PRIVACY POLICY

Last updated: August 18, 2026

This Privacy Policy (the “Policy”) describes how KOKI SOFTWARE COMPANY LIMITED (“Koki”, “we”) collects, uses, stores, shares, and protects personal data when you use the koki.vn website, the Koki Flashcards application, and Koki's related products, features, or services (collectively, the “Services”).

Koki respects your privacy and undertakes to process personal data in accordance with Vietnamese law and the other legal requirements applicable to the Services.

To the extent that Koki determines the purposes and means of processing personal data, Koki assumes the responsibilities of a personal data controller, or of a personal data controller-processor, as provided by law.

Your use of the Services is not automatically treated as consent to every personal data processing activity. Where the law requires consent, Koki will provide the necessary information and obtain your consent for each applicable processing purpose.

1. Data we may collect

Depending on how you use the Services, Koki may collect and process the following categories of data.

1.1. Account data

When you register or use a Koki account, the data may include:

Email address
Name or display name
Account identifier
Information necessary to sign in and authenticate the account
Account status
User settings and preferences.

1.2. Flashcard content and learning data

Koki stores flashcard content and learning data on its servers in order to provide features such as storage, synchronisation, and use of the Services across multiple devices.

The data may include:

Decks
Questions and answers
Notes
Classification tags
Text and other content you create within flashcards
Study progress
Review history
Study results
Study settings
Information used to synchronise data across devices.

Koki's backend storage and processing infrastructure makes use of Amazon Web Services (AWS).

If you place your own personal data, or another person's personal data, into flashcard content, Koki may store that data as part of the content you create. You should not place another person's personal data into the Services unless you have an appropriate right or basis for doing so.

Koki does not actively require users to place sensitive personal data into flashcard content, except where a specific feature gives separate notice and there is an appropriate basis for processing.

1.3. Device and technical data

Koki or Koki's service providers may automatically receive certain technical information, such as:

Device type and model
Operating system and its version
Application version
Language
Time zone
IP address
Installation or device identifier
Advertising identifier, where permitted by law, by the operating system, and by device settings
Network information
Technical information necessary for operation, security, and error diagnosis.

1.4. Usage and diagnostic data

This data may include:

Screens or features used
Time and duration of use
Actions and interactions within the app or website
Performance data
Technical logs
Error and incident reports
Information relating to the installation, updating, or operation of the app.

Koki uses Firebase for certain technical, analytics, or app operation functions. The scope of data Firebase processes depends on the Firebase services Koki enables and configures at any given time.

1.5. Order data

When you purchase a service plan, a redemption code, or another product on Koki's website, we may process:

Full name
Email address
Phone number, if you provide one or if it is necessary for the transaction
Order code
The plan or product selected
The order value
The time the order was created
Payment status
Order status
The redemption code or the information needed to provide the entitlement
Information necessary for support, reconciliation, accounting, and complaint resolution.

1.6. Transaction and payment reconciliation information

For payment by bank transfer, the transaction is carried out through your bank or banking application.

Koki does not ask you to provide banking passwords, PINs, OTPs, CVV codes, or similar banking authentication details.

In order to confirm and reconcile a transaction, Koki may receive or process certain information appearing in transaction notifications, statements, or reconciliation data provided by the bank, such as:

The name of the payer, where displayed
The amount
The transaction time
The transfer reference
The transaction code
Reference information necessary for reconciliation.

For in-app purchases, payment is handled by the Apple App Store, Google Play, or the corresponding distribution platform. Koki may receive transaction confirmation information, the transaction code, the product purchased, the transaction status, or similar information necessary to confirm your entitlement to the Services, but does not directly receive your full payment card details.

1.7. Advertising data

Koki Flashcards uses Google AdMob to display and measure advertising.

Depending on device settings, the user's privacy choices, the advertising configuration, and legal requirements, Koki and Google AdMob may process information such as:

The number of times an advertisement is displayed
The number of clicks or interactions with an advertisement
The advertising identifier
Device information
IP address
Information about consent to, or refusal of, personalised advertising
Technical signals necessary to serve, measure, secure, or prevent fraud in advertising.

Personalised advertising is applied only to the extent permitted by law and by the user's choices.

1.8. Support and complaint data

When you contact Koki by email, we may retain:

Your name, if provided
Email address
Related account information
The content of the correspondence
Screenshots, files, or information you choose to send
Related order or transaction information
The history of handling the request, feedback, or complaint.

2. Sources of data

Koki may receive personal data:

Directly from you
Automatically from the website, app, or device when you use the Services
From the Apple App Store, Google Play, or an app distribution platform
From a bank or a relevant service provider, to the extent necessary to confirm and reconcile a transaction
From Google AdMob, Firebase, AWS, and technical providers, to the extent necessary to provide and operate the Services
From other sources where you permit it or where the law permits.

3. Purposes for which we use data

Depending on the type of data, Koki may use personal data to:

Create, authenticate, and manage accounts
Provide the features of Koki Flashcards
Store flashcard content on servers
Synchronise learning data across devices
Record and display study progress
Maintain and improve the operation of the Services
Process orders
Confirm and reconcile payments
Deliver the redemption code, service plan, or entitlement purchased
Send notifications relating to transactions, accounts, or important changes to the Services
Provide customer support
Receive and resolve feedback, requests, and complaints
Detect, prevent, and address errors, fraud, abuse, or conduct affecting the safety of the Services
Protect Koki accounts and systems
Analyse how the Services are used in order to improve quality and performance
Measure and operate advertising
Display contextual or personalised advertising where permitted
Comply with accounting, tax, and other legal obligations
Establish, exercise, or defend the lawful rights and interests of Koki or others where the law permits
Comply with lawful requests from competent state authorities.

Koki does not use personal data for a new purpose incompatible with the notified purpose without first completing the steps required by law.

4. Bases for processing, and consent

Koki processes personal data on one or more bases available under applicable law, including:

Your consent, where the law requires it
Performance of a transaction, agreement, or provision of the Services that you request, where the law permits
Compliance with a legal obligation
A lawful request from a competent state authority
Other cases in which the law permits personal data to be processed without consent.

Where consent is the basis for processing:

The content of the consent will be clear and verifiable
You will be given the necessary information about the processing activity
Consent is determined for each applicable purpose
Koki does not treat silence or non-response as consent
You have the right to withdraw consent in accordance with the law.

Withdrawing consent does not affect the lawfulness of processing carried out before the withdrawal request takes effect.

In some cases, if the data is necessary to provide a feature or carry out a transaction you have requested, refusing to provide it or asking us to stop processing it may mean that Koki cannot continue to provide the corresponding feature or service.

5. Google AdMob, Firebase, and Amazon Web Services

5.1. Google AdMob

Koki uses Google AdMob to serve and measure advertising within the app.

AdMob may process device data, IP addresses, advertising identifiers, and advertising interaction data, according to the configuration, the user's privacy choices, and Google's policies.

5.2. Firebase

Koki uses Firebase for technical, analytics, operational support, or app diagnostic functions.

Depending on which Firebase services are enabled, Firebase may process technical data, device information, usage data, in-app events, and diagnostic data.

5.3. Amazon Web Services (AWS)

Koki uses AWS as part of its server infrastructure and backend data storage.

Flashcard content and data relating to accounts, learning, or the operation of the Services may be stored or processed on AWS infrastructure according to Koki's system configuration.

5.4. Providers' own policies

Google and AWS are independent service providers with their own privacy policies, terms, and security standards.

To the extent Koki engages providers to process data on its behalf, Koki applies appropriate management measures and agreements as required by law.

6. Cookies and similar technologies

The Koki website may use cookies, local storage, identifiers, or similar technologies in order to:

Maintain sign-in sessions
Remember preferences
Secure the website
Measure usage activity
Analyse performance
Support the website's necessary functions.

The mobile app may use device identifiers, installation identifiers, or similar technologies instead of traditional cookies.

You can control some of these technologies through your browser settings, device settings, operating-system privacy preferences, or the choice mechanisms shown within the Services.

Disabling certain necessary cookies or technologies may affect the ability of some features to function.

7. Sharing, and who may access data

Koki shares or permits access to personal data only to the extent necessary for the purposes described in this Policy, or where the law permits.

The organisations and individuals who may access data include:

7.1. Authorised Koki personnel and departments

Only personnel and departments that need access to data to perform their assigned duties may access data, and only to the appropriate extent.

7.2. Infrastructure and technical providers

Including Amazon Web Services (AWS) and technical providers supporting system operation where necessary.

7.3. Google

Including Google AdMob and Firebase, to the extent necessary for the advertising, analytics, operational, and technical functions Koki uses.

7.4. Apple and Google Play

In-app purchase information may be exchanged with Apple or Google to the extent necessary to confirm the transaction and the entitlement.

7.5. Banks and parties involved in transactions

Necessary information may be exchanged with a bank or a relevant provider in order to verify, reconcile, or process a transaction.

7.6. Competent state authorities

Koki may provide data upon a lawful request or where the law requires.

7.7. Corporate transactions

In the event of a reorganisation, merger, consolidation, transfer of operations, or another corporate transaction, data may be transferred to the extent permitted by law and with appropriate safeguards.

8. Koki does not sell personal data

Koki does not sell users' personal data to third parties.

Koki's use of Google AdMob, Firebase, AWS, or other providers for advertising, analytics, storage, or operation of the Services does not mean that Koki sells personal data to those providers.

9. Cross-border transfers of personal data

Some of Koki's service providers, including Google and AWS, may use systems, servers, or personnel located outside Vietnam, depending on the service and the technical configuration.

Accordingly, in some cases personal data collected in Vietnam may be:

Stored on systems located outside Vietnam
Transferred to organisations or individuals abroad
Processed through platforms or infrastructure located outside Vietnam.

Where such activity constitutes a cross-border transfer of personal data under the law, Koki will carry out the measures, documentation, and procedures required by law.

10. Data retention periods

Koki retains data for as long as necessary for the purposes of processing, except where the law requires or permits continued retention.

Retention periods are determined according to the following principles.

10.1. Account, flashcard, and learning data

Retained while the account is active, or for as long as necessary to provide the Services.

Where an account is validly deleted, the related data will be deleted, destroyed, or de-identified in accordance with Koki's procedures, except for data that must continue to be retained under the law or that falls within a case in which the law permits a deletion request not to be carried out.

10.2. Order and transaction data

Retained for as long as necessary to:

Confirm and perform the transaction
Support customers
Reconcile payments
Resolve disputes
Prevent fraud
Comply with accounting, tax, and related legal obligations.

Data that must be retained under accounting, tax, or sector-specific rules will be retained for at least the period the law requires, even after the app account has been deleted.

10.3. Support, feedback, and complaint data

Retained for as long as necessary to handle the request, feedback, complaint, or dispute, and for a reasonable period after the matter closes, in order to protect the lawful rights and interests of the parties or to comply with legal obligations.

10.4. Technical, analytics, and advertising data

Retained for as long as necessary for operational, analytics, security, measurement, or advertising purposes, which may depend on the retention configuration of Koki or of the relevant service provider.

10.5. Backups

Some data for which deletion has been requested may remain temporarily in backups until the backup is overwritten or its normal retention cycle ends.

Data in backups is not reused for ordinary business purposes after a deletion request has been carried out, except where necessary to restore systems or where the law permits.

11. Data protection measures

Koki applies management and technical measures appropriate to the nature of the data and the level of risk, in order to reduce the risk of:

Unauthorised access
Unauthorised use
Unauthorised disclosure
Unauthorised alteration
Loss, destruction, or damage of data
Misappropriation of data.

The protective measures may include:

Using secure connections when transmitting data
Access control and permission management
Limiting the personnel able to access data
Authentication mechanisms for administrative systems
Logging and monitoring system activity where appropriate
Data backup and recovery
System updates, patching, and protection
Managing service providers' access rights
Encryption or other technical protection measures where appropriate
Procedures for receiving and handling data security incidents.

No electronic system can be guaranteed absolutely secure. Where an incident or breach involving personal data is detected, Koki will take containment and remedial measures and give notifications as required by law where applicable.

12. Your rights over your personal data

To the extent provided by applicable law, you may have rights such as:

To be informed about personal data processing activities
To consent or refuse consent to processing that requires consent
To withdraw consent
To access your personal data
To correct, or request correction of, your data
To request the provision of your personal data
To request deletion of data
To request restriction of processing
To object to processing as provided by law
To request the application of personal data protection measures
To complain, report, bring legal proceedings, or claim compensation as provided by law.

Some rights may be limited where the law permits or requires Koki to continue processing data, for example to comply with legal, accounting, or tax obligations, to resolve disputes, to prevent fraud, or to comply with a lawful request from a competent state authority.

13. How to access, correct, and request correction of data

For information the Services allow you to manage yourself, you can view or edit it directly in the corresponding account or settings area.

For requests you cannot carry out yourself, you may email:

Email: support@koki.vn

Suggested subject line: Personal data request

Your message should include:

The email address or Koki account concerned
The type of request you wish to make
The information Koki needs to identify the relevant data.

To prevent another person from making a fraudulent request to access or change data, Koki may require reasonable identity verification before acting.

Koki does not ask you to provide passwords, banking OTPs, or unnecessary authentication details in order to carry out a request.

14. How to request deletion, destruction, or restriction of processing

You may send a request to delete, destroy, restrict processing, withdraw consent, or object to processing to:

Email: support@koki.vn

Suggested subject line: Personal data request

Koki will:

Receive the request
Verify identity or authority to make the request where necessary
Identify the relevant data and processing activities
Carry out the request to the extent provided by law
Notify the outcome, or the reason the request cannot be carried out in whole or in part.

Koki may continue to retain or process certain data where the law requires or permits, for example data relating to accounting, tax, disputes, fraud prevention, or other legal obligations.

15. Time limits for handling personal data rights requests

Once a properly submitted request is received, Koki applies the following time limits under personal data protection law:

Type of request	Initial response	Standard time to comply	Where coordination with a processor/third party is needed
Withdrawal of consent, restriction of processing, objection to processing	2 business days	15 days	20 days
Access, correction, request for correction, or provision of data	2 business days	10 days	15 days
Deletion of data	2 business days	20 days	30 days
Request to apply data protection measures or solutions	2 business days	15 days	As applicable under the law

Where a request is complex and the law permits an extension, Koki may extend the period as provided by law and will notify you of the reason for the extension.

The time limits apply on the basis that Koki has received a properly submitted request together with the information necessary to verify the requester and the scope of the request.

16. Account deletion

If Koki Flashcards provides an account deletion function directly in the app or on the website, you can follow the instructions shown there.

You may also send an account deletion request to:

Email: support@koki.vn

Suggested subject line: Account deletion request

Deleting an account may result in loss of access to:

Flashcard content stored on the servers
Learning data
Progress
Synchronised content
Features or data attached to the account.

Once a valid request has been verified, Koki will delete, destroy, or de-identify the data within the scope permitted to be deleted.

Deleting an account does not mean all data is deleted immediately. Koki may continue to retain data that:

Must be retained under the law
Is necessary for accounting or tax purposes
Is necessary to resolve disputes or complaints, or to prevent fraud
Falls within a case in which the law permits a deletion request not to be carried out
Remains temporarily within the normal backup cycle.

17. Feedback, requests, and complaints about information security and personal data

If you believe your personal data has been collected, used, disclosed, stored, or protected inappropriately, you may send feedback, a request, or a complaint to:

Email: support@koki.vn

Suggested subject line: Personal data complaint

Koki will:

Receive the matter by email
Acknowledge and classify the request
Ask for additional information or identity verification where necessary
Examine the data, systems, and related information
Coordinate with service providers if needed
Notify the outcome or the intended course of action by email.

For general feedback, requests, or complaints relating to accounts, orders, payments, refunds, technical faults, or the Services, Koki applies the “Methods for Receiving and Resolving Feedback, Requests, and Complaints” published separately on the koki.vn website.

Publishing the general complaints policy separately does not limit your personal data rights or the handling time limits set out in this Privacy Policy.

18. Children's privacy

Koki Flashcards is a learning application and may be used by users of many ages.

For users who are children under Vietnamese law, Koki applies age-appropriate protective measures and gives priority to protecting the best interests of the child when processing personal data.

Where the law requires the consent of a parent, guardian, legal representative, or of the child themselves for a specific processing activity, Koki will obtain the appropriate consent before carrying out that activity.

Koki does not actively require children to provide personal data beyond what is necessary to use the Services.

A parent, guardian, or legal representative may contact Koki at support@koki.vn if they believe a child's personal data is being processed inappropriately, or if they wish to exercise a right provided by law.

Once the request has been verified, Koki will take the appropriate measures as provided by law.

19. Third-party services and content

The Services may contain links or connections to third-party services.

When you leave Koki's Services or use a third party's product directly, that party's collection and processing of data may be governed by their own privacy policy and terms.

Koki recommends reviewing the third party's policy before providing data directly to them.

20. Changes to this Privacy Policy

Koki may update this Policy where:

The Services or their functions change
The methods of data processing change
The service providers change
Legal requirements change
Strengthening the protection of users' rights is needed.

The updated version will be published on the website or in the app and will state the date of the update.

If a change gives rise to a new processing purpose requiring consent under the law, Koki will give notice and obtain the appropriate consent before applying it to the data concerned.

21. Related policies

In addition to this Privacy Policy, Koki may publish separate policies and conditions applying to particular aspects of the Services, including:

The Methods for Receiving and Resolving Feedback, Requests, and Complaints
The Terms of Service or transaction conditions
The Payment Policy
The Service Termination and Refund Policy
Other policies published on koki.vn.

Where content relates directly to the protection of personal data, this Privacy Policy and personal data protection law apply accordingly.

22. Contact information

Any question, request, or complaint relating to this Policy or to the processing of personal data may be sent to:

KOKI SOFTWARE COMPANY LIMITED

Address: No. 6, Alley 35, Ngo Thi Sy Street, Ha Dong Ward, Hanoi City, Vietnam

Tax ID: 0111043866

Email: info@koki.vn

Website: https://koki.vn