Privacy Policy

1. Information We Collect

2. How We Use Your Information

• Providing and maintaining your RinKuzu account and personalized learning sessions
• Generating adaptive quizzes from your uploaded PDF materials using Google Gemini AI
• Tracking your mastery progress across Bloom's Taxonomy levels using SAINT-Bloom knowledge tracing
• Improving and evaluating our adaptive learning algorithms through aggregate analysis
• Sending you service-related notifications (e.g., account verification, password reset, billing)
• Detecting, preventing, and responding to security incidents, fraud, or policy violations
• Complying with legal obligations under Vietnamese law, GDPR, and other applicable regulations

3. Legal Basis for Processing (GDPR)

If you are located in the European Economic Area, we process your personal data under:

• Contract performance (Art. 6(1)(b)): Processing necessary to provide our service to you
• Legitimate interests (Art. 6(1)(f)): Security, fraud prevention, service improvement
• Consent (Art. 6(1)(a)): Optional analytics cookies; non-essential data processing
• Legal obligation (Art. 6(1)(c)): Compliance with applicable laws

4. Data Retention

We retain your personal data for as long as your account is active and for a period of up to 3 years after account deletion, unless a longer retention period is required by law. Specific retention periods:

• Account data: Until account deletion + 3 years
• Uploaded PDFs: Until you delete them or your account + 90 days
• Learning activity logs: 3 years (aggregated/anonymized after 1 year)
• Security and audit logs: 1 year
• Billing records: 7 years (tax and accounting obligations)

5. Third-Party Data Processors

We use the following third-party services, each acting as a data processor under GDPR:

All processors are bound by Data Processing Agreements (DPAs) incorporating standard contractual clauses approved by the European Commission.

6. International Data Transfers

Some third-party processors (notably Google Gemini AI) may process data outside the European Economic Area. Such transfers are protected by: (a) adequacy decisions by the European Commission, or (b) standard contractual clauses (SCCs) as approved by the European Commission. A copy of the relevant SCCs is available upon request.

7. Your Rights Under GDPR

If you are in the EEA, you have the right to:

• Access: Request a copy of your personal data
• Rectification: Correct inaccurate or incomplete data
• Erasure: Request deletion of your data ("right to be forgotten")
• Restriction: Request limited processing in certain circumstances
• Portability: Receive your data in a structured, machine-readable format
• Object: Object to processing based on legitimate interests
• Withdraw consent: Withdraw consent at any time where processing is consent-based
• Lodge a complaint: File a complaint with your local data protection authority

To exercise any of these rights, contact us at support@rinkuzu.app. We will respond within 30 days.

8. Vietnamese PDPA Compliance

For users in Vietnam, we comply with Decree No. 13/2023/ND-CP on the Protection of Personal Data (PDPD). Under Vietnamese law, you have the right to: be informed of data processing purposes; consent to or withdraw consent for processing; access and correct your personal data; delete your personal data; and complain to competent authorities. Contact our Data Protection Officer at dpo@rinkuzu.app.

9. Children's Privacy (COPPA Compliance)

RinKuzu's services are not directed to children under the age of 13 (“Children”). We do not knowingly collect personal data from children under 13 without verifiable parental consent. If you believe we have inadvertently collected such data, please contact us immediately at support@rinkuzu.app, and we will promptly delete it.

10. AI-Generated Content and Automated Decisions

RinKuzu uses Google Gemini AI to generate quizzes and evaluate answers. You have the right not to be subject to solely automated decisions that produce significant effects. If you believe an AI-generated evaluation has produced an unfair result, you may request human review by contacting support@rinkuzu.app. We do not use AI-generated content to make automated decisions with legal or similarly significant effects without human oversight.

11. Data Security

We implement industry-standard security measures: TLS 1.3 encryption in transit, AES-256 encryption at rest, bcrypt password hashing, role-based access control (RBAC), regular security audits, and intrusion detection systems. In the event of a data breach affecting your personal data, we will notify you and the relevant supervisory authority within 72 hours as required by GDPR Article 33.

12. AI Training Disclaimer

We do not use your personal data, uploaded learning materials, quiz content, or learning activity data to train, fine-tune, or improve any machine learning models or AI systems. Your content is processed solely for the purpose of providing the RinKuzu service to you.

13. Data Controller Information

14. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by posting the new policy on this page and updating the “Last updated” date. For significant changes, we will send a notification to your registered email address. We encourage you to review this policy periodically.

15. Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:

• Email: support@rinkuzu.app
• Data Protection Officer: dpo@rinkuzu.app
• Address: Room 302, Building A1, Hanoi University of Science and Technology, 17 Dai Co Viet, Hanoi, Vietnam