English
Get started
Legal

Privacy Policy

How uLearnBox collects, uses and protects your personal information, and the rights you have over it.

Version 2026-11-02 · Effective 2 November 2026

This Privacy Policy explains how uLearnBox collects, uses, shares and protects personal data when You use the uLearnBox learning management system, its mobile apps and the uLearnBox Website, and the rights You have. Words with a capital letter have the meaning given in the Terms of Service.

1. Who We are and when this Policy applies

uLearnBox Joint Stock Company (ULEARNBOX JOINT STOCK COMPANY, tax code 0110659109; We, Us, Our), 15th Floor, Viet A Building, 9 Duy Tan Street, Cau Giay Ward, Hanoi, Vietnam, provides the Service. This Policy applies to:

  • the uLearnBox web application and the iOS and Android apps (together, the App);
  • the Website at https://ulearnbox.com, including its pricing, tutorial, support and contact pages;
  • Our dealings with Centers, Center Administrators and people who contact Us.

It does not apply to websites or services of third parties that a Center links to or embeds, or to how a Center uses data outside the Service. Each Center may have its own privacy notice.

2. Our two roles: for Our customers, and on behalf of Centers

Like other learning platforms used by schools and organizations, We play two different roles:

  • We decide how data is used (as data controller) for: Center Administrators acting for their Center, billing and invoices, the security of the Service, support requests, Website visits and Our own communications.
  • We process data on behalf of a Center (as data processor) for: the Members a Center adds or invites, their Accounts, profiles and roles in that Center, Center Content, Learner Content and Learning Records. The Center decides why and how this data is used, and We follow its instructions given through the Service.

If You are a Learner or a teacher and have a question about Your data in a Center, such as grades or enrollment, or want to exercise Your rights over it, please contact that Center first. If You contact Us, We will forward Your request to the Center or help the Center to answer it.

3. Personal data We process

Account and profile

  • name, email address, username (in Centers that use usernames), profile picture and interface language;
  • a password, which We store only as a one-way hash (Argon2id), and, if You sign in with Google, Your Google account identifier and Google email address;
  • whether Your email address is verified, whether a password change is required, Your decisions on the Terms of Service, and Your choices about receiving news and offers by email.

Center membership

  • the Centers You belong to, Your roles, departments and groups, invitation and membership status, and internal codes the Center assigns;
  • data a Center Administrator enters or imports about You, for example from a member import file.

Learning data

  • enrollments in classes, courses and learning paths;
  • attempts, progress, time spent, scores, answers, results and completion recorded by the learning player, including SCORM and xAPI data sent by learning packages;
  • attendance, assignment submissions (files, links and notes), teacher feedback and grades, grade adjustments and their reasons;
  • questions and answers You post in lessons, notifications sent to You, and certificates issued to You;
  • reports and exports that a Center generates from these records.

Security and usage data

  • sign-in sessions, with the device and browser label, time of sign-in and last activity;
  • security and audit logs of important actions, which may include the IP address and browser user agent, and request identifiers;
  • technical logs needed to run the Service and investigate errors;
  • if You turn on notifications in a browser or in the mobile apps, a push token for that device, linked to the sign-in session on it.

Billing data

  • the Center's Plan, orders, payment status and transaction references;
  • invoice details provided for a VAT invoice, such as company name, tax code, address and invoice email;
  • card payments are made on FastSpring's checkout and bank transfers through SePay or Our bank. We do not receive or store full card numbers.

Communications

  • messages You send through the contact form or by email, and Our replies;
  • service emails We send to You (for example verification, password reset, invitations, notifications and billing reminders) and their delivery status.

Website and cookies

See section 6.

We do not ask for special categories of personal data (such as health, religion or biometric data). Centers should not place such data in the Service unless it is necessary and lawful.

4. Where the data comes from

  • from You, when You register, complete Your profile, learn, submit work or contact Us;
  • from Your Center, when a Center Administrator invites, imports, enrolls or grades You;
  • from Google, when You choose to sign in with Google;
  • from Our payment providers, about the status of a payment;
  • automatically, from Your use of the App and the Website.

5. Why We use personal data and on what basis

  • To provide the Service: create and secure Accounts, sign You in, run Centers, deliver lessons, record progress and results, issue certificates, and send service emails and, if You turn them on, push notifications. Basis: performance of the contract with You or with Your Center, and the Center's instructions for data We process on its behalf.
  • To bill Centers: process payments, issue invoices and keep accounting records. Basis: the contract, and Our legal obligations under tax and accounting law.
  • To keep the Service secure: prevent abuse, scan uploaded files for malware, detect suspicious sign-ins, keep audit logs and back up data. Basis: Our legitimate interest in a secure Service, and legal obligations.
  • To support You and improve the Service: answer requests, fix errors and understand, in aggregated form, how features are used. Basis: Our legitimate interest. We do not use Center Content, Learner Content or Learning Records to train artificial intelligence models.
  • To tell You about uLearnBox: send news and offers to Center Administrators and others who agreed to receive them. Basis: Your consent, which You can withdraw at any time with the unsubscribe link in each email or in Your Account settings. We do not send marketing to Learners on behalf of uLearnBox.
  • Website analytics and advertising: only with Your consent, as described in section 6.
  • To comply with the law and to establish or defend legal claims.

Where Vietnamese law requires Your consent, We ask for it separately for each purpose, and You can withdraw it at any time without affecting processing that took place before.

6. Cookies and similar technologies

In the App

The App uses only what it needs to work: a session cookie and a security (CSRF) cookie to keep You signed in and protect Your requests, and browser or device storage for preferences such as language, dismissed notices and progress of a lesson that has not been saved yet. The mobile apps keep Your session in the device's secure storage. The App does not use advertising cookies, analytics trackers or advertising SDKs, so these cannot be turned off without signing out.

On the Website

The Website uses necessary cookies and storage, for example to remember Your language. With Your consent, given through the cookie banner, the Website may also use:

  • analytics cookies, such as Google Analytics, to measure visits and improve the Website;
  • advertising cookies, such as Google Ads and Meta (Facebook) pixels, to measure Our campaigns and show uLearnBox ads to people who visited the Website.

These providers process data under their own privacy policies. They are not loaded until You accept them, and You can change Your choice at any time from the cookie settings link on the Website. Refusing them does not affect the Website or the App. Ads may also be shown through these platforms based on Your settings with them; You can manage those settings with Google and Meta directly.

7. Who We share personal data with

  • Your Center. Center Administrators and teachers in a Center see the data about You in that Center, as their roles allow. Other Members may see limited information, such as Your name in a class or a question You posted.
  • The public, when a feature is public. For example, the certificate verification page shows the details printed on a certificate to anyone who has its verification code or link.
  • Service providers that process data for Us under contract and only on Our instructions:
    • hosting and storage providers that run Our servers, databases and file storage in Singapore;
    • Bunny.net, for file storage, content delivery and encrypted backups;
    • Resend, for sending service emails, and MailerLite, for sending news and offers to those who agreed to receive them;
    • Google, for Google sign-in and, through Firebase Cloud Messaging, for delivering push notifications, together with Apple's push notification service for iPhones and iPads;
    • FastSpring, for card payments, as merchant of record, and SePay, for bank transfer payments;
    • on the Website, with Your consent, Google (Analytics and Ads) and Meta.
  • Authorities and others where required: when the law, a court or a competent authority requires it, or to protect the rights, safety and property of users, the public or Us.
  • A successor business, if uLearnBox is involved in a merger, acquisition or sale of assets, subject to this Policy.

We do not sell personal data, and We do not share data from the App for advertising.

8. International transfers

The servers, databases and file storage of the Service are located in Singapore, so personal data is transferred from Vietnam and other countries to Singapore. Some service providers, such as those for email delivery, content delivery and payments, may also process data in other countries, including outside Vietnam and the European Economic Area. When We transfer personal data abroad, We do so in accordance with Vietnamese law, including the required impact assessment, and, where the GDPR applies, with appropriate safeguards such as the European Commission's standard contractual clauses.

9. How long We keep personal data

  • Accounts: until the Account is deleted or closed by its Center, at Your request or the Center's own (see "Deleting Your Account" in section 11), and afterwards only as long as needed to handle disputes or meet a legal obligation.
  • Choices about Terms and marketing emails: as long as the Account exists, as a record of what You accepted or agreed to and when.
  • Push tokens: until You sign out of that device or browser, or its session ends.
  • Center data (members, content, Learning Records): for as long as the Center keeps it, according to the Center's retention settings and actions. To have a Center and its data deleted, the Owner asks Us (see the Terms of Service). If the Owner asks for time to export the data, We allow a reasonable period first. We then end all access to the Center at once, and its data is deleted automatically, except invoices and data We must keep by law.
  • Billing records and invoices: for the period required by tax and accounting law.
  • Security and audit logs: as long as the Center or Account they concern exists, because they show who changed results, roles and settings, and longer only when needed for an investigation, a dispute or by law.
  • Backups: encrypted backups of the database are not overwritten automatically; We keep them until We delete them under Our backup retention decisions. Data deleted from the Service may remain in a backup until that backup is deleted, and is used only to restore the Service after an incident.
  • Website analytics: according to the retention settings of the analytics provider, if You consented.

10. How We protect personal data

We use technical and organizational measures appropriate to the risk, including encryption in transit (HTTPS), password hashing, encrypted backups, separation of each Center's data, role-based access, malware scanning of uploaded files, security logging and limited staff access on a need-to-know basis. No system is completely secure. If a personal data breach occurs, We will notify the affected Centers, the competent authority and, where required, the people affected, within the time required by law.

11. Your rights

Depending on the law that applies to You, including Vietnam's Law on Personal Data Protection and, where it applies, the GDPR, You have the right to:

  • be informed about how Your personal data is processed;
  • access Your personal data and obtain a copy;
  • correct inaccurate or incomplete data;
  • delete Your data, or restrict or object to its processing, in the cases the law provides;
  • withdraw consent at any time, for processing based on consent;
  • receive Your data in a portable format, where applicable;
  • complain to the competent data protection authority.

You can update much of Your profile in the App. To exercise other rights, contact Us at support@ulearnbox.com. We may ask You to confirm Your identity. For data We process on behalf of a Center, We forward the request to that Center, which decides on it, and We help it to respond. Some data may have to be kept, for example a result already officially recorded by a Center, or invoices.

Deleting Your Account

  • An Account that belongs to a Center (one You sign in to at that Center's own address): the Center decides on deleting it and answers You. Under Account settings on the Website or in the mobile app You can send a deletion request after confirming Your identity with Your password or Google account; the Center's Administrators are notified by email and in the App. When the Center deletes You as a member, Your access ends at once and Your personal data in that Center is deleted automatically. If You are the Owner of that Center, ask Us first to make another Member the Owner, or to delete the whole Center (see section 9).
  • Any other Account, for example one You use at ulearnbox.com to create or manage Centers: You can delete it Yourself under Account settings, after confirming Your identity. You are signed out at once, and Your Account and personal data are deleted automatically. Anonymous scores, completion totals and invoices are kept; detailed learning records, submissions and files are deleted. If You own a Center, ask Us first to make another person its Owner, or to delete the Center.
  • You can also ask by email at support@ulearnbox.com. We forward a request about an Account that belongs to a Center to that Center; for any other Account, We answer within 30 days.

Deleted data may remain in encrypted backups until those backups are deleted (see section 9).

12. Children

The Service may be used by schools and other Centers that teach children. Children use the Service through their Center. The Center is responsible for having a lawful basis and for obtaining the consent of the child and of a parent or guardian where the law requires it, including under Vietnamese law for children aged 7 and over, before adding a child. A parent or guardian who has questions about a child's data should contact the child's Center. We do not use children's data for advertising or marketing, and the App shows no ads.

13. Additional information for certain regions

European Economic Area and United Kingdom. Where the GDPR applies, the controller of the data described in section 2 as Ours is uLearnBox, and the controller of Center data is the Center. You can complain to the supervisory authority where You live or work.

California. We do not sell personal information. Website advertising cookies, if You accept them, may count as "sharing" under California law, and You can refuse or withdraw that consent in the cookie settings. You may exercise the rights described in section 11, and We will not discriminate against You for doing so.

Do Not Track. The App does not track You across other websites. On the Website, optional cookies load only with Your consent.

14. Changes to this Policy

We may update this Policy. Each version has a date and is published at ulearnbox.com/support/privacy, where earlier versions also remain available. If We make material changes, We will inform Center Administrators and Account holders in advance, by email or in the App. Where a change requires new consent, We will ask for it.

15. Contact us

For questions about this Policy or Your personal data, contact Us: