Privacy Policy

This Privacy Policy describes how 5ac.vn collects, uses, stores, and protects your personal data in compliance with Vietnamese law.

1. Definition of Personal Data

Pursuant to Article 2 of Decree 13/2023, the terms used in this Policy are defined as follows:

1.1. Personal Data: Information in the form of symbols, text, numbers, images, sounds, or similar forms in an electronic environment that is associated with a specific individual or helps identify a specific individual, including:

• Basic personal data: Full name, phone number, email, address, date of birth, gender, account information, IP address, and other identifying information.
• Sensitive personal data: Political views, religion, health status, genetic information, biometric information, geolocation data, and other types of sensitive data as prescribed by Decree 13/2023.

1.2. Processing of personal data: One or more activities that impact personal data, such as collection, recording, analysis, confirmation, storage, editing, disclosure, combination, retrieval, transmission, deletion, or other actions.

1.3. Data Subject: The individual to whom the personal data relates, including Users of 5ac.vn.

2. Data Collected

5ac.vn collects the following types of data from Users:

2.1. Account Data:

• Full name;
• Email address;
• Phone number;
• Username and password (encrypted);
• Profile picture (if uploaded by the User);
• Payment information (via payment processing partners — see Section 5).

2.2. Usage Data:

• Activity logs: access times, features used, session duration;
• Conversation history with the AI Agent, including input and output content;
• Tasks, requests, and commands executed through the Service;
• Frequency and intensity of Service usage.

2.3. Device Data:

• IP address;
• Device type, operating system, and browser;
• Language and time zone;
• Cookie information and device identifiers (Device ID);
• Network connection type and internet service provider.

2.4. Payment Data:

• 5ac.vn does not directly collect or store credit/debit card information;
• Payment information is collected and processed by our payment partners (Stripe and/or lawful payment gateways in Vietnam);
• 5ac.vn may store: transaction history, subscribed service plans, expiry dates, and payment status.

2.5. Sensitive Data:

• 5ac.vn does not actively collect sensitive personal data;
• In the event that the User voluntarily provides sensitive data through conversations with the AI Agent, the User understands and agrees that this data will be processed in accordance with this Policy.

3. Purposes of Processing

5ac.vn processes the User's personal data for the following purposes:

3.1. Providing and operating the Service:

• Authentication and Account management;
• Processing and responding to User requests and queries;
• Operating AI Agents and related features;
• Processing payments and managing service plans.

3.2. Improving and developing the Service:

• Analyzing aggregated usage behavior to improve user experience;
• Training and fine-tuning AI models (as provided in Section 9);
• Developing new features and optimizing performance.

3.3. Security and compliance:

• Detecting, preventing, and addressing fraudulent or abusive activities;
• Protecting system and data security;
• Complying with legal obligations under Vietnamese law;
• Resolving disputes and enforcing the Terms of Service.

3.4. Communication and support:

• Sending operational notices, service updates, and policy changes;
• Providing technical support and answering inquiries;
• Sending promotional and marketing information (only with the User's separate consent).

4. Legal Basis

5ac.vn processes personal data based on the following legal grounds under Decree 13/2023:

4.1. Consent of the data subject (Article 9 of Decree 13/2023):

• The User consents to this Privacy Policy when registering an Account and/or using the Service;
• Consent is given explicitly, voluntarily, and is recorded as evidence;
• The User has the right to withdraw consent at any time; withdrawal of consent does not affect the lawfulness of processing carried out prior to such withdrawal.

4.2. Contractual obligation: Processing is necessary for the performance of the service contract between the User and 5ac.vn.

4.3. Legal obligation: Processing is necessary for compliance with applicable Vietnamese legal requirements.

4.4. Legitimate interests: Processing for the purposes of security, fraud prevention, and Service improvement is based on the legitimate interests of 5ac.vn, without infringing upon the rights and interests of the User.

5. Sharing with Third Parties

5ac.vn shares data with the following third parties to the extent necessary to provide the Service:

5.1. Infrastructure and security providers:

• Cloudflare, Inc. — CDN services, DDoS protection, page load speed optimization, and DNS. Scope: IP addresses, access data. Policy: Cloudflare Privacy Policy

5.2. Analytics service providers:

• Google Analytics (Google LLC) — Aggregated user behavior analysis, Service performance measurement. Scope: anonymized usage data, masked IP addresses. Policy: Google Privacy Policy

5.3. Payment processing partners:

• Stripe, Inc. — Credit/debit card payment processing. Scope: payment information (5ac.vn does not store card details). Policy: Stripe Privacy Policy
• Lawful payment gateways in Vietnam — Support for domestic payments (if applicable).

5.4. AI service providers: Providers of large language models (LLMs) and AI APIs — Processing input/output of the AI Agent. Data is processed under applicable data processing agreements (DPAs).

5.5. Competent state authorities: 5ac.vn may disclose personal data if required by a competent state authority under applicable law, or if disclosure is necessary to protect the legitimate rights and interests of 5ac.vn, the User, or a third party.

6. Data Subject Rights

Pursuant to Decree 13/2023, the User as a data subject has the following rights:

6.1. Right to be informed: To be informed about the processing of their personal data, unless otherwise provided by law.

6.2. Right to consent: To consent or withhold consent to the processing of their personal data (except where the law permits processing without consent).

6.3. Right to access: To access, view, edit, or request edits to their personal data.

6.4. Right to withdraw consent: To withdraw consent at any time. Withdrawal of consent does not affect the lawfulness of processing carried out prior to such withdrawal.

6.5. Right to deletion: To delete or request deletion of their personal data, unless otherwise provided by law.

6.6. Right to restrict processing: To request restriction of the processing of their personal data.

6.7. Right to data portability: To request their personal data in a readable format.

6.8. Right to object to processing: To object to the processing of their personal data to prevent or limit disclosure or use for advertising or marketing purposes.

6.9. Right to complain and report: To file complaints or reports with competent authorities regarding unlawful processing of personal data.

6.10. Right to initiate legal proceedings: To initiate legal proceedings as prescribed by law.

Exercising rights: To exercise any of the above rights, the User should send a request to legal@5ac.vn. 5ac.vn will respond within thirty (30) business days from receipt of a valid request.

7. Retention Period

7.1. 5ac.vn only retains the User's personal data for as long as necessary to achieve the processing purposes set out in Section 3 of this Policy, unless the law requires longer retention.

7.2. Specific retention periods:

• Account data: Retained for the duration the Account remains active and for a maximum of twelve (12) months after the Account is terminated or deleted, to serve legal obligations and dispute resolution.
• Usage data and conversation history: Retained for a maximum of twenty-four (24) months from the date of collection, after which it will be anonymized or deleted.
• Payment data: Retained for a maximum of five (5) years in accordance with accounting and tax laws.
• Access logs and device data: Retained for a maximum of twelve (12) months.
• Anonymized data: May be retained indefinitely for analysis and Service improvement purposes.

7.3. After the retention period expires, data will be securely deleted or anonymized.

8. Security

8.1. Technical measures: 5ac.vn applies appropriate technical safeguards, including:

• Encryption of data in transit (TLS/SSL 1.2+);
• Encryption of data at rest (AES-256);
• Web application firewall (WAF) and intrusion detection systems;
• Multi-factor authentication (MFA) for admin accounts;
• Periodic security audits and vulnerability scanning.

8.2. Organizational measures: 5ac.vn implements organizational measures including:

• Access control policies based on the need-to-know principle;
• Employee training on personal data protection;
• Execution of non-disclosure agreements (NDAs) and data processing agreements (DPAs) with relevant parties;
• Designation of personnel responsible for personal data protection.

8.3. Incident response: In the event of a personal data breach, 5ac.vn commits to:

• Notifying the competent authorities (Ministry of Public Security, Ministry of Information and Communications) within 72 hours;
• Notifying affected data subjects within the timeline prescribed by Decree 13/2023;
• Taking immediate remedial measures to prevent and mitigate harm.

8.4. While 5ac.vn strives to protect data with appropriate measures, no system is guaranteed to be absolutely secure. The User also bears responsibility for protecting their own access information.

9. AI Training — Policy on Not Using User Data for Training

9.1. Commitment: 5ac.vn commits not to use the User's personal data and content for training or fine-tuning foundation AI models (foundation models / LLMs).

9.2. Scope of commitment:

• Conversation content, inputs, outputs, uploaded files, and all other User data will not be included in the training datasets of the AI models used by 5ac.vn;
• Third-party AI model providers are also bound by agreements not to use customer data for training.

9.3. Exceptions:

• 5ac.vn may use fully anonymized conversation logs (non-personally identifiable) for quality assessment and product improvement purposes;
• With the User's separate, explicit consent, 5ac.vn may use specific data for the purpose of improving AI Agent quality.

9.4. Transparency: The User has the right to request information about how their data is processed in relation to AI models by contacting legal@5ac.vn.

10. Contact

For any questions or requests relating to this Privacy Policy or the processing of personal data, please contact:

We will respond within seven (7) business days for general requests and within thirty (30) business days for requests to exercise data subject rights.