1. Scope
This policy covers the lop247.com website and the app at app.lop247.com (the “Service”), operated by Lớp 247 (“we”). Lớp 247 is a free, non-commercial project developed and run by an individual; send any personal data questions to [email protected].
2. Who is responsible for the data
For data a center enters into the Service — students, parents, teachers, attendance, tuition, salaries, remarks — the center decides why and how it is processed (the data controller). We process that data on the center's behalf, only to provide the Service (the data processor).
For account details of people who sign up and technical data from using the Service, we are the data controller.
If you are a student or parent with a request about your data, please contact the center that runs your classes first. We will help the center handle it.
3. Data we process
Account details
- Email and name; phone number, address, bio and profile photo if you add them.
- Passwords and recovery codes are stored hashed, never in plain text. If you turn on two-step verification, its key is encrypted before it is stored.
Data entered by the center
- Students: name, parent's name and phone number, address, classes, attendance, scores, remarks and tuition records.
- Teachers and assistants: account details, assigned classes, sessions taught and salaries.
Technical and security data
- On sign-up: email, IP address and browser, to block automated sign-ups.
- On sign-in: IP address, browser, operating system, device type and approximate location (country, region) derived from the IP address. This lets you review sign-in history and helps us spot unusual access.
- Security event logs such as repeated failed sign-ins or password resets.
Other data
- Feedback and attachments you send in the app or by email.
- On lop247.com: visit statistics via Google Analytics (see Cookies). The app at app.lop247.com does not use Google Analytics.
4. How we use it
- To provide the Service: classes, attendance, tuition and salary calculation, reports, backups.
- To authenticate sign-ins, protect accounts and detect or prevent unauthorized access.
- To send necessary emails such as sign-up confirmation, password resets and notices of important changes.
- To help when you send feedback or report a bug, and to improve the Service.
- To meet legal obligations.
We do not sell personal data, do not use student or parent data for advertising, and do not contact a center's students or parents.
5. Data about students who are children
Many students are children, whose data the law protects more strictly. Centers must obtain consent from a parent or guardian before entering a student's data, enter only what is needed for teaching, and delete it when no longer needed.
Students do not sign in to the Service. Only the center owner and the teachers and assistants the center creates accounts for can see student data, within their permissions.
7. Security
- All connections are encrypted with HTTPS.
- Each center's data is isolated at the database level; one center's accounts cannot access another center's data.
- Passwords are hashed, two-step verification keys are encrypted, and failed sign-in attempts are rate-limited.
- The database is backed up regularly.
If an incident exposes or loses personal data, we will notify the affected centers and the competent authorities within the time required by law.
8. Retention
Data is kept while the center's account is active, including sign-in history. Centers can delete students, classes and other records themselves in the app. Some deleted data (such as accounts, students and classes) is kept for a while so it can be restored if deleted by mistake, before being permanently removed.
Each center keeps at most 3 backups in the app. Excel export files are deleted automatically after 30 days.
When a center asks for its account to be deleted, we remove its data from the live system within 30 days; older backups are removed as they rotate out. Some data may be kept longer where the law requires.
9. Your rights
Under Vietnam's personal data protection law, you have the right to:
- Be informed about how your personal data is processed.
- Give or withdraw consent.
- Access, correct and request deletion of your personal data.
- Request restriction of, or object to, processing.
- Get a copy of your data (centers can export to Excel or download a backup themselves).
- Complain, report or take legal action as provided by law.
To exercise these rights, email [email protected]. We will respond within the time required by law. For data entered by a center, we will work with that center on the request.
11. Changes to this policy
We may update this policy when the Service or the law changes. The date at the top of the page shows the latest update. For important changes, we will notify you by email or in the app.
12. Contact
Questions or requests about personal data: [email protected].