English
Get started
Legal

Privacy Policy

How uLearnBox collects, uses and protects your personal information, and the rights you have over it.

Version 2026-11-09 · Effective 9 November 2026

This Privacy Policy explains how uLearnBox collects, uses, shares and protects personal data when You use the uLearnBox learning management system, its mobile apps and the uLearnBox Website, and the rights You have. Words with a capital letter have the meaning given in the Terms of Service.

1. Who We are and when this Policy applies

uLearnBox Joint Stock Company (ULEARNBOX JOINT STOCK COMPANY, tax code 0110659109; We, Us, Our), 15th Floor, Viet A Building, 9 Duy Tan Street, Cau Giay Ward, Hanoi, Vietnam, provides the Service. This Policy applies to:

  • the uLearnBox web application and the iOS and Android apps (together, the App);
  • the Website at https://ulearnbox.com, including its pricing, tutorial, support and contact pages;
  • Our dealings with Centers, Center Administrators and people who contact Us.

It does not apply to websites or services of third parties that a Center links to or embeds, or to how a Center uses data outside the Service. Each Center may have its own privacy notice.

2. Our two roles: for Our customers, and on behalf of Centers

Like other learning platforms used by schools and organizations, We play two different roles:

  • We decide how data is used (as data controller) for: the contact and account details of Center Owners and Administrators that We use to contract with, bill, support and inform their Center, billing and invoices, the security of the Service, support requests, Website visits and Our own communications.
  • We process data on behalf of a Center (as data processor) for: the Members a Center adds or invites, their Accounts, profiles and roles in that Center, Center Content, Learner Content and Learning Records. The Center decides why and how this data is used, and We follow its instructions given through the Service.

If You are a Learner or a teacher and have a question about Your data in a Center, such as grades or enrollment, or want to exercise Your rights over it, please contact that Center first. If You contact Us, We will forward Your request to the Center or help the Center to answer it.

3. Personal data We process

Account and profile

  • name, email address, username (in Centers that use usernames), profile picture and interface language;
  • a password, which We store only as a one-way hash (Argon2id), and, if You sign in with Google, Your Google account identifier and Google email address;
  • whether Your email address is verified, whether a password change is required, Your decisions on the Terms of Service, and Your choices about receiving news and offers by email.

Center membership

  • the Centers You belong to, Your roles, departments and groups, invitation and membership status, and internal codes the Center assigns;
  • data a Center Administrator enters or imports about You, for example from a member import file.

Learning data

  • enrollments in classes, courses and learning paths;
  • attempts, progress, time spent, scores, answers, results and completion recorded by the learning player, including SCORM and xAPI data sent by learning packages;
  • attendance, assignment submissions (files, links and notes), teacher feedback and grades, grade adjustments and their reasons;
  • questions and answers You post in lessons, notifications sent to You, and certificates issued to You;
  • reports and exports that a Center generates from these records.

Security and usage data

  • sign-in sessions, with the device and browser label, time of sign-in and last activity;
  • security and audit logs of important actions, which may include the IP address and browser user agent, and request identifiers;
  • technical logs needed to run the Service and investigate errors;
  • if You turn on notifications in a browser or in the mobile apps, a push token for that device, linked to the sign-in session on it.

Billing data

  • the Center's Plan, orders, payment status and transaction references;
  • invoice details provided for a VAT invoice, such as company name, tax code, address and invoice email;
  • card payments are made on FastSpring's checkout and bank transfers through SePay or Our bank. We do not receive or store full card numbers.

Communications

  • messages You send through the contact form or by email, and Our replies;
  • service emails We send to You (for example verification, password reset, invitations, notifications and billing reminders) and their delivery status.

Website and cookies

See section 6.

We do not ask for special categories of personal data (such as health, religion or biometric data). Centers should not place such data in the Service unless it is necessary and lawful.

4. Where the data comes from

  • from You, when You register, complete Your profile, learn, submit work or contact Us;
  • from Your Center, when a Center Administrator invites, imports, enrolls or grades You;
  • from Google, when You choose to sign in with Google;
  • from Our payment providers, about the status of a payment;
  • automatically, from Your use of the App and the Website.

5. Why We use personal data and on what basis

  • To provide the Service: create and secure Accounts, sign You in, run Centers, deliver lessons, record progress and results, issue certificates, and send service emails and, if You turn them on, push notifications. Basis: performance of the contract with You or with Your Center, and the Center's instructions for data We process on its behalf.
  • To bill Centers: process payments, issue invoices and keep accounting records. Basis: the contract, and Our legal obligations under tax and accounting law.
  • To keep the Service secure: prevent abuse, scan uploaded files for malware, detect suspicious sign-ins, keep audit logs and back up data. Basis: Our legitimate interest in a secure Service, and legal obligations.
  • To support You and improve the Service: answer requests, fix errors and understand, in aggregated form, how features are used. Basis: Our legitimate interest. We do not use Center Content, Learner Content or Learning Records to train artificial intelligence models.
  • To tell You about uLearnBox: send news and offers to Center Administrators and others who agreed to receive them. Basis: Your consent, which You can withdraw at any time with the unsubscribe link in each email or in Your Account settings. We do not send marketing to Learners on behalf of uLearnBox.
  • Website analytics and advertising: only with Your consent, as described in section 6.
  • To comply with the law and to establish or defend legal claims.

Where Vietnamese law requires Your consent, We ask for it separately for each purpose, and You can withdraw it at any time without affecting processing that took place before.

6. Cookies and similar technologies

In the App

The App uses only what it needs to work: a session cookie and a security (CSRF) cookie to keep You signed in and protect Your requests, and browser or device storage for preferences such as language, dismissed notices and progress of a lesson that has not been saved yet. The mobile apps keep Your session in the device's secure storage. The App does not use advertising cookies, analytics trackers or advertising SDKs, so these cannot be turned off without signing out.

On the Website

The Website uses necessary cookies and storage, for example to remember Your language. With Your consent, given through the cookie banner, the Website may also use:

  • analytics cookies, such as Google Analytics, to measure visits and improve the Website;
  • advertising cookies, such as Google Ads and Meta (Facebook) pixels, to measure Our campaigns and show uLearnBox ads to people who visited the Website.

These providers process data under their own privacy policies. They are not loaded until You accept them, and You can change Your choice at any time from the cookie settings link on the Website. Refusing them does not affect the Website or the App. Ads may also be shown through these platforms based on Your settings with them; You can manage those settings with Google and Meta directly.

7. Who We share personal data with

  • Your Center. Center Administrators and teachers in a Center see the data about You in that Center, as their roles allow. Other Members may see limited information, such as Your name in a class or a question You posted.
  • The public, when a feature is public. For example, the certificate verification page shows the details printed on a certificate to anyone who has its verification code or link.
  • Service providers that process data for Us under contract and only on Our instructions:
    • hosting and storage providers that run Our servers, databases and file storage in Singapore;
    • Cloudflare, for network protection, content delivery, and file storage and encrypted backups in the Asia-Pacific region;
    • Resend, for sending service emails, and MailerLite, for sending news and offers to those who agreed to receive them;
    • Google, for Google sign-in and, through Firebase Cloud Messaging, for delivering push notifications, together with Apple's push notification service for iPhones and iPads;
    • FastSpring, for card payments, as merchant of record, and SePay, for bank transfer payments;
    • on the Website, with Your consent, Google (Analytics and Ads) and Meta.
  • Authorities and others where required: when the law, a court or a competent authority requires it, or to protect the rights, safety and property of users, the public or Us.
  • A successor business, if uLearnBox is involved in a merger, acquisition or sale of assets, subject to this Policy.

We do not sell personal data, and We do not share data from the App for advertising.

8. International transfers

The servers and databases of the Service are located in Singapore, and files and encrypted backups are stored there or with Cloudflare in the Asia-Pacific region, so personal data is transferred from Vietnam and other countries to Singapore and that region. Some service providers, such as those for email delivery, content delivery and payments, may also process data in other countries, including outside Vietnam and the European Economic Area. When We transfer personal data abroad, We do so in accordance with Vietnamese law and, where the GDPR applies, with appropriate safeguards such as the European Commission's standard contractual clauses.

9. How long We keep personal data

  • Accounts: until the Account is deleted or closed by its Center, at Your request or the Center's own (see "Deleting Your Account" in section 11), and afterwards only as long as needed to handle disputes or meet a legal obligation.
  • Choices about Terms and marketing emails: as long as the Account exists, as a record of what You accepted or agreed to and when.
  • Sign-in sessions: deleted 30 days after they expire or are signed out.
  • Push tokens: until You sign out of that device or browser, or its session ends.
  • Center data (members, content, Learning Records): for as long as the Center keeps it, according to the Center's retention settings and actions. To have a Center and its data deleted, the Owner asks Us (see the Terms of Service). If the Owner asks for time to export the data, We allow a reasonable period first. We then end all access to the Center at once, and its data is deleted automatically, except invoices and data We must keep by law.
  • Billing records and invoices: for the period required by tax and accounting law.
  • Security and audit logs: 12 months. When entries are needed for an investigation, a dispute or by law, We keep a copy of those entries for as long as that requires. The history of attendance corrections is kept as long as the Class attendance record it explains, with its IP address and browser removed after 12 months.
  • Backups: encrypted backups are kept for at most 35 days and then deleted automatically. Data deleted from the Service may remain in a backup until then, and backups are used only to restore the Service after an incident.
  • Website analytics: according to the retention settings of the analytics provider, if You consented.

10. How We protect personal data

We use technical and organizational measures appropriate to the risk, including encryption in transit (HTTPS), password hashing, encrypted backups, separation of each Center's data, role-based access, malware scanning of uploaded files, security logging and limited staff access on a need-to-know basis. No system is completely secure. If a personal data breach occurs, We will notify the affected Centers, the competent authority and, where required, the people affected, within the time required by law.

11. Your rights

Depending on the law that applies to You, including Vietnam's Law on Personal Data Protection and, where it applies, the GDPR, You have the right to:

  • be informed about how Your personal data is processed;
  • access Your personal data and obtain a copy;
  • correct inaccurate or incomplete data;
  • delete Your data, or restrict or object to its processing, in the cases the law provides;
  • withdraw consent at any time, for processing based on consent;
  • receive Your data in a portable format, where applicable;
  • complain to the competent data protection authority.

You can update much of Your profile in the App. To exercise other rights, contact Us at support@ulearnbox.com. We may ask You to confirm Your identity. For data We process on behalf of a Center, We forward the request to that Center, which decides on it, and We help it to respond. Some data may have to be kept, for example a result already officially recorded by a Center, or invoices.

Deleting Your Account

  • An Account that belongs to a Center (one You sign in to at that Center's own address): the Center decides on deleting it and answers You. Under Account settings on the Website or in the mobile app You can send a deletion request after confirming Your identity with Your password or Google account; the Center's Administrators are notified by email and in the App. When the Center deletes You as a member, Your access ends at once and Your personal data in that Center is deleted automatically. If You are the Owner of that Center, first transfer ownership to another Member under Settings > Ownership in that Center, or ask Us to delete the whole Center (see section 9).
  • Any other Account, for example one You use at ulearnbox.com to create or manage Centers: You can delete it Yourself under Account settings, after confirming Your identity. You are signed out at once, and Your Account and personal data are deleted automatically. Scores and completion totals no longer linked to You, and invoices, are kept; detailed learning records, submissions and files are deleted. If You own a Center, first transfer ownership to another Member under Settings > Ownership in that Center, or ask Us to delete the Center.
  • You can also ask by email at support@ulearnbox.com. We forward a request about an Account that belongs to a Center to that Center; for any other Account, We answer within 30 days.

Deleted data may remain in encrypted backups until those backups are deleted (see section 9).

12. Children

The Service may be used by schools and other Centers that teach children. Children use the Service only through their Center: a child cannot sign up alone, and the Center creates or invites the child's Account. The Center is responsible for having a lawful basis and for obtaining the consent of the child and of a parent or guardian where the law requires it, including under Vietnamese law for children aged 7 and over, before adding a child.

Children under 13 in the United States. Where the U.S. Children's Online Privacy Protection Act (COPPA) applies, a school that adds a child under 13 consents on the parent's behalf to Our collection of the child's personal information, which We use only for the school's educational purposes and for no other commercial purpose. This section and the Data Processing Agreement are Our notice to the school. A Center that is not a school must obtain verifiable consent from a parent before adding a child under 13.

What We collect from children. Only what the Center needs to teach and the child needs to learn:

  • the name, username or email address and class details that the Center enters, and a profile picture if one is added;
  • learning data: progress, answers, scores, results, attendance, assignment submissions, teacher feedback and certificates;
  • questions and answers posted in a class, which only members of that class can see;
  • sign-in sessions and, if notifications are turned on, a push token for the device.

We do not collect a child's location, contacts, advertising identifier or other identifiers for tracking. The App has no ads, no advertising or analytics SDKs and no in-app purchases. Learning packages run in a player that does not let them send data to other websites; if a Center links to or embeds content from another service, such as a video site, that service's own policy applies, and the Center decides whether to use it with children.

How We use and share it. We use a child's personal information only to provide the Service to the child's Center, keep the Service secure and support the Center. We do not use it for advertising or marketing or to train artificial intelligence models, and We do not sell it. We disclose it only to the Center, to the parents or guardians the Center links to the child (see below), to the service providers in section 7 that run the Service for Us under contract, and where the law requires. The certificate verification page shows a child's name only to someone who has the certificate's verification code or link, and a Center can choose to hide Learners' names on that page.

Parent and guardian access. A Center may link a parent or guardian to a child. The linked parent can then see the child's classes, courses, calendar, work that is due and the results the Center chooses to share, on the web and in the uLearnBox Parents app, without being able to change them. The Center decides what is shared, and removing the link ends the parent's access at once. The parent's own Account is handled like any other Account under this Policy.

Rights of parents. A parent or guardian can review the personal information about their child, have it corrected or deleted, and refuse its further collection or use. Ask the child's Center, which can view, correct and delete it with the tools in the Service, or contact Us (section 15): We forward the request to the Center within 5 business days and help it to answer. If a parent refuses further collection, the child can no longer use the Service through that Center.

How long We keep it. We keep a child's personal information only as long as reasonably necessary for the educational purpose for which the Center provided it, and never indefinitely:

  • while the child is a Member of the Center. When the Center deletes the child as a Member, or the Center is deleted, the child's personal data is deleted automatically; results already recorded are kept only as statistics no longer linked to the child;
  • sign-in sessions are deleted 30 days after they end, a push token when the child signs out of that device or its session ends, and security and audit logs after 12 months unless they are needed for an investigation or by law (section 9);
  • encrypted backups are deleted after at most 35 days.

How We protect it. We protect children's personal information with the measures described in section 10, and require Our service providers to protect it under contract. We do not knowingly allow a child to create an Account outside a Center, and We delete such an Account if We learn of it.

13. Additional information for certain regions

European Economic Area and United Kingdom. Where the GDPR applies, the controller of the data described in section 2 as Ours is uLearnBox, and the controller of Center data is the Center. You can complain to the supervisory authority where You live or work.

California. We do not sell personal information. Website advertising cookies, if You accept them, may count as "sharing" under California law, and You can refuse or withdraw that consent in the cookie settings. You may exercise the rights described in section 11, and We will not discriminate against You for doing so.

Do Not Track. The App does not track You across other websites. On the Website, optional cookies load only with Your consent.

14. Changes to this Policy

We may update this Policy. Each version has a date and is published at ulearnbox.com/support/privacy, where earlier versions also remain available. If We make material changes, We will inform Center Administrators and Account holders in advance, by email or in the App. Where a change requires new consent, We will ask for it.

15. Contact us

For questions about this Policy or Your personal data, contact Us: