Privacy Policy

ORA·tech operates the service at ora-tech.vn and is responsible for managing the personal data you create on the system.

For any privacy-related questions, please contact: privacy@ora-tech.vn

Account information

• Email (used to sign in; it cannot be changed through the interface).
• Password (securely hashed — we do NOT know your password).
• Display name and avatar (set by you, editable at any time).
• Current plan and expiry date.

Learning activity

• Questions you bookmark, questions reviewed, and your mastery level.
• Interview sprint progress and quiz results.
• Reports of incorrect or faulty questions (if you submit them).

Payments

• Order ID, amount, payment date, and the plan purchased.
• Bank transaction details provided by the payment gateway partner (transaction ID, sender's bank, transfer memo).
• ✅ We NEVER store: credit card numbers, CVV, PINs, OTPs, or banking passwords. All of this is handled by the payment gateway and your bank.

Technical information (for security)

• IP address, browser type, device, and access time.
• Sign-in history (successful / failed / from a new device).

This information is used solely to protect your account from unauthorized sign-ins. Only authorized technical staff can view it.

• Provide you with our learning and interview-practice services.
• Authenticate and protect your account (against unauthorized sign-ins, brute force, and abuse).
• Process payments when you upgrade your plan.
• Improve the product based on aggregated, anonymized statistics.

To operate the service, we work with the following partners:

• Payment gateway — processes bank-transfer payments (VietQR).
• PayPal — processes international payments for overseas customers.
• Google — lets you sign in with your Google account (optional). We only receive your email, name, and public profile picture. We do not access Gmail, Drive, Calendar, or contacts.
• Cloud hosting provider — stores your account data and learning activity. All servers are located in Singapore.
• AI services (such as Google Gemini and DeepSeek) — help generate quizzes and explain questions.💡 When calling an AI service, we only send the content of the question being studied — we do NOT send your email, password, or personal history.

We apply security measures aligned with international standards:

• Passwords are one-way hashed — we CANNOT read your password.
• All data transmitted between your device and our servers is encrypted (HTTPS).
• The database is connected over a secure channel. Only authorized staff can access it.
• Each account can be signed in on only one device at a time — if someone signs in to your account on a new device, the old device is automatically signed out. We keep this history so you can detect unauthorized access.
• Anti-abuse mechanisms (rate limiting, lockout) to prevent password brute-forcing.

• Account and learning activity: until you request deletion.
• Detailed review history: 6 months (then automatically cleaned up to keep the system lightweight).
• Invoices / payments: as required by accounting law (at least 5 years).
• Sign-in / security history: at least 12 months to support investigations in case of an incident.
• Data backups: 30 days (automatic).

Under Decree 13/2023/NĐ-CP (Vietnam's Personal Data Protection Decree) and international standards (GDPR / CCPA), you have the following rights over your personal data:

• Right of access — View your account information at any time on the Profile page.
• Right to rectification — Update your display name and avatar. Email cannot be changed through the interface — please email us if you need to change it (we will verify your old email before making the change).
• Right to erasure — Email us from your own account email. We will process the request within 30 days.(Self-service deletion in the app is in development.)
• Right to data portability — Request a file of your personal data and learning history via email at privacy@ora-tech.vn.
• Right to object to analytics — Ask us to stop using your data for product-improvement purposes (note: we still need it for basic account operation).
• Right to complain — If you are unhappy with how we handle your data, you may file a complaint with the Authority of Information Security (Ministry of Information and Communications).

We use a few essential cookies that are necessary for the service to function:

• Keep your session signed in (cleared after 15 minutes of inactivity).
• Allow automatic session renewal (up to 7 days).
• Protect against request forgery (CSRF protection).
• Remember your chosen interface language (Vietnamese / English).

✅ There are NO advertising or third-party behavioral-tracking cookies (such as Facebook Pixel, Google Analytics, AdSense, etc.).

The ORA·tech service is intended for people aged 13 and older. We do not knowingly collect data from children under 13.

If a parent or guardian discovers that a child under 13 has registered, please email privacy@ora-tech.vn so we can delete the account within 7 days.

In the rare event of a personal data breach, we commit to:

• Notify you by email and an in-app banner within 72 hours of discovery.
• Clearly describe the type of data affected and guide you on what to do (e.g., change your password).
• Report to the competent authorities as required by law.

When there is a significant change (e.g., adding a new partner or expanding the scope of collection), we will notify you by email and an in-app banner 7 days in advance of it taking effect. You may decline the change by requesting account deletion.

For any questions, requests, or complaints about privacy:

📧 privacy@ora-tech.vn

We aim to respond within 5 business days.