Privacy Policy
Version 1.1 · Effective
Texva is a tool for creating teaching materials. This policy explains what data of yours we hold, why, who we pass it to, and what rights you have.
We write in plain language and avoid jargon where we can. The Vietnamese and English versions are both originals and carry equal weight. Other languages in the app are reference translations.
1. Who is responsible for your data
| Operator | The Texva team |
| Address | Hanoi, Vietnam |
| Privacy contact | privacy@texva.app |
We act in two different roles — and the difference matters
For you, the Texva account holder (teacher, lecturer, author): we are the data controller. We decide what we collect and how we use it. This whole policy applies to you.
For your students — people who join a class with a class code and complete work inside Texva: you or your school are the controller, and we are only the processor. We handle student data on your instructions and not for our own purposes. That relationship is set out in Terms of Service section 7, not in this document. Schools that need a signed Data Processing Agreement can write to privacy@texva.app.
Put plainly: you decide about student data, we only hold it for you. Anyone with a question about student data should ask the school first, not us.
2. What we collect
2.1 What you give us
| Category | Specifically | When |
|---|---|---|
| Account | Email, hashed password, display name | At sign-up |
| Google sign-in | Google identifier, email, name, avatar | If you choose Google sign-in |
| Profile | Username, short bio, language, timezone | When you fill it in |
| Content | Documents you write, figures, exams, lessons, and their earlier versions | As you work |
| Uploads | Images, fonts and files you place in documents | When you upload |
| AI conversations | What you send the AI assistant and what it replies | When you use AI features |
| Payments | Plan, billing period, amount (VND), order code, status | When you buy a plan |
| Contact | What you send through the contact form | When you send it |
We do not collect: card numbers, date of birth, national ID numbers, phone numbers, location, health data, or biometric data.
2.2 What using the service generates
Technical logs (IP address, browser type, timestamp, path, error codes) — needed to run the service, prevent abuse and diagnose faults. AI and compilation usage counts, to enforce quotas.
2.3 We do not track you
Texva runs no Google Analytics, Google Tag Manager, Meta Pixel, PostHog, Mixpanel, Plausible, Clarity or any other measurement tool. No advertising tags. No behavioural profiles. We do not sell data — not ever, not to anyone.
3. What we use it for, and on what legal basis
| What we do | Why | Legal basis (GDPR Art. 6) |
|---|---|---|
| Create and maintain your account, sign you in | Without it there is no service | Performance of a contract |
| Store, sync and recover documents | This is the service | Performance of a contract |
| Compile documents to PDF | This is the service | Performance of a contract |
| Run AI features when you ask | You actively click | Performance of a contract |
| Take payment, issue records | You bought a plan | Contract + legal obligation |
| System email (verification, password reset, alerts) | Needed for account safety | Performance of a contract |
| Prevent abuse, rate limiting, fraud prevention | Keeps the service working for everyone | Legitimate interests |
| Diagnose faults, improve reliability | The product has to work | Legitimate interests |
| Email about new features | Only if you separately opt in | Consent |
Under Vietnamese law these correspond to processing to perform our contract with you, to meet legal obligations, and — for anything marked "Consent" — only after you have consented. You may withdraw consent at any time, without affecting processing already carried out lawfully.
4. AI features — what to know before you click
When you use the AI assistant, AI exam generation, or AI marking, the relevant content is sent to an external AI model provider for them to process and return a result. This is unavoidable: the model runs on their infrastructure, not on your machine.
The rules we set ourselves:
- AI never runs on its own. No AI feature reads your documents in the background. Only when you click.
- We send only what that request needs, not your whole library.
- We do not use your content to train models, and we choose zero-retention options at the provider where they offer them.
- If you would rather not, don't use the AI features — the rest of Texva works exactly the same. No AI feature is enabled by default in the background.
AI output can be wrong. Questions, answer keys, worked solutions and marks produced by AI must be checked by you before they reach students. See Terms of Service section 6.
AI marking: when you enable it, student work is sent to an AI provider. Because students are often children, we treat this as your decision as controller — you must be satisfied the school has a lawful basis for it. AI-suggested marks are not final marks; a teacher still has to review and decide.
5. Who we share with
We do not sell data. We share only with the service providers Texva needs to run:
| Provider | Used for | What passes through |
|---|---|---|
| Cloudflare (R2, hosting) | File storage, serving the app | Uploads, compiled PDFs |
| Google sign-in; push notifications; Gemini models | Account identifiers; what you send to AI | |
| OpenAI, Anthropic, DeepSeek, OpenRouter | AI models | What you send to AI |
| Amazon Web Services (SES) | Sending system email | Email address, message content |
| SePay, MoMo | Taking payment | Order code, amount, status |
| Server hosting provider (VPS) | Servers and database | All service data |
Separately, some content is loaded directly by your browser from outside servers — fonts, the push notification library, and citation lookups when you search for one. Those servers see your IP address even though we send them nothing. They are: Google Fonts (fonts in the editor and on published pages), Firebase (push notifications, only if you turn them on), jsDelivr (formula styles in HTML export), packages.typst.org (Typst packages), and Crossref and Zotero (citation lookup, only when you search).
We update the list on this page before bringing in any new provider that touches personal data.
We may also disclose data in response to a lawful request from a competent authority. We check each request for validity and notify you unless legally prohibited from doing so.
6. Data leaving Vietnam
The providers in section 5 host outside Vietnam. Your data will be transferred abroad — principally to the United States and other countries where those providers operate infrastructure. DeepSeek in particular is a provider based in China; you can choose a different AI model if you prefer not to use it.
For these transfers we maintain a cross-border personal data transfer impact assessment as required by Vietnamese law. For users in the European Economic Area and the United Kingdom we rely on the European Commission's Standard Contractual Clauses.
7. Cookies and data stored on your device
Texva uses no cookies. No login cookies, no tracking cookies, no advertising cookies. That is why you will not see a cookie banner here — not because we forgot, but because there is nothing to ask you about.
We do keep some things in your browser's local storage, all of them serving features you are using. The main ones:
| What | Why |
|---|---|
texva_token | Keeps you signed in (one hour, renewed automatically). Cleared when you sign out. |
texva_refresh | Renews that sign-in so you are not signed out every day. Cleared when you sign out. |
i18nextLng | Remembers your chosen language |
mantine-color-scheme-value | Remembers light/dark appearance |
oauth_redirect_to | Returns you to the right page after Google sign-in |
Separately, so you don't lose work when your connection drops, your browser holds local drafts, answer photos and unsent handwriting in IndexedDB. This data sits on your machine and is not sent to us until you save or submit. Clearing your browser's site data deletes it.
The rest is the editor's working state — display preferences, unsaved drafts, the name you typed to join a class — all prefixed texva, and none of it is ever used for tracking.
8. How long we keep things
| Type | Period |
|---|---|
| Account and content | Until you delete your account |
| Documents you deleted | In trash until you delete permanently |
| After you request account deletion | 30-day grace period to change your mind, then deleted |
| Technical logs | Up to 30 days |
| AI conversations | Until you delete the conversation or your account |
| Payment records | 10 years, as required by Vietnamese accounting law |
| Class data and student work | As instructed by the school — see the [DPA |
The accounting exception is a real exception: even after you delete your account, invoices and payment records must be retained by law. They keep only the minimum transaction details.
9. Your rights
Under Vietnamese personal data protection law — and under the GDPR if you are in the EEA/UK — you have the right to:
- Be informed about what we process
- Access and receive a copy of your data
- Correct inaccurate data
- Delete your data and account
- Restrict or object to processing
- Take your data with you in a machine-readable format
- Withdraw consent you previously gave
- Complain to a supervisory authority
How to exercise them
Editing your profile, changing your password, deleting documents: do it directly in the app.
Downloading your data and deleting your account: do it yourself on the Account & data page. “Download my data” builds a JSON file with every piece of personal information we hold about you, and downloads every project as a .texva package. “Delete account” closes the account immediately; for the next 30 days you can sign in again to restore it, after which the account and its projects, classes and uploads are permanently deleted (except payment records — see section 8).
For everything else, email privacy@texva.app from the address on your account. We may ask a follow-up question to confirm it is really you — not to obstruct you, but so nobody else can obtain your data by impersonating you.
We respond within 72 hours to access and correction requests, as Vietnamese law requires. For users in the EEA/UK the outer limit is one month under the GDPR. Free of charge.
If you are unhappy with how we handle it, you may complain to the Department of Cybersecurity and High-Tech Crime Prevention (A05), Ministry of Public Security in Vietnam, or to the data protection authority where you live if you are in the EEA/UK.
10. Children and students
Texva accounts are for people aged 16 and over. We do not knowingly collect data from children under 16 to create accounts.
But students who join with a class code are frequently children, and we know it. How we handle that:
- Joining a class needs no account and no email address. The only thing we hold is a display name the student types themselves — which can perfectly well be a nickname.
- We do not ask for age, date of birth, phone number, or school details. What we don't hold, we can't leak.
- No tracking, no advertising, no behavioural profiling of students — same as for everyone else.
- We do not use student work to train AI models.
- Answer photos and handwriting are held in a separate store, reachable only through a permission check, never on a public path.
Obtaining parent or guardian consent is the school's or teacher's responsibility, not ours — they have the real relationship with the family, and we do not. This is a binding commitment in Terms of Service section 7.
If you are a parent who wants to see or delete your child's data: contact the school first. If that does not work, email us at privacy@texva.app and we will work with the school to resolve it.
11. What to know about files you upload
Images and files you place in documents are served from a public path so documents load quickly. That means anyone with the exact URL can view the file, even without an account. The URLs are very hard to guess, but that is not the same as access control.
We tell you this outright rather than letting you discover it: do not place images containing other people's private information — mark sheets with full names, identity documents, personal photographs — into documents.
Student answer photos in exam rooms are not in this category; they are held in a separate store and always go through a permission check.
12. Security
Passwords are hashed, never stored readably. All connections use HTTPS. Document access is checked server-side on every request. Exam answer keys are held in a store separate from the questions, so that a single programming error is not enough to expose them.
No system is perfectly secure. If a data breach occurs that is likely to affect you, we will notify the competent authority and you within 72 hours of becoming aware of it.
13. When this policy changes
Every version carries a version number and effective date at the top of the page.
Minor changes: we update the document and record it in the history. Significant changes — collecting a new category of data, using it for a new purpose, adding a provider that touches personal data: we give at least 30 days' notice by email or in-app, and ask for consent again where the law requires it.
14. Contact
Any question about personal data: privacy@texva.app
Address: The Texva team, Hanoi, Vietnam