Privacy Policy for Smartie TV

1. Introduction & Scope

IIT JSC ("we", "us", "our", or "IIT") is committed to protecting the privacy and data security of users, students, teachers, educational institutions, and families who use the Smartie interactive TV learning application (the "Application" or "Service").

This Privacy Policy explains the nature, scope, purpose, and security measures regarding any data processed through the Application on connected TV platforms, including Android TV / Google TV (Google Play), LG webOS, and Samsung Tizen.

2. Information We Collect and Process

Smartie operates as an educational client designed for institutional classrooms and home study. We adhere strictly to data minimization principles:

A. Device Identification & Licensing Data

• Device Identifier: A unique hardware-derived string (e.g., ANDROID_ID on Android TV devices, or platform DUID on Smart TVs).
  Purpose: Used exclusively to validate active educational licenses, manage seat allocations, and enable QR-code mobile-to-TV pairing.
  Storage: Stored in volatile runtime memory and secure device local storage.
• Session Tokens: Cryptographic JSON Web Tokens (JWT) used to maintain authenticated sessions with our backend API. Access tokens are kept in memory only; refresh tokens are securely persisted on the local device.

B. Educational Activity & Learning Progress

• Learning Logs: Subject topic completion, practice quiz scores, and student interactions with educational curriculum materials.
• Playback Telemetry: Media playback timestamps and resume points to allow students to continue video and audio lessons where they left off.

C. Technical Diagnostics & Error Logs

• Non-identifying operational telemetry (such as crash logs, HTTP response error codes, and network reachability status) to detect platform-specific rendering anomalies and ensure stable TV playback.

D. Information We DO NOT Collect

• NO Government Identification or Financial Details: We do not collect credit cards, banking information, or national identity numbers.
• NO Geolocation Tracking: We do not collect or monitor GPS or real-time location data.
• NO Biometric or Facial Recognition: We do not capture or process biometric records.
• NO Background Sensor / Media Access: The Application does not access device microphones, cameras, contacts, or local personal media libraries.

3. How We Use Collected Information

We process collected information strictly for legitimate educational and technical purposes:

• License & Device Authentication: Authenticating device bindings and managing institutional school subscriptions.
• Curriculum & Content Delivery: Synchronizing textbooks, interactive exercises, video lectures, and learning resources.
• Session Continuity: Retaining user progress across sessions and handling seamless token rotation.
• App Quality & Performance: Diagnosing platform-specific bugs and maintaining high-performance spatial navigation on TV hardware.

4. Google Play Data Safety Commitments

Security Measures:

• Encryption in Transit: All network requests to backend services use industry-standard HTTPS / TLS 1.3 encryption.
• Strict Network Policy: Cleartext HTTP traffic is disabled by default (usesCleartextTraffic = false).
• Memory-Safe Token Management: Short-lived access tokens reside solely in volatile memory; refresh tokens are rotated via single-flight authenticated endpoints.

5. Third-Party Sharing & Commercial Advertising

• Zero Commercial Ads: Smartie contains NO advertisements, banner ads, interstitial videos, or commercial ad networks.
• No Third-Party Trackers: We do not integrate third-party ad SDKs, analytics brokers, or cross-app tracking beacons.
• No Data Selling: We will never sell, rent, monetize, or disclose user data or student records to any third party for commercial or marketing purposes.

6. Children's Privacy & Families Policy Compliance (COPPA / GDPR-K)

Because Smartie is utilized in educational environments as well as households with children:

• We comply strictly with the Children’s Online Privacy Protection Act (COPPA), the EU General Data Protection Regulation (GDPR-K), and the Google Play Families Policy.
• The Application does not solicit or collect personal contact information from children under the age of 13.
• All educational tools, learning materials, and interactive content are designed to be safe, non-commercial, and family-friendly.
• Parents, guardians, and school administrators retain full control over device bindings and data deletion.

7. Data Retention and Deletion (User Rights)

• Retention Period: Device identifiers and learning records are retained only for the duration of the active school license or user subscription.
• Device Deactivation: Users can release device licenses at any time directly within the TV UI (Settings > Deactivate Device).
• Data Deletion Requests: Educational institutions, teachers, parents, and users may request the permanent deletion of their account records, device bindings, or progress logs by emailing info@iit.vn with the subject line "Data Deletion Request". Requests are verified and processed within 30 days.

8. Contact Information

For any inquiries, feedback, or data privacy requests, please contact our Data Protection Office:

• Company: IIT JSC (Công ty Cổ phần IIT)
• Official Website: https://iit.vn
• Contact Email: info@iit.vn
• Country: Vietnam