Vispo Care 隱私權政策

繁體中文

摘要

• Vispo Care 是給家長與監護人使用的 App 與網站。家長可以查看孩子的到離班紀錄、聯絡簿與通知。
• 我們只為提供服務而處理資料。我們不出售個人資料，不做廣告追蹤，App 也沒有安裝分析或當機回報 SDK。
• 人臉辨識只在監護人同意後啟用。系統只保存臉部特徵值，不保存影像。監護人可隨時在 App 撤回，撤回後特徵值立即停用並刪除。
• 你可以在 App 修改資料、關閉通知、解除 LINE 綁定、撤回人臉同意或刪除帳號，也可以寄信給我們。

1. 適用範圍與個人資料管理者

本政策適用於 Vispo Care 家長 App（Android 套件名稱 app.vispo.parent、iOS）、家長網站，以及支援這些服務的後端系統。

個人資料管理者：智加雲科技有限公司（Vispo Technology Co., Ltd.），統一編號 62094663，地址：新竹縣竹北市復興一街89巷1號1樓。

聯絡方式：privacy@vispo.app。

家長帳號資料（帳號、手機或 Email、裝置、LINE 綁定、通知紀錄，以及你在 App 內的同意操作）由智加雲科技有限公司擔任個人資料管理者。孩子就讀的補習班、學校或安親機構（以下稱「機構」）輸入與管理的資料（學生名冊、出勤紀錄、監護人聯絡資料，以及在機構現場蒐集的臉部特徵值）由機構擔任個人資料管理者，Vispo 依機構的委託處理。關於這些資料的請求，請向機構提出，Vispo 會協助機構處理。

2. 我們蒐集的資料

帳號與登入

• 手機號碼或 Email，以及你選擇的登入方式（手機簡訊驗證碼、Email 驗證碼或 Google 登入）。
• 使用 Google 登入時，Google 提供的 Email、姓名與帳號識別碼。
• 一次性驗證碼。驗證碼只用於登入或確認手機，到期後失效。
• 登入憑證儲存在你的裝置中，用於維持登入狀態。

家長個人資料

• 顯示名稱、頭像（只在你選擇相片時上傳，上傳前會在裝置上裁切與縮小）。
• 介面語言、時區與時間格式。

家庭與孩子的綁定

• 機構提供的綁定碼、你與孩子的關係、你的姓名與手機號碼。
• 你新增的家庭聯絡人：姓名、關係、手機號碼與 Email。
• 為確認同一個家庭而使用的手機驗證紀錄。

孩子的資料（由機構提供，家長可查看並修改部分欄位）

• 姓名、英文名、性別、生日、年級、學校與班級、學號。
• 地址、電話與 Email。
• 飲食限制與照護提醒。這些內容可能包含健康相關資訊，請只填寫照顧孩子需要的內容。

出勤與學習紀錄

• 到班與離班時間、校區、作廢或補登紀錄、請假紀錄。
• 課堂紀錄、聯絡簿、作業與學習報告。

人臉辨識資料（只有監護人同意後才處理）

• 在機構打卡機前拍攝的臉部影像，只用於計算臉部特徵值與活體檢查，不寫入資料庫或日誌。
• 臉部特徵值（一組數值，不是照片）。
• 同意紀錄：同意、拒絕或撤回的狀態、條款版本、時間，以及同意方式：家長在 App 同意、紙本同意、學生在機構現場的拍攝裝置上確認身分並宣告已取得家長同意，或機構管理員在現場登錄同意。
• 現場同意另保存身分確認程度（宣告已取得家長同意，不是強身分驗證）、條款內容的雜湊值與校區；學生在拍攝裝置上同意時，另保存該裝置的識別碼；機構管理員登錄時，另保存登錄的人員。

通知與裝置

• 推播權杖（Expo push token）、App 產生的隨機安裝識別碼、平台（iOS 或 Android）、裝置名稱與通知權限狀態。
• 通知內容、送達與已讀紀錄，以及你的通知偏好。

LINE 綁定（選用）

• 你選擇綁定 LINE 時，我們保存 LINE 使用者識別碼與綁定時間，用於透過機構連結的 LINE 官方帳號傳送通知。

技術紀錄

• 伺服器在處理請求時記錄 IP 位址、時間、請求路徑與錯誤資訊，用於安全與除錯。

我們不蒐集的資料

• 位置、通訊錄、麥克風錄音或廣告識別碼。App 不使用相機；相簿權限只用於選擇頭像。
• App 沒有安裝第三方分析、廣告或當機回報 SDK。

3. 使用目的

• 建立與維護家長帳號，驗證身分與登入。
• 將家長與孩子的機構資料配對，並確認同一家庭的成員。
• 顯示孩子的到離班、請假、課堂與聯絡簿資料。
• 在監護人同意後，以人臉辨識記錄孩子到班。
• 透過 App 推播、LINE 或 Email 傳送到離班與機構通知。
• 回應你的要求、提供客服，以及處理刪除與更正申請。
• 維護系統安全、防止濫用、除錯，以及遵守法律義務。

個人資料保護法的特定目的：069 契約、類似契約或其他法律關係事務；090 消費者、客戶管理與服務；135 資（通）訊服務；136 資（通）訊與資料庫管理。

4. 法律依據與同意

• 為提供你申請的服務（契約或類似契約關係），我們處理帳號、綁定、出勤與通知資料。
• 人臉辨識、LINE 綁定、推播通知與頭像需要你的同意或主動設定。你可以隨時撤回，撤回不影響撤回前已進行的處理。
• 孩子的資料由機構依其與家長的關係提供。監護人以法定代理人身分代孩子作出人臉辨識等決定。
• 你可以選擇不提供資料，但部分功能可能無法使用，例如未驗證手機時無法完成家庭配對。

5. 孩子的資料與監護人的角色

Vispo Care 是給家長與監護人使用的服務，不是給孩子使用的 App，我們不會在 App 內直接向孩子蒐集資料。孩子的資料由機構建立；家長透過機構提供的綁定碼連結孩子。只有通過驗證的監護人與機構授權人員可以查看該孩子的資料。

6. 人臉辨識

以下是監護人同意的條款原文（版本 face-2026-09）：

經家長同意後，孩子在教室打卡機前錄製的臉部特徵值只用於記錄到班。系統不保存影像；家長可隨時在帳號頁關閉，關閉後特徵值立即刪除，之後需重新登錄。

• 同意方式：監護人可在 App 的帳號頁閱讀條款並同意，或在機構以紙本同意。機構也可以在現場的拍攝裝置上顯示學生版條款，由學生確認身分並宣告已取得家長（法定代理人）同意；系統只記錄這個宣告，不做強身分驗證，並傳送啟用通知給已綁定的家長，家長可在 App 撤回。未同意、拒絕或撤回時，機構的打卡機不會為孩子建檔或辨識。
• 建檔：機構人員在打卡機前拍攝 3 到 18 張影像。影像以加密連線傳送到 Vispo 自行營運的人臉服務，計算特徵值後即丟棄，不寫入資料庫或日誌。
• 使用範圍：特徵值只用於比對同一機構的打卡紀錄，不用於其他目的，也不提供給第三方。人臉服務使用獨立的資料庫權限。
• 撤回與刪除：監護人可隨時在 App 帳號頁撤回。撤回後特徵值立即停用，並排入刪除；App 會顯示刪除進度。之後要再使用，需重新同意並重新建檔。
• 條款變更：條款內容改變時，版本也會改變，系統會請監護人重新同意。
• 孩子離開機構：孩子離開機構或結束就讀時，系統不會自動刪除特徵值。監護人在 App 撤回同意，或機構在系統中撤回同意時，特徵值停用並刪除。孩子離開機構時，由機構刪除該孩子的特徵值。機構停用分校時，系統停用該分校的打卡機，但不會自動刪除特徵值。

7. 資料分享與受託處理者

我們不出售個人資料，也不為廣告目的分享資料。我們只在下列情況分享資料：

Parent App 不處理付款。機構管理員匯入名冊時，系統只把欄位標題與欄位格式類型傳給 OpenAI 以建議欄位對應，不傳送任何儲存格內容。

8. 國際傳輸

我們的後端服務在 Google Cloud 日本東京區域（asia-northeast1）執行。轉送簡訊驗證碼的服務（relay）在 Google Cloud 台灣區域（asia-east1）執行。Supabase 資料庫的所在區域依服務商（Supabase）的專案設定，本頁尚未列出確切區域。Expo、Resend、Apple、Google、LINE 與 Cloudflare 可能在台灣以外的國家處理資料。我們只把提供服務需要的資料傳給這些業者，並使用加密連線傳輸。

9. 保存期限

10. 資料安全

• 所有連線使用 HTTPS 加密。
• 資料庫使用列層級存取控制，家長只能看到自己家庭與已綁定孩子的資料。
• 人臉服務使用獨立的資料庫權限，影像不寫入資料庫或日誌。
• 頭像存放在非公開儲存空間，只透過 5 分鐘內有效的簽署網址讀取。
• 刪除帳號等敏感操作需要重新驗證手機或 Email。

11. 你的權利與行使方式

依個人資料保護法，你可以請求查詢或閱覽、製給複製本、補充或更正、停止蒐集處理利用，以及刪除你的個人資料。

在 App 內操作

• 修改顯示名稱、頭像、登入 Email 與家庭聯絡人：「個人設定」。
• 關閉通知或調整通知方式：「個人設定」→「通知偏好」。
• 移除推播裝置：「個人設定」→「通知裝置」。
• 解除 LINE 綁定：「個人設定」→「LINE 綁定」。
• 撤回人臉辨識同意：「個人設定」→ 孩子的人臉辨識區塊 →「撤回同意」。
• 刪除帳號：「個人設定」→「刪除帳戶」→ 驗證目前的手機或 Email →「確認刪除」。刪除範圍是整個家庭帳號：連結到這個家庭帳號的所有登入方式（手機、Email、Google 等），包括家庭中其他家長的登入，都會一併刪除；其他家長需要重新註冊並重新綁定孩子。刪除後，家庭帳號立即停止家長存取與通知。清除工作在下一次執行時（通常在 1 分鐘內）依第 9 節刪除帳號資料。刪除前 App 會請你確認，刪除後沒有取消期間。

寄信申請

寄信到 privacy@vispo.app，註明你的請求與登入手機或 Email。請勿寄送密碼、驗證碼或孩子照片。我們只用下列方式確認你的身分：你從帳號的登入 Email 回覆我們的信，或我們傳簡訊驗證碼到家庭已驗證的手機。確認後依個人資料保護法規定的期限回覆。刪除申請確認後，與在 App 內刪除的處理相同。

機構保管的孩子資料與出勤紀錄，以及依法必須保留的交易與安全紀錄，不會因刪除家長帳號而自動刪除。需要更正或刪除機構資料時，我們會協助轉交機構處理。

刪除家長帳號不會撤回孩子的人臉辨識同意。要撤回時，請在刪除帳號前於 App 撤回，或在刪除後聯絡孩子的機構。

12. 政策變更

政策內容改變時，我們會更新本頁的版本與生效日期；每個版本有各自的生效日期。重大變更會在生效日前至少 7 天，在 App 內或以 Email 公告。

13. 聯絡我們

對本政策或你的個人資料有任何問題，請寄信到 privacy@vispo.app。

Vispo Care Privacy Policy

Version privacy-2026-11-13 · Effective date 2026-11-13 · Vispo Technology Co., Ltd.

Summary

• Vispo Care is an app and website for parents and guardians. Parents can see their child's arrival and departure records, contact book and notifications.
• We process data only to provide the service. We do not sell personal data, we do not track you for advertising, and the app contains no analytics or crash-reporting SDK.
• Face recognition starts only after a guardian consents. We store only a face template, not images. A guardian can withdraw consent in the app at any time. The template is then disabled and deleted.
• You can edit your data, turn off notifications, unlink LINE, withdraw face consent or delete your account in the app, or you can email us.

1. Scope and data controller

This policy applies to the Vispo Care parent app (Android package app.vispo.parent, iOS), the parent website, and the back-end systems that support them.

Data controller: Vispo Technology Co., Ltd. (智加雲科技有限公司), Taiwan unified business number 62094663, registered address: 1F., No. 1, Ln. 89, Fuxing 1st St., Zhubei City, Hsinchu County, Taiwan.

Contact: privacy@vispo.app.

Vispo Technology Co., Ltd. is the controller of parent account data: your account, phone number or email, devices, LINE link, notification history, and the consent actions you take in the app. Your child's cram school, school or after-school center (the "organization") is the controller of the data that it enters and manages: the student roster, attendance records, guardian contacts, and face templates collected on site. Vispo processes that data on the organization's behalf. Send requests about that data to the organization. Vispo helps the organization with them.

2. Data we collect

Account and sign-in

• Phone number or email, and the sign-in method you choose (SMS code, email code or Google sign-in).
• If you use Google sign-in: the email, name and account identifier that Google provides.
• One-time verification codes. They are used only to sign in or confirm a phone number, and they expire.
• Sign-in tokens stored on your device to keep you signed in.

Parent profile

• Display name and avatar (uploaded only if you choose a photo; the app crops and resizes it on your device first).
• Interface language, time zone and time format.

Family and child links

• The link code from the organization, your relationship to the child, your name and phone number.
• Family contacts you add: name, relationship, phone number and email.
• Phone verification records used to confirm members of the same family.

Child data (provided by the organization; parents can view it and edit some fields)

• Name, English name, gender, date of birth, grade, school and class, student number.
• Address, phone and email.
• Food restrictions and care reminders. These can contain health-related information. Enter only what is necessary to care for the child.

Attendance and learning records

• Arrival and departure times, campus, voided or corrected records, leave records.
• Class records, contact book, assignments and learning reports.

Face recognition data (only after guardian consent)

• Face images taken at the organization's kiosk. They are used only to calculate the face template and to check liveness. They are not written to the database or to logs.
• Face template (a set of numbers, not a photo).
• Consent records: granted, denied or withdrawn state, terms version, time, and method: a parent consents in the app, paper consent, a student confirms their identity on the organization's on-site capture device and declares that a parent has consented, or an organization administrator records consent on site.
• For on-site consent we also store the identity assurance level (a declaration of parent consent, not strong identity verification), a hash of the terms content and the campus. When a student consents on the capture device, we also store the device ID. When an organization administrator records consent, we also store the staff member who recorded it.

Notifications and devices

• Push token (Expo push token), a random installation ID that the app creates, platform (iOS or Android), device name and notification permission state.
• Notification content, delivery and read records, and your notification preferences.

LINE link (optional)

• If you link LINE, we store your LINE user ID and link time to send notifications through the LINE Official Account that the organization connected.

Technical records

• When servers process a request, they record the IP address, time, request path and error details for security and debugging.

Data we do not collect

• Location, contacts, microphone recordings or advertising identifiers. The app does not use the camera; photo library access is used only to choose an avatar.
• The app contains no third-party analytics, advertising or crash-reporting SDK.

3. Purposes

• Create and maintain parent accounts, verify identity and sign in.
• Match parents with their child's organization records and confirm members of the same family.
• Show the child's attendance, leave, class and contact book records.
• After guardian consent, record the child's arrival with face recognition.
• Send attendance and organization notifications by app push, LINE or email.
• Respond to your requests, provide support, and process deletion and correction requests.
• Keep the system secure, prevent abuse, fix errors and meet legal obligations.

Specific purposes under Taiwan's Personal Data Protection Act: 069 contracts, quasi-contracts or other legal relationships; 090 consumer and customer management and services; 135 information and communication services; 136 information, communication and database management.

4. Legal basis and consent

• We process account, link, attendance and notification data to provide the service you request (a contract or similar relationship).
• Face recognition, LINE links, push notifications and avatars need your consent or your own action. You can withdraw at any time. Withdrawal does not affect processing done before it.
• The organization provides child data based on its relationship with the family. A guardian makes decisions such as face recognition consent for the child as the child's legal representative.
• You can choose not to provide data, but some functions may not work. For example, family matching needs a verified phone number.

5. Children's data and the guardian's role

Vispo Care is a service for parents and guardians. It is not an app for children, and we do not collect data directly from children in the app. The organization creates the child's records; a parent links to the child with a code from the organization. Only verified guardians and authorized organization staff can see the child's data.

6. Face recognition

This is the text that a guardian agrees to (version face-2026-09):

With a guardian's consent, the face template recorded at the classroom kiosk is used only to record arrival. No images are stored. Guardians can turn this off anytime on the account page; the template is deleted immediately and must be recorded again to use it later.

• How consent is given: a guardian can read the terms and agree on the Profile page of the app, or agree on paper at the organization. The organization can also show the student terms on a capture device on site. The student confirms their identity and declares that a parent (legal representative) has agreed. The system records only this declaration and does not do strong identity verification. It sends an activation notice to linked parents, who can withdraw consent in the app. If there is no consent, or if consent is denied or withdrawn, the kiosk does not enroll or recognize the child.
• Enrollment: organization staff take 3 to 18 images at the kiosk. The images go over an encrypted connection to a face service that Vispo operates. The service calculates the template and then discards the images. Images are not written to the database or to logs.
• Use: the template is used only to match check-ins at the same organization. It is not used for other purposes and is not given to third parties. The face service uses separate database permissions.
• Withdrawal and deletion: a guardian can withdraw at any time on the Profile page of the app. The template is disabled immediately and queued for deletion; the app shows the deletion status. To use face recognition again, the guardian must consent again and the child must enroll again.
• Changes to the terms: when the terms change, the version changes and guardians are asked to consent again.
• When a child leaves the organization: the system does not delete the template automatically when the child leaves or the enrollment ends. The template is disabled and deleted when a guardian withdraws consent in the app, or when the organization withdraws consent in the system. When a child leaves, the organization deletes that child's template. When the organization deactivates a campus, the system disables the kiosks of that campus, but it does not delete templates automatically.

7. Sharing and service providers

We do not sell personal data and we do not share it for advertising. We share data only as follows:

The parent app does not process payments. When an organization administrator imports a roster, the system sends only column headers and column format types to OpenAI to suggest column mapping. It sends no cell values.

8. International transfers

Our back-end services run in the Google Cloud Tokyo, Japan region (asia-northeast1). The service that relays SMS verification codes runs in the Google Cloud Taiwan region (asia-east1). The Supabase database region follows the provider (Supabase) project setting. This page does not yet list the exact region. Expo, Resend, Apple, Google, LINE and Cloudflare can process data outside Taiwan. We send these providers only the data needed to provide the service, over encrypted connections.

9. Retention

10. Security

• All connections use HTTPS encryption.
• The database uses row-level access control. Parents can see only their own family and linked children.
• The face service uses separate database permissions. Images are not written to the database or to logs.
• Avatars are in private storage and are read only through signed URLs that expire within 5 minutes.
• Sensitive actions, such as account deletion, need a new verification of your phone or email.

11. Your rights and how to use them

Under Taiwan's Personal Data Protection Act, you can ask to access or review your personal data, get a copy, add to or correct it, stop its collection, processing or use, and delete it.

In the app

• Edit display name, avatar, sign-in email and family contacts: Profile.
• Turn off notifications or change channels: Profile → Notification preferences.
• Remove push devices: Profile → Notification devices.
• Unlink LINE: Profile → LINE link.
• Withdraw face recognition consent: Profile → the child's face recognition section → Withdraw consent.
• Delete your account: Profile → Delete account → verify your current phone or email → Confirm deletion. Deletion covers the whole family account: every sign-in method linked to the family account (phone, email, Google and others), including the sign-ins of other parents in the family, is deleted. Other parents must register again and link the children again. Parent access and notifications for the family account stop immediately. The clean-up job deletes the account data as section 9 describes on its next run, usually within 1 minute. The app asks you to confirm before deletion. There is no cancellation period after deletion.

By email

Email privacy@vispo.app with your request and your sign-in phone or email. Do not send passwords, verification codes or child photos. We verify your identity only in one of these ways: you reply to our email from the account's sign-in email, or we send an SMS code to the family's verified phone. We then reply within the periods that the Personal Data Protection Act sets. After we confirm a deletion request, it is processed in the same way as a deletion in the app.

Child data and attendance records kept by the organization, and transaction and security records that the law requires us to keep, are not deleted automatically when you delete a parent account. To correct or delete organization records, we help send your request to the organization.

Deleting a parent account does not withdraw your child's face recognition consent. To withdraw it, do so in the app before you delete the account, or contact your child's organization after deletion.

12. Changes to this policy

When this policy changes, we update the version and the effective date on this page. Each version has its own effective date. We announce material changes in the app or by email at least 7 days before they take effect.

13. Contact us

For questions about this policy or your personal data, email privacy@vispo.app.

Delete your account and data · 繁體中文