Privacy Policy

1. Scope and roles

This Policy explains how TEX Vietnam Technology JSC ("we", "us") handles personal data processed on CLASSQR. It is written in the style of the EU General Data Protection Regulation (GDPR) and the UK GDPR.

• For the account data of the person who registers (a center owner or teacher), we are the data controller.
• For student and parent data that a center or teacher enters into the Platform, the center/teacher is the data controller; we are the data processor, acting only on the center's instructions and only to provide the service.

2. Data we collect

3. Purposes of processing

• Creating and managing accounts and classes; authenticating sign-in; attendance.
• For online classes in a room the Platform created: suggesting attendance from how long each student stayed in the meeting. The teacher always confirms attendance; nothing is marked automatically.
• Recording learning results, generating progress reports and sending them to parents by email or in-app notice as instructed by the center.
• Recording tuition the center collects; processing subscription payments; issuing invoices.
• Technical support, and service, security and policy-change notices.
• Keeping the system secure, detecting fraud and abuse; anonymized statistics to improve the product.
• Complying with legal obligations (accounting, tax, lawful requests from authorities).

We do not sell personal data and do not use student or parent data for advertising.

4. Legal basis and consent

• The person who registers an account agrees to this Policy when they sign up (performance of a contract).
• The center/teacher warrants that it has informed, and obtained the necessary consent of, parents or guardians before putting student data — especially data of children who are minors — and parent data on the Platform, and is responsible for the lawfulness of that data.

5. Sharing data with third parties (subprocessors)

Data is shared only to the minimum extent necessary, with the following recipients:

Gemini, Claude and OpenAI receive only what a teacher submits to write questions and tests (for example the subject, topics, question text or an uploaded document) and, for the Help chat, what center staff type there and the names, statuses and counts of their center's classes and exams, never student names or answers. Under the providers' API terms, this data is not used to train their models. Each provider acts under a contract that limits its use of the data. Because some providers are outside the European Economic Area and the United Kingdom, transfers to them rely on their standard contractual clauses or an equivalent safeguard. In our white-label model, each center's data is kept separate; one center cannot see another's data.

6. Cookies and browser storage

The Platform uses a session cookie to keep you signed in, a cookie to remember your language and interface preferences, and browser storage for brief offline behavior. We do not use third-party advertising tracking cookies. During checkout, Paddle may set its own cookies under Paddle's privacy policy. You can clear cookies in your browser, but you will need to sign in again.

7. Storage, security and retention

• Data is stored on servers we manage, transmitted over HTTPS, with passwords one-way hashed, role-based access control, and logging of administrative access.
• Daily backups are encrypted and kept for up to 30 days.
• Retention period: for the life of the service, plus 30 days after an account or center is deleted, after which it is removed from active systems. Transaction and invoice records are kept for the period required by accounting and tax law (up to 10 years). Technical logs are kept for up to 12 months.
• Online meeting data: participants who match no student of the class are deleted 90 days after the meeting; platform notifications (webhooks) are deleted after 14 days. Display names a teacher links to a student are remembered for that class and deleted with the class. Attendance a teacher confirmed is kept as an attendance record, like attendance taken by hand.
• Disconnecting a meeting platform: a teacher disconnects in Settings, Online meetings, or removes the app in their platform account (for Zoom: App Marketplace, Manage, Added Apps). When no center uses the connection any more, we revoke our access with the platform and delete the tokens at once, and we stop reading meetings. Rooms already created remain in the teacher's platform account. To have the remaining meeting data deleted, contact the center or write to us as described in section 8.

8. Your rights

Subject to applicable law, including the GDPR and UK GDPR, a data subject (or a student's parent or guardian) has the right to: be informed, give or withdraw consent, access their data, rectify it, erase it, restrict processing, object to processing, request a copy of their data (data portability), and lodge a complaint with a supervisory authority (in the EU, your national data protection authority; in the UK, the Information Commissioner's Office).

How to exercise these rights: students and parents should first contact their center or teacher (the data controller for their data); the account holder or center should send a request to [email protected]. We acknowledge within 72 hours and act on the request within 30 days, and may ask you to verify your identity first.

Residents of California and other US states with privacy laws: we do not sell or share personal data for advertising; the rights above cover your rights to know, delete and correct your data.

9. Data breach notification

If we discover an incident that exposes, loses or alters personal data without authorization, we will notify the affected center and, where required by law, the competent supervisory authority, without undue delay and in any case within 72 hours of becoming aware of it, together with the remedial steps taken.

10. Children's data

The Platform supports educational use, so it necessarily processes data about students who are minors. That processing always happens through a center, teacher, parent or guardian; only the minimum data needed for learning is collected; student profiles are not made public; and no advertising is sent to students. A parent or guardian may request access to or deletion of their child's data as described in section 8.

The center is responsible for obtaining verifiable parental consent where the law requires it before a child's data is put on the Platform or a child joins an online class whose meeting data the Platform reads, including under the US Children's Online Privacy Protection Act (COPPA) for children under 13 and under the GDPR and UK GDPR where a child is below the age of digital consent in their country. We process children's data, including the meeting data described in section 2, only on the center's instructions and only to provide the service.

11. Grabaciones de clases

Cuando un profesor usa "Grabar clase", la Plataforma guarda la sesión como una secuencia de eventos de la pizarra: las páginas y diapositivas mostradas, los trazos, las formas, las pizarras auxiliares, los cuadros de diálogo, el puntero láser y los pasos revelados del repaso en clase, junto con una copia del documento o de la prueba tal como era al empezar. La voz del profesor solo se graba cuando el profesor activa la grabación de voz. La aplicación no graba las cámaras, los micrófonos ni las pantallas de los estudiantes; una grabación de voz puede captar lo que digan los estudiantes cerca del micrófono del profesor.

Solo los estudiantes inscritos en la clase y los profesores de la clase pueden ver una grabación, después de iniciar sesión; las grabaciones no tienen enlace público. Registramos qué estudiantes vieron una grabación y durante cuánto tiempo, para que el profesor sepa quién volvió a ver la clase.

Una grabación se conserva 90 días y después se elimina automáticamente junto con sus archivos. Se elimina antes si el profesor la elimina o elimina su actividad, lección o clase.

El centro o el profesor que graba es el responsable del tratamiento de la grabación. Debe informar a los estudiantes, y a sus padres o tutores, de que las clases pueden grabarse, y obtener el consentimiento cuando la ley lo exija, sobre todo en el caso de menores: por ejemplo, el consentimiento verificable de los padres según la ley estadounidense COPPA para menores de 13 años, y el consentimiento de un padre, madre o tutor según el RGPD o el RGPD del Reino Unido para menores que no alcancen la edad de consentimiento digital de su país (16 años, o una edad inferior fijada por la ley nacional).

Para que se elimine una grabación, el estudiante, el padre, la madre o el tutor se pone en contacto con el centro o el profesor, que puede eliminarla al instante desde la lista de lecciones. También puedes escribirnos como se indica en la sección 8.

12. Changes to this Policy

When this Policy changes materially, we will notify you by email or in-app notice at least 7 days before the change takes effect. The effective date of the current version is shown at the top of the page.

13. Privacy contact

Our data protection contact handles all requests, questions and complaints at: