Privacy Policy
OneHub (operated by VasBook Technology, Vietnam) takes your privacy seriously. This Privacy Policy explains what data we collect, what we don't, and how we comply with Vietnamese data protection laws.
1. Core principles
- On-device first — messages, contacts, orders, debts NEVER leave your phone. All chat content stays in the local SQLite database on your device.
- Zero-knowledge backend — OneHub servers only store: user identifier (phone), subscription tier, billing status, device registry metadata. We CANNOT read your messages.
- Mirror Zalo permissions — we never request more Android permissions than the Zalo official app needs.
- No third-party tracking — no Google Analytics, no Mixpanel, no Facebook Pixel. We use Plausible (privacy-first, no cookies, no PII).
2. Data we collect on web (onehub.vasbook.com)
2.1 Account data (Postgres on VPS in Vietnam)
- Phone number (primary identifier, format +84…)
- Email (optional, only if you add it for magic-link login)
- Display name (you set this)
- Subscription tier + payment status (Free/Basic/Start/Pro/Premium/Enterprise)
- Device registry: device name, OS version, app version, hardware fingerprint hash, last-seen timestamp. NO push tokens stored without your consent.
- Audit log: login/logout/2FA/billing events (timestamp, IP, user-agent)
2.2 Aggregate data pushed from mobile app (optional)
- Daily order totals per platform (count + VND revenue, NO customer details)
- Daily debt totals (count + VND, NO debtor names)
- This data is OPTIONAL — app only pushes if you enable "Web dashboard sync"
2.3 What we DO NOT collect
- ❌ Message content (text, photos, voice)
- ❌ Contact names, phone numbers, addresses
- ❌ Order/customer/debtor details (only aggregates)
- ❌ Zalo / Facebook session tokens
- ❌ Location data
- ❌ Browser cookies for tracking (only essential session cookie + language preference)
3. Data we collect on mobile app
All data on the app is stored locally in an encrypted SQLite database (Phase E will add SQLCipher AES-256, currently sandbox-protected). Includes:
- Message cache (90-day rolling retention, user-configurable 30–365 days)
- Contacts derived from notifications
- Sale orders, purchase orders, payments, shipments, bank accounts
- Reply history, bill PNG receipts (cached 7 days)
None of this data is uploaded to OneHub servers. Uninstalling the app = deleting all data.
4. Vietnam legal compliance
- Nghị định 13/2023/NĐ-CP (PDPL) — Personal Data Protection Decree. We collect consent before scanning Zalo QR. Source
- Luật An ninh mạng 2018 — Cybersecurity Law. Data stored on-device + Vietnam VPS. Source
- Luật Giao dịch điện tử 2023 — E-Transactions Law. OneHub is NOT a payment processor (we use Paddle MoR).
- Luật ATTTM 2015 — Information Security Law. We implement Talsec freeRASP runtime protection on the mobile app.
5. Data retention
- messagesCacheDays:
90 - notifRawDays:
7 - auditLogDays:
30 - ordersContactsPaymentsShipments:
forever-local-until-user-delete
6. Your rights (PDPL Đ.9)
- Access: Settings → "Export my data" (JSON dump of all your web account data)
- Rectification: edit account info in Dashboard → Settings
- Deletion: Settings → "Delete account" (permanent, irreversible, 7-day grace period)
- Portability: data export in machine-readable JSON
- Object/restrict: contact DPO email below
7. Cookies & tracking
We use only essential cookies:
onehub_session: JWT session token (24h expiry, HTTP-only, Secure flag, SameSite=Strict)lang: language preference (vi/en, 1-year expiry)
No advertising cookies. No third-party tracking pixels. Plausible analytics is cookieless.
8. Third-party services we use
- Paddle (Merchant of Record) — payment processing, VAT compliance. Paddle Privacy
- VNPay (Vietnamese gateway) — VietQR/ATM. VNPay Privacy
- Cloudflare (CDN + DDoS protection)
- Let's Encrypt (free SSL certs)
- Plausible (anonymous analytics)
9. Data breach response
If a breach occurs affecting personal data, we will notify affected users via email within 72 hours per PDPL Đ.23.
10. Children's privacy
OneHub is designed for small business owners (CN-HKD / SME). We do not knowingly collect data from anyone under 16.
11. Changes to this policy
We will post material changes here with a new "Last updated" date. Continued use after changes = acceptance.
12. DPO Contact
Data Protection Officer: privacy@onehub.vasbook.com
General support: support@onehub.vasbook.com
Postal address: VasBook Technology, Vietnam (full address available on request from DPO)