Privacy Policy

VieBoost is a product by Vasbook, operated by Lê Khả Thanh (solo founder, bootstrapping). We take your privacy seriously. This Privacy Policy explains what data we collect, what we don't, and how we comply with Vietnamese data protection laws.

Data controller (PDPL Art. 9): Lê Khả Thanh (operating Vasbook).
Address: Chung cư Xuân Mai Complex, Phường Yên Nghĩa, Thành phố Hà Nội
Contact: [email protected] (support) · [email protected] (general)

1. Core principles

• On-device first — messages, contacts, orders, debts NEVER leave your phone. All chat content stays in the local SQLite database on your device.
• Zero-knowledge backend — VieBoost servers only store: user identifier (email; phone optional, only for 2FA), subscription tier, billing status, device registry metadata. We CANNOT read your messages.
• Mirror Zalo permissions — we never request more Android permissions than the Zalo official app needs.
• No third-party tracking — no Google Analytics, no Mixpanel, no Facebook Pixel. We use Plausible (privacy-first, no cookies, no PII).

2. Data we collect on web (vieboost.vasbook.com)

2.1 Account data (Postgres on VPS in Vietnam)

• Email (primary identifier — used for magic-link / OTP login)
• Phone number (optional, only if you enable 2FA; format +84…)
• Display name (you set this)
• Subscription tier + payment status (Free/Basic/Start/Pro/Premium/Enterprise)
• Device registry: device name, OS version, app version, hardware fingerprint hash, last-seen timestamp. NO push tokens stored without your consent.
• Audit log: login/logout/2FA/billing events (timestamp, IP, user-agent)

2.2 Data pushed from the mobile app

• The app does NOT transmit your messages, orders, contacts, or debts to VieBoost servers.
• All business data stays on your device — see Section 3.
• The only data sent to our servers is what's listed in Section 2.1 (account & billing).

2.3 What we DO NOT collect

• ❌ Message content (text, photos, voice)
• ❌ Contact names, phone numbers, addresses
• ❌ Order/customer/debtor details (only aggregates)
• ❌ Zalo / Facebook session tokens
• ❌ Location data
• ❌ Browser cookies for tracking (only essential session cookie + language preference)

3. Data we collect on mobile app

3.1 Notification access — why VieBoost reads notifications

VieBoost uses Android's Notification access (NotificationListenerService) to read incoming message notifications from apps such as Zalo, Messenger, Shopee and TikTok. This is core functionality that powers the unified inbox. Notification content is processed entirely on your device and is NEVER transmitted to VieBoost servers. It is used only to display your combined inbox and to derive contacts/orders — never sold, shared, or used for advertising. You can revoke this permission anytime in Android Settings; uninstalling the app deletes all data.

3.2 Local data stored

All data on the app is stored locally in a SQLite database protected by the Android app sandbox (not accessible to other apps). Backups you export are encrypted with AES-CTR + HMAC. Includes:

• Message cache (90-day rolling retention, user-configurable 30–365 days)
• Contacts derived from notifications
• Sale orders, purchase orders, payments, shipments, bank accounts
• Reply history, bill PNG receipts (cached 7 days)

None of this data is uploaded to VieBoost servers. Uninstalling the app = deleting all data.

4. Vietnam legal compliance

• Nghị định 13/2023/NĐ-CP (PDPL) — Personal Data Protection Decree. We obtain your consent through an in-app disclosure before enabling Notification access. Source
• Luật An ninh mạng 2018 — Cybersecurity Law. Data stored on-device + Vietnam VPS. Source
• Luật Giao dịch điện tử 2023 — E-Transactions Law. VieBoost is NOT a payment processor (we use Paddle MoR).
• Luật ATTTM 2015 — Information Security Law. We implement Talsec freeRASP runtime protection on the mobile app.

5. Data retention

• messagesCacheDays: 90
• notifRawDays: 7
• auditLogDays: 30
• ordersContactsPaymentsShipments: forever-local-until-user-delete

6. Your rights (PDPL Đ.9)

• Access / Portability: export your on-device data anytime via in-app Backup (an encrypted .vbbackup file). For your web/billing account data, contact the DPO email below.
• Rectification: edit your account info on the Account page.
• Deletion: uninstall the app to delete all on-device data. To delete your web/billing account (email + subscription), email the DPO below.
• Withdraw consent: revoke Notification access anytime in Android Settings.
• Object/restrict: contact DPO email below

7. Cookies & tracking

We use only essential cookies:

• vieboost_session: JWT session token (24h expiry, HTTP-only, Secure flag, SameSite=Strict)
• lang: language preference (vi/en, 1-year expiry)

No advertising cookies. No third-party tracking pixels. Plausible analytics is cookieless.

8. Third-party services we use

• Paddle (Merchant of Record) — payment processing, VAT compliance. Paddle Privacy
• SePay — Vietnamese bank-transfer reconciliation for VietQR payments.
• Cloudflare (CDN + DDoS protection)
• Let's Encrypt (free SSL certs)
• Plausible (anonymous analytics)
• Google Gemini (optional AI assistant) — only if you add your own API key (BYOK). We send only your typed question with personal data (phone, email, bank numbers, names) removed; no business data. Google AI terms

9. Data breach response

If a breach occurs affecting personal data, we will notify affected users via email within 72 hours per PDPL Đ.23.

10. Children's privacy

VieBoost is designed for small business owners (CN-HKD / SME). We do not knowingly collect data from anyone under 16.

11. Changes to this policy

We will post material changes here with a new "Last updated" date. Continued use after changes = acceptance.

12. DPO Contact

Data Protection Officer: [email protected]

General support: [email protected]

Postal address: Chung cư Xuân Mai Complex, Phường Yên Nghĩa, Thành phố Hà Nội