Privacy Policy

When you register an account, top up your wallet, or create gifts on NDHGift, the following data groups will be collected:

• Account Information & Authentication: Full name, email address, avatar, phone number (if any), securely hashed password, and social network identifiers (Google ID, Facebook ID) if using quick login via OAuth.
• Financial Information & Transactions: Wallet top-up history, order code (payment_code), amount, bank QR transfer payment information, transaction status, coupon usage history, service invoices, and digital wallet balance fluctuations.
• Gift Customization Data & Uploaded Media: Content of wishes, letters, recipient names, photos, background audio, videos uploaded for personalizing digital cards, selected effects, and scheduled release configurations (scheduled_at).
• Support & AI Chatbot Conversation Session Data: Content of questions and discussions with AI Chatbot or support staff via Live Chat and contact forms to enhance service quality.
• Technical Information & Access Logs: IP address, device ID, OS, browser type, screen resolution, system language, gift view count, and critical audit logs.

As an online gift and invitation service, NDHGift processes data concerning recipients:

• Role of NDHGift: For recipient personal data (names, shared photos, private wishes) provided by gift creators, NDHGift acts as a Data Processor under technical entrustment. We strictly never use recipient info for advertising or spam.
• Responsibilities of the Gift Creator: The gift creator warrants and guarantees obtaining lawful consent from the recipient prior to uploading their photos, personal information, or memorial videos to the system.
• Guest Interactions & Reactions (Gift Reactions): When recipients access the gift link and send reactions or heart emojis, the system only records these public engagement metrics to notify the gift creator.
• Children's Personal Data Protection: When creating cards containing photos or data of children under 16, the creator must be a parent or legal guardian, or have explicit consent from guardians under Article 20 of Decree 13/2023/ND-CP.

NDHGift commits to only using collected data within legitimate purposes:

• Create, store, render graphics, and maintain the display of digital gift links according to your request.
• Process wallet balance crediting, automated deductions upon gift activation, invoice generation, and email transaction notifications.
• Personalize interface and experience, recommending templates suitable for each festive occasion or event theme.
• Send technical notifications, security alerts, and gift-opened notices when the recipient views the gift (if view notification is enabled).
• Detect, reconcile, and promptly prevent account fraud, abnormal transactions, or code tampering.
• Improve automated response performance of the AI Chatbot and optimize the customer care system.

We implement multi-layered cybersecurity solutions to protect the integrity of your assets and personal information:

• Transmission Encryption: All internet traffic is encrypted using industry-standard SSL/TLS protocols.
• Authentication Information Encryption: User passwords are one-way hashed using the secure Bcrypt algorithm with random salts, impossible to reverse into original passwords.
• Rate Limiting: Apply rate-limiting barriers on critical APIs (login, top-up, messaging, gift creation) to eliminate brute-force and denial-of-service (DDoS) attacks.
• Safety Audit Logs: All sensitive security changes (password updates, account linking, fund transfers) are recorded in independent system audit logs for security monitoring.

NDHGift uses cookies and local storage technologies (LocalStorage) to ensure smooth operation:

• Strictly Necessary Session Cookies: Store your session token, Cross-Site Request Forgery token (CSRF Token), and display language settings (locale: Vietnamese / English).
• Analytics & Performance Cookies: Measure anonymous traffic and analyze most-viewed pages to optimize loading speed and user experience.
• Your customization: You can refuse or delete cookies through your browser settings. However, disabling essential cookies may prevent you from logging in or paying for gifts on NDHGift.

We commit to not trading, selling, transferring, or renting users' personal data to any data brokers or third parties for commercial marketing purposes.

Information is shared only to the minimum extent directly serving service operations, including:

• Bank Payment Partners & Transfer Intermediaries: Electronic payment gateways (such as SePay) to generate bank QR codes and automatically reconcile wallet top-up transactions.
• Server Infrastructure & Cloud Storage Providers: To securely store images, music files, and databases under standard security agreements.
• State Regulatory Authorities: Upon mandatory written requests from procedural organs or competent state authorities in accordance with Vietnamese law.

NDHGift applies a clear data retention policy based on collection purposes and legal compliance:

• Member Account Data: Stored continuously during active account status. Upon account deletion request, all personal data will be permanently erased or anonymized within 30 working days.
• Expired Gift Data: When a gift duration plan ends, the link switches to suspended display. Data and media files (images, music) are reserved as backup for the next 30 days for renewal. After this reservation period without renewal, the system will automatically clean up large media files to optimize server resources.
• Forever Plan Gift (Lifetime): Maintained and stored continuously throughout the service operation lifecycle of the NDHGift platform.
• Invoices and accounting documents data: Financial transaction information and top-up history are retained for at least 5 years under the Accounting Law of Vietnam for tax audit and legal settlement purposes.
• Request deletion of Facebook/Google login data: If you logged in with Facebook and want to delete your data: Go to Facebook Settings & Privacy > Apps and Websites > Select NDHGift > Click Remove. Our system will automatically detect and remove the linked identifier from the database.

Pursuant to Decree 13/2023/ND-CP, you are the Data Subject and hold the following lawful rights regarding your personal information:

• Right to be Informed & Right to Consent: You are transparently notified about data collection and have the right to consent or withhold consent for data processing.
• Right to Access & Rectification: You can access, view, and update your full name, avatar, and password at any time in Account Settings.
• Right to Withdraw Consent & Request Data Erasure: You have the right to request cessation of data processing or permanent deletion of your account and associated gift data from the server.
• Right to Restriction of Processing & Right to Object: You have the right to request restriction of data processing or object to the use of data for unintended purposes.
• Right to Enable Anonymous Mode: You can proactively enable the anonymous feature in your profile settings to hide your name and avatar on the Member Leaderboard.
• Right to Lodge a Complaint & Initiate Lawsuits: You have the right to lodge a complaint or initiate legal proceedings with competent authorities if you discover that your personal data protection rights are infringed.

To exercise any of the above rights, simply contact NDHGift's Data Protection team via Support. We will respond and process your request within 72 business hours.

NDHGift reserves the right to update and amend this Privacy Policy at any time to accommodate platform development or legal updates.

Major changes will be announced via homepage banners or sent to your registered email. The last updated date is clearly stated at the top of the page. Your continued use of the service after effective policy revisions constitutes acceptance of the new terms.