We collect only the data needed to run the service, never sell personal data and always tell you where your data goes.
About this translation
This English version is provided for convenience only. If it differs from the Vietnamese version, the Vietnamese version prevails.
1. Data we collect
Account: Gmail address, username, full name and password (hashed with Argon2, never stored in readable form). When you sign in with Google, we receive your email address and name from your Google account.
Verification and sessions: email verification codes, password reset links and sign-in sessions (with browser information) — codes and tokens are stored hashed.
Transactions: credit top-up orders (amount, order code, status), bank transaction details sent to us by our reconciliation partner (transaction ID, amount, description, time) and your credit history. We do not collect card numbers or banking passwords.
Tool data: Google Form links, the configuration and the responses generated, the log of every submission and saved templates; saved research models; Excel files you upload; Google Sheets links and the data read from them when you use the encoding tool; the topic and model when you build a questionnaire.
Support: messages in the chat, the name and phone number/Zalo you choose to leave, and the page you were viewing when you started the chat.
Technical: IP address, browser, and the path and status code of each request in the server logs (query parameters are not logged).
2. How we use it
To provide, operate and protect the tools and services you request.
To verify accounts, process payments and record credits.
To support you when you contact us, and to notify you of important changes to your account or the service.
To detect and prevent fraud, abuse and technical incidents.
3. Cookies and browser storage
A sign-in session cookie (HttpOnly, sent over HTTPS only) to keep you securely signed in.
Temporary cookies for Google sign-in and to protect the API from automated access.
Browser storage (localStorage/sessionStorage) to keep guests’ models, the support chat session, which notices you have dismissed and the display language you chose.
We do not use advertising cookies.
4. Third parties that process data
To run the service, some data is processed by the following providers:
Google: Google sign-in, reCAPTCHA against spam on the sign-in/sign-up pages, the Gemini API (your topic, model and list of questions when you build a questionnaire or encode data), Google Forms and Google Sheets (when you ask us to read a form, submit responses or read a spreadsheet), Google Fonts and YouTube (guide videos).
Cloudflare: delivering and protecting the website.
The cloud server and database providers where the system is deployed.
Payment reconciliation partners (SePay, VietQR) to confirm bank transfers.
Telegram: internal notifications to administrators about support messages and transactions.
We do not sell personal data, and we disclose it to competent authorities only when the law requires it.
5. Retention
Account data is kept for as long as the account is active.
Data from completed jobs may be archived offline and removed from the live system after a period of time.
Server logs are rotated by size and overwritten automatically.
Transaction data is kept for as long as needed for reconciliation and to meet legal obligations.
6. Security
All connections are encrypted with HTTPS; passwords are hashed with Argon2; sign-in and password reset tokens are stored hashed; administrator permissions are separated and administrative actions are logged. No system is completely secure — if we discover an incident, we will notify you and fix it promptly.
7. Your rights
View and edit your profile, change your password and revoke sign-in sessions directly on the Profile page.
Request a copy, correction or deletion of your personal data and account by contacting support from your registered email address.
Withdraw your consent to data processing; doing so may make some features unavailable.
We process personal data in accordance with Vietnamese law on personal data protection (Decree No. 13/2023/ND-CP). Users under 16 need the consent of a parent or guardian.
8. Changes to this policy and contact
This policy may be updated; a new version takes effect when it is posted on this page. For any question about your personal data, please contact us through the channels on the Contact page.