Privacy policy

Personal data protection policy

This policy explains how SyllaPrep collects, uses, stores and protects personal data, under Decree 13/2023/ND-CP and the Personal Data Protection Law. SyllaPrep provides this service.

We have two roles. For the data of students and parents and the content in a workspace, the workspace (a tutor or center) decides why it is processed, and we process it on the workspace's behalf. For account, sign-in, billing and inquiry data, we are the controller.

For the copies kept to improve its AI, SyllaPrep decides why they are processed.

Data we collect

We collect only what running the service needs:

• Accounts: display name, email, password (stored only as a hash, by the sign-in service), language, and a profile photo if you upload one; with Google sign-in, the name and email Google provides.
• Sign-in sessions: when you signed in, when you were last active, and a description of the browser and device, so you can review and sign out other sessions.
• Workspace content: classes, assignments, materials and files; student names and notes entered by tutors; answers, files and voice recordings students submit; marks and feedback.
• Students without accounts: each student's class card (link and code, stored encrypted), wrong code tries, when they last came in, and the name a student enters when asking to join through a class link. We collect nothing that identifies the device.
• Parents: the link between a parent and a student, and share codes (stored only as a hash).
• Billing: invoices, plans, amounts, transfer status and invoicing details. We never receive or store card details.
• The first-run survey: how you teach, how many students you have, how you heard of SyllaPrep and the tools you use, if you answer.
• Enterprise inquiries: name, email, phone, organization, student count, message, and a one-way hash of the IP address to stop flooding.
• Usage statistics: page views and usage events without any identity, through analytics we host ourselves.
• Error reports: when something breaks, we record the page, the kind of error and the type of browser and device, without any identity, name, email or content, on systems we run ourselves.

What we use it for

We use data to:

• Provide the service: sign-in, assigning, submitting and marking work, sharing progress with parents.
• Send necessary email: verification, invitations, password resets, and necessary notices about your account, assignments and billing.
• Take payment, issue invoices and match transfers.
• Protect accounts and systems against abuse and fraud.
• Understand how the service is used so we can improve it, only through non-identifying figures.
• Evaluate and improve SyllaPrep's AI with lesson requests, imported worksheets, the lessons AI writes and tutors' edits, unless the workspace owner turns this off. Names and contact details are removed before use. Students' work is never used.
• Answer support requests, inquiries and complaints, and meet legal obligations.

Legal basis

We process account data on the basis of the consent you give when creating an account and to perform our service contract with you. Billing data is processed to perform the contract and meet accounting and tax obligations.

Student and parent data is processed on the workspace's instructions, based on the consent the workspace holds from them (and from a parent or guardian for a child), as the Terms of service require. You can withdraw consent at any time; withdrawing does not affect processing that already took place.

Processors

We do not sell personal data. We share data only with providers needed to run the service, under contracts that require them to protect it:

• Hosting provider: SyllaPrep's servers and database, in Singapore. Holds all the data above.
• Network and file storage provider: delivery and protection network (all traffic passes through it), storage of files, photos, recordings and backups in the Asia-Pacific region, and the bot check on the contact form.
• Resend (a United States company): sends SyllaPrep's email from servers in Tokyo, Japan; receives recipient addresses and email content.
• OpenAI: receives worksheet text when a tutor imports a Word file, lesson requests with the text of files a tutor attaches to make a lesson, and students' typed answers with their questions for marking; never names, identifiers, recordings, file names or the files themselves. Servers in the United States.
• Google: only for people who choose to sign in with Google; Google tells us your name and email.

AI processing

When a tutor imports a worksheet or creates a lesson, SyllaPrep sends the worksheet's text, or the lesson request together with the text of any Word or PDF files the tutor attached to make the lesson, to OpenAI (United States). File names are never sent. The attached files are deleted after they are read; the passages, words and points taken from them stay with the lesson's generation record until that record is deleted.

When a student hands in work, SyllaPrep sends each typed answer, with its question and marking criteria, to OpenAI to mark it and write feedback. We never send names, emails, identifiers, class or workspace names, recordings, photos or uploaded files. Personal details a student writes into an answer stay in that answer, so remind students not to write them.

OpenAI does not keep the result and does not use this data to train its models. A workspace owner can turn AI marking off in settings; written answers are then marked by a tutor.

SyllaPrep keeps its own copy of lesson requests, imported worksheets, the lessons AI writes and tutors' edits to improve its AI, unless the workspace owner turns off "Use content to improve SyllaPrep's AI". The text of attached files and students' answers are never kept for this.

Transfers outside Vietnam

SyllaPrep's data is stored and processed outside Vietnam: mainly in Singapore; outgoing email passes through servers in Japan run by a United States company; and worksheet text, lesson requests and students' typed answers sent to AI for marking are processed in the United States. We choose providers with security commitments, send only what is needed, and keep the cross-border transfer impact assessment the law requires.

How long we keep data

We keep data as long as its purpose needs:

• Accounts: until you ask for deletion. Sign-in sessions expire after 30 days.
• Workspace content: for as long as the workspace exists. Files removed from assignments or submissions are deleted periodically. A new workspace that never makes its first payment is deleted after 7 days.
• Invoices and payment records: for the period accounting and tax law requires.
• Inquiries: while needed to answer and follow up, and deleted on request.
• Database backups: 30 days. Deleted data leaves the backups within 30 days.
• Copies kept to improve AI: while the workspace exists and the setting stays on; deleted within a day after it is turned off or the workspace is deleted.
• Error reports and server technical logs: up to 30 days.

Cookies

SyllaPrep uses only cookies needed to run the site and remember your choices. We use no advertising or tracking cookies. SyllaPrep's cookies:

• sid: keeps you signed in, up to 30 days.
• oidc_tx: protects a sign-in in progress, for up to 30 minutes.
• auth_return: keeps the invitation or join code just opened, so a sign-in still ends in the right place, for one day.
• locale: your language.
• theme: light or dark appearance.
• sidebar and sidebar-width: the sidebar's state and width.
• surface: the area you used last when you have several roles.
• gshare: temporary viewing access when a parent opens a share link.
• learner: remembers students without accounts on this device and which student is doing a lesson, up to 180 days from their last entry.
• The sign-in service at id.syllaprep.com and the network provider also set their own cookies, needed for sign-in and security.

Children

Many students on SyllaPrep are children. Student accounts and data are created by tutors or centers, who are responsible for holding the consent of a parent or guardian, and of the student from age 7, under Decree 13/2023/ND-CP. We never use children's data for advertising or profiling. If you are a parent and believe your child's data was added without consent, contact the tutor, the center or [email protected].

When a tutor shares a class link, anyone holding it sees the short names of the class's students (given name and family initial, for example "An N."), never their work. Work is protected by each student's code unless the tutor chooses no code. The tutor can replace or turn off the link at any time.

Security

We encrypt every connection (HTTPS), encrypt session keys, store passwords, invitation codes and share codes only as hashes, limit access by role within each workspace, restrict server access, and back up daily. Files are uploaded and downloaded only through time-limited links. If a data breach happens, we notify the authorities and the people affected within the time the law sets.

Your rights

Under personal data protection law, you have the right to:

• Be informed about how your data is processed.
• Give or refuse consent, and withdraw it.
• Access, view and correct your data.
• Ask for your data to be deleted, restrict processing, or object to it.
• Receive a copy of your data.
• Complain, report, sue and claim compensation as the law provides.

Personal data contact

You can change your name, email, photo and language yourself under Account. For anything else, email [email protected]. We respond within 72 hours of receiving a valid request and may need to verify that the data is yours.

If you are a student or parent, requests about data in a workspace are normally handled by your tutor or center; if you send one to us, we pass it to that workspace and help them carry it out.