Privacy Policy

There are two different roles, which determine who you should contact:

• Your account data (email, name, password, signed-in devices) — Tilio decides how it is processed and acts as the data controller.
• Student data you enter (names, dates of birth, parent contacts, attendance, tuition) — you (the teacher or center) are the controller; we only store and process it according to your actions. Parents who want to access, correct or delete their child's information should contact the teacher or center directly.

Your account: email, username, full name, phone number, date of birth, avatar, recovery email, role and interface language. Passwords are never stored in readable form — only a bcrypt hash.

Business data you enter: classes, students (name, date of birth, phone, email, address, parent name, notes), sessions, attendance, grades, learning journals, tuition and payments, payroll, expenses, holidays and rewards.

Attachments: avatars, journal photos, expense receipts and reward images, stored in private storage and served only through short-lived signed links after an access check.

Security data: for each sign-in we record the device type, browser, operating system, IP address and user agent so you can review signed-in devices and sign them out remotely. An activity log records who changed which data and when.

• To provide the features you use: scheduling, attendance, tuition, payroll, receipts and online classrooms.
• To authenticate you and keep your session.
• To alert you about sign-ins from new devices and let you sign them out remotely.
• To keep an activity log so discrepancies can be traced.
• To process subscription payments and renewals.

We do not sell data, do not use your data or your students' data for advertising, and do not train artificial intelligence models on it.

If you choose these sign-in methods, we only receive and store your identifier at that provider, your email address, name and profile picture. We never receive your password for those services and do not access your contacts, posts or mailbox. You can unlink them at any time in Settings → Profile → Linked accounts.

When you choose to connect a calendar, we request permission to read and write calendar events and store access and refresh tokens:

• Scopes: https://www.googleapis.com/auth/calendar.events for Google, Calendars.ReadWrite for Microsoft.
• Data sent: session name, class name, start and end time, and session notes. Student names, grades and tuition are never sent.
• Google Meet rooms are created through a Calendar event on your Google account; we store the Meet link and event ID.
• Tilio only reads, updates or deletes events it created and linked to a session. Google Calendar and Outlook sync both ways for those events.
• Lesson-plan storage (only when the centre owner connects it): https://www.googleapis.com/auth/drive.file for Google Drive (Tilio only sees files it created or you picked), Files.ReadWrite for OneDrive. Tilio only writes inside the “TilioClass - Giáo án” folder and reads a file's content only when you choose to import a lesson plan from it.
• Disconnect at any time in Settings → Connected apps; the tokens are deleted from our system.

Tilio's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Tilio uses YouTube API Services so teachers can upload learning-journal videos to the center's own YouTube channel. This feature is optional and is only activated when the center owner clicks Connect on the YouTube card in Settings → Connected apps and authorizes Tilio on Google's consent screen. By using this feature you agree to be bound by the YouTube Terms of Service; videos on YouTube are also subject to the Google Privacy Policy.

• Permissions requested: https://www.googleapis.com/auth/youtube.upload (to upload videos to the channel) and https://www.googleapis.com/auth/youtube.readonly (to identify the selected channel and confirm that an uploaded video belongs to it).
• Data we receive and store: the YouTube channel ID and name, the email of the connected Google account, and OAuth access and refresh tokens. For each video attached to a journal we store the video ID, the video title and the link's review status.
• Data we send to YouTube: the video file chosen by the teacher, the title they enter, the fixed description “Tải lên từ TilioClass.” (“Uploaded from TilioClass.”), the Education category, the visibility (Unlisted or Private) and the “made for kids” setting. The video file goes directly from the browser to Google; it does not pass through or get stored on Tilio's servers. Tilio never sends student names, grades, tuition or other student data on its own; teachers should avoid putting a student's full name in the title.
• Data we read from YouTube: the channel details when connecting, and the channel ID, title and visibility of the video just uploaded, to confirm it belongs to the center's channel. Tilio does not read other videos, comments, subscribers, analytics or any other channel data, and does not edit or delete videos.
• How it is used and shared: videos live on the center's YouTube channel and are managed by the center in YouTube Studio. Unlisted videos can be watched by anyone with the link. A video link is shown to parents only after a teacher approves it and the center owner publishes it under the parent's video-sharing consent. YouTube data is not used for advertising, not sold and not shared with third parties. Tilio does not place YouTube cookies or trackers; YouTube only opens when a viewer clicks a video link.
• Protection: tokens are encrypted with AES-256-GCM before storage, decrypted only in server memory when calling the YouTube API, never sent to the browser and never written to logs.
• Deletion and revocation: tokens are deleted when the center owner clicks Disconnect on the YouTube card, when the Tilio account is deleted, or when Google reports that access was revoked (Tilio deletes the tokens on its next call). You can revoke Tilio's access at any time via the Google security settings page. Video IDs in journals are kept until you remove the link, delete the journal or delete your account; uploaded videos stay on the center's channel until you delete them on YouTube.

The Zoom integration is optional. It is only activated when the center owner clicks Connect Zoom in Settings → Connected apps and authorizes Tilio on Zoom's own consent screen.

• Permissions requested: user:read:user (to show which Zoom account is connected and whether it is licensed), and meeting:write:meeting, meeting:read:meeting, meeting:update:meeting, meeting:delete:meeting (to create, read, update and delete meetings that Tilio creates for your classes).
• Data we receive and store from Zoom: the Zoom user ID, account email and account type (Basic or licensed), OAuth access and refresh tokens, and the ID and join link of each meeting Tilio creates. The host start link is requested from Zoom each time a teacher clicks “Start class (host)” and is not stored.
• Data we send to Zoom: the meeting topic (session or class name), start time, duration, time zone and meeting settings. No student names, grades, tuition or other student data is sent to Zoom.
• What we do not access: recordings, transcripts, chat messages, meeting content, contacts, participant lists or any meetings not created by Tilio.
• How it is used: only to create online classrooms for your sessions, show the join link to your teachers and to parents in the parent portal, and let teachers start the meeting as host.
• Protection: tokens are encrypted with AES-256-GCM before storage, decrypted only in server memory when calling the Zoom API, never sent to the browser and never written to logs. Zoom data is not sold, not used for advertising and not shared with third parties.
• Retention and deletion: tokens are kept while the connection is active. They are deleted immediately when you disconnect Zoom in Tilio, when you remove the app from the Zoom App Marketplace (Zoom notifies us and we delete the connection automatically), or when you delete your Tilio account. Meeting links saved on sessions stay until you remove them or delete the sessions; meetings already created remain in your Zoom account, where you control them.

Step-by-step instructions for adding, using and removing the integration are in the Zoom integration guide.

• Infrastructure providers. Vercel hosts the application; Supabase provides the PostgreSQL database and private file storage. They process data only to provide infrastructure to Tilio.
• Services you connect. Google (including YouTube), Microsoft, Zoom and Zalo receive only the data described above, and only after you connect them.
• Links you share with parents. Receipt and parent portal links show only one student's information and can be revoked at any time.
• Email delivery. Verification, password reset and reminder emails are sent through our mail server.
• Legal requirements. We disclose data only when required by applicable law.

We do not embed third-party analytics, advertising or tracking tools — no Google Analytics, no Facebook pixel.

We only use strictly necessary cookies, never for tracking:

• tilio_session — keeps you signed in.
• tilio_otp — two-step verification step, lasts a few minutes.
• tilio_oauth_state, tilio_zoom_state — protect sign-in and app connections against forged requests, last 10 minutes.
• tilio_lang — remembers your interface language.

The application runs on Vercel. Data is stored in a PostgreSQL database managed by Supabase, and attachments in private Supabase storage buckets. Connections use TLS.

• Business data: kept until you delete it or delete your account.
• Activity log: entries older than 30 days are deleted automatically.
• Sessions: deleted when you sign out or revoke a device.
• Connected app tokens (Google, YouTube, Microsoft, Zoom): deleted when you disconnect or remove the app.
• Account deletion: all classes, students, sessions, attendance, tuition, attachments and connections are deleted and cannot be recovered.

Depending on where you live (including under the GDPR, Vietnam's Decree 13/2023/ND-CP on personal data protection and similar laws), you have the right to:

• Access and portability — download a full copy of your data in Settings → Profile → Download data (JSON).
• Rectification — correct any information directly in the app.
• Erasure — delete individual records or your whole account in Settings → Delete account.
• Withdraw consent — unlink sign-in providers or disconnect Google, YouTube, Microsoft or Zoom at any time in Settings; you can also revoke access at the provider (for Google and YouTube: Google security settings; for Zoom: App Marketplace → Manage → Added Apps → Remove).
• Restriction and objection — ask us to limit or stop a specific processing activity.
• Complaint — lodge a complaint with your local data protection authority.

How to exercise your rights: use the in-app tools above, or email support@tilioclass.com from your account email. We will verify your identity and respond within 30 days. Parents asking about a child's data should contact the teacher or center that entered it; we will assist the center in handling the request.

Passwords are hashed with bcrypt. Sessions are signed with a server secret and stored in HttpOnly, SameSite, secure cookies. OAuth tokens for Google (including YouTube), Microsoft and Zoom are encrypted with AES-256-GCM using a key kept in a secret server environment variable. We use HTTPS/TLS, server-side permission checks, private file storage, two-step verification, new sign-in alerts, fine-grained staff permissions and an activity log. No system is perfectly secure; please use a unique password and enable two-step verification.

Students do not have Tilio accounts, and Tilio (including the Zoom integration) is not intended to be authorized by anyone under 16. Information about students is entered by teachers or centers, who are responsible for obtaining parental consent where the law requires it. Students only open join links shared by their teacher.

Questions about this policy or your data: support@tilioclass.com · Support page.

When we make significant changes, we update the date at the top of this page and notify you in the app.