# Jstep-Go Privacy Policy

Last Updated: April 08, 2026

G.A.INFORMATION TECHNOLOGY AND SERVICES CO., LTD ("we," "us," or "our") operates Jstep-Go (the "Service"). This Privacy Policy explains how we collect, use, disclose, and protect your personal information when you use our Service.

We are committed to protecting your privacy and complying with applicable data protection laws, including Personal Data Protection Law of Vietnam (PDPL), the EU General Data Protection Regulation (GDPR), and the California Consumer Privacy Act (CCPA).

## 1. Information We Collect

### 1.1 Information You Provide

1. **Account Information**
   - Email address
   - Password (hashed)
   - Username and display name (optional)
   - Profile information (optional)

2. **Social Login Information** *(include only if applicable; otherwise delete this block)*
   - **Via Google**: Email address, name, and profile picture
   - We only access publicly available profile information from Google. We do not access your password, social media posts, or friend lists.

3. **AI Tutor Input Data** — e.g. AI Tutor / AI-assisted learning
   - Text data entered when using Gemini AI
   - Voice data submitted when using Gemini AI, if applicable

4. **Support Inquiries**
   - Content of your inquiries
   - Contact information

### 1.2 Information Collected Automatically

1. **Usage Data**
   - Search history
   - Browsing history
   - Learning history and progress data
   - In-app activity data

2. **Technical Information**
   - IP address
   - Browser type and version
   - Device information (OS, device type, device ID)
   - Access date and time
   - Cookie data

3. **Log Information**
   - Server logs
   - Error logs
   - Access logs

## 2. How We Use Your Information

We use the information we collect for the following purposes:

1. **Service Provision and Operation**: Account creation and management, login authentication, providing Service features (including Gemini AI if offered), saving and displaying learning history, and delivering personalized learning experiences.

2. **Service Improvement and Development**: Analyzing usage patterns, developing new features, improving user experience, and fixing bugs.

3. **Communication**: Responding to inquiries, sending important service announcements, and maintenance notifications.

4. **Marketing (Opt-in Only)**: Sending information about the Service, new features, and campaigns. You may opt out at any time.

5. **Security and Fraud Prevention**: Detecting and preventing unauthorized access, investigating violations of our terms, and maintaining system security.

6. **Legal Compliance**: Responding to legal obligations and protecting our rights.

## 3. AI Tutor and Data Sharing with Google

Our AI Tutor is powered by Google (Gemini API, e.g. Google Gemini API), provided by Google LLC.

### 3.1 Data Sent to Google

When you use AI Tutor, the text and/or voice data you input (as applicable) are sent to Google's servers to generate AI-powered responses.

### 3.2 How Google Handles Your Data
- We use Google Gemini API as a paid business API. Google does not use the data sent through the API to train its AI models.
- Your data is processed temporarily to generate responses and is handled in accordance with Google's data retention policies.
- For details, please refer to Google's Privacy Policy: https://policies.google.com/privacy

### 3.3 Precautions When Using AI Tutor

- Do not input sensitive information such as passwords, credit card numbers, or government-issued identification numbers.
- AI-generated responses are for reference only; accuracy is not guaranteed.

## 4. Disclosure to Third Parties

We do not sell your personal information to third parties.

We do not share your personal information with third parties except in the following circumstances:

1. When required by law
2. When necessary to protect the life, body, or property of an individual, and it is difficult to obtain consent
3. When necessary for public health or the sound development of children, and it is difficult to obtain consent
4. When cooperating with a government agency or local authority performing duties prescribed by law, and obtaining consent may impede such duties

## 5. Third-Party Services

We use the following third-party services in the operation of our Service:

1. **Supabase (Database and Authentication)**
   - Provider: Supabase Inc.
   - Purpose: User authentication, data storage and management
   - Data stored: Account information, usage history
   - Data location: United States (AWS infrastructure)
   - Security: Encryption at rest and in transit, Row Level Security (RLS)
   - Privacy Policy: https://supabase.com/privacy

2. **Google Gemini API (AI Tutor)**
   - Provider: Google LLC
   - Purpose: Providing the AI Tutor feature
   - Data sent: Text and voice data entered by users
   - Privacy Policy: https://policies.google.com/privacy

3. **Google Analytics (Usage Analytics)**
   - Provider: Google LLC
   - Purpose: Analyzing Service usage
   - Data collected: Access logs, behavioral data (anonymized)
   - Privacy Policy: https://policies.google.com/privacy
   - Opt-out: https://tools.google.com/dlpage/gaoptout

## 6. Cookies and Similar Technologies

### 6.1 How We Use Cookies

We use cookies and similar technologies for the following purposes:

1. **Essential Cookies**: Required for basic Service functionality, such as maintaining login sessions and security features.
2. **Functional Cookies**: Remembering your settings and preferences.
3. **Analytics Cookies**: Analyzing Service usage through tools such as Google Analytics.

### 6.2 Managing Cookie Preferences

You can disable cookies through your browser or device settings. However, disabling cookies may cause some features of the Service to function improperly.

## 7. Security Measures

We implement the following security measures to protect your personal information:

1. **Encryption in Transit**: All communications use SSL/TLS encryption.
2. **Encryption at Rest**: Passwords are hashed before storage. Data stored in our database is encrypted.
3. **Access Control**: Supabase Row Level Security (RLS) ensures that users can only access their own data.
4. **Infrastructure**: Our database platform, Supabase, operates on AWS's secure infrastructure.
5. **Intrusion Prevention**: We use firewalls and intrusion detection systems.
6. **Organizational Measures**: We have appointed a data protection officer and established internal data handling policies.

## 8. Data Retention

We retain your personal information only for as long as necessary to fulfill the purposes for which it was collected.

| Data Type | Retention Period |
|-----------|-----------------|
| Account information | Until account deletion, or after 1 year of inactivity |
| Usage history and learning data | Up to 2 years |
| Gemini AI conversation data | Up to 1 year |
| Support inquiries | 1 year after resolution |
| Log information | Up to 6 months |

Where retention is required by law, we will retain information for the legally required period.

Upon account deletion, all personal information associated with your account will be **permanently deleted within 30 days**, except where retention is required by law.

## 9. Your Rights

You have the following rights regarding your personal information:

1. **Right of Access**: Request access to the personal data we hold about you.
2. **Right of Correction**: Request correction of inaccurate personal data.
3. **Right to Suspension of Use**: Request that we stop using your personal data.
4. **Right of Deletion**: Request deletion of your personal data.
5. **Right to Stop Third-Party Sharing**: Request that we stop sharing your personal data with third parties.

To exercise any of these rights, please contact us using the information provided at the end of this policy. We will respond to your request within 30 days.

### 9.1 Account Deletion

You may delete your account at any time through the account settings screen within the app.

## 10. Rights of EEA and UK Residents (GDPR)

If you are located in the European Economic Area (EEA) or the United Kingdom, you have the following additional rights under the General Data Protection Regulation (GDPR) and UK GDPR:

1. **Right to Data Portability**: Receive your personal data in a structured, commonly used, and machine-readable format.
2. **Right to Restriction of Processing**: Request restriction of processing of your personal data under certain conditions.
3. **Right to Object**: Object to the processing of your personal data based on our legitimate interests.
4. **Right to Refuse Automated Decision-Making**: Refuse decisions based solely on automated processing that produce legal effects concerning you.

We act as the Data Controller under the GDPR. Our legal bases for processing are: your consent, performance of a contract, our legitimate interests, or compliance with a legal obligation.

To exercise these rights or file a complaint, please contact us using the information below. You also have the right to lodge a complaint with your local data protection authority.

## 11. Rights of California Residents (CCPA)

If you are a California resident, you have the following rights under the California Consumer Privacy Act (CCPA):

1. **Right to Know**: Request information about the categories and specific pieces of personal information we have collected, used, and shared.
2. **Right to Delete**: Request deletion of the personal information we have collected from you.
3. **Right to Opt-Out**: Opt out of the "sale" of your personal information to third parties.
4. **Right to Non-Discrimination**: Not receive discriminatory treatment for exercising your privacy rights.

We do not "sell" your personal information as defined by the CCPA.

To exercise your CCPA rights, please contact us using the information below. You may submit up to 2 requests within a 12-month period, and we will respond within 45 days.

## 12. Children's Privacy

The Service is not intended for children under the age of 13, and we do not knowingly collect personal information from children under 13. Individuals under 13 are prohibited from using the Service.

If you are under 17, we recommend that you obtain parental or guardian consent before using the Service.

If we become aware that we have inadvertently collected personal information from a child under 13, we will promptly delete such information. If you believe we may have collected information from a child under 13, please contact us using the information below.

## 13. Do Not Track

Some browsers offer a "Do Not Track" (DNT) feature. As there is currently no universally accepted industry standard for DNT signals, the Service does not respond to DNT signals.

## 14. International Data Transfers

Some of the third-party services we use (such as Supabase and Google) have servers located outside of Viet Nam. Your personal information may be transferred to and processed in other countries, including Viet Nam.

We take appropriate safeguards, including contractual protections, to ensure that your personal information is protected in accordance with this Privacy Policy and applicable laws.

## 15. Changes to This Privacy Policy

1. We may update this Privacy Policy from time to time to reflect changes in law or our Service.
2. When we make changes, we will post the updated Privacy Policy within the Service with a new effective date.
3. For significant changes, we will provide advance notice through in-app notifications or email.
4. The revised Privacy Policy takes effect on the stated effective date.

## 16. Contact Us

If you have any questions about this Privacy Policy, or if you wish to exercise your rights regarding your personal information, please contact us at:

**Privacy Inquiry Contact**

- Service: Jstep-Go
- Operator: G.A.INFORMATION TECHNOLOGY AND SERVICES CO., LTD
- Representative: KATSUMOTO KENJI
- Address: 7 floor, Star Building, 33 ter - 33 bis Mac Dinh Chi street, Sai Gon ward, Ho Chi Minh city, Viet Nam
- Email: info@sotochika.com