VatLieuOpsEnglish version
Privacy Policy
This policy applies to VatLieuOps — operations software for the construction-materials trade — including the web app at vatlieuops.app and the VatLieuOps apps for Android and iOS. It describes what data we collect, how we use, share, store and protect it, and how you can ask us to delete it. If the two versions differ, the Vietnamese version prevails.
1. Who is responsible for the data
VatLieuOps is provided to businesses. Each business creates accounts for its staff and drivers and enters its own business data (customers, suppliers, drivers, orders, balances…). The business decides what is entered and who can see it; VatLieuOps stores and processes that data on the business's behalf. VatLieuOps is responsible for account data, trial requests and technical data.
2. Data we collect
Account information
Business code, username, full name, phone number and role (admin, dispatcher, driver). Passwords are stored only as one-way hashes; nobody can read the original password.
Trial requests
When you request a trial on the sign-in screen: the phone number (Zalo) or email address you enter, so we can contact you to set up an account.
Business data entered by users
Customer, supplier, driver and vehicle details (names, phone numbers, addresses, licence plates, driving licences), orders, pickup and delivery addresses, amounts, payments, balances, expenses and edit history (who changed what, and when).
Photos
Proof-of-delivery photos and expense receipt photos, only when you take them with the camera or pick them from your gallery. The app accesses only the photos you choose; it does not read your photo library.
Voice recordings
Only in the web app, when you tap record to create an order by voice; the mobile apps do not record audio or request microphone access. The recording is sent to be turned into a draft order for you to review; VatLieuOps does not store the recording in its database.
Technical information
IP address, browser or device type, access times and server error logs, used to run and protect the service. At sign-in, Cloudflare Turnstile checks the browser or device to block automated (bot) access.
Data kept only on your device
- Your sign-in session, kept in the device's secure storage.
- If you turn on quick sign-in with fingerprint or Face ID: your business code, username and password, encrypted in the device's secure storage. Fingerprints and faces are checked by the operating system; the app never receives or sends biometric data.
- A driver's actions and photos taken while offline are kept on the device and uploaded automatically once the connection returns.
Data we do not collect
GPS location, contacts, messages, advertising IDs. The app shows no ads and uses no third-party analytics or tracking tools.
3. How we use data
- To provide the software's features: orders, deliveries, balances, cash book, expenses, statements and exports.
- Sign-in, authentication, role-based access and account protection against unauthorized access.
- To contact you about a trial account and to provide support you ask for.
- To bill the service by the number of orders created.
- Backups, to restore data after an incident.
We do not sell or rent data, and we do not use it for advertising.
4. Sharing
Within your business
Each business's data is kept separate and is visible only to that business's users, according to their roles. Drivers see only their own trips and trips waiting to be accepted.
Service providers
We use the following providers to run the service; they process data only to provide their service to us:
- MongoDB Atlas — database hosting.
- Cloudflare — networking and security, bot checks (Turnstile), backup storage.
- Google (Gemini API) — turns voice recordings into draft orders, only when you use voice order creation in the web app. Google processes recordings under the Gemini API terms.
Legal requirements
We disclose data to authorities only when lawfully required under Vietnamese law.
5. Security
- All traffic between the app and our servers is encrypted with HTTPS.
- Passwords are one-way hashed; sign-in sessions expire.
- Each business's data is kept separate; every access is checked against the user's role.
- Important edits are recorded in an audit history.
6. Retention
Data is kept while the business uses the service. When deletion is requested, the data is removed from our systems within 30 days; older backups containing it are deleted automatically within 8 days after that. Trial requests are kept until we have handled them and are deleted on request.
7. Requesting account and data deletion
Staff and driver accounts are created and managed by the business you work for. You can ask for your account and personal data to be deleted at any time.
Staff and drivers
- Send your deletion request to the administrator of the business that manages your account.
- The administrator opens Hệ thống → Tài khoản (System → Accounts), selects the account, switches off “Hoạt động” (Active), then chooses “Xóa thông tin” (Delete personal data) and types the username to confirm.
- If you cannot reach the administrator, or the request is not handled within 30 days, email [email protected] or message Zalo +84 913 569 028 with your business code and username. We pass the request to the business's administrator and follow it up until it is done.
What is deleted: the account's username, password, full name, phone number and notes, including in the account's edit history. The account can no longer sign in.
What is kept: orders, payments and balances already recorded belong to the business and are kept as required by accounting and tax rules; on those records the person is shown as “Tài khoản đã xóa” (deleted account). A driver's profile in the business's driver list (used for trips and pay) is managed by the business; you can ask the business to correct or remove it.
Administrators: deleting all of a business's data
The administrator sends the request by email or Zalo as above. We verify it through the registered phone number or email, reply within 7 working days and delete all of the business's accounts, business data and photos within 30 days of verification.
Older backups containing deleted data are deleted automatically within 8 days. On your device, the sign-in session is removed when you sign out, quick sign-in details are removed when you turn off quick sign-in on the sign-in screen, and all app data is removed when you uninstall the app.
8. Your rights
You have the right to be informed about, access, correct and request deletion of your personal data, and to withdraw consent, under Vietnamese personal data protection law. Staff and drivers can contact the business that manages their account or contact us directly.
9. Children
VatLieuOps is business software and is not intended for anyone under 18. We do not knowingly collect children's data.
10. Changes
When this policy changes, we update this page and the effective date at the top. For significant changes, we notify users in the app before they take effect.
11. Contact
For any question about this policy or your personal data:
- Phone, Zalo: +84 913 569 028
- Email: [email protected]