Privacy Policy

Account information: name, email, phone number (if you provide it), password (stored only as a hash), profile photo, interface language, and when and which version of the terms you accepted. If you sign in with Google, Zasu receives your name, verified email, profile photo and Google account ID from Google — never your Google password or any other data.

Tutor and expert profiles: photo, bio, date of birth, gender, education, experience, degrees and certificates uploaded for verification, and bank account details (bank, account number, account holder) for paying out earnings. For identity verification Zasu checks your ID card or passport and records only the result; no copy of the document is stored.

Learning activity: schedules, packages, classroom attendance (join/leave times), reviews, lesson notes and homework, messages, files shared in lessons, and disputes.

Transactions: top-ups (amount, bank, reference code, transfer memo), payments, refunds and withdrawal requests. Zasu does not collect or store payment card details.

Technical data: IP address, device type, browser and access logs, used for security and fraud prevention.

To run the service: accounts, scheduling, video classrooms, messaging, payments, escrow and tutor payouts.

To protect transactions: verifying tutor profiles, handling disputes, and detecting multiple accounts, trial abuse and off-platform dealings.

To contact you: in-app notifications and emails about lessons, payments and password resets. Zasu does not send marketing emails without your separate consent.

To improve the service: tutor recommendations, rankings and badges based on teaching quality, and aggregated statistics that do not identify you.

Zasu processes data based on the consent you give when signing up, to perform the service agreement between you and Zasu, and to meet legal obligations (accounting, tax and requests from competent authorities).

Public tutor and expert profiles (name, photo, bio, subjects, education, experience, prices, reviews) are visible to everyone. Date of birth, bank details and verification documents are never shown publicly.

Learners and tutors see each other's name and photo and the details of their shared lessons. Email addresses and phone numbers are not shared between them.

Family notebook: if you invite a parent or guardian (up to 2, by email or QR code), once they confirm they can see your schedule, attendance, progress reports, homework titles and status, goals, packages and wallet balance, and top up your wallet; they cannot see messages, homework content, files or login details. Zasu stores their name, email, relationship and the devices they opened the notebook on in order to send updates. You can remove a follower anytime in Settings, and followers can stop on their own.

Zasu administrators access data when needed to review profiles, reconcile payments, handle disputes and review messages flagged by the system. Administrator actions are logged.

Zasu does not sell personal data. Data is shared only with the infrastructure providers needed to run the service: hosting and database (Vercel, Supabase), Google sign-in (Google), video classrooms (LiveKit), email delivery (Resend), bank transfer reconciliation (SePay) and the banks that carry out transactions — or with competent authorities when the law requires it.

Zasu's database and file storage are in Singapore; the video and email providers may process data in other countries. By accepting this policy you agree that your data may be transferred to and stored outside Vietnam; Zasu applies equivalent safeguards when transferring it.

Classroom audio and video are streamed live between participants through a video server; Zasu does not record lessons.

Zasu uses only essential cookies: a login session cookie (valid for 30 days) and a cookie that remembers your language. Zasu does not use third-party advertising or tracking cookies.

Account data is kept while your account is active. Files shared in lessons are deleted automatically after 7 days.

When you ask for your account to be deleted, your personal data is deleted or anonymised, except for transaction records and documents that accounting and tax laws require us to keep — those are kept for the legally required period.

Passwords are hashed with bcrypt; all connections are encrypted with HTTPS; documents and lesson files are kept in private storage; administrator access is granted per person and logged. Messages containing contact details are blocked automatically to protect both sides.

If a breach exposes personal data, Zasu will notify the competent authority and affected users as required by law.

Processing the data of anyone under 16 requires the consent of a parent or guardian. If we find a child's account created without that consent, Zasu may suspend it and delete the related data.

A parent or guardian records their consent by accepting the child's Family notebook and ticking the consent box; Zasu keeps the time of consent as evidence.

Under Decree 13/2023/ND-CP you have the right to be informed, to access, correct and download your data, to request its deletion, to restrict or object to processing, and to withdraw consent. Most information can be edited yourself in Settings and your Profile.

Send any other request to support@izasu.com — Zasu replies within 72 hours. Withdrawing consent may mean Zasu can no longer provide the service to you, but does not affect processing carried out before.

Zasu will announce significant changes in the app or by email before they apply. Questions about personal data: support@izasu.com.