Privacy
Effective / published version: 2026-09-19
_Last updated: 22 April 2026_ 1. INTRODUCTION LearnSys EduFlow (operated by LearnSys, Hong Kong) is committed to protecting the privacy and personal data of our users. This Privacy Policy describes how we collect, use, store, disclose, and safeguard personal data when you use our platform at hk.learnsys.org (the "Service"). This policy is designed to align with the Personal Data (Privacy) Ordinance (Cap. 486) of Hong Kong ("PDPO") and relevant Education Bureau (EDB) guidance for schools. 2. DATA WE COLLECT a) Account information: full name, email address, display name, encrypted password, organisation (school), role, language preference. b) Usage information: pages visited, features used, submission timestamps, browser type, IP address, session identifiers. c) Educational content: class lists, assignment submissions, teacher feedback, AI-generated artefacts (lesson plans, worksheets, quizzes), and documents uploaded to the Vault. d) AI interaction data: chat messages, prompts, generated responses, token usage, model used. e) Communications: support requests, invitation records, audit log entries. We do NOT collect: government ID numbers, bank/credit card details (billing is handled by Stripe), location tracking, biometric data. 3. HOW WE USE YOUR DATA - To provide core platform features (class management, assignments, AI assistant, vault). - To authenticate users and authorise access based on role and tenant membership. - To generate educational artefacts on teacher request. - To deliver notifications (in-app, and via email when you opt in). - To comply with legal obligations and respond to lawful requests. - To improve platform reliability and detect fraud or abuse. We do NOT sell, rent, or trade your personal data to third parties. 4. AI PROCESSING AI features (chat, marking assistance, content generation) may send your prompt content to upstream AI providers for processing. We do not permit providers to retain your data for model training. Teachers always remain the final reviewer of AI-generated output. For detailed AI controls, see our AI Usage Policy. 5. DATA STORAGE AND SECURITY - Data is stored in encrypted databases hosted in Hong Kong and neighbouring regions. - Uploaded files are stored in object storage with tenant isolation. - Passwords are hashed using industry-standard algorithms (Argon2id). - Access is restricted by role-based access control (RBAC) and audit logged. - All connections use TLS 1.2 or higher. 6. DATA SHARING Your data may be shared only with: - Your school administrators and assigned teachers within the same tenant. - Sub-processors acting on our behalf (email delivery, AI inference, object storage, payment processing). - Authorities when required by valid legal process. 7. YOUR RIGHTS Under the PDPO, you have the right to: - Access your personal data. - Request correction of inaccurate data. - Request deletion of your account and associated data. - Withdraw consent for optional processing (e.g. email marketing). To exercise these rights, contact [email protected]. 8. COOKIES AND LOCAL STORAGE We use first-party cookies for session management, language preference, and tenant context. No third-party advertising trackers are used. 9. CHILDREN The Service is intended for use by students through schools. Students below the age of majority may only use the platform under a school account with parental/guardian awareness, as arranged by the school. 10. CHANGES We will notify schools of material changes to this policy via email and in-app notice at least 14 days before taking effect. 11. CONTACT Privacy queries: [email protected] Support: https://hk.learnsys.org/contact-support