OpenSTEM

Privacy Policy

We respect and are committed to protecting your personal information. This policy explains how OpenSTEM LMS collects, uses and protects your data.

Last updated: August 15, 2026

1. Introduction

OpenSTEM LMS (“we”) treats the protection of personal data as a top priority. This Privacy Policy describes the types of information we collect, the purposes for which we use it, how we protect it, and the rights you have over your personal data when using the Platform.

2. Information we collect

We collect the following types of information:

  • Account information: full name, email, password (encrypted), role (student/teacher/administrator), and affiliated organization.
  • Learning records: course progress, assignment results, experience points (XP), badges and achievements.
  • Content you create: courses, projects, lessons, comments and the materials you upload.
  • Payment information: data related to transactions (we do not store card information directly; payments are processed by our payment gateway partner).
  • Technical data: IP address, device type, browser, cookies and activity logs, used to keep the service secure and to improve it.

3. How we use information

  • To provide, operate and personalize the learning experience on the Platform.
  • To track learning progress and provide reports to teachers, parents and schools.
  • To process transactions and service plans, and to provide customer support.
  • To ensure security and to detect and prevent fraud or abuse.
  • To send important notices about your account and the service.
  • To improve the quality of the Platform’s content and features.
  • To measure the effectiveness of advertising and marketing — only with your consent, and only with the data described in Section 5. We do not use the data of minors for this purpose.

4. Protecting children’s data

OpenSTEM LMS serves students, including children. We pay particular attention to protecting the information of users who are minors. Student accounts are usually created and managed through a school, a learning center or a parent. We collect only the minimum data needed for learning purposes and do not use children’s data for advertising.

5. Sharing information with third parties

We do not sell your personal data. Information is shared only in the following cases:

  • Operational service providers: infrastructure and technology partners that help the Platform run — storage and database (Supabase), application hosting (Google Cloud / Firebase), transactional email (Amazon Web Services – SES), protection against automated access (Cloudflare), and artificial intelligence services that assist with content creation (Google Gemini). These partners may process data only on our instructions.
  • Payment gateway: PayOS receives the information needed to process transactions. We do not store your card information.
  • Advertising and measurement platforms: Google (Google Analytics, Google Ads) and Meta (Facebook, Instagram) — only with your consent. Details are given immediately below.
  • Zalo messaging platform (VNG): if you provide a phone number when registering for a training session or when using a service plan, we send that phone number, together with the information that needs to appear in the message (full name, session name, time, registration code), to Zalo so that it can send confirmation and reminder messages.
  • Your organization: if you use an account that belongs to a school or learning center, the organization’s administrators and teachers can access your learning data for teaching purposes.
  • When required by law: in response to a lawful request from a competent government authority.

5.1. Data shared with advertising platforms

When you turn on the “Advertising” option in the cookie preferences bar, we share the following data with Google and Meta:

  • Your email and/or phone number in one-way hashed (SHA-256) form — this string is used for matching and cannot be reversed into the original information.
  • Technical identifiers: ad click IDs (gclid, fbclid), cookies set by the advertising platforms (_fbp, _fbc), IP address and browser information.
  • An internal account identifier (a random string that contains no personal information).
  • Event names and conversion values — for example: registered an account, created a first class, purchased a service plan — together with an order ID where applicable.

We do not share with these platforms: lesson content, student work, scores, learning results, progress data, or any data of users who are minors.

Purpose: to measure the effectiveness of advertising campaigns, to exclude existing customers from trial invitation ads, and to find groups of users with similar characteristics.

The legal basis is your consent, and you can withdraw it at any time in the Cookie Policy or by reopening the cookie preferences bar at the bottom of the page. If you have not consented, or have withdrawn your consent, the system does not send your data to Google and Meta. This applies to data sent directly from our servers as well, not only to cookies running in the browser.

Within the learning area, Meta’s advertising measurement code is not loaded, and Google’s code runs in a mode that sets no cookies until consent is given.

Google, Meta, Supabase, Amazon Web Services, Cloudflare and PayOS may store and process data on servers located outside Vietnam. We choose partners with appropriate data protection commitments and transfer only the data described in this section.

6. Data storage and security

We apply appropriate technical and organizational measures to protect data, including encryption in transit (HTTPS), role-based access control and secure authentication. However, no system is absolutely secure; you are also responsible for keeping your sign-in information confidential.

7. Retention period

We retain personal data for as long as necessary to provide the service and to comply with legal obligations. When data is no longer needed, we delete or anonymize it securely.

8. Your rights

Depending on applicable law, you have the following rights over your personal data:

  • The right to access and request a copy of your data.
  • The right to request correction of inaccurate information.
  • The right to request deletion of your data or account.
  • The right to withdraw consent to the processing of your data.

To exercise these rights, please contact contact@ohstem.vn.

9. Cookies

The Platform uses cookies and similar technologies to keep you signed in, remember your preferences and improve your experience. Please see our Cookie Policy for details.

10. Changes to this policy

This policy may be updated from time to time. Significant changes will be announced on the Platform. Please check the “Last updated” date at the top of this page for the latest version.

11. Contact

If you have questions about this Privacy Policy or how we handle your data, please contact us by email at contact@ohstem.vn.

If you have any questions, please contact contact@ohstem.vn.