Privacy Policy

Article 1. Personal Data Controller

1. The Personal Data Controller is Nguyen Huu Trong, address Block C1 - Q7 Saigon Riverside Complex Apartment, 04 Dao Tri st, Phu Thuan ward, TP.HCM (“We”, “Us”).
2. All requests and complaints concerning personal data are received at nguyenhuutrong2901@gmail.com.

Article 2. Scope

1. This Policy applies to all personal data processed through the App on the iOS and Android platforms.
2. This Policy also applies to the two websites vernest.net and wealth.vernest.net (together, the “Website”), to the extent of the technical data that arises when You view the Website. The Website requires no sign-in and has no data entry fields.
3. This Policy does not apply to third-party services, websites or applications that You access from Your device.

Article 3. Personal data processed

We process only data that You provide or that arises from Your use of the App, namely:

1. Account identification data: email address and a one-way hashed password.
2. Profile data You enter: full name and profile picture. The Application does NOT collect Your date of birth, phone number, marital status or number of dependants.
3. Financial data You enter: assets, liabilities, cash flows, financial goals and accompanying notes.
4. The email address of anyone you invite into your household. When you send an invitation we store that address so we can match it when the invited person signs in. An invitation that is never accepted expires and is deleted; you can also revoke one at any time in the app.
5. Minimal technical data required for operation: error logs and system access timestamps.
6. When You view the Website: Your IP address, browser information and time of access, recorded automatically by the Website’s hosting provider to serve the pages and protect against attacks. The Website only remembers the language You choose, in Your own browser, and sets no tracking or advertising cookies.
7. We do NOT connect to Your bank accounts, do NOT collect location, contacts, messages or browsing history, and collect nothing beyond what You enter into the App yourself.

Article 4. Purposes of processing

Personal data is processed for the following purposes and only within them:

1. To create, authenticate and manage Your account.
2. To compute and display back to You financial figures derived from the data You entered.
3. To let members of the household You set up view and update shared data.
4. To keep the system secure and to detect and resolve technical incidents.
5. To comply with the law upon a lawful request from a competent State authority.
6. We do NOT use Your data for advertising, marketing, credit scoring or commercial behavioural analysis.

Article 5. Legal basis

1. Processing is carried out on the basis of Your consent under Article 9 of the Law on Personal Data Protection No. 91/2025/QH15.
2. Consent is obtained SEPARATELY for each purpose, never pre-ticked, and never conditioned on agreeing to another purpose — as required by Article 9.4 of the Law. The App keeps a log of every consent event together with the policy version in force at that moment.
3. You may withdraw consent at any time under Article 10 of the Law. The App only asks consent for the core purpose set out under "Purposes of processing", so withdrawal means ending the service and deleting Your account (done directly in the Profile section), because the App cannot operate without processing the data You enter.
4. Withdrawal does not apply to processing carried out BEFORE the moment You request it, under Article 10.4 of the Law.

Article 6. Data sharing

1. We do NOT sell, rent or trade Your personal data to any third party for commercial purposes.
2. Your data is shared with the household members You yourself invited or approved, limited to that household’s shared data.
3. We use hosting and authentication infrastructure provided by Supabase Inc. acting as a Data Processor under the data processing terms of the service agreement between the parties, permitted to process data only on Our instructions and bound by equivalent confidentiality obligations.
4. You can read the Processor’s data protection commitments at https://supabase.com/privacy and its data processing terms at https://supabase.com/legal/dpa.
5. We use the email delivery service of Resend (Plus Five Five, Inc., United States) acting as a Data Processor, solely to send You transactional messages that You yourself trigger, such as the email containing Your password reset code. The data transferred to this party consists ONLY of Your email address and the content of that message; it does NOT include any financial data.
6. We do NOT use this service to send advertising or marketing email. This Processor’s data protection commitments and data processing terms are published at resend.com.
7. The Website is hosted on the infrastructure of Cloudflare, Inc. (United States) acting as a Data Processor. When You view the Website, Cloudflare receives Your IP address and browser information SOLELY to serve the pages and protect them from attacks; the Website does NOT pass any account or financial data to this party. This Processor’s data protection commitments and data processing terms are published at cloudflare.com.
8. We disclose data to State authorities only upon a lawful written request under Vietnamese law.

Article 7. Cross-border transfer

1. Your data is stored on servers located in SINGAPORE. Processing of Your personal data therefore involves a cross-border transfer of personal data under Article 20 of the Law on Personal Data Protection No. 91/2025/QH15.
2. In addition, when the App sends You a transactional email (such as one containing a password reset code), Your email address is transferred to the email delivery provider’s servers located in the UNITED STATES. This is also a cross-border transfer of personal data. The scope of that transfer is limited to Your email address and the content of the transactional message; Your financial data does NOT leave the storage infrastructure described above.
3. When You view the Website, Your IP address and browser information are processed on the server network of the Website’s hosting provider, headquartered in the UNITED STATES. This is also a cross-border transfer of personal data, limited to the technical data described in the “Personal data processed” article.
4. We carry out the cross-border transfer impact assessment and file the dossier with the specialised personal data protection authority in the cases the law requires, and make it available to competent authorities on request.
5. The transfer that takes place when You use the App is covered by the consent You ticked for this Policy; We do not treat merely opening the App as consent.

Article 8. Retention period

1. Personal data is retained for as long as Your account remains active.
2. If You are the HOUSEHOLD OWNER and delete Your account without first transferring ownership to someone else, all of that household’s data — assets, liabilities, transactions, goals, closed periods, and every member’s profile and photos, including photos uploaded by other members — is permanently erased and CANNOT be recovered. Other members lose access to that household; their own accounts remain.
3. If You are a MEMBER (not the owner) and delete Your account, We delete Your login account, email address and profile photo. The household’s shared data (assets, transactions, goals and their photos) belongs to the household and is kept, together with the member profile bearing Your display name — no longer linked to any account, using the default picture — so that contributions already recorded stay attributed to the right person. The household owner may delete that profile, unless it has contributions inside a closed period.
4. Technical backups, if any, are purged on the backup cycle, no later than 30 days after account deletion.
5. The activity log (which records who deleted what within the household, and who invited, accepted an invitation to or was removed from the household, along with the name of the person who did it and — for invitations — the invited email address) is kept for the most recent 24 months only. Older entries are deleted automatically and are no longer accessible.

Article 9. Security measures

1. All data is encrypted in transit via HTTPS/TLS and encrypted at rest on the server.
2. Passwords are stored as one-way hashes; We do not store and cannot read Your original password.
3. The system enforces database-level authorisation (Row-Level Security) so each household can reach only its own data.
4. We apply reasonable technical and organisational measures against unauthorised access; however, no system can guarantee absolute security.

Article 10. Rights of the data subject

Under Article 4 of the Law on Personal Data Protection No. 91/2025/QH15, You have the following rights over Your personal data:

1. The right to be informed about the processing of Your personal data.
2. The right to give or withhold consent to processing.
3. The right to access, view and correct Your personal data; the App provides this in the Profile section.
4. The right to withdraw consent.
5. The right to erasure; the App provides account deletion, with the scope of data erased set out in the Retention period clause.
6. The right to request provision of data, to restrict processing, and to object to the processing of Your personal data.
7. The right to complain, denounce, initiate legal proceedings and claim damages under the law.
8. The right to require the competent authority or the parties involved to apply protective measures to Your personal data.
9. To exercise these rights, write to nguyenhuutrong2901@gmail.com. We receive and act on such requests within the period required by law.

Article 11. Children’s data

1. The App is designed for users aged 16 and above. We do not knowingly collect personal data from children under 16.
2. If You enter information about a dependent child in the household profile, You confirm that You are the child’s legal representative and exercise the data subject’s rights on their behalf under Article 24 of the Law on Personal Data Protection No. 91/2025/QH15. For a child aged 7 or above, publishing or disclosing information about the child’s private life additionally requires that child’s own consent.
3. If You believe a child’s data has been provided improperly, please notify nguyenhuutrong2901@gmail.com so that We can erase it.

Article 12. Data breach notification

1. On discovering a personal data protection violation, We notify the specialised personal data protection authority as required by the Law on Personal Data Protection No. 91/2025/QH15, and take steps to stop the violation and remedy its consequences.
2. We also notify You at Your registered email address where the violation is likely to affect Your rights and interests.

Article 13. Amendments

1. We may amend this Policy to reflect changes in the law or in the App.
2. Amendments are published in the App together with a new effective date. Before You continue using the App, it asks for Your consent to the amended Policy again; We do not treat silence or continued use as consent.
3. If You do not agree, at that same step You may sign out, or delete Your account (and export Your data before deleting it).

Article 14. Contact

1. Questions, requests or complaints about this Policy: Nguyen Huu Trong, Block C1 - Q7 Saigon Riverside Complex Apartment, 04 Dao Tri st, Phu Thuan ward, TP.HCM, email nguyenhuutrong2901@gmail.com.