Privacy Policy

1. Scope and roles

This Policy explains how TEX Vietnam Technology JSC ("we", "us") handles personal data processed on CLASSQR. It is written in the style of the EU General Data Protection Regulation (GDPR) and the UK GDPR.

• For the account data of the person who registers (a center owner or teacher), we are the data controller.
• For student and parent data that a center or teacher enters into the Platform, the center/teacher is the data controller; we are the data processor, acting only on the center's instructions and only to provide the service.

2. Data we collect

3. Purposes of processing

• Creating and managing accounts and classes; authenticating sign-in; attendance.
• For online classes in a room the Platform created: suggesting attendance from how long each student stayed in the meeting. The teacher always confirms attendance; nothing is marked automatically.
• Recording learning results, generating progress reports and sending them to parents by email or in-app notice as instructed by the center.
• Recording tuition the center collects; processing subscription payments; issuing invoices.
• Technical support, and service, security and policy-change notices.
• Keeping the system secure, detecting fraud and abuse; anonymized statistics to improve the product.
• Complying with legal obligations (accounting, tax, lawful requests from authorities).

We do not sell personal data and do not use student or parent data for advertising.

4. Legal basis and consent

• The person who registers an account agrees to this Policy when they sign up (performance of a contract).
• The center/teacher warrants that it has informed, and obtained the necessary consent of, parents or guardians before putting student data — especially data of children who are minors — and parent data on the Platform, and is responsible for the lawfulness of that data.

5. Sharing data with third parties (subprocessors)

Data is shared only to the minimum extent necessary, with the following recipients:

Gemini, Claude and OpenAI receive only what a teacher submits to write questions and tests (for example the subject, topics, question text or an uploaded document) and, for the Help chat, what center staff type there and the names, statuses and counts of their center's classes and exams, never student names or answers. Under the providers' API terms, this data is not used to train their models. Each provider acts under a contract that limits its use of the data. Because some providers are outside the European Economic Area and the United Kingdom, transfers to them rely on their standard contractual clauses or an equivalent safeguard. In our white-label model, each center's data is kept separate; one center cannot see another's data.

6. Cookies and browser storage

The Platform uses a session cookie to keep you signed in, a cookie to remember your language and interface preferences, and browser storage for brief offline behavior. We do not use third-party advertising tracking cookies. During checkout, Paddle may set its own cookies under Paddle's privacy policy. You can clear cookies in your browser, but you will need to sign in again.

7. Storage, security and retention

• Data is stored on servers we manage, transmitted over HTTPS, with passwords one-way hashed, role-based access control, and logging of administrative access.
• Daily backups are encrypted and kept for up to 30 days.
• Retention period: for the life of the service, plus 30 days after an account or center is deleted, after which it is removed from active systems. Transaction and invoice records are kept for the period required by accounting and tax law (up to 10 years). Technical logs are kept for up to 12 months.
• Online meeting data: participants who match no student of the class are deleted 90 days after the meeting; platform notifications (webhooks) are deleted after 14 days. Display names a teacher links to a student are remembered for that class and deleted with the class. Attendance a teacher confirmed is kept as an attendance record, like attendance taken by hand.
• Disconnecting a meeting platform: a teacher disconnects in Settings, Online meetings, or removes the app in their platform account (for Zoom: App Marketplace, Manage, Added Apps). When no center uses the connection any more, we revoke our access with the platform and delete the tokens at once, and we stop reading meetings. Rooms already created remain in the teacher's platform account. To have the remaining meeting data deleted, contact the center or write to us as described in section 8.

8. Your rights

Subject to applicable law, including the GDPR and UK GDPR, a data subject (or a student's parent or guardian) has the right to: be informed, give or withdraw consent, access their data, rectify it, erase it, restrict processing, object to processing, request a copy of their data (data portability), and lodge a complaint with a supervisory authority (in the EU, your national data protection authority; in the UK, the Information Commissioner's Office).

How to exercise these rights: students and parents should first contact their center or teacher (the data controller for their data); the account holder or center should send a request to [email protected]. We acknowledge within 72 hours and act on the request within 30 days, and may ask you to verify your identity first.

Residents of California and other US states with privacy laws: we do not sell or share personal data for advertising; the rights above cover your rights to know, delete and correct your data.

9. Data breach notification

If we discover an incident that exposes, loses or alters personal data without authorization, we will notify the affected center and, where required by law, the competent supervisory authority, without undue delay and in any case within 72 hours of becoming aware of it, together with the remedial steps taken.

10. Children's data

The Platform supports educational use, so it necessarily processes data about students who are minors. That processing always happens through a center, teacher, parent or guardian; only the minimum data needed for learning is collected; student profiles are not made public; and no advertising is sent to students. A parent or guardian may request access to or deletion of their child's data as described in section 8.

The center is responsible for obtaining verifiable parental consent where the law requires it before a child's data is put on the Platform or a child joins an online class whose meeting data the Platform reads, including under the US Children's Online Privacy Protection Act (COPPA) for children under 13 and under the GDPR and UK GDPR where a child is below the age of digital consent in their country. We process children's data, including the meeting data described in section 2, only on the center's instructions and only to provide the service.

11. Gravações de aulas

Quando um professor usa "Gravar aula", a Plataforma guarda a sessão como uma sequência de eventos do quadro: as páginas e os slides exibidos, os traços, as formas, os quadros auxiliares, as caixas de diálogo, o ponteiro laser e as etapas reveladas da correção em sala, com uma cópia do documento ou da prova como estava no início. A voz do professor só é gravada quando o professor ativa a gravação de voz. O aplicativo não grava as câmeras, os microfones nem as telas dos alunos; uma gravação de voz pode captar o que os alunos disserem perto do microfone do professor.

Somente os alunos matriculados na turma e os professores da turma podem assistir a uma gravação, depois de entrar na conta; as gravações não têm link público. Registramos quais alunos assistiram a uma gravação e por quanto tempo, para que o professor saiba quem reviu a aula.

Uma gravação fica guardada por 90 dias e depois é excluída automaticamente com seus arquivos. Ela é excluída antes se o professor a excluir ou excluir a atividade, a lição ou a turma.

O centro ou o professor que grava é o controlador dos dados da gravação. Cabe a ele informar os alunos, e seus pais ou responsáveis, de que as aulas podem ser gravadas, e obter o consentimento quando a lei exigir, especialmente no caso de menores: por exemplo, o consentimento verificável dos pais segundo a lei americana COPPA para crianças com menos de 13 anos, e o consentimento de um dos pais ou responsável segundo o RGPD ou o RGPD do Reino Unido para crianças abaixo da idade de consentimento digital do seu país (16 anos, ou uma idade menor fixada pela lei nacional).

Para que uma gravação seja excluída, o aluno, um dos pais ou o responsável entra em contato com o centro ou o professor, que pode excluí-la na hora pela lista de lições. Você também pode nos escrever como descrito na seção 8.

12. Changes to this Policy

When this Policy changes materially, we will notify you by email or in-app notice at least 7 days before the change takes effect. The effective date of the current version is shown at the top of the page.

13. Privacy contact

Our data protection contact handles all requests, questions and complaints at: