Privacy Policy

Last updated: 2026-10-13

This policy is available in Traditional Chinese, Simplified Chinese and English. In case of any discrepancy, the Traditional Chinese version shall prevail.

Welcome to Little Days School. This policy explains what personal data we collect when you use this website, why we collect it, how we use it, and what rights you have. It is written to provide the notice required by Article 8 of Taiwan's Personal Data Protection Act (the "PDPA").

1. Who we are: the platform and the schools

The online course platform used by this website is operated by 先睿國際有限公司 (Taiwan business registration number 60790313), referred to below as "we", "us" or the "platform operator". Its representative is 鄭蓉芳, and its registered address is 高雄市鳳山區立人街10號 (No. 10, Liren St., Fengshan Dist., Kaohsiung City, Taiwan). Contact email: volurio.com@gmail.com.

The platform hosts multiple schools. Each teacher or organization runs its own independent school:

Schools (course providers): create and sell courses, run their own storefront, respond to students' assignments, and manage their own students and sharers.
The platform operator (先睿國際有限公司): runs the whole system, including account sign-in, collecting course payments on the schools' behalf, issuing e-invoices, sending notification emails, video playback, data storage and information security.

The personal data described in this policy is collected, processed and used by us in our capacity as the platform operator. Access to the data is divided as follows:

School administrators can see the data of students who purchased or registered at that school.
The platform operator can access the data of all schools where needed to operate and maintain the system.

Sharer program data (see 2.3) is jointly collected and used by the platform operator and the school whose sharer program you join, within the purposes described in this policy.

This policy applies to this website, as well as to the other school websites and the official platform website on the same platform.

Each school has its own separate accounts. The account you create by signing in at School A and the account you create by signing in at School B are two separate records. School A's administrators cannot see your data at School B.

2. What personal data we collect

2.1 Sign-in (Google, LINE)

When you sign in to a school with your Google or LINE account, we receive the following data from Google or LINE and store it in your account record at that school:

Account identifier of the sign-in service: the fixed ID that Google or LINE assigns to the account.
Name (display name): the name you set on Google or LINE.
Email: provided when you sign in with Google. If you agree to share your email when signing in with LINE, we will receive your email.
Profile picture URL: a link to the image hosted by Google or LINE.

We never receive your Google or LINE password.

The system also records in your account: registration time, your school, interface language, your referral code, the person who referred you (if you first arrived through a referral link), and your role (student or school administrator). School administrators may also add tags and notes to students.

2.2 Purchases and checkout

Email: taken from your signed-in account; if you purchase without signing in, entered by you on the checkout page. Used to send purchase confirmations, course activation notices and e-invoice notices.
Order details (generated by the system): the courses or bundles purchased, amount, discount, coupon code, order number, payment status, the language at the time of the order, and the referral code (if any).
Payment result (returned by NewebPay): the NewebPay transaction number and whether the payment succeeded.
E-invoice (generated by the system): invoice number, issue time and status.

Credit card and other payment details are collected directly by NewebPay and never pass through or are stored on this website. When you pay, you are redirected to NewebPay's payment page. The only data we send to NewebPay is the order number, amount, item description and your email.

E-invoices are issued through NewebPay (ezPay). The buyer information we send is your email (the buyer name field is also filled with your email).

Purchasing without signing in (guest purchase): You can buy a course without signing in. The system creates a "guest" record using the email you enter so that you can access the course later. After payment:

The payment confirmation page and email include a "claim link", valid for 7 days.
Afterwards, whenever you sign in to the same school with a Google or LINE account that has the same email, your orders and courses are merged into your account automatically.

2.3 Sharer program (referral commissions)

If you apply to become a sharer at a school and want to receive commissions, you need to provide:

Name (must match your national ID card), phone number and email: for review and contact.
National ID number and registered or mailing address: for withholding and reporting income tax as required by law.
Bank code, branch, account number and account holder name: for payouts.
Images of the front and back of your national ID card: to verify your identity.
The time you confirmed the tax notice and agreed to the program notes: to keep a record of your confirmation.

How this data is protected:

A watermark is burned into ID images at the moment of upload. The watermark states that the image may be used only by that school's company for sharer program review and income reporting, and not for any other purpose. The image cannot be restored to a version without the watermark.
ID images are stored in non-public cloud storage. Viewing them generates a link valid for only 60 seconds.
The school's admin panel normally shows only masked national ID and bank account numbers. An administrator must click to reveal each full value individually. Every reveal, ID view and ID deletion is logged with the administrator and the time.
School administrators can delete ID images after the review is complete.

2.4 Learning data

Video progress, resume position, unit completion time: visible to you and the school's administrators.
Assignment content, uploaded files, versions and teacher feedback: visible to you and the school's administrators. You may choose to make your work "visible to classmates"; classmates in the same course will then see your work and your name (your display name on the sign-in service; "Classmate" if you have none; your email is never shown).
Quiz answers, scores and pass/fail: visible to you and the school's administrators.
Course reviews (stars and comments): shown publicly on the course page, but your name is masked (rules below); the school's administrators can see your real name and email.

Review name masking rules:

Chinese names keep the first and last characters, with the middle replaced by ○. For example: 王小明 → 王○明, 陳美 → 陳○.
English names keep the first word, and the rest are shortened to initials. For example: Mary Jane Watson → Mary J. W.
If the name looks like an email address or URL, or there is no name, "Student" is shown.
Schools can hide inappropriate reviews. Hidden reviews are not public and do not count toward the average rating; you can still see your own review, with a notice that it has been hidden by the school.

Video watermark: When a course video plays, your email (or your account ID if you have no email) is overlaid on the screen to deter recording. This watermark appears only on your own screen.

Course intro videos (YouTube): Intro videos on course pages are hosted on YouTube. If a course has no custom cover image, the page loads the video thumbnail from YouTube's image domain (i.ytimg.com); the YouTube player is embedded from youtube-nocookie.com only after you press play. When the thumbnail or the player loads, YouTube (Google) may receive your IP address and device information (such as your browser type) and handles it under Google's own privacy policy.

2.5 The "Open a school" form on the official platform website

This item applies only to the official platform website. When you apply to open a school there, we collect what you fill in: name, email, phone or LINE ID (optional), the course you want to offer, your current progress, any message (optional), and the interface language at the time.

To prevent spam, the system stores your IP address only as an encrypted hash (the original IP is not stored), and uses it to limit submissions from the same source to 3 within 10 minutes.

2.6 Data generated automatically when you browse

Essential cookies (sign-in state, cart, language, etc.; see Section 5).
After you consent to analytics and advertising cookies, the browsing data collected by Google Analytics and Meta Pixel (see Section 5).
Our website hosting and video services automatically log connection information while providing their services (for example IP address, browser type and access time). These logs are retained according to each provider's own policy.

3. Purposes of collection

The specific purposes announced by Taiwan's Ministry of Justice are shown after each item.

Creating and managing accounts, sign-in verification (2.1): 090 consumer and customer management and services; 135 information and communication services.
Performing the course purchase contract: collecting payment, activating courses, sending notices (2.2): 069 contracts, quasi-contracts or other legal relationships; 148 online shopping and other e-commerce services.
Issuing e-invoices, accounting and tax (2.2, 2.3): 063 collection, processing and use of personal data by non-government agencies under statutory obligations; 129 accounting and related services.
Providing learning services: progress, assignments, quizzes, reviews (2.4): 158 student (trainee) data management (including graduates); 090.
Sharer review, commission calculation, payouts and income tax withholding (2.3): 069; 063; 129.
Responding to school applications and discussing opening a school (2.5): 069; 090.
Website traffic analytics and advertising measurement, only with your consent (2.6): 040 marketing; 157 surveys, statistics and research analysis.
Information security, abuse prevention, system operation (all data): 136 information, communication and database management.

Categories of personal data: C001 identifying an individual (name, email, phone, address); C002 identifying financial information (bank account); C003 identifiers in government data (national ID number); C011 personal descriptions (for example reviews and assignment content); C051 school records (learning progress, quiz scores).

4. Period, region, recipients and methods of use

Period

Account data (2.1): kept until the account is deleted. There is currently no self-service account deletion; you may request deletion by email as described in Section 6, and we will handle it manually.
Order and invoice data (2.2): kept for the periods required by the Business Entity Accounting Act and other laws.
Sharers' ID images, national ID number, address and bank account (2.3): kept while you remain a sharer, and after your last payout for the period required by tax laws, then deleted. Schools may also delete ID images earlier, after the review is complete.
Learning data, reviews and assignments (2.4): kept until deleted by you or the school, or until the account is deleted. You can delete your own reviews.
School applications (2.5): kept until one year after our correspondence ends.
Notification email logs (recipient email and the variables used in the email): kept until the account is deleted.
Cookies: for the duration listed for each cookie in Section 5.

Region

The Republic of China (Taiwan).
Data is stored in data centers of the cloud service providers we engage, which may be located outside the Republic of China (for example in the United States). These providers include: database and file storage (Supabase), website hosting (Vercel), video (Cloudflare), email delivery (Resend), and analytics and advertising (Google, Meta). Your data may therefore be transferred abroad for processing.

Recipients

Administrators of your school: that school's students' names, emails, purchase and learning records, assignments, quizzes and the real names behind reviews; that school's sharer applications (national ID and bank account numbers masked by default, with every reveal logged). School administrators can export a student list limited to name, email, role, registration time and total spending. Purpose: running the school and teaching.
Operations staff of the platform operator (先睿國際有限公司): may access the data of all schools where needed for system operation, customer support, payments and invoicing.
NewebPay / ezPay: order number, amount, item description and email. Purpose: payment collection and e-invoicing.
Google, LINE: provide your account data to us when you sign in. Purpose: sign-in.
Supabase: all database data and uploaded files, held on our behalf. Purpose: database and file storage.
Vercel: request data handled while the website runs, processed on our behalf. Purpose: website hosting.
Cloudflare (Stream): video playback requests. Purpose: video streaming.
Resend: recipient email and email content. Purpose: sending notification emails.
Google Analytics, Meta (Facebook): only after your consent, events such as page views, add to cart, begin checkout, purchase (course ID, name, amount, order number) and school application submission. These do not include your name or email. Purpose: traffic analytics and advertising measurement.
Authorities legally entitled to request data: to the extent required by law.

Except for the cloud service providers processing data on our behalf, and the recipients listed above within the scope listed for each, we do not provide your personal data to third parties.

Methods

Data is collected, stored, processed and transmitted electronically. The database has access controls, and personal data tables can be accessed only from the server side. Uploaded files are kept in non-public storage and viewed through short-lived signed links.

5. Cookies and tracking technologies

5.1 Essential cookies (required for the website to work; cannot be turned off)

Sign-in state (authjs.session-token, or __Secure-authjs.session-token over https): remembers your sign-in at each school; the content is encrypted. The sign-in at each school expires 30 days after your last sign-in there, and browsing does not extend it. Duration: 30 days.
Sign-in flow temporary data (Auth.js CSRF, state, etc.): protects the sign-in flow against forgery. Duration: the sign-in flow.
signin_tenant: remembers which school you are signing in to, so that the Google or LINE sign-in returns to the right school. Duration: 15 minutes.
cart.school-code: cart contents, separate for each school. Duration: 30 days.
ref.school-code: remembers which sharer's referral link brought you to the site, used to calculate commissions, separate for each school. Duration: 30 days.
locale.school-code (the official platform website uses its own name): remembers your chosen interface language. Duration: 1 year.
cookie_consent.school-code (cookie_consent on the official platform website): remembers your choice about analytics and advertising cookies, separate for each website. Duration: 1 year.

5.2 Analytics and advertising cookies (require your consent)

If a school or the official platform website has set up Google Analytics 4 (GA4) or Meta Pixel, you will see a cookie consent banner at the bottom of the screen on your first visit.
Until you click "Accept", the website does not load any GA4 or Meta Pixel code. Clicking "Decline" does not affect purchasing, learning or browsing.
If a website has no tracking codes set up, no banner appears and no tracking takes place.
Your choice applies per website: accepting at School A does not mean accepting at School B.
No tracking data is sent from school admin pages. If you go straight to the admin pages, no tracking code is loaded; if you consented on the site before entering them, the tracking code already loaded is paused using the official opt-out mechanisms provided by Google and Meta, and resumes only when you leave the admin pages.
You can change your choice at any time via "Cookie settings" in the page footer.

Who owns the tracking codes:

Each school may use its own GA4 and Meta Pixel accounts, set up by the school itself or by the platform operator on its behalf. This data goes into that school's own Google and Meta accounts, and the school uses it under Google's and Meta's terms.
The official platform website uses GA4 and Meta Pixel set up by the platform operator.

5.3 Cross-school linking on a shared domain

Some schools use the platform's shared domain (with addresses in the form "platform domain/school-code/…"). These schools share the same domain with each other and with the official platform website. Google Analytics and Meta Pixel store browser-identifying cookies on that domain (for example _ga and _fbp). This means:

If you accept tracking at both School A and School B, the GA4 or Pixel of both schools will read the same visitor ID.
Providers that serve many accounts at once (for example Meta) are technically able to link your browsing across different schools and the official platform website.
The events we send to GA4 and Pixel do not include your name or email. However, such linking may still allow these providers to infer which schools you have visited.

Schools using their own domain are not affected; their cookies are separate from the shared domain.

You can decline analytics and advertising cookies at each school, or use your browser's cookie clearing and blocking features.

6. Your rights and how to exercise them

Under Article 3 of the PDPA, you may, with respect to your personal data:

Inquire about or request to review it
Request a copy
Request supplementation or correction
Request that its collection, processing or use be stopped
Request its deletion

How to exercise these rights: Email volurio.com@gmail.com, stating the school you use and your sign-in method (Google or LINE). After verifying your identity, we will handle your request within the time limits of Article 13 of the PDPA: within 15 days for an inquiry, review or copy; within 30 days for supplementation, correction, stopping collection, processing or use, or deletion. Where necessary these periods may be extended, and we will tell you the reason.

Deleting your account: The website currently has no self-service account deletion. Please email us to request account deletion, and we will handle it manually.

Things you can do yourself:

Edit or delete your own course reviews
Change an assignment from "visible to classmates" back to "teacher only"
Decline cookies or change your cookie choice

Please note:

Data that the law requires us to keep (such as invoices and accounting records) may not be deletable during the statutory period.
After your account is deleted, you will no longer be able to watch courses you purchased.

School applicants may also reply directly to the email we used to contact them to request inquiry, correction or deletion.

7. Consequences of not providing data

You are free to choose whether to provide personal data. However:

Without signing in with Google or LINE, you cannot create an account, watch purchased courses, submit assignments or write reviews.
Without providing an email at purchase, you cannot complete the purchase (we need it to send the activation notice and e-invoice).
Without providing your national ID number, address, bank account and ID images when applying as a sharer, you cannot pass the review or receive commissions (referral records and commissions will still accumulate as usual).
Without filling in the required fields of a school application, we cannot contact you.
Declining analytics and advertising cookies does not affect any feature.

8. Data security

Our measures include:

The database is separated by school and has access controls; personal data tables can be accessed only from the server side.
ID images and assignment files are kept in non-public storage and can be opened only through short-lived signed links.
Sharers' national ID and bank account numbers are masked by default in the admin panel, and revealing them requires a separate action for each value and is logged.
Student list exports are limited to a few fields and are logged.
Videos are played through time-limited signed URLs.

However, no transmission over the internet can be guaranteed to be 100% secure. If personal data is stolen, leaked, altered or otherwise infringed, we will notify you by email or other appropriate means after investigating, as required by Article 12 of the PDPA.

9. Minors

Anyone under 18 years of age should use this website only after their legal representative has read and agreed to this policy and the Terms of Service.

10. Changes to this policy

We may revise this policy due to changes in law or in our services. Revisions will be announced on the website and the version date on this page will be updated; for material changes, we will also notify you by email.

11. Contact us

先睿國際有限公司
Email: volurio.com@gmail.com