Effective · Vietnamese law

Privacy Policy

How Klassi collects, uses, stores, shares, and protects personal data when you use klassi.vn — aligned with Decree 13/2023/ND-CP and applicable Vietnamese law.

Last updated: July 12, 2026

1. Overview and data controller

Klassi (“we”, “the platform”) operates the Klassi software service at klassi.vn to help teachers and tutoring centers manage classes, attendance, tuition tracking, parent/student communication, and related features (including Class AI when enabled). Privacy contact: [email protected] (subject suggestion: [Privacy]). This Policy forms part of the Terms of Service. By registering, signing in (email/password or Google), linking a parent/student portal account, or continuing to use the service, you acknowledge and agree to this Policy to the extent permitted by law. Who is covered: • Teachers / account holders: register and manage classes. • Parents: access portals via teacher links and/or linked portal accounts. • Students / learners: attendance, class content, Class AI (if enabled) — a full account may not be required. If you do not agree, stop using the service and/or request deletion under Your rights.

2. Processing roles (important)

2.1 Klassi as controller For platform account data (name, email, username, login data, subscription, technical logs, platform fees), Klassi is the personal data controller under Decree 13/2023/ND-CP. 2.2 Teachers as controllers of class content For student/parent and class data entered or collected by teachers (student names, parent phone/email, attendance, teacher–parent tuition status, messages, materials, GPS check-in, Q&A board content, etc.), the teacher / their organization decides the purposes and means of collection. Klassi provides infrastructure processing on the teacher’s technical instructions (processor for that class data), except where law provides otherwise or Klassi determines its own purposes (e.g. platform security, fraud prevention). 2.3 Teacher responsibility Teachers must only enter and share data with a lawful basis (teaching agreement, parent/guardian consent, or other legal grounds), especially for children under 16 under Decree 13/2023/ND-CP. Klassi does not verify each consent instance; teachers remain responsible to parents, students, and authorities for unlawful collection.

3. Information we collect

3.1 Teacher / platform accounts Name, email, username, password (hashed only), profile photo (if any), 2FA (if enabled), login/session history, subscription plan, platform invoice history, referral codes (if any), Google login link identifiers. 3.2 Class data entered or created by teachers Class details, schedule, session address, monthly fee, student lists, parent contacts, notes, attendance, teacher–parent tuition status, bank/QR details provided by teachers, materials, messages, anonymous board content, interactive practice content. 3.3 Parent / student portals Access tokens, link open times, attendance (time, method), GPS coordinates when location permission is granted, IP address, portal linking data (email, OTP), push preferences (if enabled). 3.4 Class AI (when enabled) Prompts/questions sent to the assistant, class-material context used for answers, system responses, quota usage logs, abuse-prevention signals. We do not use class content to train third-party AI models beyond delivering the stated service. 3.5 Platform payments When purchasing paid plans: transaction data, invoice IDs, payment status via providers (e.g. Stripe, SePay/VietQR or equivalents). Klassi does not store full card numbers on our systems when the payment gateway processes cards directly. 3.6 Public teacher page (/p/...) Page content; contact form submissions (name, phone, email, message). 3.7 Technical data IP, browser/device, language/theme/session cookies or localStorage, security and abuse logs. 3.8 Sensitive data We do not intentionally collect sensitive personal data under Decree 13/2023/ND-CP (health, politics, religion, biometrics, etc.). GPS check-in location is processed only when permission is granted and the teacher enables the feature. If you voluntarily enter sensitive data in notes/messages/materials, that is your choice.

4. Purposes and legal bases

We process data to: • Perform the service contract / provide Klassi features (sign-in, classes, attendance, tuition status, portals, messaging, materials, Class AI, plan billing). • Send transactional notices: email verification, password reset, OTP, schedule/tuition/pickup reminders, attendance summaries, material alerts (when email/push is configured). • Secure the platform; prevent fraud, spam, and unauthorized access; fix incidents. • Provide support, handle complaints, and improve service in aggregated/anonymized form where appropriate. • Comply with legal duties and lawful requests from competent authorities. Main legal bases (Decree 13/2023/ND-CP and related rules): • Contract performance / providing the service you request. • Consent (registration, enabling GPS, enabling push, optional inputs…). • Legitimate interests: security, stability, abuse prevention — without overriding data-subject rights. • Legal obligation when required by law. We do not sell personal data.

5. Sharing

5.1 Teacher-controlled sharing Parents/students only see what teachers configure on portals or share via features. Teachers must send links to the correct recipients and must not publish tokens publicly. 5.2 Processors Hosting, databases, cache, file storage, queues, transactional email, payment gateways, AI model providers (only to generate responses for the service). They process data under contract/instructions and only to deliver Klassi. 5.3 Legal and rights protection We may disclose data when Vietnamese law requires it, pursuant to valid authority requests, or when reasonably necessary to protect Klassi, users, or the public and to prevent serious fraud/abuse. 5.4 Business transfers In a merger, assignment, or restructuring, data may transfer to a successor with equivalent protections and notice where required by law.

6. Cross-border transfers

Some infrastructure, email, payment, or AI providers may process/store data outside Vietnam. When transferring personal data abroad, we apply measures consistent with Decree 13/2023/ND-CP and applicable guidance at the time of transfer (impact assessment, protective contracts, technical–organizational measures), and only as needed to provide the service. If you do not agree to transfers necessary for operations, you may stop using the service and request account closure.

7. Retention and security

Retention: • Account and class data: while the account is active and needed for stated purposes. • After account closure: delete or anonymize within a reasonable period (typically 30–90 days), except where law requires longer retention (security logs, payment evidence/invoices, ongoing disputes). • Portal tokens: time-limited; revocable when teachers remove students or regenerate links. • AI/abuse logs: kept as needed for operations, security, and quota reconciliation. Security measures (non-exhaustive): • HTTPS/TLS in transit. • Password hashing; encrypted 2FA secrets at rest. • Tenant-scoped access; portal access via token. • Admin audit logs where applicable. No system is perfectly secure. Use strong passwords, enable 2FA when available, and do not share portal links publicly.

8. Data subject rights

Under Decree 13/2023/ND-CP and related law, you may have rights (subject to legal conditions), including to: • Be informed, consent, access, and correct data. • Delete or request deletion. • Restrict processing; object in certain cases. • Lodge complaints, denunciations, or lawsuits as provided by law. • Claim damages where legally grounded. • Withdraw consent (where processing is consent-based) — some features may stop working. How to exercise: • Teachers: update profile, manage/delete classes–students, close account in-app; or email [email protected]. • Parents/students: contact the teacher first (class-data controller); Klassi will coordinate on valid requests to [email protected]. We may verify identity before acting. Typical response time: within 15 business days, or as required by law; complex requests may be extended with notice.

9. Cookies and similar technologies

We use cookies/localStorage to: • Remember language (vi/en) and theme. • Maintain sign-in sessions. • Anti-spam on the anonymous board (student session). • Store plan-intent / referral technical signals when needed. Essential cookies for sign-in and security cannot be disabled if you want full service use. We do not use third-party advertising cookies to track behavior beyond operating Klassi, unless we notify you and obtain separate consent (if introduced later).

10. Children’s data

Klassi may store student names and parent contacts entered by teachers. Under Decree 13/2023/ND-CP, processing children’s personal data follows specific rules (including consent of the child and/or parent/guardian depending on age and processing type). Teachers are responsible for obtaining required consent/lawful bases before: • Entering parent/student phone or email. • Enabling GPS/location check-in. • Letting students use Class AI or interactive tools tied to personal data. Klassi does not independently target children outside teacher-managed class contexts. Parents who do not want a child listed should contact the teacher to remove/edit data; you may also copy [email protected] so we can help coordinate.

11. Personal data incidents

If a personal data protection incident occurs as defined by law, we will assess risk and notify/remediate under Decree 13/2023/ND-CP and competent authority guidance (including notifying authorities and/or data subjects when legally required). Notify [email protected] immediately if you suspect unauthorized account access or exposure of a portal link.

12. Applicable legal framework

This Policy is designed to comply with Vietnamese law, including (without limitation): • Decree 13/2023/ND-CP on personal data protection and implementing guidance. • The Law on Cybersecurity and related rules on storage and lawful disclosure. • The Law on Electronic Transactions and applicable e-commerce / digital service rules. • The Law on Protection of Consumer Rights (for qualifying consumer transactions). If the Vietnamese and translated versions differ, the Vietnamese version prevails for users in Vietnam.

13. Policy changes

We may update this Policy to reflect law or product changes. New versions are posted at /privacy with an updated date. Material changes may be announced by email, in-app notice, or banner. Where law requires separate consent, we will use that form. Continued use after the effective date (where re-consent is not mandatory) means you acknowledge and accept the update to the extent permitted by law.

14. Contact

Privacy / personal data requests: Email: [email protected] Website: https://klassi.vn/contact Please describe your request (access, correction, deletion, complaint…) and provide reasonable verification details. This Policy is not legal advice for your specific situation.