Privacy Policy

1. Who is responsible for your data

Tempofin is a self-study platform for finance exams, starting with CFA® Level I. It is run from Vietnam by an individual business owner, who is the data controller. If you need the operator’s legal name, tax code and registered address, write to us and we will send them to you.

Contact for anything about your data: hotro@tempofin.study.

We have no office or appointed representative in the European Union or the United Kingdom. Write to us directly at the address above; we answer in English or Vietnamese.

Because we are based in Vietnam, we also handle personal data in line with Vietnam’s Personal Data Protection Law (Law No. 91/2025/QH15) and its implementing decree (Decree No. 356/2025/ND-CP).

2. What we collect

We aim to collect as little as we need. We do not ask for your date of birth, street address, national ID number or occupation.

Information you give us

• Account details: email address, full name, and a password (stored only as a one-way hash, which we cannot read).
• Contact details: your country. If you are in Vietnam, also a mobile phone number and the province and ward you live in (no street address). Outside Vietnam we do not ask for a province or ward, and a phone number is optional. We use these to contact you about your account or payments and to confirm you own the account when you ask for help.
• Exam settings: the exam you are preparing for, your exam date, minutes you plan to study per day, a study time and place if you set them, and your exam result if you choose to enter it.
• What you create: notes, flashcards you write yourself, and error reports on questions (the question ID and the reason you pick).
• Support requests: subject, message and the replies that follow.
• Purchases: the plan you request, any promotional code you enter and the price after discount.
• Marketing choice: whether you tick the box to receive monthly updates and offers, and when.

Information created as you study

• Each question you answer: the option you chose, whether it was right, and how long it took.
• Each study session: when it started and how many seconds you were actively working.
• Reading progress in each lesson, how long you spent, and when you first opened each lesson (the free plan uses this to count new lessons per day).
• Your mastery level for each topic, your flashcard review history and next review dates.
• A daily record of your estimated exam score, kept so it can later be compared with your real result.
• The times you reach a part of the app that your plan does not include, so we can set the free plan’s limits sensibly.
• Your time zone, the language you use Tempofin in (so our emails reach you in that language) and the date your account was created (the first 7 days of a new account include every feature).
• When you accepted this policy and which version.

Information from other sources

• Google, if you sign in with Google: your name, email address and profile picture.
• Our payment-notification provider (SePay), when you pay by bank transfer: the amount, time, transfer reference text, bank transaction ID and the receiving account. Depending on your bank, the reference text can include the sender’s name. We never receive your own account or card number.

Information collected automatically

• Cookies and similar technologies. See our Cookie Policy.
• For emails we send about your study (monthly updates and reminders), whether the email was opened and which button you clicked. We do not store your IP address or device for this. See section 4.
• How you use the app inside the learning area: which pages you open, which buttons you press, and the step where you stop or leave. We use this to find and fix the parts that are hard to use.
• Technical error reports (see Sentry in section 5). We have switched off screen recording and the sending of personal data with errors.
• Like every website, our hosting provider processes your IP address and basic request details to deliver pages and keep security logs.

What we do not do

• We do not sell or rent your personal data.
• We do not use third-party advertising trackers, and we do not load Google Analytics inside the learning area after you sign in.
• We do not record your screen.
• We do not send promotional email unless you ticked the box.
• We do not make decisions that have legal or similarly significant effects on you by automated means. Your study plan and exam-score estimate are learning aids, not decisions about you.

3. Why we use it, and our legal basis

If GDPR or UK GDPR applies to you, these are the legal bases we rely on.

• Running your account and the learning service (account details, answers, sessions, progress, mastery, flashcards, notes, exam settings, support): performance of our contract with you (Art. 6(1)(b)). Without this data the product would be just an e-book.
• Payments: performance of our contract with you, and compliance with legal obligations to keep accounting records (Art. 6(1)(b) and (c)).
• Improving content, in aggregate: finding questions that many learners get wrong in the same way (usually our mistake), finding lesson passages where readers stop, finding the parts of the app where learners get stuck or leave, and setting the free plan’s limits. Legitimate interests (Art. 6(1)(f)): keeping the content correct and the product fair. We look at these results across many learners, not to judge any one person.
• Following your progress to help you: the person who runs Tempofin can see each learner’s activity (for example whether you study regularly, whether you chose an exam, how long since you last came back) to decide when to check in or remind you of an exam registration deadline. We keep notes and a log of contact with you (email, calls, messages) and, if you tell us, where you heard about Tempofin and who referred you. Legitimate interests (Art. 6(1)(f)): helping learners who stall. You can object at any time (section 8).
• Reminder emails about your study (for example if you signed up but have not started, or have not returned for a while): legitimate interests (Art. 6(1)(f)). Every reminder has a link that switches reminders off. They count opens and clicks, as described in section 4.
• Monthly update emails, offers and promotions: your consent (Art. 6(1)(a)). The box is never pre-ticked. You can withdraw consent at any time (section 8) without affecting anything else.
• Security and preventing abuse (for example limits on how fast questions can be answered, and records of administrator actions): legitimate interests (Art. 6(1)(f)).
• Support, including AI-assisted replies: performance of our contract (Art. 6(1)(b)) and legitimate interests (Art. 6(1)(f)). Some replies are drafted by an AI assistant, and those replies are always labelled as AI. See Anthropic in section 5.
• Establishing or defending legal claims: legitimate interests (Art. 6(1)(f)).
• Counting which channels bring learners, in totals only: the first time you open one of our public pages we record where you came from (the link’s utm parameters, the domain of the referring page, the first page and when) in a cookie, and copy it to your account once if you sign up. Legitimate interests (Art. 6(1)(f)): knowing which channels are worth keeping. We use it only in totals across learners, never on your profile and never to contact you. You can refuse it on the Cookie Policy page (section 4) or object at any time (section 8).
• Analytics cookies: consent where the law requires it. Our English pages do not use analytics cookies. See the Cookie Policy.

4. Reminder and update emails

• Always sent when you ask for them: sign-in links and email verification links. These carry no open or click counter.
• Reminders about your study go to accounts with a verified email address: if you signed up and have not started, or if you have stopped studying for a while. We stop after a final message. Switch them off with the link at the bottom of any reminder.
• Monthly update emails go only to people who ticked the box, and only when there is something new to report. Unsubscribe from the link in the email or in your Account page.

Update and reminder emails include a tiny image and links that pass through our own server, so we can see, for each person, whether an email was opened and whether a button was clicked. We use this to learn which emails are useful. It does not store your IP address or device. Open counts are only an estimate (some mail apps load images automatically, and some block them).

5. Who receives your data

We use a small number of service providers to run the platform. They process data on our instructions and under their own terms.

• Supabase — database hosting (servers in Singapore).
• Vercel — runs the application.
• Sentry — records technical errors. Screen recording and personal data are switched off.
• Resend — sends our emails (sign-in links, verification, reminders, updates, support notifications, and the notice to us when you request a plan).
• ImprovMX — forwards email you send to our support address to the operator’s mailbox.
• Google (Gmail) — the operator’s mailbox: receives your emails and the plan-request notices, and is where we reply to you.
• SePay (Vietnam) — reads transfers into Tempofin’s bank account and tells our system so your plan can open automatically. It sees only transfers made to Tempofin.
• Anthropic (Claude) — an AI assistant that reads your support request and related account facts (plan, orders, amounts paid) to draft a reply. It cannot refund money, open plans or change accounts. Replies it writes are always labelled as AI.
• Zalo — if we message you for support through Zalo, the message passes through Zalo’s service.
• Google (sign-in) — only if you choose to sign in with Google.
• Google Analytics and Google Tag Manager — on our Vietnamese-language public pages only. See the Cookie Policy.
• Video embedded in a lesson, if any, loads from YouTube (privacy-enhanced mode) or Vimeo only after you press play.

We may also disclose data where the law requires it. We do not sell your data.

6. Transfers outside your country

Tempofin is run from Vietnam, our database is in Singapore, and our providers process data in other countries, mainly the United States, Japan and Europe. If you are in the EU, UK or another region with transfer rules, your data is therefore transferred outside your country.

These countries may not protect personal data in the same way as your own. Most of the providers listed in section 5 publish data processing terms that include safeguards for international transfers, such as the European Commission’s Standard Contractual Clauses.

Write to hotro@tempofin.study if you want to know which safeguards apply to a particular provider.

7. How long we keep it

• Account and learning data: as long as your account exists, including if you pause for months or retake the exam later. We do not delete an account just because it has been inactive. You can delete it yourself at any time (section 8).
• Unverified accounts: a new account must verify its email address. Accounts not verified after 3 days are permanently deleted (our daily clean-up job runs once a day, so this takes about 3 to 4 days).
• When you delete your account: the account is locked immediately. You have 30 days to change your mind by writing to us. After that we permanently delete your account and the learning data, support requests and notes attached to it (we run this deletion in batches, so it can take a little longer). An account that has made a payment is not removed by that batch, because its payment records must be kept: it stays locked and unused. Write to us if you want the remaining data on such an account erased, and we will do it by hand.
• Payment records: records of your orders, payments and the bank transactions that paid for them are kept after the account is deleted, for accounting and legal reasons. We keep them for as long as accounting and tax law requires (in Vietnam, generally 10 years).
• Backups and provider logs: copies in backups and in providers’ logs are overwritten or deleted on a rolling schedule, not at the moment an account is deleted.

8. Your rights, and how to use them

Depending on where you live, you can have some or all of the rights below. We will answer within one month. We may need to confirm you own the account first. Where a feature exists, use it. Otherwise write to hotro@tempofin.study.

• Access and portability: in the app, open Account and choose “Download your data” to get a JSON file with your account, exam settings, answers, sessions, mastery, reading progress, notes, flashcards, results you entered, plan and payment history, support requests and error reports. The file does not contain lesson text, question bodies or answers (that is our content, not your data). It also leaves out the operator’s notes and contact log about you — write to us to see those.
• Correction: in Account you can edit your name, country, phone number, province and ward. To change your email address, or anything else, write to us.
• Deletion: in Account choose to delete your account and type the confirmation phrase. See section 7 for what happens next and what we must keep.
• Withdraw consent to marketing: switch off “updates and offers” in Account, or use the unsubscribe link in any update email.
• Switch off study reminders: use the link at the bottom of any reminder email.
• Object or restrict: you can object to processing based on our legitimate interests (including the follow-up described in section 3), or ask us to restrict processing. There is no button for this yet; write to us.
• Complain: you may complain to the data protection authority where you live or work, or where you think a breach happened. In the EU the authority is your national or state data protection authority; in the UK it is the Information Commissioner’s Office. In Vietnam, the authority responsible for personal data protection is part of the Ministry of Public Security. We would be grateful for a chance to fix the problem first.

9. Children

Tempofin is made for adults preparing for professional exams. It is not directed at children, and we do not knowingly collect data from children below the age at which they can consent to an online service in their country. You must be at least 18 to create an account. If you think a child has given us data, write to us and we will delete it.

10. Security

Passwords are stored as one-way hashes. Traffic to the site is encrypted with HTTPS. Administrator actions on learner data are logged. Bank-transfer notifications are accepted only when they carry a valid signature from the provider. We do not store card or bank-account numbers. No system is perfectly secure, so please use a strong password. If a breach affects your rights, we will tell you and the authorities as the law requires.

11. Californian residents

This section applies to the extent the California Consumer Privacy Act, as amended by the CPRA, applies to us. In the last 12 months we have collected these categories of personal information, for the purposes in section 3: identifiers (name, email, country, phone, province and ward, account ID); internet and app activity (answers, sessions, reading progress, email opens and clicks); commercial information (plan requests, purchases); and the contents of your messages to support. The only information the CPRA treats as sensitive that we handle is your account log-in (email and a hashed password), which we use only to sign you in.

We do not sell your personal information and we do not share it for cross-context behavioural advertising. You have the right to know and access what we collect, to delete it, to correct it, to opt out of sale or sharing (not needed, since we do neither), to limit use of sensitive information (not needed), and not to be treated worse for using these rights. Use the same tools as in section 8, or write to hotro@tempofin.study. An authorised agent may write on your behalf with your signed permission.

12. Changes to this policy

We will post any change on this page and update the date at the top. If a change significantly affects how we use your data, we will ask you to read and accept the new version the next time you sign in.

A Vietnamese version of this policy is available at /vi/quyen-rieng-tu. If the two differ, the English version prevails, unless the law where you live says otherwise.

13. Contact

Questions, requests or complaints about your data: hotro@tempofin.study.