Who this notice covers
VFuture Academy operates an online learning and project platform in Vietnam. Legal representative: NGUYEN HA AN. Privacy and legal requests: legal@vfuturelabs.org. General support: contact@vfuturelabs.org. This notice covers our public website, accounts, learning workspace and related platform services.
This draft identifies the platform operator by its public brand. The owner must confirm the responsible legal entity, legally required contact details and its role in each processing activity before publication.
Information used by the platform
Account and profile information includes your email, account identifier, authentication information, display name, handle, optional avatar, language preference, branch and access roles. If you choose Google or Microsoft sign-in, that OAuth identity provider processes the sign-in and supplies basic account information, such as your account identifier, email address and name where available, to authenticate you.
Learning records include enrollment, lesson progress, activity state, quiz and exam answers, attempts, timestamps, grades, feedback, assignments and uploaded files. The platform also stores course completion, skill evidence, certificates, experience points and streaks. Notebook features may store your drafts and learning artifacts.
Project membership, project and opportunity interest, content you contribute and public-profile choices are stored when you use those features. Messages you email us include your email address and the information you choose to send. Avoid sending passwords, verification codes or unnecessary sensitive information.
Why information is processed
We use account data to authenticate you, manage access and support your account. We use learning and submission data to deliver courses, save your work, assess assignments, provide feedback and record achievement. Project and opportunity records support the participation features you use.
Access controls, request limits, audit records and exam-integrity events support security, abuse prevention, reliable operation and fair assessment. Exam events can include losing or regaining focus, hiding the page, pasting and leaving fullscreen; these are separate from optional website analytics.
The owner must confirm and document the applicable legal basis for each purpose before publishing this notice. Where consent is required, it must be informed and specific. Optional analytics consent is separate from access to learning services; this notice does not treat browsing or silence as consent.
Cookies, preferences and optional analytics
Authentication cookies keep your session working. Language and consent preferences remember your choices. Security controls may use a limited first-party request identifier or trusted network information to restrict abuse; this is separate from optional audience measurement.
Optional first-party analytics runs only after you allow it in cookie preferences. Events describe bounded public page, card, filter, pagination or action interactions and public content identifiers. Free-text searches, raw URLs, email addresses and form contents are not analytics event properties. When signed in, accepted events can be associated with your existing account identifier; we do not add a separate persistent analytics identifier.
Rejecting analytics does not disable sign-in or learning. You can change your choice with Cookie preferences in the footer. Withdrawal stops future optional events and clears unsent events; it does not automatically erase data already recorded. Operational learning records, security logs and exam-integrity records continue where needed to provide the service.
Information you make public
A public profile, approved project, published contribution or certificate verification may expose selected information to other people. Review the visibility controls and content before sharing. Public content can be copied or indexed by third parties, and changing visibility cannot guarantee removal of their copies.
Private course progress, submissions and administrative records are not intended for public catalog publication. Authorized staff can access records within their assigned responsibilities.
Service providers and external services
The implementation uses Supabase for authentication, database and file-storage services. Hosting, email delivery and infrastructure services may process information needed to run the platform. Google and Microsoft act as OAuth identity providers when you choose their respective sign-in flows, processing authentication information and sharing basic profile and email information needed for sign-in. Website fonts are served from our own website, without browser requests to Google font services. External links, embedded content and an optional notebook runtime can connect you to other operators subject to their own notices.
The deployment-specific provider list, processing locations and any cross-border transfer arrangements require owner verification before this draft is published. This notice does not assert that all data remains in Vietnam or that a particular international transfer safeguard is already in place. We may disclose information when legally required or necessary to respond to a lawful request, subject to applicable law.
Retention and deletion
Retention depends on the purpose of each record, account status, learning and certificate verification needs, security requirements and applicable legal obligations. This draft does not set an unverified retention period. The owner must approve a documented schedule for active data, logs, deleted records and backups before publication.
To ask about deletion or a particular record, email legal@vfuturelabs.org. A request may require identity verification and review of records that must lawfully be retained. Deleting an account may need additional steps for owned content, learning records or backups; we do not promise immediate deletion from every system.
Your choices and privacy requests
You can request information about processing, access, correction, deletion or restriction, object to processing, withdraw consent, or raise a complaint as applicable under Vietnamese law. Email legal@vfuturelabs.org with the request and the account or record concerned. Do not include your password. We may ask for proportionate information to verify identity and authority.
We will assess the request and explain the applicable process, any lawful exception and available next steps. Withdrawing necessary processing may affect the features we can provide; optional analytics remains optional. You may contact the competent authority or pursue remedies available under applicable law.
Children and people needing representation
Do not assume that creating an account alone supplies any consent required from a parent or legal representative. The owner must establish the relevant age, capacity and representative-consent process before offering services where that process is required. A parent or representative concerned about a child’s information can contact legal@vfuturelabs.org.
Security and incidents
The platform uses authenticated access, role checks and controlled file access to reduce unauthorized use. No online service can guarantee absolute security. Keep credentials private and report suspected account compromise or data exposure to legal@vfuturelabs.org. We will assess incidents and take the notification and response steps required by applicable law; this draft does not promise an unverified response time.
Updates and legal framework
The approved notice will identify its effective date. Material changes to purposes or consent requirements need appropriate notice and, where required, renewed consent. This draft is prepared with reference to Vietnam’s Personal Data Protection Law 91/2025/QH15 and Decree 356/2025/NĐ-CP, both effective from 1 January 2026. The official sources are linked below. This draft is not a certification of legal compliance.