Privacy Policy

1. Who processes your data

Mosra is operated by {{LEGAL_NAME}}, at {{BUSINESS_ADDRESS}}. "We" in this document means that entity.

Any question or request about personal data goes to {{PRIVACY_EMAIL}}. That is the single point of contact for the requests in section 10.

This policy covers the Mosra app, mosra.app and the desktop application.

2. Who is responsible for what

For your own account data — email, name, the content you create, billing history — we are the data controller.

For student data produced when you teach with Mosra — assessment results, answers, session nicknames — you or your school are the controller, and we are a processor acting on your instructions. The detailed terms are in the Data Processing Addendum.

If your organisation self-hosts Mosra on its own infrastructure, the data sits on your servers and your organisation is both controller and host. The provider list in section 6 applies only to the cloud service we operate.

3. What we collect

We collect only what running the Service needs. The table below is the complete list, by category.

We do not knowingly collect sensitive personal data (health, biometrics, political or religious views). Please keep it out of lesson content and questions.

4. Purposes and legal bases

We do not use your data for targeted advertising, we do not run automated profiling that affects your rights, and we do not sell personal data to anyone.

5. AI features and your data

When you use an AI feature, your request and the content needed to answer it are sent to a third-party model provider. The current default is Google (Gemini) — the up-to-date list is on the Sub-processors page.

That content leaves Vietnam. See section 7.

We keep your assistant conversation history so you can revisit it and so the assistant has context. You can delete a conversation at any time.

AI usage logs (provider, token counts, cost) hold numbers only — never the content of your requests.

We do not use your content to train models, ours or anyone else's.

6. Who we share with

We share data with the providers Mosra needs to run — file storage, email delivery, payments, AI models, push notifications. They may only process it on our instructions.

The full list, with purpose and processing location, is on the Sub-processors page. We update it whenever a provider changes.

Other cases

• When you share deliberately: people you invite to a class, anyone you send a presentation link to, members of a team licence.
• When the law requires it: in response to a valid request from a competent authority. We review each request and disclose the minimum.
• On a business transfer: if the Service changes hands we will give notice, and the new owner must keep to this policy.

We do not sell, trade or rent personal data.

7. International transfers

Some of our providers run infrastructure outside Vietnam: file storage, email, international payments, push notifications and AI models. Your data may therefore be stored or processed abroad.

For each provider we put a data processing agreement in place, apply standard contractual clauses where needed, and complete the cross-border transfer impact assessment Vietnamese law requires.

If your data must stay in-country, the self-hosted deployment is the right option. Get in touch to discuss it.

8. How long we keep it

Once a period ends, the data is deleted or anonymised so no individual can be identified from it.

9. Security

• Every connection to Mosra uses HTTPS; data is encrypted in transit.
• Passwords are stored hashed, never in readable form.
• Access to production is limited to a small number of people and is logged.
• Regular backups, with restore testing.
• Rate limiting against password guessing and abuse.

No system is perfectly secure. Use a unique password for Mosra and do not share your account.

10. Your rights

Vietnamese data protection law gives you the rights below. We answer within the deadline in the right-hand column, counted from the point we have verified who you are.

Send requests to {{PRIVACY_EMAIL}}. We may need to verify your identity first — that step protects you from someone else impersonating you to take or delete your data.

Some data we must keep even if you ask us to delete it, such as invoices under accounting rules. Where that applies we will tell you exactly what was kept and why.

If you are a student wanting your results deleted, contact your teacher or school first — they control that data. We will pass on any request that reaches us by mistake.

11. Additional rights in the EU, EEA and UK

If you are in the European Union, the EEA or the United Kingdom, the GDPR and UK GDPR also apply to you.

• The legal basis for each purpose is set out in section 4.
• You have the right to data portability in a machine-readable format — use the data download in account settings.
• You have the right to object to processing based on legitimate interests.
• The GDPR deadline for responses is one month. The deadlines in section 10 are shorter, and we apply the shorter ones to everyone.
• Transfers outside the EEA rely on the European Commission's standard contractual clauses, or the provider's equivalent mechanism.
• You have the right to complain to the data protection authority where you live.

12. Children and students

Mosra accounts are for people aged 16 and over. We do not knowingly collect data to create accounts for anyone younger.

Students under 16 can join a session or assessment run by their teacher without an account. In that case the teacher or school is the controller and is responsible for obtaining parental or guardian permission where the law requires it.

We recommend telling students to use a nickname rather than their real name.

If you are a parent and believe your child has created an account, contact {{PRIVACY_EMAIL}} and we will delete it.

The page for teachers and parents explains student data in more detail.

13. Participants without an account

When you join a live session or view a shared presentation without signing in, we still record some data: the nickname you typed, your score, which slides you saw and for how long.

That data is shown to whoever ran the session, and is deleted after 12 months.

We do not build a profile that follows you between sessions.

14. Cookies and browser storage

We use cookies and browser storage for essentials only: keeping you signed in, remembering your language and a few interface preferences.

We currently run no analytics, no advertising pixels and no third-party tracking cookies. If that changes, we will ask you first.

Details are on the Cookie page.

15. Data incidents

If personal data is exposed, we notify the competent authority within 72 hours of becoming aware, as Vietnamese law requires.

We notify you directly where the incident is likely to pose a high risk to your rights, telling you what happened and what to do.

If you find a security flaw, report it to {{SUPPORT_EMAIL}}. We do not pursue good-faith reporters.

16. Changes to this policy

We update this policy when the way we handle data changes. The version and effective date are shown at the top of the page.

For material changes — a new processing purpose, a new provider abroad — we give notice by email or in-app, and ask for consent again where needed.

17. Contact

You also have the right to complain to the competent data protection authority if you believe we have handled your data improperly.