1. Data controller
The controller and processor of your personal data is VIETQUEST TECHNOLOGY AND MEDIA COMPANY LIMITED, address: No. 1, Lane 31 Hoang Cau Street, O Cho Dua Ward, Ha Noi 11511, Vietnam.
Send any request, question or complaint about personal data to admin@vietquest.vn or call +84 96 619 6066.
2. Data we collect and why
We collect only what the app needs to work. Specifically:
a) Account
When you sign in with Apple, Google or Zalo, we receive the identifier issued by that provider, your display name and your email address if you choose to share it. Purpose: to create and recognise your account, link tickets and your collection to you, and help you when you need support. We never receive or store your password.
b) Precise location (GPS)
The app uses your device's precise location only while the app is open, to recognise that you are standing near a Destination and activate its content on site. We do not track location in the background and we do not store your movement history. Location is processed on the device; our servers receive only the event "Destination X activated" to record your progress.
c) Photos and videos you take
Photos and videos you take with a spirit are saved to your device's photo library. They are uploaded to our servers only when you actively choose to share them. The app does not access other photos in your library beyond the ones you select.
d) Purchase history and content entitlements
When you buy a ticket, we receive transaction details from the Apple App Store, Google Play or our web payment gateway: ticket type, time, transaction ID and status. Purpose: to unlock exactly what you bought, restore your ticket when you change devices, and handle support and refunds. We never receive or store your card number or bank account details.
e) Device information and basic usage events
Device type, operating system, app version, an app-generated device identifier, and basic events such as opening the app, activating a Destination and technical errors. Purpose: stable operation, bug fixing and fraud prevention, in particular enforcing the rule that one account is unlocked on one device at a time.
We do not collect sensitive data such as health information, biometrics, political opinions or religious beliefs. We do not use your data for personalised advertising and we do not sell your data to anyone.
3. Legal basis for processing
We process your data on the basis of:
- Performance of a service contract: your account, tickets, progress and collection are what we need to provide the app to you.
- Separate consent for each permission: location, camera and notifications are requested in the app at the moment they are needed, with a short explanation of why. You can withdraw consent at any time in your device Settings; the app keeps working but the related feature is switched off.
- Legal obligation: keeping transaction records as required by tax and accounting law.
- Legitimate interest: securing our systems and preventing fraud, to the extent this does not unreasonably affect your rights.
5. Cross-border data transfers
Your account and progress data are stored on servers located in Singapore (Supabase). Media is delivered through Cloudflare's global network. Some partners listed in section 4 may process data in the countries where their infrastructure is located.
We commit to transferring data abroad in compliance with the Law on Personal Data Protection No. 91/2025/QH15 and its implementing regulations, including preparing and filing the required cross-border transfer impact assessment dossiers, and to working only with partners that offer equivalent safeguards.
6. Retention period
We keep your data for as long as your account is active. When you ask us to delete your account, we delete your personal data within 30 days.
Exception: transaction records that must be kept under tax and accounting law are retained for the statutory period, separated from the deleted account and used only for that purpose.
7. Your rights
Under Law No. 91/2025/QH15 you have the right to:
- Know about and access your personal data.
- Correct inaccurate data.
- Delete your data and your account.
- Withdraw consent given for each permission (location, camera, notifications).
- Restrict or object to processing where the law allows.
- Lodge a complaint with us or with the competent personal data protection authority.
How to exercise them: in the app, go to Me → Delete account to delete directly; or email admin@vietquest.vn from the address linked to your account, stating your request. We respond within 72 hours and complete requests within the statutory period.
8. Children
The app is intended for people aged 13 and over. We do not knowingly collect personal data from children under 13. If you are a parent or guardian and believe your child has provided data to us, contact us and we will delete it promptly.
For users aged 13 to under 16, processing requires the consent of a parent or guardian as provided by law.
9. Security
Data is encrypted in transit (HTTPS/TLS) and at rest with our infrastructure partners. Internal access is limited on a need-to-know basis. We store no passwords (sign-in is through Apple, Google or Zalo) and no payment card numbers.
If a data breach occurs, we will notify the competent authority and affected users within the statutory time limits.
10. Changes to this policy
When this policy changes materially, we update the effective date at the top of the page and notify you in the app before the change takes effect. Continued use after the new effective date means you accept the updated policy.
11. Contact
VIETQUEST TECHNOLOGY AND MEDIA COMPANY LIMITED · No. 1, Lane 31 Hoang Cau Street, O Cho Dua Ward, Ha Noi 11511, Vietnam · Email: admin@vietquest.vn · Phone: +84 96 619 6066.