Home › Privacy policy

Privacy policy

Last updated: 24/10/2026

This policy explains what data BuffViet collects, how it is used, how long it is kept and what rights you have over your data.

We process your personal data under the 2025 Personal Data Protection Law (Law No. 91/2025/QH15) and Decree 356/2025/ND-CP, based on your consent and to provide the services you request, including processing orders, managing your wallet balance and calculating charges.

You agree to this policy by ticking the consent box when creating an account, or by clicking Agree on the website or in our Telegram bot. As proof, we record when you agreed, which version of the policy you agreed to, and your IP address when you agree on the website. If the policy changes materially, we will ask you to confirm again.

1. Data we collect

Account details: your email and password. Passwords are stored with one-way encryption, so not even we can read them.
Order details: the link you submit with an order (post, video, channel) and the quantity ordered.
Transaction history: top-ups, charges and refunds in your wallet.
Top-up details: your top-up code and the transfer note sent to us by the bank.
Refund details: bank, account number and account holder name, only when you submit a balance refund request.
Telegram details: your Telegram user ID, if you buy through our bot. We do not store your phone number or contacts.
IP address: recorded when you create an account or a sign-in fails, to block password guessing and mass sign-ups. The server also keeps an access log of IP addresses, times and pages visited, for security and troubleshooting.

We never ask for your social media password or access to your accounts, and we do not store bank card details. Payments are made directly through your bank.

2. How we use your data

Processing orders, charging and refunding accurately.
To send essential messages: email verification, password resets and order updates.
To detect and prevent fraud and abuse.
To support you and resolve your complaints.

We do not sell your data and do not use it for advertising.

3. Data sharing

To fulfil your orders, we may share the public link and quantity you order with technical partners that help process the service. Your email, password, balance and transaction history are not shared with them.

We also use an email delivery service and a payment confirmation service. The email service only receives your email address. The payment confirmation service only receives the bank transfer details.

We disclose data to authorities only when legally required to do so.

4. Data retention

Order, transaction and refund request history: kept for as long as your account is active, as the basis for reconciling payments and refunds.
IP addresses used to block password guessing and mass sign-ups: deleted automatically after about 15 minutes. Server access logs: up to 30 days.
When you ask us to delete your account, we delete your email and sign-in details. Transaction records are kept in a form no longer linked to your identity, for accounting purposes.

5. Your rights

Access your data: all of your orders and transactions are shown when you sign in.
Change your password under Account. To change your email, please contact support.
Request account deletion: contact support and we will process it within 7 working days.
Withdraw your consent at any time by contacting support. We respond within 2 working days and complete the request within 15 days, including stopping data processing and deleting your account. Withdrawal does not affect transactions already completed.
Lodge a complaint with the competent authority if you believe your data has been processed unlawfully.

6. Cookies

This website only uses essential cookies: keeping you signed in, protecting forms, remembering your chosen currency and your answer to the privacy notice. We use no advertising cookies and no third-party tracking code.

7. Browser extension

Our extension stores your API key and the website address in your own browser. It reads the address of the open tab only when you click its icon, to detect the platform. It does not read page content, track your browsing, or send data anywhere other than this website.

8. Data security

All connections are encrypted with HTTPS and passwords are stored with one-way encryption. You can turn on two-factor authentication, and changing your password signs out all other devices. For your safety, use a password unique to this website.

9. Contact

Please send any request regarding your personal data to our support team. Contact: Zalo chat.