaction description, transaction ID, status. We do not store card numbers, CVV or banking credentials. | Tuition: recorded by the center itself. Subscription plans: returned by our payment processor. |
| Technical | IP address, device and browser type, session cookies, access and error logs. | Collected automatically when the Platform is accessed. |
3. Purposes of processing
- Creating and managing accounts and classes; authenticating sign-in; attendance.
- Recording learning results, generating progress reports and sending them to parents by email or in-app notice as instructed by the center.
- Recording tuition the center collects; processing subscription payments; issuing invoices.
- Technical support, and service, security and policy-change notices.
- Keeping the system secure, detecting fraud and abuse; anonymized statistics to improve the product.
- Complying with legal obligations (accounting, tax, lawful requests from authorities).
We do not sell personal data and do not use student or parent data for advertising.
4. Legal basis and consent
- The person who registers an account agrees to this Policy when they sign up (performance of a contract).
- The center/teacher warrants that it has informed, and obtained the necessary consent of, parents or guardians before putting student data — especially data of children who are minors — and parent data on the Platform, and is responsible for the lawfulness of that data.
- Face-based attendance is only activated when the center turns it on and the user (or their guardian) consents; face data can be deleted at any time from account settings or on request.
5. Sharing data with third parties (subprocessors)
Data is shared only to the minimum extent necessary, with the following recipients:
| Recipient | Purpose | Location |
|---|---|---|
| Paddle.com Market Ltd and affiliates ("Paddle") | Payment processing for subscription plans, invoicing, tax and refunds, as our merchant of record. | United Kingdom, United States |
| Google LLC (Gemini API) | AI model used to generate or grade test questions and give feedback, when a center uses an AI feature. | United States |
| Anthropic, PBC (Claude API) | AI model used for the same AI features described above. | United States |
| OpenAI, L.L.C. (OpenAI API) | AI model used for the same AI features described above. | United States |
| Cloudflare, Inc. | Hosting of the public pages and static files, network security, and content delivery. | Global network |
| Our infrastructure and server provider | Hosting and running the application server and database. | See our current hosting notice |
| Our email delivery provider | Sending account notices and the reports centers ask us to send to parents. | United States |
| Competent authorities | Only on a valid, lawful written request. | — |
Only the content needed for the AI request is sent to Gemini, Claude or OpenAI (for example the question text or the answer to grade); we do not attach a student's full name, phone number or photo. Under the providers' API terms, this data is not used to train their models. Each provider acts under a contract that limits its use of the data. Because some providers are outside the European Economic Area and the United Kingdom, transfers to them rely on their standard contractual clauses or an equivalent safeguard. In our white-label model, each center's data is kept separate; one center cannot see another's data.
6. Cookies and browser storage
The Platform uses a session cookie to keep you signed in, a cookie to remember your language and interface preferences, and browser storage for brief offline behavior. We do not use third-party advertising tracking cookies. During checkout, Paddle may set its own cookies under Paddle's privacy policy. You can clear cookies in your browser, but you will need to sign in again.
7. Storage, security and retention
- Data is stored on servers we manage, transmitted over HTTPS, with passwords one-way hashed, role-based access control, and logging of administrative access.
- Daily backups are encrypted and kept for up to 30 days.
- Retention period: for the life of the service, plus 30 days after an account or center is deleted, after which it is removed from active systems. Transaction and invoice records are kept for the period required by accounting and tax law (up to 10 years). Technical logs are kept for up to 12 months.
- Facial data is deleted as soon as a user removes their face registration or the center disables the feature.
8. Your rights
Subject to applicable law, including the GDPR and UK GDPR, a data subject (or a student's parent or guardian) has the right to: be informed, give or withdraw consent, access their data, rectify it, erase it, restrict processing, object to processing, request a copy of their data (data portability), and lodge a complaint with a supervisory authority (in the EU, your national data protection authority; in the UK, the Information Commissioner's Office).
How to exercise these rights: students and parents should first contact their center or teacher (the data controller for their data); the account holder or center should send a request to [email protected]. We acknowledge within 72 hours and act on the request within 30 days, and may ask you to verify your identity first.
Residents of California and other US states with privacy laws: we do not sell or share personal data for advertising and do not use it for profiling with legal effect; the rights above cover your rights to know, delete and correct your data.
9. Data breach notification
If we discover an incident that exposes, loses or alters personal data without authorization, we will notify the affected center and, where required by law, the competent supervisory authority, without undue delay and in any case within 72 hours of becoming aware of it, together with the remedial steps taken.
10. Children's data
The Platform supports educational use, so it necessarily processes data about students who are minors. That processing always happens through a center, teacher, parent or guardian; only the minimum data needed for learning is collected; student profiles are not made public; and no advertising is sent to students. A parent or guardian may request access to or deletion of their child's data as described in section 8.
11. Changes to this Policy
When this Policy changes materially, we will notify you by email or in-app notice at least 7 days before the change takes effect. The effective date of the current version is shown at the top of the page.
12. Privacy contact
Our data protection contact handles all requests, questions and complaints at: