Privacy policy
Effective from 09/12/2026.
1. Controller
APIHUB TECH (tax code [to be added], address [to be added], email [to be added]) controls and processes personal data collected through kho.apihub247.com, under Personal Data Protection Law 91/2025/QH15 and Decree 356/2025/ND-CP.
2. Data we collect
- Account: email; display name and avatar if you use Google login; preferred language.
- Consent: document version accepted, time, IP address, browser user agent.
- Orders: product, amount, order code, payment time; invoice details if you enter them.
- Bank transactions: when you pay, the bank sends us the transaction details, which may include the payer's name and account number. We use them only to match orders.
- Usage: download history (time, IP address), reviews you write.
- Not collected: passwords, card data, buyers' ID document images.
3. Purposes and legal bases
| Purpose | Basis |
|---|---|
| Create and protect your account, log in | Contract; your consent |
| Process orders, deliver, refund | Contract |
| Issue e-invoices, keep accounting records | Legal obligation |
| Transactional emails (login codes, receipts, review invitations) | Contract; your consent |
| Fraud prevention, security, tracing leaked files | Legitimate interest; legal obligation |
| Anonymous visit statistics | No cookies, no identification |
4. Processors and transfers abroad
- Supabase (database, login, file storage), servers in Singapore;
- Cloudflare (web hosting, cookie-free analytics), global network;
- Resend (email), United States;
- Google (Google login, if you choose it), United States;
- SePay (reads incoming transactions on the Company's bank account to confirm orders), Vietnam;
- the Company's e-invoice provider, Vietnam.
Transfers abroad follow the law, with a cross-border transfer impact assessment on file.
5. Retention
- Account: until you ask us to delete it, except data the law requires us to keep.
- Orders, invoices, payment records: the accounting retention period (at least 10 years).
- Download logs and consent records: while you use the products and during the complaint limitation period.
6. Your rights
You may be informed, give or withdraw consent, access, correct, request deletion, restrict or object to processing, receive your data, complain and claim compensation. Write to [to be added]; we reply within the legal time limits.
7. Cookies
Only cookies needed to keep you logged in. No advertising or tracking cookies.
8. Security
Encrypted connections (HTTPS), role-based access, two-factor authentication for administrators, product files only through short-lived links after a permission check. Breaches are reported to the authority and affected people as required.
9. Children
The Website is for business users aged 16 or over.
10. Changes
Updates take effect when published; material changes will be notified and require your consent again.