Privacy Policy

1. Personal Data We Collect

To provide our service, the Platform (acting as “Data Controller”) collects the following personal data:

• Registration information: name, email, password (stored encrypted — no one can retrieve the original password)
• Transaction information: purchase history, amounts, payment method, refund records (does not include full card numbers, which are processed directly by the payment provider)
• Usage records: course learning progress, quiz results, comments and reviews
• Correspondence: emails a teacher or school sends to you individually through the platform (subject, message, date and who sent it)
• Technical information: IP address, browser type (used for security protection and traffic analysis)

2. Purpose of Data Use

• Providing, maintaining, and improving course services
• Processing payments, granting course access, sending purchase receipts
• Sending service notifications (e.g. password resets, payment results)
• Enabling your teachers and school to contact you individually (for example answering your question), and keeping a record of those emails so the school’s staff can see what was sent to you
• Marketing communications with your consent (you can unsubscribe at any time)

3. Who We Share Data With

To provide payment, video streaming, and email delivery services, some of your data is passed to the following categories of third-party service providers (acting as “Data Processors” — under the PDPA 2010 2025 amendments, they bear equivalent statutory responsibility for personal data processed on our behalf), and is subject to each provider’s own privacy policy:

• Payment service providers (processing payment transactions)
• Video streaming service providers (processing course video playback)
• Email delivery service providers (processing system notifications and emails sent to you individually)

Except where required by law or with your consent, we do not sell or provide your personal data to third parties beyond those listed above.

4. Data Retention Period

Your personal data will be retained until your account is deleted, or for the period required by law (e.g. transaction records must be retained for a statutory minimum period). Emails a teacher or school sent to you individually are kept until your account or the school is deleted, and are deleted with it.

5. Your Rights

Under the PDPA 2010 (including the 2025 amendments), you may at any time:

• Request access to, correction of, or deletion of the personal data we hold about you
• Request that we stop processing your personal data
• Exercise your right to data portability — for example, your student list data can be obtained in a portable format via the dashboard export feature

Please submit requests via the “Data Protection Officer Contact” details below; we will process your request within a reasonable timeframe.

6. Data Protection Officer (DPO)

Under the PDPA 2010 2025 amendments, the Platform has appointed a Data Protection Officer responsible for personal data protection matters. Contact: [Please fill in the DPO’s name/email — this must be completed before launch, see the launch checklist in the documentation].

7. Data Breach Notification

In the event of a personal data breach likely to cause you harm, we will notify Malaysia’s Personal Data Protection Department (PDPD) within 72 hours of becoming aware of it, as required under the PDPA 2010, and will notify affected users as appropriate.

8. Cookies and Tracking Technologies

This site may use cookies or similar technologies to maintain your login state and record learning progress; some pages may embed third-party analytics tools (e.g. Google Analytics) to understand usage behaviour and help us improve our service.

9. Information Security

We employ industry-standard security measures (such as encrypted password storage and encrypted transmission) to protect your personal data, but cannot guarantee absolute security.

10. Changes to This Policy

Any revisions to this Policy will be announced on this page along with an updated “last updated” date.

11. Governing Language

This Privacy Policy is provided in English, Bahasa Malaysia, and Simplified Chinese for convenience. In the event of any discrepancy or conflict between versions, the English version shall prevail.

Appendix: Signing In with Google or Facebook

You may choose to sign in to Teachvix (including school websites) with your Google or Facebook account. When you do, we handle your data as follows:

• What we receive: With Google sign-in, Google shares your name, email address and profile picture URL with us (along with your account’s language setting). With Facebook sign-in, we receive your name, verified email address and profile picture URL. We never receive your password, and we do not receive your other content on those services (such as your Gmail, contacts or Facebook posts).
• How we use it: Only to create and sign you in to your Teachvix account, to identify you, and to show your name and profile picture on the platform. We do not use it for advertising, and we do not sell it.
• Who we share it with: The same as section 3 above — only the processors necessary to provide the service (such as our cloud hosting and database providers).
• Retention and deletion: This data is kept with your account and deleted together with it when you delete your account or ask us to delete it. You may also request access, correction or deletion under section 5.
• Revoking access: You can revoke Teachvix’s access at any time from your Google Account’s “Third-party apps & services” page, or Facebook’s “Apps and websites” settings.
• Social sign-in is optional: You can register and sign in with an email address and password instead, with no loss of functionality.
• Google API data use: Teachvix’s use of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Appendix: Website AI Sales Assistant

When you use the “Ask Teachvix” assistant on the Teachvix website, we handle your data as follows:

• Answers come from a third-party model: your question, the earlier questions and answers in the same conversation, and the website language and region settings are sent in real time to Google LLC’s Gemini API to generate the answer. We use its paid tier, under whose terms this content is not used to train or improve Google’s models. The data is processed on Google’s servers, which may be located outside Malaysia, Taiwan or your own country.
• Conversations are kept for 90 days: each question you ask and the answer the assistant gives are stored with the conversation, to see which answers helped and which did not and to improve the quality of answers. You can also press “Yes” or “No” on an answer, and that rating is stored with the answer. Only Teachvix platform administrators can see these conversations. The record holds no IP address, account or school, and is deleted automatically 90 days after the last message. Common personal data (Email addresses, phone numbers, links) is removed from your questions before storing (the assistant’s answers are stored as written and may repeat what you typed), but we cannot guarantee that all of it is, so please do not type passwords, card numbers or other sensitive personal data into the chat. You can write to us to ask for deletion: tell us roughly when you asked and what you asked, so we can find that conversation. Because this service needs no sign-in, we cannot guarantee that we will find it.
• Questions that could not be answered: when the assistant finds nothing to base an answer on, we record only that one question and which assistant it was (website or dashboard), to find what the documentation is missing. Common personal data (Email addresses, phone numbers, web addresses) is removed first, but not everything can be, so please do not type personal data into a question. The record holds no IP address, account, school or surrounding conversation and is deleted automatically after 90 days.
• IP address: used only to limit how often questions can be sent and to prevent abuse. It is deleted within about a day and is not matched to your identity.
• Check that you are a person: to tell visitors from scripts, the chat window uses Cloudflare’s Turnstile service. It receives your IP address and some information about your browser and decides whether you look like a script; most visitors see nothing at all, and only a visitor who looks automated is asked to tick a box. Once you pass, we set a pass cookie in your browser that lasts at most two hours and holds no personal data.
• Usage counts: to understand how the assistants are used and what they cost, we add up daily counts only (for example how many questions were asked, how many could not be answered, how much processing was used). We do not record questions, answers, IP addresses, accounts or schools, and the counts are deleted automatically after 180 days.
• Leaving your details: if you choose to submit the “Leave your details” form, we collect the email, name and message you enter, plus the recent conversation at the time you send it, and use them only to reply to that enquiry. This data is deleted automatically after 12 months; before then you can ask to access, correct or delete it as described under “Your Rights” in this policy.

Appendix: Teachvix Assistant in the Dashboard

When school owners and instructors use the Teachvix assistant in the Teachvix dashboard, we handle data as follows:

• Answers come from a third-party model: your question and the earlier messages in the same conversation, plus the school details needed to answer (your role, the school’s plan and country, the dashboard page you’re on and your dashboard language), are sent in real time to Google LLC’s Gemini API. Your name, email, students and orders are not sent — please don’t type students’ personal details into your questions. We use its paid tier, under whose terms this content is not used to train or improve Google’s models. The data is processed on Google’s servers, which may be located outside Malaysia, Taiwan or your own country.
• Conversations are kept for 90 days: your questions and the assistant’s answers are stored with the conversation, together with which account and which school asked, to see which answers helped and which did not and to improve the quality of answers. You can also press “Yes” or “No” on an answer, and that rating is stored with the answer. Only Teachvix platform administrators can see these conversations. The record holds no IP address and is deleted automatically 90 days after the last message. Common personal data (Email addresses, phone numbers, links) is removed from your questions before storing (the assistant’s answers are stored as written and may repeat what you typed), but we cannot guarantee that all of it is, so please do not type students’ personal data, passwords, card numbers or other sensitive data into your questions. You can ask to see, correct or delete your own conversations in the ways listed under “Your rights” in this policy.
• Questions that could not be answered: when the assistant finds nothing to base an answer on, we record only that one question and which assistant it was (website or dashboard), to find what the documentation is missing. Common personal data (Email addresses, phone numbers, web addresses) is removed first, but not everything can be, so please do not type personal data into a question. The record holds no IP address, account, school or surrounding conversation and is deleted automatically after 90 days.
• Usage records: to limit how many questions can be asked, we record when a question was asked and by which account and school — not what was asked or your IP address — and keep these records for at most two days.
• Usage counts: to understand how the assistants are used and what they cost, we add up daily counts only (for example how many questions were asked, how many could not be answered, how much processing was used). We do not record questions, answers, IP addresses, accounts or schools, and the counts are deleted automatically after 180 days.
• One-click setup: if a school owner uses One-click setup, three of the answers you enter (what you teach, who it is for, the first lesson’s topic) and the rewritable text of the homepage template you pick are sent to DeepSeek’s API to write the drafts. The price, name and introduction you enter are not sent; they are only saved into your school’s drafts. Your six answers and the results are stored with your school’s data (at most three runs per school) and deleted when the school is deleted.
• Optional: you don’t have to use the assistant; if you don’t, nothing is sent.

Appendix: Chat Window on a School’s Website

A school can switch on the chat window Teachvix provides on its own website. When a visitor uses it, that school is the data controller and Teachvix processes the data on the school’s behalf:

• Conversations are stored: What a visitor types into the chat window (including conversations with the AI alone), and any Email address or name the visitor chooses to leave, are stored with the conversation so the school can reply and improve its service. Only people at that school with the right permission can read them. A conversation is deleted automatically 12 months after it ends; a visitor can also ask the school to delete it earlier, and the school owner can delete it from the support inbox.
• Answers from a third-party model: When a visitor asks the AI a question, the text of the question and the recent messages in the window are sent to Google LLC’s Gemini API to produce an answer; under the terms of its paid plan they are not used to train its models.
• Identifying cookie: To keep a visitor’s place in a conversation, a cookie that identifies only that conversation is set on their device. It expires after 30 days.
• IP address: Used only to limit how often questions can be asked and to prevent abuse; deleted within about a day.
• Check that you are a person: when a school’s website is served on a Teachvix domain, the chat window uses Cloudflare’s Turnstile service to tell visitors from scripts. It receives the visitor’s IP address and some information about their browser and decides whether they look like a script; most visitors see nothing at all, and only a visitor who looks automated is asked to tick a box. Once they pass, we set a pass cookie in their browser that lasts at most two hours and holds no personal data. A school using its own domain does not use this check.
• Usage counts: to understand how the assistants are used and what they cost, we add up daily counts only (for example how many questions were asked, how many could not be answered, how much processing was used). We do not record questions, answers, IP addresses, accounts or schools, and the counts are deleted automatically after 180 days.
• Your rights: A visitor can ask that school, or ask Teachvix in the ways listed under “Your rights” in this policy, to access, correct or delete their conversation earlier.

Appendix: AI Tutor on a School’s Lesson Pages

A school can turn on the AI tutor Teachvix provides on its lesson pages. When a student uses it, that school is the controller of the data and Teachvix processes it on the school’s behalf:

• Stored conversations: What a student types to the tutor, and the tutor’s answers, are stored with the conversation. Only that school’s owner and the instructors who manage the course can read them, to see what students find hard and to improve the course. They are deleted automatically 12 months after the last message, and with the student’s account if it is deleted; a student can also ask the school to delete one earlier, and the school owner can delete it from the tutor chats page.
• Answers from a third-party model: When a student asks a question, the question text, the recent messages in the conversation and the parts of the course material used to answer (video subtitles and lesson text) are sent to Google LLC’s Gemini API to produce the answer. Under its paid-plan terms they are not used to train its models. The content of quiz and assignment lessons is not sent.
• Usage counters: To limit how often questions can be asked, we record the time of each question and the account and school (not the question text or an IP address), for at most two days.
• Your rights: A student can ask that school, or ask Teachvix in the ways listed under “Your rights” in this policy, to access, correct or delete their tutor conversations earlier.