Privacy and Personal Data Protection Policy

1. Scope and data controller

1.1. This policy applies to the sites and services of 200Lab: the public site 200lab.io, the learning site learn.200lab.io, the API api.200lab.io, the MCP server mcp.200lab.io and the emails we send you.

1.2. The party that controls and processes your personal data is:

• Business name: Công ty TNHH công nghệ 200LAB
• Tax ID: 0317035178
• Office: 9A Phạm Văn Hai, Phường Tân Sơn Hòa, TP.HCM
• Contact channel: the 200Lab Fanpage at https://www.facebook.com/edu.200lab
• Email for personal data matters: edu@200lab.io
• Team responsible for personal data protection: the 200Lab Executive Board, reachable at edu@200lab.io

1.3. This policy does not apply to sites or services of other parties that you open from 200Lab, for example YouTube, Google Meet, Zoom, Telegram, GitHub, PayPal or your bank. Those parties have their own policies.

2. Data we collect

We collect only the data needed to provide the service. The data falls into the groups below.

2.1. Account data

• Your email address and whether it has been verified.
• Your password. We store only a bcrypt hash; we do not store and cannot read the original password.
• If you sign in with or link GitHub: your GitHub account identifier, GitHub username and the GitHub email that GitHub returns. We do not store your GitHub access token.
• Your account role (learner, author, mentor, administrator).
• The visit source that led to the sign-up, sent along when you create an account: the entries of the elearning_src cookie (section 10).

2.2. Profile data

• Your public username (handle), display name, avatar, cover image, short tagline, bio, website, social links and linked GitHub name. These fields are shown on your public profile page (see section 11).
• Private contact details: phone number and Telegram username. Both fields are optional, visible only to 200Lab and never shown publicly. We use them to contact you when you take a live class.

2.3. Purchase and payment data

• Your cart, orders, the products and Offers you buy, prices, any discount or referral code applied, order status and refund history, if any.
• The visit source that led to the order, sent along when you place an order: the referring page (domain and path), campaign tags (UTM), the click code in a 200Lab email, the landing page, the blog post you viewed most recently and the time of each entry (section 10).
• The bank transfer details that SePay passes to us for reconciliation: amount, transfer description, bank reference code, bank and transaction time. Depending on the bank, the description may contain the sender's name.
• When you pay through PayPal: the PayPal order ID, the capture ID, the amount collected in USD, the PayPal fee, the exchange rate used and the transaction status, including refunds and chargebacks that PayPal reports to us.
• We do not collect, store or process card numbers, CVV/CVC codes, card expiry dates or any other payment card data. 200Lab accepts bank transfers through VietQR codes and payments through PayPal; when you pay by card through PayPal, PayPal handles the card under its own policy.

2.4. Learning data

• Your access to courses, learning paths, articles and materials, together with the access period.
• Learning progress (lessons opened and completed), quiz results, submissions (text content and a GitHub link if the assignment asks for one) and mentor feedback.
• Certificates issued, their serial numbers and your choice to make each one public or private.
• Experience points, the badges you earn (with the time earned) and your choice to share each badge publicly.
• Course reviews you write (star rating and comment).
• Your download history of materials (artifacts).

2.5. Technical, cookie and device data

• IP address, user agent string, device type, operating system, browser and the country inferred from the IP, attached to each sign-in session.
• A device identifier generated by the FingerprintJS library (the open-source edition, running entirely in your browser). It is used only to tie a sign-in session to a device and to detect stolen sessions, never for advertising.
• Security event logs: sign-in, sign-out, session refresh, session replaced.
• When your API key or agent connection is used: the network range of the IP address (the IP address shortened to the network block that contains it), the application name the tool reports and the API key or connection that was used. We use this data only to protect the account against shared use and to alert the 200Lab operations team, and we keep it for at most 2 days.
• When you are signed in: your interactions with promotion notices on the site (a notice shown, clicked, closed or answered with "Not interested") and the article where the notice appeared. We use this data to choose which offers to show and to measure how promotions perform. It is kept for 180 days and is no longer tied to you once you delete your account. When you are not signed in, we do not record these interactions per person.
• Cookies and browser storage, described in section 10.
• Measurement data from Google Analytics, Meta Pixel and the OpenAI measurement pixel, described in section 10.

2.6. Contact data for live classes

• The phone number and Telegram name listed in section 2.2, if you provide them.
• When you press "Open Telegram" on a course page, we create a single-use invite link to the class Telegram group. When you join the group, Telegram and the other group members see your Telegram account according to your Telegram privacy settings.
• If the class runs on Google Meet or Zoom, that platform processes your name, image and voice when you join a session. Sessions may be recorded to provide a recording to the learners of the class (see the Terms of use).

2.7. Referral (affiliate) program data

• Your referral code and link (created automatically when you open the Referrals page), the share of commission you choose to pass on to buyers, the orders credited to your code or link, the number of buyers counted toward your level, your current level and maximum commission rate, your membership status (active or suspended), commissions and payouts.
• The program no longer has a sign-up step, so we no longer collect a sign-up note. A note you sent when you signed up earlier, if any, is kept with your membership details.
• Payout details: bank name, account holder name and account number. The account number is encrypted at rest (AES-GCM); only the 200Lab payout team can open it when making a transfer. The bank name, account holder name and last four digits are stored in plain form so that you and we can recognize the account.
• Your personal tax identification number (under current tax rules, the 12-digit personal identification number, or a previously issued 10-digit tax code), so that 200Lab can withhold and declare personal income tax on the commission.

2.8. Data you send when contacting support

When you message the 200Lab Fanpage through Messenger, we receive the message content and the Facebook account information that Meta lets the page see.

3. Purposes and legal bases for processing

We do not sell your personal data. We do not use your personal data to train AI models. We send only transactional emails and service notices (email verification, receipts, access, class schedules, changes to the terms). If 200Lab starts a newsletter later, we will ask you first and you can unsubscribe at any time.

Financial data (such as the bank account number in group 2.7) is sensitive personal data under the law. We process it only when you enter it yourself to receive commissions, and only for making payouts.

4. Sharing data with third parties

We share only the part of the data each task needs. Some recipients process data outside Việt Nam, which means data is transferred abroad.

For transfers of data abroad, we prepare and keep an impact assessment dossier as required by Vietnamese law.

About "Applications you authorize yourself": 200Lab lets you authorize an external application (for example an AI agent using the MCP protocol) to access your learner account. Each time, you see the "Grant access" screen and can decline. When you allow it, that application receives data within the scope shown and is itself responsible for how it processes that data.

5. Storage and retention periods

When a period ends, the data is deleted or anonymized by automatic cleanup tasks.

6. Security

• Passwords are hashed with bcrypt; session refresh tokens are stored only as SHA-256 hashes.
• Affiliates' bank account numbers are encrypted at rest with AES-GCM. The encryption key is kept separate from the database.
• Each account has at most two active sign-in sessions. When you sign in from a third place, the oldest session is signed out at once. You can view and revoke sessions, or sign out everywhere.
• Sessions are bound to the device; the session cookie is httpOnly, sent only over HTTPS and protected against CSRF.
• Every connection uses HTTPS. Learning access is granted only after the bank transfer has been verified, never on the strength of information the browser sends.
• The database is backed up daily to separate storage and kept for 30 days.
• Only staff who need it for their work can access data, and every administrative action that changes data is logged.

No system is perfectly secure. If a data breach occurs, we notify the specialized personal data protection authority within 72 hours of discovering it, and notify you when the incident affects you, as required by law.

7. Your rights

Under the Personal Data Protection Law, you have the following rights:

1. To be informed: to know which of your data is processed, why and by whom. This policy is how we fulfil that right.
2. To consent or not to consent to the processing of your data.
3. Access: to view and receive a copy of your data.
4. Correction: to correct inaccurate or outdated data.
5. Erasure: to request that your data be deleted.
6. To withdraw your consent.
7. To restrict processing and to object to the processing of your data.
8. To complain, denounce, sue and claim damages as provided by law.

Withdrawing consent does not invalidate processing that took place before it. Some rights are limited by law; for example, we must still keep payment records for accounting and tax purposes.

8. How to exercise your rights

• View and edit your profile, phone number and Telegram name: the profile page in learn.200lab.io.
• View and revoke sign-in sessions, link or unlink GitHub: the account page in learn.200lab.io.
• Hide a certificate from the public verification page: the certificates page in learn.200lab.io.
• Turn off a shared badge or certificate link: the Shared links section in learn.200lab.io.
• Turn the achievements list on your profile page on or off: the Shared links section in learn.200lab.io.
• View orders and commissions: the orders page and the Referrals page in learn.200lab.io.
• Delete your account, request a copy of your data, withdraw consent, object to processing: email edu@200lab.io or message the 200Lab Fanpage through Messenger. There is no self-service account deletion button yet; you send the request by email to edu@200lab.io or through Messenger and we carry it out within the time limits in the paragraph below.

To protect you, we may verify that you own the account before acting, for example by sending an email to the registered address. We respond to a request within 02 working days. Access and correction requests are completed within 10 days; deletion requests within 20 days, or within 30 days if another processor must also delete the data.

When we delete an account, we close every session, delete the password and the GitHub link, delete the profile (name, image, bio, links, phone number, Telegram name), delete the visit source recorded at sign-up, release the handle and replace the email with an anonymous address. Reviews you wrote are shown without a name. Order and payment records are kept, no longer tied to your identity, for the period the law requires. After deletion you lose access to the courses you bought, and this cannot be undone.

9. Children and age

200Lab's services are for people aged 16 and over. If you are under this age, a parent or guardian must consent and exercise your data rights on your behalf. If you find that we have collected a child's data without proper consent, message us and we will delete it.

10. Cookies and browser storage

Essential cookies (always on, no choice needed; without them you cannot sign in):

• refresh_token: keeps you signed in, httpOnly, 14 days, renewed while you keep using the site.
• csrf_token: protects against request forgery.
• __Host-browser_ctx: ties the session to the browser you are using.
• elearning_ref: remembers the referral code when you open a referral link, so the code's offer applies when you buy, within the program's attribution period (currently 30 days).
• elearning-locale: remembers the language you chose (Vietnamese or English), shared by 200lab.io and its subdomains, for 1 year.

Functional cookies:

• elearning-consent: remembers your choice in the cookie banner, shared by 200lab.io and learn.200lab.io, for 12 months, or 6 months if "Measurement" is off. When it expires, we ask again.

Visit source cookies (200Lab's own, always on, no choice needed):

• elearning_src: the first external page that brought you to 200Lab (domain and full path), the campaign tags (UTM) of the first time you arrived through a campaign, and your most recent arrival from outside (referring page, UTM tags, the click code in a 200Lab email, landing page), with the time of each entry. Shared by 200lab.io and its subdomains.
• elearning_blog: the path of the blog post you viewed most recently on 200lab.io and when you viewed it. Used only on 200lab.io.
• 200Lab does not write your name, email or account ID into these two cookies. Your browser sends them with requests to 200lab.io like any other cookie, but 200Lab's servers ignore them; 200Lab uses their content only when you place an order (and, for elearning_src, also when you create an account), and then stores it with that order or account. Purpose: to know which page, campaign, email or article led to orders and sign-ups, so that 200Lab knows which content helps learners. Not shared with advertisers.
• Each entry is used only for 30 days from when it was written; the cookie expires 30 days after the last write, and the browser (Safari, for example) may delete it sooner. You can delete them at any time by clearing the 200lab.io cookies in your browser; this does not affect signing in or buying.

Browser storage (localStorage and sessionStorage), kept only on your device:

• Light or dark theme, the cart while you are not signed in, the discount code being entered, the status of an order being paid, the autoplay-next-lesson choice, how many times promotion notices have been shown, and your choice to close them or answer "Not interested".

Cookieless visit statistics: Cloudflare Web Analytics records page views, paths, referring pages, device type and browser, and page load speed. This tool sets no cookies, stores nothing on your device and does not identify individuals, so it runs without asking you. Recipient: Cloudflare. Purpose: counting visits and monitoring page speed.

Third-party measurement and advertising cookies, chosen separately for each purpose:

• Measurement: Google Analytics 4 (cookies _ga, _ga_*) records page views, learning and purchase events, device type and browser, and approximate location from a shortened IP. Recipient: Google. Purpose: understanding how the site is used to improve its content. Kept for up to 2 years.
• Advertising: Meta Pixel (cookies _fbp, _fbc) and the OpenAI measurement pixel (cookies __oppref, __obref) record page views, purchase and sign-up events to measure the effectiveness of 200Lab's advertising on Facebook, Instagram and ChatGPT. Recipients: Meta, kept for up to 3 months; OpenAI, kept for up to 12 months (__oppref 30 days, __obref 12 months).
• Both purposes stay off until you choose; until then none of these cookies is set. In the cookie banner you choose "Decline all", "Measurement only" ("Measurement" on, "Advertising" off) or "Accept all". You can also open "Details" and turn each purpose on or off separately; each toggle takes effect immediately.
• Each day, we count the total number of times each answer in the cookie banner was chosen, to know the consent rate for each purpose. These counts are not tied to any cookie, account, IP address or other identifier.
• You can change your choice at any time through "Cookie settings" in the 200lab.io footer or on the account page in learn.200lab.io. When you turn a purpose off, its cookies are deleted from your browser and the corresponding tool stops sending data.

You can delete or block cookies in your browser settings. Blocking essential cookies will prevent you from signing in.

11. Public profile, reviews and certificates

• The profile page 200lab.io/@handle shows the public profile fields in section 2.2. Your phone number, Telegram name and email are never shown there.
• The profile page 200lab.io/@handle lists your certificates and badges only when you turn on "Show achievements on your public profile" (off by default). The list includes only the certificates you keep public and the badges you have turned sharing on for, with the name you agreed to display. Your old handles still redirect to your current handle, so the list can also be viewed through an old handle. When you turn it off, the list disappears from the page at once; link preview images may remain for up to 5 minutes, and copies that social networks have saved are beyond our power to withdraw. Learner profile pages are not included in search results.
• Course reviews are shown publicly with your handle and display name.
• A certificate appears on the public verification page only when you turn it on. That page shows only the name you agreed to display and minimal information about the course, and can be turned off at any time without deleting the certificate. The verification page is not included in search results.
• A badge appears on the public share page 200lab.io/thanh-tich/... only when you turn sharing on for that badge. The page and the share image show the name you agreed to display, the badge name and the date earned; your public avatar may be shown with them. For a secret badge, the condition for earning it is not stated. The share page is not included in search results.
• When you turn sharing off or withdraw your display name, the link stops working at once. Share images are generated when someone opens them and 200Lab does not keep them; but copies that social networks or other people have saved are beyond our power to withdraw.

12. Changes to this policy

We may update this policy when the service or the law changes. Each new version is posted on this page with its effective date. For important changes, we notify you by email or on the learning site at least 7 days before they apply. If a change requires new consent, we will ask you again.

13. Contact

For any question or request about personal data, email edu@200lab.io or message the 200Lab Fanpage: https://www.facebook.com/edu.200lab. You can also send a letter to the office of Công ty TNHH công nghệ 200LAB at 9A Phạm Văn Hai, Phường Tân Sơn Hòa, TP.HCM.