Privacy policy

Personal data protection

• Bui Dang Minh (Minh Spark) is the contact responsible for website-operation data. Data-rights contact: buidangminh23@gmail.com, phone/Zalo 0384741350. Operator details: https://minhspark.com/en/policies/#thong-tin.
• Depending on actions, data includes name, email, telephone, contact address, company, messages, orders, reviewed agreement/terms, version, integrity hash and acceptance timestamp, payment references/status, the email of the software account to be registered, support history and subscriptions. Technical data may include IP, logs, paths, referrers, device category and performance. Account passwords and card, bank, wallet or PayPal passwords or OTPs are not requested.
• Software and AI plan registration: to register, pay for and manage the plan as the customer authorises, Minh Spark signs in to the customer's Claude, ChatGPT or other software account with the account email and the one-time verification code the provider sends to that email, never with a password. While signed in, Minh Spark can see what the account displays, such as name, email, plan and billing settings, and the list of conversations and files. Minh Spark only works in the plan and billing settings, does not open, read, copy or keep conversations, files or other data in the account, and does not keep verification codes after use. After each action the customer can end Minh Spark's session with the sign-out-of-all-sessions option in the account's security settings.
• Purposes: inquiries, contracting/fulfillment, download/activation, authorised plan registration and management, reconciliation/refunds, support/complaints, abuse prevention, reliability, legal obligations and subscribed messages. Processing requires appropriate purposes/grounds; necessary consent must be requested separately, not inferred from silence.
• Marketing is optional and separate from necessary transactional email. Unsubscribe by email link or the contact address. Withdrawal does not invalidate earlier lawful processing but applies to future consent-based processing.
• Functional recipients/providers: Vercel (hosting/performance), Supabase (storage), Upstash (rate limits/queues), Resend (email), VietQR, an automatic bank-transfer reconciliation service and selected banks/wallets (reconciliation), PayPal (payments), Telegram (order operations notifications), the software/AI provider the customer chooses (plan registration and billing on the customer's account). Sharing is limited to necessary functions; authorities receive data on a lawful basis.
• Some providers operate outside Vietnam, so data may be processed abroad. Processing/transfers must meet legal requirements; this policy does not certify completed assessments or transfer formalities. Payment providers' policies cover data they directly collect.
• Browser storage remembers language/cart choices and pending checkout details to resume a session: name, email, order reference, amount and document IDs. A 24-hour age limit is checked upon subsequent loading; data may remain on the device until that check or until website data is cleared in browser settings. Clearing browser data does not delete server-side order records.
• Display names and messages submitted to the guestbook may become public after moderation. Do not include secrets or other people's personal information in public submissions.
• Analytics records use hashes instead of IPs, but hashing does not make all data anonymous; infrastructure may process IPs/logs for security and operations.
• Retention follows purpose: inquiries until completion and related needs end; orders through fulfillment, warranty, disputes and mandatory periods; mailing subscriptions until withdrawal/purpose ends. Data no longer lawfully needed should be deleted/anonymized; backups follow system cycles and legal duties.
• Individuals may request information, access/copies, correction, deletion, restriction/objection, withdrawal, complaints and other legal rights. Email the request type and enough information to match records; proportionate verification prevents improper disclosure. Initial response within 2 working days; completion follows request-specific legal deadlines, explaining required retention or inability to comply fully.
• Appropriate access controls, sharing limits and system protection are applied without absolute security guarantees. Incidents are investigated, contained, notified/remedied as required. Do not send unnecessary secrets or sensitive data.