Last updated: 22 July 2026

Version: 4

Effective date: 22 July 2026

English version for reference only. If there is any conflict with the Vietnamese version, the Vietnamese version shall prevail.

Introduction

NoraClass is a digital learning platform operated by Rebo Technology JSC (Công ty Cổ phần Công nghệ Rebo) at https://noraclass.com. NoraClass provides three-dimensional lessons and authoring tools, an interactive whiteboard, interactive books (page-flip books), lab simulations, a community learning-materials library, the Nora AI assistant, personal subscriptions, and online class-management solutions for schools and partners (including connections to school systems where supported).

This Personal Data Privacy Policy (“Policy”) describes how we collect, use, store, protect, and share personal data when you access and use NoraClass. We aim to comply with Vietnamese personal data protection laws, including Decree 13/2023/ND-CP and related regulations (as amended or replaced from time to time, including applicable rules on personal data protection in the online environment).

By registering, signing in, or continuing to use the service, you confirm that you have read and understood this Policy.

1. Purpose and scope

This Policy aims to:

Clearly define how NoraClass collects, uses, stores, protects, and shares personal data;
Strengthen users’ control over their data;
Ensure transparent processing on an appropriate legal basis and in accordance with law.

It applies to all individuals who have used, are using, or will use NoraClass, including personal accounts, school/partner-provisioned LMS accounts, and website/app visitors.

2. Collection and use of personal data

2.1. Data we collect

Account/profile data: name, email, password (hashed/encrypted), phone (if provided), role, avatar, school/class/organization info (if any);
Technical data: IP address, browser/device type, cookies, access logs;
Activity history: lesson interactions, authoring tools / whiteboard/simulation usage, AI quotas, access times, and operational events needed to run the service;
User-generated content: lessons, materials, class data, feedback, comments;
Payment data: order codes, transaction status, purchased plans, wallet history (if any). Card/bank processing is handled by payment partners (partner payment gateways); we do not store full card numbers;
Third-party data: basic identity data from Google/OAuth within the scope you authorize; account/class/role lists provided by schools or partners for LMS deployment;
Support data: messages and attachments when you contact support.

Collection is based on consent, contract performance, legal obligation, and/or legitimate interests within the law.

2.2. Purposes of use

Provide, maintain, and operate NoraClass services (including authoring tools, AI, and class management);
Authenticate users, manage accounts/permissions, and provide support;
Process payments, activate/renew plans, and prevent payment fraud;
Send transactional, security, and service notices; send marketing where consented or otherwise lawful;
Aggregated analytics to improve products and UX;
Secure systems and address Terms or legal violations;
Comply with lawful authority requests.

3. Retention and protection

3.1. Retention period

We retain personal data while the account is active and as needed for stated purposes. After you stop using the service or request deletion, we may retain data for a reasonable period (typically at least 6 months, or longer if required by law or organizational contracts) for disputes, complaints, accounting/tax obligations, or authority requests; then we delete, anonymize, or restrict storage as required.

LMS data belonging to schools/partners may follow retention terms in the deployment contract and lawful organizational instructions.

3.2. Security measures

Transport encryption (e.g. HTTPS) and password hashing/encryption; passwords are not stored in readable form;
Access control and need-to-know internal permissions; reasonable monitoring and logging;
Firewalls, intrusion-prevention measures, and backups appropriate to system scale;
Periodic review and remediation of security risks.

No system is perfectly secure. You must protect your credentials and devices.

4. Your rights

4.1. Access and correction

You may sign in to view and update certain profile information. For access requests beyond in-product self-service, contact us under Section 10.

4.2. Deletion

You may request deletion when data is no longer needed for the original purpose; when you withdraw consent (where processing is based on consent); or when there are grounds that processing is unlawful or for an improper purpose. We will act after identity verification and any minimum retention required by law or contract. Deletion may be limited where data is needed for contract performance, disputes, or authority requests.

4.3. Objection and withdrawal of consent

You may refuse or withdraw consent for consent-based processing (e.g. marketing) at any time. Withdrawal does not affect prior lawful processing and may limit features that require the processing.

4.4. Other statutory rights

Where applicable, you may also have rights to be informed, restrict processing, object to certain processing, and lodge complaints with competent authorities. We may verify identity before handling requests.

5. Authentication and user responsibilities

5.1. Accounts

Accounts may be created via email/password or linked login (e.g. Google) as configured;
Minors or persons under guardianship need parent/guardian consent before use;
For school-provisioned student accounts, notices/consent may be handled through the school under its policies and applicable law.

5.2. Your responsibilities

Provide accurate information and keep it updated;
Protect passwords and devices; do not share credentials;
Promptly report unauthorized access or account-takeover risks;
Remain legally responsible for content you create, upload, or share.

To the extent permitted by law, we are not liable for damages caused by your failure to take basic security measures that are your responsibility.

6. Children’s / student data in LMS

Schools/partners are primarily responsible for legal bases, notices, and parental/guardian consent where required;
We process data as a technical service provider under the contract and lawful organizational instructions;
We do not knowingly use student data for targeted advertising;
Parents/guardians may contact the school and/or us to exercise rights within our authority.

7. Sharing with third parties

We do not sell personal data. Sharing occurs only when necessary, including:

Technical providers (cloud, email, analytics, security) under contract and need-to-know principles;
Payment partners to process transactions;
Schools/LMS partners for data within their organizational scope;
Lawful authority requests;
Where needed to protect our or users’ legitimate rights (e.g. fraud or cyberattack prevention), within the law;
Other cases with your consent.

8. Account security and cookies

8.1. Account protection

Passwords are hashed/encrypted and not stored in readable form;
We apply session controls and reasonable anti-abuse measures;
Use strong unique passwords.

8.2. Cookies

We use essential cookies for sessions and security; analytics/performance cookies to understand usage; and marketing cookies if enabled. You may refuse non-essential cookies in your browser; some features may not work fully.

8.3. Security change notices

Where technically supported, we may email notices about security-related changes (e.g. password changes). Keep contact details accurate to receive alerts.

9. Cross-border transfers

Some infrastructure or providers may be located outside Vietnam. When transferring data abroad, we apply safeguards required by applicable law.

10. Updates and contact

We may update this Policy to reflect legal or service changes. New versions are published on the Platform and take effect on the stated date. Continued use after the effective date means you are informed of the update, unless law requires another consent form.

Rebo Technology JSC
Email: contact@noraclass.com
Phone: +84 935 602 880
Website: https://noraclass.com

Privacy Policy