Privacy Policy

Last updated: 2 October 2026

This page explains what data we collect, what we use it for, who we share it with, and what you control. The data controller is ESAT Education Science and Technology Company Limited, which operates HOCSAT (hocsat.com). Registered office: 180A, Alley 173 Hoang Hoa Tham Street, Ngoc Ha Ward, Ba Dinh District, Hanoi, Vietnam. Office: Unit 2606, Tower A, Paragon Building, 86 Duy Tan Street, Cau Giay District, Hanoi, Vietnam.

1. Data we collect

Account information: your name and email address.
Study data: your answers, scores, time spent, flagged questions and personal notes.
Technical data: IP address, device and browser type, language, and the pages and actions on the site.
Order data: order code, plan chosen, amount and payment status.

We do not collect phone numbers and do not store card or bank details — payments are handled by the PayOS gateway on their own systems.

2. What we use it for

Creating and maintaining your account, sending your password and password-reset emails.
Scoring your tests, storing your history and analysing strengths and weaknesses by skill.
Processing orders and granting access to the plan you bought.
Detecting abuse (bulk account creation, account sharing) and protecting the system.
Understanding how the product is used so we can improve content and features.

3. Email and marketing consent

We keep two kinds of email strictly apart:

Service email (password, password reset, order confirmation) goes to every account, because it is required to use the service at all.
Advice and offer email goes only to people who ticked the separate consent box at registration. That box is optional and does not affect your access to the service.

You can withdraw consent at any time using the link at the bottom of any advice email, or by emailing us.

4. Third parties

We do not sell your data. It is only passed to the providers the service needs to work:

Google — Google sign-in (if you choose it) and reCAPTCHA anti-bot on the registration page.
PayOS — processing payments in Vietnamese dong.
Paddle.com — our reseller and Merchant of Record for payments in US dollars. Paddle receives your email, country and payment details to take the payment and calculate tax, under the Paddle Privacy Policy. We never see your full card details.
Gmail SMTP — sending service email.
DB-IP — approximate location data (country, region) derived from IP addresses.

5. Cookies and data stored on your device

We use no advertising cookies. Your browser stores:

accessToken in localStorage — keeps you signed in.
visitorId in localStorage — an anonymous id used for usage statistics.
sessionId in sessionStorage — groups the actions of a single visit.

Clearing your browser data signs you out on that device.

6. Storage, retention and security

Data is held in a SQL Server database over encrypted connections. Passwords are not stored in readable form. We keep your study data for as long as your account exists, so you can see your progress over time; technical activity logs are kept for statistics and abuse detection.

7. Your rights

You can ask to see, correct or delete your data, withdraw marketing consent, or get a copy of your results. Send the request from the email address you registered with to info@hocsat.com; we respond within 30 days. Note that deleting an account is irreversible and removes your entire test history.

8. Younger users and changes to this policy

The service is aimed at students preparing for the SAT. If you are under 16, please register with the consent of a parent or guardian. When this policy changes we update the text and the date at the top of this page; changes that materially affect your rights will also be announced by email.

Questions about your personal data? Email info@hocsat.com. See also our Terms of Service.