Privacy & Personal Data Protection Policy

1. Data Controller and Data Protection Contact

WINSELL COMPANY LIMITED (Tax ID: 1801831784, Can Tho, Vietnam) acts as the Data Controller and/or Data Processor for personal data processed through your use of WinSell, WISA, and KODA.

We have established a dedicated Data Protection Officer (DPO) team. You can reach our privacy team at: privacy@winsell.vn.

2. Categories of Personal Data Collected

Account Data: Email address, display name, profile avatar (via Google OAuth), cryptographically hashed passwords, and language preferences (vi, en, zh-CN).

Commerce and Billing Data: Order history, subscription tier, SePay/VietQR transaction identifiers, and corporate VAT invoice details (company legal name, tax code, registered address). We do not store your bank card numbers or banking OTPs.

Technical and Interaction Logs: Client IP address, device telemetry, system logs, browser user-agent, CUBE budget usage metrics, and timestamps.

Conversation Content: Prompts, uploaded research files, and AI-generated outputs. Note: Under our standard commercial agreement, WinSell does not use your private conversations to train public AI models.

3. Purposes and Legal Bases for Processing

Service Delivery: Authenticating your identity, routing AI queries, rendering chat threads, and providing the Koda workspace environment.

Contractual Performance and Billing: Managing subscription quotas, tracking CUBE balances, reconciling VietQR payments, and issuing electronic VAT tax invoices.

System Security and Abuse Prevention: Traffic rate-limiting, DDoS mitigation, fraud detection, and preventing unauthorized API abuse.

Regulatory Compliance: Meeting statutory bookkeeping, cyber-security, and legal audit mandates under Vietnamese law.

4. Cross-Border Data Transfers

To provide state-of-the-art AI capabilities, user prompt requests may be transmitted over encrypted channels (TLS 1.3) to API server clusters operated by foundational AI providers located in the United States, the European Union, or other regions (e.g., OpenAI, Anthropic, Google Cloud).

WinSell executes enterprise Data Processing Addenda (DPAs) with upstream infrastructure providers and complies with Cross-Border Data Transfer Assessment procedures pursuant to Law 91/2025/QH15.

5. Data Subject Rights

In accordance with Vietnamese law and international standards (GDPR equivalent), you have the right to:

1. Be informed and provide or withhold consent regarding data processing activities.

2. Access, view, and export a copy of your personal data.

3. Request correction or rectification of inaccurate data.

4. Request erasure of your data ("right to be forgotten") or restrict processing.

5. Withdraw consent at any time (without affecting the lawfulness of processing prior to withdrawal).

6. Lodge complaints or seek judicial remedies under applicable law.

To exercise these rights, submit your request from your registered email address to privacy@winsell.vn. We respond within 72 business hours.

6. Protection of Minors' Personal Data

We do not knowingly collect personal data from children under 13 years of age. If we learn that an account belongs to a child under 13 without parental consent, we will promptly delete the data and terminate the account.

For users between 13 and under 18 years of age, we do not perform behavioral profiling for commercial advertising.

7. Data Retention and Security Safeguards

Personal data is retained only for as long as necessary to fulfill the disclosed purposes or until you request its deletion, except where statutory retention periods apply (such as tax records retained for a minimum of 5 years). User-selectable conversation retention cycles (30 days, 90 days, 12 months, permanent), asymmetric deletion mechanics, and Legal Hold rules are detailed in our Data Governance & Chat Retention Policy (/legal/data-governance).

Data in transit is protected using TLS 1.3 encryption. Data at rest is secured with AES-256 encryption within isolated, firewall-protected database clusters.