Privacy Policy
Effective 11/10/2026
This policy explains how Hedra Skills processes your personal data under Vietnam's Personal Data Protection Law No. 91/2025/QH15 and Decree 356/2025/ND-CP. The Vietnamese version prevails.
1. Controller
[CẦN BỔ SUNG: seller name], address [CẦN BỔ SUNG], privacy email admin@hedraup.com.
2. Data we collect
| Data | Purpose | Basis |
|---|---|---|
| Name, email, avatar (Google or email link) | Account, sign-in, license delivery | Contract |
| Phone/Zalo (optional) | Support, scheduling the service | Consent |
| Invoice details (company, tax code, address) | Issuing an invoice on request | Legal obligation |
| Orders and payments (transaction ref, amount; no full account number) | Confirming payment, accounting | Contract, legal obligation |
| Licenses, downloads (time, hashed IP) | Delivery, preventing unlicensed sharing | Legitimate interest |
| Contact form messages | Replying to you | Consent |
We never sell personal data or use it for advertising.
3. Processors
Supabase (database and auth, Singapore), Vercel (hosting, cookie-free analytics), payOS (VietQR payment gateway, Vietnam), Google (if you sign in with Google), a transactional email provider (e.g. Resend). Some store data outside Vietnam (Singapore, USA); transfers follow Law 91/2025/QH15.
4. Retention
Account: until you ask for deletion. Orders and payment records: as required for accounting records (at least 10 years). Contact messages and download logs: up to 24 months.
5. Your rights
You may know, consent, access, correct, delete, restrict, obtain a copy, withdraw consent and complain. Write to admin@hedraup.com. Order records we must keep by law are retained for that period.
6. Security
HTTPS, row-level security in the database, license keys stored only as hashes, secrets only on the server. Breaches are notified as required by law.
7. Cookies
See the Cookie policy.