Privacy & Data Protection Policy
Applies to the 1ERP mobile app (Android, iOS) and all websites operating on the Huy Hoàng Software platform.
Applies to: mobile app 1ERP (Android: com.huyhoangsoftware.dashboardapp, iOS) and the website system huyhoangsoftware.com together with the websites, online stores, and admin portals operated by Huy Hoàng Software on this platform (collectively, the «System»).
Responsible entity: CÔNG TY TNHH ĐẦU TƯ VÀ CHUYỂN ĐỔI SỐ HUY HOÀNG (Huy Hoàng Software) — Address: 63/1 Trần Huy Liệu, Thôn 4 — Email: services@huyhoangsoftware.com — Hotline: 0868 928 426.
Effective from: 06/11/2026. Version 1.0.
This policy is prepared in accordance with the 2015 Law on Network Information Security, the 2018 Law on Cybersecurity, Decree 13/2023/ND-CP on personal data protection, and Decree 52/2013/ND-CP on e-commerce, and also meets the Google Play and App Store user data policies.
1. What the System does and who its users are
1ERP is an enterprise management (ERP) platform covering: sales and orders, inventory, accounting – receipts and payments, HR – timekeeping – payroll, contracts, projects, internal chat and voice/video calls, customer relationship management (CRM), shipping, and e-commerce websites. Users include: customer businesses (account owner), staff are issued accounts by the business, and shoppers on websites operated by the System.
For employee and customer data that the business enters into the System, that business is the Data controller; Huy Hoàng Software is the Data processor under the service contract. For accounts registered directly on huyhoangsoftware.com, Huy Hoàng Software is the Data controller.
2. Data we collect
2.1. Data you provide
- Account information: full name, phone number, email, password (stored hashed, unreadable by anyone), avatar, username, and role and department within the business.
- Staff information (when the business uses HR features): date of birth, gender, national ID/citizen ID number, address, bank account number for salary payment, salary level, employment contract, insurance, and documents uploaded by you or the business.
- Transaction information: orders, delivery addresses, receipt and payment vouchers, invoices, contracts, document content, and attachments.
- Content you create: messages, voice messages, files shared in chat, comments, task notes, and proposals.
- Support contact information: content you send via forms, email, Zalo, and hotline.
2.2. Data collected through device permissions (only when you allow it and only for the corresponding feature)
| Permissions | Purpose | When collected |
|---|---|---|
| Position (precise / approximate) | Location-based timekeeping: comparing coordinates with the business's timekeeping points; delivery and point-of-sale location. | When you tap timekeeping or use the map. |
| Background location | Automatically remind you or record timekeeping when you arrive at or leave your workplace, if the business enables this feature and you consent in the app. The app displays a clear notification while tracking location in the background. | Only when the «automatic timekeeping» feature is enabled. You can turn it off at any time in Device Settings or in the app. |
| Camera & photos/videos | Take timekeeping photos (face verification), take or choose photos of documents, products, and avatars, send photos in chat, and make video calls. | When you actively take or choose photos or turn on the camera during a call. |
| Microphone & recording | Voice/video calls, voice messages, speech-to-text, call recording when the business enables call recording (everyone on the call sees the «Recording» indicator). | When you are in a call or tap record. |
| Biometrics (Face ID / fingerprint) | Quick app unlock. Authentication is performed by the operating system; the app does not no receive or store biometric data. | When you enable «Sign in with biometrics». |
| Files / storage | Upload and download documents, contracts, invoices, and photos. | When you select a file. |
| Notification | Notifies you of new messages, incoming calls, orders, request approvals, and timekeeping reminders. | When you allow notifications. |
| Contacts, calendar (iOS, optional) | Select a phone number when creating a customer; add meeting events to the device calendar. | Only when you actively use the feature and grant permission. We do not upload your entire contact list to our servers. |
Face photo during timekeeping is stored with the timekeeping record for your business to cross-check; the System does not create a biometric profile to identify you on other platforms.
2.3. Automatically collected data
- Device & app: device type, operating system, app version, language, installation identifier (Firebase Installation ID), and device ID for sending push notifications, recognizing login sessions, and alerting on unusual logins.
- Usage logs: IP address, login time, pages/features used, and app errors — for security, fraud prevention, and bug fixing.
- Cookies on websites: login session cookies, language/currency preference cookies, and shopping cart cookies; analytics cookies (Google Analytics, Facebook Pixel, TikTok Pixel) only when the business operating the website enables them. You can turn off cookies in your browser.
Us no collect advertising identifiers (Advertising ID), no track you across other companies' apps, and no sell personal data.
3. Payments and financial data
- Service payments and purchases is made through payment gateways licensed in Vietnam and internationally: bank transfer / QR via SePay, VNPAY, MoMo, PayPal (depending on the website). Card numbers, CVV codes, and online banking passwords are processed by the payment gateway on its own systems in accordance with the PCI DSS standard; The System does not store your card numbers or online banking login credentials.
- We only receive the following back from the payment gateway: transaction ID, amount, time, status, and the last 4 digits or transfer account name — for reconciliation and to confirm orders and invoices.
- The business's bank account (to receive payments) and employees' salary accounts is stored encrypted in the database and can be viewed only by people with accounting / HR permissions at that business.
- E-invoice: when a business issues an invoice, the buyer's name, tax code, address, and email are sent to the e-invoice provider (Viettel SInvoice, SePay eInvoice) in accordance with General Department of Taxation regulations.
- Ledger: receipt and payment data, receivables and payables, and payroll are used to prepare the business's books and financial statements in accordance with Vietnamese accounting standards; only personnel granted accounting permissions by that business can access them.
4. What we use data for
- Provide the exact functions you request: login, order management, inventory, timekeeping, payroll, chat, calls, invoices, and reports.
- Send business notifications (new orders, calls, voucher approvals) and security notifications (unusual logins, password changes). We do not send advertising via push notifications unless you subscribe.
- Security and fraud prevention: detecting unusual logins, restricting access, and keeping logs.
- Operations, bug fixing, and anonymized statistics to improve the product.
- Fulfill legal obligations: retain accounting documents, invoices, and employment data for the statutory period.
- Artificial intelligence: when enabled by the business, the System uses AI for speech-to-text, summarizing call minutes, chat assistance, and document reading (OCR). Data is processed only for that feature and is not used to train third-party models (AI providers are used under enterprise API terms and do not retain data for training).
Legal bases for processing: your consent (when granting device permissions or registering an account), performance of the service contract with the business, legal obligations, and legitimate interests in system security.
5. Who we share data with
We share data only to the extent necessary for the features you use, with the following types of partners:
| Partner type | Partners | Data shared |
|---|---|---|
| Your business | The business account owner issues you an account | All business data you create in that business account (timekeeping, timekeeping location, timekeeping photos, work group messages, documents). |
| Infrastructure & notifications | Google Firebase (Cloud Messaging, Remote Config, Installations); servers located in Vietnam | Device ID, installation ID, and abbreviated notification content. |
| Map | Google Maps | Coordinates to display the map and calculate distances when you use map features. |
| Sign in | Google Sign-In, Sign in with Apple | Email, name, and avatar from the account you choose to sign in with. |
| Voice / video calls | LiveKit (servers operated by us in Vietnam) | Audio and video streams during calls; call recordings are stored on our servers, in the business's own folder. |
| Artificial intelligence | OpenAI or an AI model operated by us (depending on the business's configuration) | Audio / text to be transcribed, summarized, or answered; no identifying information is sent beyond the content to be processed. |
| Payment | SePay, VNPAY, MoMo, PayPal | Amount, order ID, and the payer's name and phone number (if the gateway requires). |
| E-invoice | Viettel SInvoice, SePay eInvoice | Buyer information on invoices as required by tax regulations. |
| Shipping | Giao Hàng Nhanh (GHN), Giao Hàng Tiết Kiệm (GHTK), Viettel Post, and the carriers chosen by the business | Recipient name, phone number, and address, package contents, and cash on delivery (COD) amount. |
| Message | Zalo Official Account, Zalo Mini App, email (SMTP/Gmail), SMS (if enabled by the business) | Phone number / email and transaction notification content. |
| Government agencies | Tax authorities and competent authorities | When there is a lawful written request or under tax and insurance declaration obligations. |
All partners are bound by contract or terms of service to use data only to provide services to us. We do not sell or rent personal data to anyone.
6. Data storage and protection
- Servers are located in Vietnam; each business's data is kept separate (its own database and file folder) so that one business cannot access another business's data.
- HTTPS/TLS encrypted transmission; passwords hashed one-way; bank accounts and API keys encrypted at rest; periodic encrypted backups.
- Detailed role-based permissions; access logs; alerts for logins from new devices; automatic logout of inactive sessions; support for biometric login and PIN on the device.
- Huy Hoàng Software personnel access data only when technical support is needed at the business's request and are bound by confidentiality commitments.
- In the event of a data breach, we will notify the affected business and the competent authorities within 72 hours as required by regulations.
7. Retention period
- Account: throughout the period of use and up to 30 days after account deletion (to complete deletion from backups).
- Accounting documents, invoices, and contracts: 10 years under the Law on Accounting; employment records, payroll, and insurance: in accordance with the Labor Code and insurance regulations.
- Timekeeping location and photos: according to the business's retention cycle, 24 months by default.
- Call recordings and AI minutes: 90 days by default, adjustable by the business; the person who started the call can delete it sooner.
- Security logs: 12 months. Anonymized / statistical data: without limitation.
8. Your rights
- View and edit personal information in the section Personal › Account information of the app or admin page.
- Withdraw consent location, camera, microphone, and notifications in Device Settings at any time; the related features will stop working but your account remains fully usable.
- Delete account directly in the app: Personal › Delete account, or send a request to services@huyhoangsoftware.com. The account is deactivated immediately; personal data is deleted or anonymized within 30 days, except for data that must be retained by law (accounting records, employment records), which will be separated from your identifying information once the retention period expires.
- Request a copy data, object to or restrict process, complaint: send an email to services@huyhoangsoftware.com; we respond within 72 working hours.
- If you are an employee using an account issued by a business, certain requests (deleting timekeeping or payroll data) must be confirmed by that business — the Data controller — in accordance with labor law.
9. Children
The System is intended for businesses and people aged 18 and over. We do not knowingly collect data from children under 16; if we discover any, we will delete it immediately. Parents may contact services@huyhoangsoftware.com.
10. Transfer of data abroad
Data is stored in Vietnam. Some partners (Google Firebase/Maps, OpenAI, PayPal, Apple) may process data on servers outside Vietnam to the minimum extent needed for the feature; such transfers comply with the cross-border data transfer impact assessment dossier under Decree 13/2023/ND-CP and the partners' security commitments.
11. Changes to this policy
When there are important changes, we will notify you in the app and on this page at least 7 days before they take effect. Continued use after the effective date means you have read the new policy.
12. Contact
CÔNG TY TNHH ĐẦU TƯ VÀ CHUYỂN ĐỔI SỐ HUY HOÀNG (Huy Hoàng Software)
Address: 63/1 Trần Huy Liệu, Thôn 4
Data protection email: services@huyhoangsoftware.com · Hotline / Zalo: 0868 928 426 · Website: huyhoangsoftware.com
Privacy Policy (English summary)
This policy applies to the 1ERP mobile app (com.huyhoangsoftware.dashboardapp) and the huyhoangsoftware.com platform operated by Huy Hoang Investment & Digital Transformation Co., Ltd. (Huy Hoang Software), Vietnam. 1ERP is a business management (ERP) app used by companies and their staff.
Data we collect: account data (name, phone, email, hashed password, avatar, role); HR data entered by your company (ID number, address, bank account for salary, payroll); business records (orders, invoices, vouchers, contracts, files); messages and call content; precise location, including in the background only when your company enables location-based attendance and you consent (a persistent notification is shown); camera/photos (attendance photo, documents, video calls); microphone (calls, voice notes, call recording with a visible indicator); device identifiers (Firebase installation/device token) for push notifications and security; usage logs and IP. Biometric unlock (Face ID / fingerprint) is handled by the OS; we never receive biometric data. We do not use advertising IDs and do not sell personal data.
How we use it: to provide the features you use, send transactional notifications, secure accounts, fix bugs, meet legal obligations (accounting, tax, labour), and — when enabled by your company — AI transcription and summaries (providers are used under enterprise API terms that exclude training on your data).
Who we share it with: your employer (the data controller for staff data); Google Firebase and Google Maps; Google / Apple sign-in; our self-hosted LiveKit call servers; AI providers (OpenAI or self-hosted models); payment gateways (SePay, VNPAY, MoMo, PayPal — card data is handled by them, not stored by us); e-invoice providers (Viettel SInvoice, SePay); delivery carriers (GHN, GHTK, Viettel Post); messaging channels (Zalo, email, SMS); and authorities when legally required. All partners may only use the data to provide their service to us.
Security & retention: servers in Vietnam, per-company data isolation, TLS in transit, hashed passwords, encrypted bank details and API keys, role-based access, audit logs, encrypted backups. Accounts are deleted within 30 days of a deletion request; accounting and labour records are kept for the periods required by Vietnamese law; attendance location/photos default to 24 months; call recordings default to 90 days.
Your rights: view and edit your data in the app; revoke device permissions at any time; delete your account in-app (Profile › Delete account) or by emailing services@huyhoangsoftware.com; request a copy, restriction or objection; we reply within 72 business hours. The service is not intended for children under 16.
Contact: Huy Hoang Investment & Digital Transformation Co., Ltd. — 63/1 Trần Huy Liệu, Thôn 4 — services@huyhoangsoftware.com — 0868 928 426 — https://huyhoangsoftware.com. Effective 06 Nov 2026, version 1.0.