Privacy Policy

1. Our role

• For account, billing, support, and website data, we are the data controller.
• For data an agency puts into its workspace (briefs, traveler lists, supplier details, proposals), the agency is the controller. We act as a processor and only process that data to provide the service to the agency.

2. Data we process

• Account: name, email, profile picture (when signing in with Google or Apple), workspace name, role, and member invitations.
• Workspace content: briefs, client emails or messages you paste, itineraries, estimates, supplier catalog, proposals, and uploaded files. This content may include personal data about clients or travelers that you enter.
• Billing: plan, term, status, transaction codes, and invoices. We do not store full card numbers or CVV codes; card data is handled by Lemon Squeezy.
• Usage and technical: IP address, browser, device, access logs, error logs, and AI Credit usage.
• Support: what you send us when contacting support.
• Website: visit measurement through Google Analytics and page performance metrics (Web Vitals).

3. Why we process it

• To create accounts, authenticate sign-ins, and provide workspace features, including AI actions.
• To charge for plans, issue AI Credits, create invoices, and reconcile payments.
• To secure the service, detect abuse and fraud, and fix problems.
• To send service emails such as verification, invitations, invoices, and important change notices.
• To support customers and improve the product using aggregated metrics.
• To meet accounting, tax, and lawful government requirements.

We do not sell personal data, and we do not use your workspace content for advertising.

4. Legal basis

We process data based on your consent, the performance of our service contract, legal obligations, and other grounds permitted by personal data protection law. You can withdraw consent at any time; this does not affect processing carried out before withdrawal.

5. Recipients and processors

• OpenAI: processes content sent to AI actions. Under OpenAI's API terms, data sent through the API is not used to train its models.
• Lemon Squeezy: processes card payments as merchant of record.
• SePay: reconciles VietQR bank transfers.
• Resend: sends service emails.
• Google and Apple: authenticate you when you choose to sign in with their accounts.
• Google Analytics: measures visits to etrip24.net.
• Cloudflare and our server hosting and storage providers: run, protect, and back up the service.
• Competent authorities, when required by law.

Each recipient only receives the data it needs for its function.

6. International transfers

Some of the providers above (such as OpenAI, Lemon Squeezy, Resend, and Google) process data on servers outside Vietnam, mainly in the United States. We only transfer the data needed for the relevant function and complete the cross-border transfer procedures required by Vietnamese law.

7. Retention

• Account and workspace data is kept while the account is active.
• After a plan ends or you ask us to delete a workspace, workspace data is deleted within 90 days. Backups rotate and expire on their backup cycle.
• Invoices and payment records are kept for the periods required by accounting and tax law.
• Security logs are kept as long as needed to investigate incidents and prevent abuse.

8. Security

Data is transmitted over HTTPS, separated by workspace, and protected by role-based permissions. Internal access is limited to what each job requires, and the system is backed up regularly. If a personal data breach occurs, we will notify the competent authority and affected people as required by law.

9. Your rights

• Be informed about processing and access your data.
• Correct inaccurate data. Most information can be edited directly in the app.
• Request deletion, restrict processing, or object to processing.
• Withdraw consent.
• Receive a copy of your data.
• Complain to the competent personal data protection authority.

Send requests to support@etrip24.net from your account email. We respond within the time limits set by law and may need to verify your identity first. For data an agency entered about its own clients, we forward the request to that agency as the controller.

10. Cookies

The app uses essential cookies to keep you signed in and secure. The etrip24.net website uses Google Analytics cookies to measure visits. You can block or clear cookies in your browser; blocking essential cookies may prevent you from signing in.

11. Children

etrip24 is built for businesses and travel professionals and is not intended for anyone under 16. We do not knowingly collect children's data.

12. Changes and contact

For material changes, we update the effective date and notify you by email or in the app.

Personal data contact: support@etrip24.net · SENZI COMPANY LIMITED, 44/18/9 Đường 8, Khu phố Ích Thạnh, Phường Long Phước, Thành phố Hồ Chí Minh, Vietnam.