Privacy Policy

Legal basis

• Personal Data Protection Law 91/2025/QH15.
• Decree 356/2025/ND-CP (both effective 01/01/2026).

Decree 13/2023/ND-CP ceased to be effective on 01/01/2026 and was replaced by Decree 356/2025/ND-CP. Consents you gave before remain valid (Law 91/2025, Art. 39).

Data controller

USEPORTIFY LAB COMPANY LIMITED.

• Tax code: 0402357698.
• Address: Floor 30, 17 Quang Trung, Hai Chau Ward, Da Nang.
• Contact: admin@useportify.com · 0965997771.

Data we process

Under Decree 356/2025 (Art. 4.1.l), online usage-tracking data is sensitive personal data. We only collect it with your consent, which you can withdraw at any time.

Wallet and blockchain data are public by nature, but once linked to your account we protect them as personal data. We never collect seed phrases or private keys.

Cookies

We use cookies needed for login and security. Analytics cookies are used only with consent. We use no advertising cookies.

Who sees your data

• Members of the same ledger see each other's display names. Your email is shown to other members only if you choose to share it, and you can turn this off at any time in the ledger settings. They do not see your personal portfolio.
• Your points balance and history are visible only to you.
• We do not sell personal data.
• We share data with processors under contract:
• infrastructure: Supabase (Singapore), Vercel, Railway;
• AI: Groq, Google Gemini (question content only);
• notifications: Firebase / Apple Push Notification service;
• payments: VNPay, MoMo, Stripe, Apple, Google.
• Price data sources such as OKX and CoinGecko receive no personal data.
• We disclose data to authorities when the law requires.

Transfers abroad and storage in Vietnam

Data is currently stored in Singapore and with some processors abroad. We are:

• preparing the cross-border transfer impact assessment under Law 91/2025 (Art. 20) and Decree 356/2025;
• signing data protection contracts with recipients;
• in the process of keeping a copy of user data in Vietnam under Law 116/2025/QH15 and Decree 333/2026/ND-CP.

We will update this section when this is done.

Retention

• Data is kept while you use the Service.
• When you delete your account, product data and points are deleted.
• Account identifiers, login/logout IPs and system logs are kept separately, with restricted access, for the legal period: at least 24 months for data and 12 months for system logs (Decree 333/2026, Art. 20).
• Entries you made in a shared ledger stay visible to the remaining members as "Former member", so the ledger stays consistent.
• Payment records are kept as accounting and tax law requires.

Your rights

You have the right to:

• be informed about processing;
• give or withdraw consent;
• view, correct or receive a copy of your data;
• have your data deleted;
• restrict or object to processing;
• complain.

Email admin@useportify.com. We will:

• acknowledge within 2 working days;
• view, correct or provide data within 10 days;
• stop or restrict processing within 15 days;
• delete data within 20 days;
• these periods may be longer where a processor must act, and may be extended once (Decree 356/2025, Art. 5).

Children

The Service is for people aged 18+. If we find children's data, we delete it.

Security and breaches

• We encrypt data in transit and at rest, control access and keep logs.
• We notify the authority of a personal data breach within 72 hours (Law 91/2025, Art. 23) and notify you when needed.

10. AI

• Chat questions are sent to the AI provider to generate answers.
• Do not enter sensitive data in the chat.
• Portify does not use your chat content to train AI models.

Changes

We give notice of material changes and ask for new consent if a purpose changes. Past versions are kept at /legal/privacy.