Privacy policy

1. Data controller

Controller and processor: Made Simple Academy. Email: [email protected].

Personal data protection contact: [email protected].

2. Data we process

We collect only what learning on this site needs:

• Google account details: name, email address, profile picture and Google account ID (basic personal data).
• Learning data: lessons watched, playback position, completed lessons, quiz answers and the name printed on certificates.
• Technical data: the session cookie, plus IP address and browser details in server logs, used for security and abuse prevention.

3. Purposes and legal basis

We process data to create and keep your account, play lessons, save progress, score quizzes, issue certificates and protect the service. This is performing our agreement with you (Article 19(1)(d) of Law 91/2025/QH15).

We do not sell data, use it for advertising or build behavioural profiles. Visitor statistics (if enabled) run only with your separate consent, which you can withdraw at any time.

4. Cookies

Essential cookies keep you signed in (our session cookie and, during the private preview, Cloudflare Access cookies). Analytics cookies are used only if you accept them in the cookie notice; choose “Essential only” to refuse.

5. Recipients and transfers abroad

Our server and database are in Vietnam. Some infrastructure providers may process data outside Vietnam:

• Google LLC (United States): Google sign-in.
• Cloudflare, Inc. (United States): content delivery, protection and access control; traffic passes through Cloudflare's network when you visit.

6. Retention

Account and learning data are kept while your account is active and deleted when you ask us to delete the account. Server logs are kept for up to 30 days. Database backups are kept for up to 14 days and then deleted automatically.

7. Your rights

Under Article 4 of Law 91/2025/QH15 you may be informed about processing; give, refuse or withdraw consent; view, correct, obtain a copy of, delete or restrict your data; object to processing; and complain, report or claim damages as the law provides.

8. Making a request and response times

Email [email protected] from your account's address. We acknowledge within 2 working days. Under Article 5 of Decree 356/2025/ND-CP we complete requests to view, correct or provide data within 10 days; to withdraw consent, restrict or object within 15 days; and to delete data within 20 days. If we need more time we tell you why in writing.

Withdrawing consent does not affect processing lawfully carried out before.

9. Children

The site is meant for learners aged 16 and over. For a learner under 16, a parent or guardian exercises the child's rights and can contact us to view or delete the child's data.

10. Security and incidents

We use encrypted connections (HTTPS), access control, rate limits, regular backups and an audit log of admin actions. If a personal data incident may cause harm, we notify the specialised data protection agency (Ministry of Public Security) within 72 hours under Article 23 of Law 91/2025/QH15 and inform affected people when needed.

11. Changes

When this policy changes we update the date above and announce important changes on the site before they apply.