- 홈
- Privacy Policy
Privacy Policy
Last updated: September 9, 2026
Effective from: September 9, 2026
Quick summary (does not replace the official text below):
- We collect the minimum information needed to provide the service: email, learning progress, and some technical data for security.
- We do not sell your personal data and do not use it for third-party advertising beyond the standard display ad network (Google AdSense) running on the site.
- Some technical data (IP, hashed fingerprint) is used to fight bots and fraud — this is necessary to protect our content and all Users.
- You have the right to access, correct, delete your data (including self-service account deletion at
/remove-account) and withdraw consent at any time.- Privacy contact: [email protected].
1. Introduction & Data Controller
1.1. TestToeic.com ("We") is committed to protecting Users' privacy. This Policy describes how We collect, use, store, share and protect personal information when You use the service at testtoeic.com.
1.2. Data Controller: TestToeic.com, operated in Vietnam. All privacy inquiries should be sent to [email protected].
1.3. This Policy is an integral part of the Terms of Service. Using the Service means You understand how Your data is processed as described here.
2. Information We Collect
2.1 Information You Provide
| Type | Data | Purpose |
|---|---|---|
| Registration | Email, username, full name | Account creation, communication |
| Profile | Avatar, bio, target TOEIC score | Personalization, displaying your public profile (if enabled) |
| Feedback/Bug reports | Message content, attached images, title, category | Support handling, product improvement |
| Friends & Battle Mode | Friend list, invitations, match history, rank | Providing dueling & leaderboard features |
| Payment | VIP/Seeds transaction history (via payment gateway) | Order processing, refunds |
2.2 Information Collected Automatically
| Type | Data | Purpose |
|---|---|---|
| Access | IP address, User-Agent, timestamp | Security, fraud prevention |
| Device | Browser fingerprint (hashed) | Detecting VIP account sharing, anti-bot |
| Behavior | Pages visited, time spent | Service improvement |
| Learning | Test results, practice progress, streaks, AI-graded Speaking/Writing scores | Core product functionality |
2.3 Anti-Fraud Information
To protect our content and prevent unauthorized access, We automatically collect and process:
- IP address: bot detection, rate limiting.
- Browser fingerprint (hashed, non-reversible): detecting account sharing.
- Request patterns: detecting automated crawling.
This data is processed automatically; staff only review it when there are specific signs of violation (see Section 6 on automated decisions).
3. Legal Basis for Processing
We only process personal data when at least one lawful basis applies:
| Basis | Applies to |
|---|---|
| Contract performance | Account creation, saving progress, processing VIP/Seeds payments, providing features |
| Legitimate interest | System security, anti-fraud/anti-crawl, proportionate service improvement |
| Consent | Optional email (feature updates), public profile, other optional processing — withdrawable at any time |
| Legal obligation | Accounting/tax record keeping, responding to lawful requests from authorities |
4. How We Use Information
We use the information We collect to:
- Provide the Service: authentication, saving progress, personalization, AI scoring.
- Security: detecting unauthorized access, anti-crawling, preventing Battle Mode cheating.
- Improve the Service: analyzing usage behavior (in aggregate/anonymized form) to improve quality.
- Communicate: sending service notices and feature updates (optional ones can be turned off).
- Legal: complying with legal requirements, resolving disputes.
We DO NOT:
- Sell your personal information to third parties.
- Share your learning data with employers or schools.
- Use the content of Your Speaking/Writing submissions for any purpose beyond scoring and improving Our internal scoring engine.
5. Data Retention
| Data Type | Retention Period | Reason |
|---|---|---|
| Account information | Until account deletion | Providing the Service |
| Learning progress & test results | Until account deletion | Core functionality |
| Access logs (IP, path, timestamp) | 90 days | Security, audit |
| Payment history | As required by accounting/tax law | Legal obligation |
| Browser fingerprint hash | 90 days | Fraud prevention |
| Feedback/bug report content & attached images | 1 year after resolution | Support, dispute reference |
About images You upload (avatar, feedback attachments): the system automatically strips EXIF metadata from images on upload — including GPS coordinates, device model and capture time — before storing them.
After the retention period, data is automatically deleted or anonymized. Data that must be kept under legal obligations is retained for the statutory period.
6. Automated Decisions & Anti-Fraud
6.1. To protect our content and Users, Our systems apply automated measures such as rate limiting, bot detection, and flagging unusual behavior (e.g. temporarily suspending or flagging accounts showing signs of crawling or VIP account sharing).
6.2. These measures are for security purposes, not for evaluating Your personal character. If an automated decision significantly affects You (e.g. an account suspension), You have the right to request human review by contacting [email protected].
7. Data Security
We apply reasonable industry-standard security measures: encryption in transit (HTTPS/TLS); hashed passwords, never stored in plain text; internal access restricted on a least-privilege basis; audit logs for administrative access; regular backups.
No system is completely secure; while We cannot guarantee absolute security, We commit to handling and notifying incidents in accordance with applicable law in the event of a personal data breach affecting You.
8. Your Rights
You have the following rights (consistent with Vietnam's personal data protection law):
- 8.1 Right to access: request a copy of the personal data We hold about You.
- 8.2 Right to rectification: update inaccurate information in Your Account settings.
- 8.3 Right to erasure ("right to be forgotten"): delete Your own account via
/remove-accountor request deletion by email. After deletion: personal information is deleted within 30 days; payment data is retained (to the extent necessary) for legal obligations; access logs containing user identifiers are anonymized. - 8.4 Right to restrict processing: request that We pause processing (except for security and legal obligation purposes).
- 8.5 Right to object: object to processing based on legitimate interest for a specific purpose.
- 8.6 Right to data portability: receive the data You provided in a commonly used, machine-readable format, where technically feasible.
- 8.7 Right to withdraw consent: for processing based on consent, withdrawal does not affect the lawfulness of processing carried out before the withdrawal.
How to exercise these rights: send an email to [email protected] with the subject [PRIVACY] Request <right type>, including Your registered email and a description of Your request. Processing time: 15 business days. We may need to verify Your identity before fulfilling the request.
9. Cookies & Tracking
9.1 Essential cookies/storage
- Session token (httpOnly, secure).
- Selected language.
- Interface preference (dark/light mode).
9.2 Advertising
We display ads via Google AdSense in certain placements (VIP Users do not see ads). Google may set cookies to serve and measure ads under its own policies; We do not share Your account/learning data with the ad network.
9.3 We do NOT use
- Facebook Pixel or similar social-media trackers.
- Cross-site tracking beyond the standard operation of Google AdSense.
10. Sharing with Third Parties
| Third Party | Data | Purpose |
|---|---|---|
| Payment gateways (PayPal, etc.) | Email, transaction amount | Processing VIP/Seeds transactions |
| Google AdSense | Standard advertising data (excludes account/learning data) | Serving ads to non-VIP Users |
| Infrastructure/hosting & AI scoring providers | Operational data, audio recordings/writing submitted for scoring | Hosting, system operation, Speaking/Writing scoring |
| Competent authorities | As legally required | Legal compliance |
Data processors acting on Our behalf may only process data under Our instructions and must apply appropriate safeguards.
11. International Data Transfers
Some infrastructure providers may host servers outside Vietnam. When transferring data abroad, We apply appropriate safeguards in accordance with Vietnamese personal data protection law to ensure an equivalent level of protection.
12. Children
The Service is not intended for children under 16. Users aged 16 to under 18 require the consent and supervision of a parent/guardian. If We discover an account belonging to a child under 16 without parental consent, We will delete the account and related data.
13. Changes to This Policy
When We change this Policy, We will: update the "Last updated" date at the top of the page; notify You via email or on the website for material changes; keep the prior version accessible for at least 90 days. Continued use of the Service after a change takes effect means You have acknowledged the updated Policy.
14. Contact
- Email: [email protected]
- Website: https://testtoeic.com
- Address: TestToeic.com, Vietnam