Chat Data Governance, Retention Lifecycle & Compliance Evidence Policy

1. System Data Classification and Architecture

WinSell, WISA, and KODA systematically classify and segregate user data into independent technical partitions to ensure strict privacy controls and compliance with Vietnam's Personal Data Protection Law No. 91/2025/QH15 and Law on Electronic Transactions No. 20/2023/QH15:

- Chat Transcripts & Messages: User input prompts, generated AI model responses, step-by-step reasoning tokens, conversation history, and automated session summaries.

- Uploaded Files & Attachments: Images, source code, text documents, spreadsheets, and PDF files stored securely on isolated cloud object storage (Cloudflare R2) configured with automated object expiration policies.

- Tool & Execution Audit Logs: System execution traces for programming sandboxes, web searches, and image rendering tools, containing privacy-redacted arguments, SHA-256 cryptographic hashes, and unique receipt IDs.

- Koda Desktop Cloud Sync Sessions: Workspace snapshots encrypted in transit and at rest under server-managed controls before cloud synchronization. This is not an end-to-end encryption commitment if the server can decrypt snapshots for synchronization.

- Billing & Accounting Records: VietQR/SePay payment confirmations, CUBE balance ledgers, and electronic VAT invoice archives maintained pursuant to Vietnam's Law on Tax Administration No. 108/2025/QH15.

2. Chat Retention Cycles and User Autonomous Choice

WinSell provides users with full autonomy over the retention lifecycle of their AI conversations. Within Account Settings, users can select one of four (04) distinct retention cycles:

1. 30-Day Retention Cycle: All sessions and messages are automatically purged 30 days after the last user interaction.

2. 90-Day Retention Cycle: Sessions are retained for 90 days to accommodate short-to-medium-term working sprints.

3. 12-Month Retention Cycle (System Default): Applied by default to all new accounts. Chat sessions are retained for 12 months from the most recent activity.

4. Long-Term Storage (No Auto-Deletion): Transcripts remain preserved continuously on your account until you deliberately delete them or request account closure.

Proactive Expiration Warnings: For sessions approaching scheduled automatic deletion under your configured retention cycle, WinSell delivers an in-app and email notice at least fourteen (14) days in advance, allowing you ample time to export or adjust your retention configuration.

3. Two-Stage Asymmetric Deletion & Cryptographic Evidence Hashes

To reconcile real-time user interface responsiveness with distributed infrastructure data safety, WinSell enforces a rigorous two-stage deletion lifecycle:

Stage 1 - Instant Logical Deletion (Soft Deletion): When a user deletes a message, conversation, or file within the app, the system timestamps the record with 'deletedAt', immediately revokes all access permissions, and permanently hides it from all Web, Desktop, and API interfaces. No user or routine system process can retrieve this content.

Stage 2 - Physical Purge & Secure Overwriting: Asynchronous background worker services scan soft-deleted entries, executing permanent database-level cascades, de-allocating binary objects from Cloudflare R2, and propagating deletion commands to all linked Koda Desktop synchronization nodes.

Cryptographic Deletion Evidence Hash: To establish verifiable proof of compliance without retaining deleted content, the system computes a SHA-256 hash of the deletion request parameters inside an atomic database transaction. This hash is permanently recorded in the Deletion Audit Ledger. The entry contains only the mathematical hash and UTC timestamp, preserving no original plain-text data.

Disaster Recovery Backup Rotation: Periodic encrypted database snapshots maintained exclusively for catastrophic disaster recovery are securely overwritten and destroyed following an automated thirty (30) day rotation schedule, isolated from operational query access.

4. Emergency Legal Hold Exceptions

Legal Hold is an obligatory statutory exception that supersedes routine automated retention cleanup and deletion schedules.

WinSell reserves the right and duty to temporarily suspend the deletion, overwriting, or destruction of specified account data strictly under the following circumstances:

1. Receipt of a binding court order, subpoena, or official judicial directive from law enforcement authorities, the People's Procuracy, or competent Vietnamese state agencies.

2. Active civil litigation, indemnification claims, or formal dispute resolution proceedings involving the user, WinSell, or affected third parties.

3. Data directly connected to severe cybersecurity incidents, unauthorized infrastructure attacks, payment fraud, or grave violations of the Platform Rules.

Data placed under Legal Hold is quarantined in a secured, access-restricted partition, accompanied by mandatory logging of the legal justification, internal authorization officer, and scheduled review milestones. Once the legal basis ceases, the affected data is immediately queued for physical deletion.

5. Immutable Audit Trail & Regulatory Disclosure Protocol

Immutable Audit Trail: WinSell operates an automated, append-only security audit ledger tracking core operations: account creation, policy acceptance, data export, tool invocation, security setting modifications, and deletion executions. Each audit record contains: Unique UUID, Account ID, UTC timestamp, partially masked IP address, active policy version hash, and SHA-256 integrity signature.

Protection of Internal Technical Telemetry: System source code, infrastructure architecture, cryptographic salts, and raw server telemetry logs constitute confidential corporate trade secrets belonging to WINSELL COMPANY LIMITED. WinSell is NOT obligated to disclose raw internal server logs to individual users or unauthorized private third parties.

Protocol for Disclosures to Competent Authorities: WinSell discloses technical audit evidence and user records exclusively when:

- Presented with a formal, lawful writ, warrant, or court order issued by competent law enforcement or judicial bodies in compliance with Vietnamese statutory procedure.

- The disclosure request has been verified for jurisdiction, procedural validity, and is limited strictly to the minimum scope necessary to satisfy the legal mandate.

- Every governmental disclosure is documented in WinSell's internal Government Request Register.

6. Upstream AI Foundation Model Provider Data Retention Scope

To perform advanced inference, prompts and contextual file excerpts are routed over authenticated TLS connections to international foundational AI providers (OpenAI, Anthropic, Google Cloud, DeepSeek).

Upstream Abuse Monitoring Disclosures: Under commercial Enterprise API Agreements and provider terms:

- Prompt inputs and outputs may be described as excluded from upstream public-model training only where the actual provider route, service tier, and contract contain the corresponding restriction.

- To detect platform abuse and prevent cyber threat campaigns, certain upstream providers (e.g., OpenAI, Anthropic) may retain temporary abuse-monitoring logs on their infrastructure for a standard window of up to thirty (30) days prior to automated deletion.

WinSell provides this disclosure so that users understand that while WinSell's internal deletion protocols govern all infrastructure controlled by WinSell, upstream network transit remains governed by standard commercial enterprise API security terms.

7. Data Subject Rights & Request Handling Procedures

Pursuant to Vietnam's Personal Data Protection Law No. 91/2025/QH15 and Consumer Rights Protection Law No. 19/2023/QH15, WinSell guarantees the following data subject rights:

1. Right of Access: Directly view and inspect all ongoing conversation transcripts and documents stored in your account.

2. Right of Data Portability (Export): Request a complete export of your chat transcripts and associated metadata in standard JSON/ZIP formats via in-app tools or by contacting privacy@winsell.vn.

3. Right to Erasure & Account Closure: Delete individual conversations instantly or request comprehensive account termination and permanent personal data deletion.

4. Right to Inquire & Dispute: Submit complaints regarding data processing practices directly to WinSell's Data Protection Officer (DPO).

Identity Verification Requirement: To protect user accounts against unauthorized hijacking or fraudulent data requests, all requests must originate from the registered account email and may require secondary multi-factor verification.

Resolution Timelines: WinSell acknowledges requests within seventy-two (72) business hours and resolves them within a maximum of thirty (30) calendar days as prescribed by law, barring active Legal Holds or force majeure technical barriers.