Privacy Policy

1. Who we are

RelaxTrain provides maths practice and performance analysis for tutoring centres and schools in Hong Kong. This policy explains how we collect, use, store and protect personal data.

Operated by Relax Train Limited, Hong Kong. Contact: support@relaxtrain.com · 57002369.

2. Data we collect

Organisation admins and teachers: name, email, role, organisation, last sign-in, activity log (e.g. adding students, creating and assigning papers).

Parents: name, email, linked student(s), message delivery records.

Students: name, grade, class, student code, PIN (stored as an irreversible hash), answers, correctness, timestamps, scores and mistake history.

Technical data: IP address, browser type, sign-in times (for security and troubleshooting).

We do not collect: identity card numbers, addresses, phone numbers (unless the organisation enters them), or card details (billing is handled outside the platform; we never store card numbers).

3. Children's data

Student records are created and managed by the tutoring centre or school (the "Organisation"). For student data, the Organisation is the data user and we act as its data processor, following its instructions.

The Organisation is responsible for obtaining parent or guardian consent before creating student accounts. Parents who wish to access, correct or delete their child's data should contact the Organisation first; we will act on the Organisation's instruction.

Students never see other students' names or scores, and the platform has no public leaderboards.

4. How we use data

To provide the service: practice papers, automatic marking, results, mistake explanations and adaptive practice.

To inform the Organisation and parents: class reports, weekly parent emails, shareable result links.

To operate and secure the service: authentication, brute-force protection, audit logging, error diagnosis.

For billing: counting active student accounts per month and issuing invoices and receipts.

We do not sell personal data and do not use it for advertising or marketing.

5. Retention

Answers and results: kept until the Organisation requests deletion, or deleted within 90 days of service termination.

Unfinished answer drafts: automatically cleared after 30 days.

Invoices and receipts: kept 7 years as required by Hong Kong tax rules.

Backups: daily; 7 days on the server and 14 days off-site, then overwritten.

Sign-in and audit logs: 12 months.

6. Who can see data

Within an Organisation: admins and head teachers see the whole organisation; teachers see only the classes assigned to them; parents see only their own children; students see only their own data.

Our platform administrators: access is limited to support, billing and error fixing, and every action is logged.

Service providers (used only to run the service):

· Alibaba Cloud Hong Kong (servers and database)

· Email delivery service (invitations, password resets, parent reports, invoices and receipts)

· FTP backup storage (backup files only)

Legal requirements: we may disclose data where required by a court order or law.

7. How we protect data

All traffic is encrypted with TLS (HTTPS).

Passwords and PINs are stored as salted scrypt hashes; we cannot read them.

Tenant isolation is enforced in the database with Row Level Security, so one organisation's data cannot be read by another even if application code has a bug.

Accounts lock for 15 minutes after 5 failed sign-ins, with per-IP rate limits.

Access is limited by role and recorded in an audit log.

Servers expose only ports 80/443 plus a management SSH port.

8. Cookies

Session cookie (rt_session): required to keep you signed in.

Language cookie (rt_locale): remembers your interface language.

No advertising cookies, no third-party tracking, no behavioural analytics.

9. Your rights

You may request access to, correction of, or deletion of your personal data, and object to or restrict certain processing.

Parents and students should contact their Organisation first; organisation admins can edit records in the console or email support@relaxtrain.com.

We respond within 40 days, in line with the Personal Data (Privacy) Ordinance.

10. Changes

If this policy changes materially, we will email organisation admins and update the date on this page.

Last updated: November 2026.