Privacy
Policy

1. Scope

This policy covers vwealth.vn, app.vwealth.vn and the VWEALTH app for iOS and Android. It explains what data VWEALTH collects, what it is used for, who it is shared with and what rights you have.

2. Data we collect

2.1 Account

• Email, name, password (stored only as an Argon2 hash), and a profile photo if you upload one.
• Language, light or dark theme, text size and email preferences.
• When you agreed to the Terms and Policy, and which version.

2.2 Sign-in and devices

• OTP codes sent to your email (expire after 10 minutes).
• Sign-in sessions: type (web or app), platform, device name, IP address, sign-in time and last use. This data enforces the one-device-at-a-time rule and protects your account.
• In the app: an app install ID, the push token issued by Google's Firebase Cloud Messaging, operating system, app language and app version.
• On the web: a browser ID cookie (section 9) to prevent abuse of offers.

2.3 Data from using the service

• Virtual books: book name, virtual capital, asset types, virtual orders, positions, virtual cash, daily book value and returns.
• AI Assistant: the strategy you describe, the inputs you enter (simulated capital, target, time horizon), AI Baskets, schedules and results.
• Portfolio checkup: the portfolio you confirm (ticker, quantity, cost price) and the checkup result.
• Tickers you pin on the price board, tickers you follow, articles you like and notifications in your bell.
• Credit history: credits added, used and refunded.

2.4 Public profile and Classes

• Display name, handle (@handle), short bio, risk level, contact channels you fill in, badges and rankings.
• Classes you create or join, and your class book.

2.5 Payments

• VWEALTH does not receive or store card details.
• In-app plans: the App Store or Google Play transaction ID, the plan, and its start and expiry dates.
• Web payments: amount, transfer reference, the transaction ID returned by the bank (through SePay) or PayPal, and invoice details if you request an invoice.

2.6 Usage measurement

• The app sends usage events (event name, time, platform, app version, and your user ID if signed in) to VWEALTH's own servers. This data is used internally to improve the product.
• The app.vwealth.vn website uses Google Analytics 4 to count page views as statistics.
• Server technical logs (IP address, browser, time, path) to run the service and block attacks.

2.7 Data we do NOT collect

• Account numbers, passwords or balances at securities or fund management companies.
• Your real order history.
• Contacts, location or microphone.

3. Portfolio screenshots and AI processing

• When you upload a screenshot for Portfolio checkup, the image is sent to the AI model provider Anthropic (United States) to read tickers, quantities and cost prices.
• The image stays in memory only while it is processed: VWEALTH does not write it to disk and does not keep it. Only the extracted data is kept so you can review, correct and confirm it.
• A screenshot may show other information (name, account number, balance). Crop it out before uploading.
• The strategy you describe to the AI Assistant and the portfolio you ask to check are also sent to Anthropic to produce the result.
• Images and content you send are not used to train AI models.
• You consent to this when you accept the Terms and Policy at sign-up (and when you agree to a new version). You can withdraw by no longer using the AI features or by deleting your account.

4. How we use data

• To provide the service: virtual books, reports, AI Assistant, Portfolio checkup, Community, Classes.
• To sign you in, send OTP codes and enforce one device at a time.
• To send reports, AI Assistant results, and account and payment emails.
• To process payments and manage plans and credits.
• To show public profiles, rankings and badges.
• To prevent abuse of offers and account sharing, and to protect the system.
• To improve the product from usage statistics.
• To meet obligations under Vietnamese law.

5. Legal basis

• Consent: given when you sign up and when you agree to a new version.
• Performance of a contract: providing the plans and credits you bought.
• Legal obligation: accounting, tax, and requests from competent authorities.
• Legitimate interest: security, fraud prevention and preventing account sharing.

6. Public profile and Classes

• Your public profile is on by default once you have a virtual book. Others (including people who are not signed in, and search engines) see: display name, @handle, profile photo, short bio, risk level, month joined, the % return and asset weights of your virtual books, number of filled orders, badges, rankings and any contact channels you fill in.
• Your display name defaults to the name you gave at sign-up. You can change it on the profile edit page.
• Never made public: email, amounts of money (capital, book value, cost price), payment data.
• Turn it off under Account ▸ Public page. When it is off, your profile is hidden and your ranking data is removed from the rankings.
• Classes: the owner and members see each member's display name (or name, if no display name is set) and % return; the owner can download this table. Email is never shown in a class.

7. Sharing data

VWEALTH shares only the data needed for each task, with:

• Anthropic (United States): processing the AI Assistant, Portfolio checkup and screenshot reading (section 3).
• Google: Firebase Cloud Messaging for push notifications; Google Analytics 4 for website page-view statistics; Google Play for in-app payments on Android.
• Apple: the App Store for in-app payments on iOS.
• Cloudflare: bot checks (Turnstile) on the web sign-in and sign-up pages.
• SePay and PayPal: reconciling bank transfers and processing international payments on the web.
• Hosting and email providers that run the service.
• Competent state authorities when required by law.

Price sources (VPS, CafeF, Fmarket, Bao Tin Minh Chau, Vietcombank) are only used to download market data; we do not send your personal data to them.

Transfers outside Vietnam

Anthropic, Google, Apple, Cloudflare and PayPal may process data outside Vietnam. We transfer only the data needed for each task listed above.

8. Push notifications

• The push token is used only to send: new weekly and monthly reports; AI Assistant results (basket ready, failed run with credit refunded, schedule stopped for lack of credits, checkup ready); and occasionally an important service notice.
• It is not used for advertising or tracking.
• You can turn notifications off in the app or in your device's notification settings. When you sign out or delete your account, the device stops receiving notifications.

9. Cookies and on-device data

The VWEALTH websites use these cookies:

• Sign-in session (orova_user_token, required) and temporary cookies during sign-in (vw_otp, vw_next).
• Browser ID (vw_did) to prevent abuse of offers.
• Display preferences: light or dark theme (vw_theme), text size (vw_text), language (vw_lang).
• Selected book (vw_active_book, vw_last_book_*) and pinned price-board tickers (vw_board_pin).
• In-app layout (vw_app) when a page is opened inside the app.
• Referral code (orova_ref, 90 days) when you open a referral link.
• Google Analytics 4 (_ga cookies) on app.vwealth.vn for page-view statistics.

VWEALTH does not use advertising or cross-site tracking cookies. If you block cookies in your browser, you will not be able to sign in.

The app stores a sign-in session token and a public data set about funds and stocks on your device so screens open quickly. Signing out or uninstalling the app removes this data.

The app asks for camera and photo library access only when you tap to take or choose a photo for Portfolio checkup, and reads only the image you choose.

10. Retention and security

• Account and usage data: kept while you use the service.
• Virtual books: kept until you reset the book or delete your account.
• Portfolio screenshots: not kept.
• Payment records: kept for 5 years under accounting and tax rules.
• Technical logs: 90 days.
• Security: HTTPS for every connection, Argon2 password hashing, internal access control, regular backups.

11. Deleting your account and your rights

Deleting your account

In the app: Account ▸ Delete account, then enter your email to confirm. On the web: send a request to contact@vwealth.vn.

• Immediately on deletion: all devices are signed out; the account email is replaced with an anonymous address; your name and profile photo are removed; the password is replaced with a random one; push notifications and emails are turned off; any active plan ends; remaining credits are cancelled.
• Your public profile is hidden and you are removed from Community and the rankings.
• Remaining usage data (virtual books, AI Baskets, checkup results) is no longer linked to your email or name. To have it erased completely, send a request to contact@vwealth.vn; we handle it within 30 days.
• Payment records are kept for the period required by law.
• A subscription paid through the App Store or Google Play must be cancelled separately in the store.

Your rights

Under Decree 13/2023/ND-CP and Law No. 91/2025/QH15, you have the right to be informed, to give and withdraw consent, to access, correct and delete your data, to restrict or object to processing, and to complain. You can view and edit most of your data in your account; send other requests to contact@vwealth.vn and we will reply within 15 working days.

12. Users under 18

VWEALTH is not for people under 18 and does not knowingly collect their data. If we find such an account, we lock it and delete the data.

13. Changes to this policy

• The version date is shown at the top of the page.
• When we change how data is collected or used, the app asks you to agree again before you continue.

14. Contact

• Email: contact@vwealth.vn
• Website: vwealth.vn