This Policy is the personal data processing notice of EduQuiz. It is made under Vietnam's Law on Personal Data Protection No. 91/2025/QH15, Decree No. 356/2025/ND-CP and related laws. It explains what data we collect, why we use it, who we share it with, how long we keep it, and what rights you have.

When you create an account by email (ticking the consent box) or continue with Google, you confirm that you have read, understood and agreed to this Policy. You may withdraw your consent at any time (section 8).

This is a translation. If it differs from the Vietnamese version, the Vietnamese version prevails.

1. Data controller

EduQuiz is owned and operated by an individual (an independent developer). In this Policy, "we" means that individual and the helpers they authorise.

This individual is the data controller and processor. Their full name, personal tax code and contact address are shown in the Owner information box above and in the site footer.

Contact point for all personal data requests: teamdevdesignwebsite@gmail.com.

2. Personal data we process

We only collect the data needed for the purposes in section 3.

a) Account data (required to use an account):

• full name and email address;
• password (stored only as a one-way hash, so nobody can read the original);
• phone number (optional).

b) Google sign-in data:

• your Google account ID, name, verified email and profile picture;
• Google provides this data after you allow it on Google's screen;
• we never receive or store your Google password.

c) Profile data (entered by you, optional):

• date of birth, gender, address;
• avatar and cover photo;
• time zone;
• location coordinates, if you choose to provide them. Location data may be sensitive personal data, and we only process it when you enter it yourself.

d) Learning data:

• tests taken, answers chosen, scores and time spent;
• study streak, achievement badges and leaderboard position;
• saved tests and posts;
• comments you post on the blog.

e) Pro membership data:

• plan purchased, validity period and activation history;
• information you send when ordering a plan (name, email, bank transfer note).

We do not collect or store your card numbers or payment account passwords.

f) Contact and support data: name, email, phone, subject and message sent through the Contact or Support page.

g) AI Assistant conversations: your questions, the answers and any images you attach in the AI Assistant.

h) Technical data:

• IP address, browser and device type;
• access times and error logs;
• device token for notifications, if you allow notifications.

3. Purposes

We process the data in section 2 to:

1. create, verify (OTP email), maintain and protect your account;
2. provide the learning service: tests, scoring, saved results, review, recommendations, streaks, badges and leaderboards;
3. activate and renew Pro plans, reconcile payments and meet tax obligations;
4. answer contact, support and complaint requests;
5. run the AI Assistant to answer your study questions;
6. send account, test, achievement and service notices (not advertising);
7. keep the service secure and prevent fraud, unauthorised access and abuse; fix technical issues;
8. comply with lawful requests from competent authorities.

We do not sell your personal data. We do not use it for advertising or marketing without your separate consent.

4. Legal bases

• Your consent: for purposes 1, 2, 5 and 6. Optional profile data is only processed when you choose to provide it.
• Performance of our service contract under the Terms of Use: for purposes 2, 3 and 4.
• Legal obligations: for purpose 3 (tax) and purpose 8. Purpose 7 relies on our duty to keep data and networks secure.
• Other cases where the law allows processing without consent.

5. Sharing

We share data only to the minimum extent needed, with:

About the AI Assistant: do not enter sensitive information such as ID numbers, bank details or health information.

Your display name and avatar may appear publicly on the leaderboard and next to comments you post. If you prefer not to show your name, change your display name or contact us for help hiding it.

6. Transfers outside Vietnam

Some recipients in section 5 (Google, and possibly the hosting provider) run servers outside Vietnam. Your data may therefore be transferred, stored and processed abroad.

We only transfer data when:

• there is a lawful basis;
• the recipient commits to protecting it at a level no lower than Vietnamese law requires;
• we have completed the cross-border transfer impact assessment, where the law requires one.

By agreeing to this Policy you consent to these transfers.

7. Retention

After these periods, data is deleted or de-identified, unless the law requires us to keep it longer.

8. Your rights

Under personal data protection law, you have the right to:

• be informed about the processing of your data;
• consent or refuse; withdraw consent at any time (this does not affect processing lawfully carried out before);
• access and correct your data (most of it directly on your Profile page);
• request deletion, including deleting your account;
• request restriction of processing; object to processing;
• obtain a copy of your data;
• complain, denounce or sue; claim compensation as provided by law;
• protect yourself as provided by law.

How to send a request: email teamdevdesignwebsite@gmail.com from your account email, or use the Contact page. State your request clearly.

• We may verify your identity first, to protect you.
• We respond and act within the time limits set by law.
• If you withdraw consent or delete data that is required, we may no longer be able to provide part or all of the service. We will tell you about this before acting.

9. Children's data

EduQuiz has content for primary, lower and upper secondary students.

Users under 16:

• May only create an account with the consent of a parent or legal guardian.
• If the child is 7 or older, the child's own consent is also required.
• Parents or guardians should create the account themselves or together with the child.

If we find a child's account without valid consent, we may suspend it and delete its data.

Parents and guardians may ask to view, correct or delete a child's data through the contact point in section 1.

10. Security measures

• Encrypted connections (HTTPS). Passwords are hashed one way.
• System access keys are kept on the server, never exposed to browsers.
• Access control: only the operator and authorised helpers can access data, under confidentiality commitments.
• Access logging and regular backups.
• Accounts that break the rules can be locked immediately.

If a personal data breach occurs, we notify the specialised personal data protection authority and you (where needed) within the statutory time limit. We also take remedial action immediately.

Please keep your password secret and sign out on shared devices.

11. Cookies and browser storage

We only use cookies and browser storage that are necessary for the website to work:

• the auth-token cookie and browser storage (localStorage) keep your sign-in token and basic account details (name, email, avatar) so you do not have to sign in again. They are cleared when you sign out;
• the NEXT_LOCALE cookie keeps your chosen language.

A test in progress only lives in the tab's temporary memory and is auto-saved to the server, not stored in the browser.

On the sign-in and sign-up pages, the Sign in with Google button loads code from accounts.google.com. Google may set its own cookies under Google's privacy policy.

We do not use advertising cookies or third-party analytics or behaviour-tracking tools. If that ever changes, we will ask for your permission first.

12. Possible unwanted consequences

No system is perfectly secure. Risks include:

• unauthorised access through cyberattacks;
• passwords leaked on the user's side;
• incidents at service providers.

We apply the measures in section 10 to reduce these risks, and we are liable as provided by law when we are at fault.

13. Changes

We may update this Policy when the law or the service changes.

• Important changes (new purposes, new types of data, new recipients) will be announced on the website or by email before they apply.
• Where a change needs new consent, we will ask you again.

14. Contact

For any question or request about personal data, write to teamdevdesignwebsite@gmail.com or use the EduQuiz Contact page.

Last updated: 23/10/2026.