Privacy Policy

Who we are

This policy explains how Chinh Phong ("we") handles personal data on chinhphong.com, app.chinhphong.com and api.chinhphong.com ("the site"). Chinh Phong decides why and how this data is processed. It follows Vietnam's Law on Personal Data Protection (Law No. 91/2025/QH15) and Decree No. 356/2025/ND-CP.

For any privacy question or request, email privacy@chinhphong.com.

What we collect and why

When you browse: your IP address and basic request data, to deliver pages, stop abuse and limit how many requests one visitor can make. On public listing pages we store only a one-way hash of your IP. If you arrive through a referral link (?ref=), a cookie keeps the code for 90 days so a broker can be credited if you sign up.
When you create an account: your name, email, password (stored only as a one-way hash), the roles you choose (buyer, seller, broker) and whether your email is verified. You confirm that you are 18 or older; we record the time you confirmed it. When you sign in we keep a session record with your IP address and browser details, to keep you signed in and detect misuse. We count sign-up, sign-in and password reset attempts per IP and per hashed email to stop abuse.
When you submit a property: property details (including plot and map sheet numbers and the exact map location), the owner's name and phone, the files you upload, the time you agreed to send the submission, and notes our staff add while reviewing it. Title and legal documents often contain names, ID numbers, addresses and ID card images, some of which may be sensitive personal data under Vietnamese law (for example ID card images and ID numbers), so upload only what is needed. Original photos keep their location and camera data; the display copies we make have it removed. We use this to review the property, prepare a listing and handle the deal.
When you ask about a listing: who asked, which listing, the stage of the request, your note and the outcome, to handle the request.
When you use the /qualify form: your company details, your name, email, phone and a pitch deck link if you give one, to contact you about working together.
When you send a message on the Contact page: your name, your email or phone, the team you chose (if any) and your message, to read it and reply. We save it in our database, where only admins can read it, and email it to that team's mailbox.
Brokers working with us in-house: legal name, tax code, tax status, referral codes and commission records (including tax withheld), to pay commissions and meet tax duties.

Analytics

On public pages (not the signed-in /app pages) we use PostHog analytics. What it does depends on your choice in the cookie banner.

If you have not chosen, or you decline: we count your visit anonymously. PostHog sets no cookies and uses no browser storage, so nothing is saved on your device and you get no ID. Each page view sends the page address, the page title, the site you came from, your browser, operating system and device type, screen size, language and time zone. PostHog's servers in the United States also receive your IP address and browser details with it. PostHog combines them with a secret value that changes every day to make an anonymous code that is used only to count visits, and deletes the secret value once that day's events are processed. The code differs from day to day, cannot be traced back to you and is not linked to your account, so this count cannot identify a person. Clicks are not recorded.
If you allow analytics: PostHog records page views and clicks, sets a random ID in a cookie and local storage, and receives your IP address. Session recording is off, and we do not link analytics to your account.

We keep a record of your choice in a cookie on your device (cp_consent): the choice, the Cookie Policy version you saw, the time and a random record ID. It lasts 180 days, and we ask again when the Cookie Policy changes. You can change or withdraw your choice at any time on the Cookie Policy page; withdrawing stops cookie-based analytics at once and removes PostHog's cookie and storage. The anonymous visit count described above continues.

Cloudflare, our host, also adds a small performance script (Cloudflare Web Analytics) to our pages. It measures page load times and sets no cookies.

Who can see your data

The public and signed-in users see only listings we have reviewed and published: a short summary, price and area ranges, watermarked preview photos and a location within about 2.5 km. Never owner names, phone numbers, exact locations, documents or original files.
Invited buyers we approve may, later in a deal, receive more of a listing's files, watermarked or stamped with their identity. These can include title and legal documents.
Chinh Phong staff can see all the data in this policy.
AI assistance: our staff may use an AI service from OpenAI, in the United States, to help assess a property. It receives the property details, including the exact location, with the owner's name and phone hidden. Photos and PDF documents uploaded with the property are sent as they are, so ID card images in them can still show names. A person reviews every result; no decision about you is made by automated processing alone.
We may disclose data when the law requires it, for example to a competent state authority. We do not sell personal data.

Service providers and transfers abroad

These providers process data for us. They are based in the United States, so your data is transferred outside Vietnam.

Cloudflare, Inc.: hosting, database, file storage, request logs, page performance measurement and the sign-up bot check (Turnstile). It holds all site data.
Resend, Inc.: sends account emails and delivers Contact page messages to our team. It receives your name, email address and the email content.
PostHog Inc.: analytics: an anonymous visit count without cookies, and full analytics only with your consent, as described above.
Sentry (Functional Software, Inc.): error tracking for the site and the server, on every page including /app. When something breaks, it receives a technical error report: the error message and where in our code it happened, the page address without its query part, your browser and device type, your IP address, and the timing of a small share of page loads and requests. It sets no cookies, does not record your screen or what you type, and receives no form contents, cookies or uploaded files.
OpenAI: the AI service described above. It receives property details, photos and documents when our staff ask it to help assess a property.
Map and content providers: the deals map loads tiles from Esri, the contact page embeds Google Maps, and some images load from a third-party content delivery network. Your browser contacts them directly when you open those pages, so they receive your IP address.

Data sent abroad is subject to the laws there. A breach could expose your contact details or documents. To reduce these risks we limit what the public sees, watermark shared files, use HTTPS, hash passwords and restrict staff access. If a breach affects you, we will act as Vietnamese law requires.

How long we keep data

Accounts, submissions, listings, deal records and form entries: until you ask us to delete them, or until we no longer need them for the deal or for legal and tax duties.
Uploaded files: not deleted automatically. A removed submission or listing goes to the trash with its files; files are deleted when we handle a deletion request or decide to delete them.
Sessions and rate limit records: a session expires 60 days after your last activity. Expired sessions and old rate limit counters can stay in our database until we clear them.
Referral cookie: 90 days. Consent cookie: 180 days. Analytics and request logs: under PostHog's and Cloudflare's retention settings. Error reports: under Sentry's retention settings.

Your rights

Under Vietnamese law you can:

know how your data is processed;
give, refuse or withdraw consent;
see your data and get a copy;
correct it;
ask us to delete it, or to restrict or stop processing it;
object to processing, including for marketing;
complain to the Ministry of Public Security or go to court, and claim damages as the law allows.

Withdrawing consent does not undo past processing, and some processing may continue where the law allows, for example for tax duties. Please give accurate data, and upload another person's data (such as an owner's name, phone or documents) only if you have the right to share it.

How to make a request

Email privacy@chinhphong.com from your account's email address and say what you want. There is no self-service account deletion yet; we delete accounts on request. We may ask you to confirm your identity.

We confirm receipt within 2 working days. We complete requests to withdraw consent, restrict or object within 15 days, and requests to see or correct data within 10 days, unless the law allows more time. Deletion requests are handled within the time the law requires.

Children

The site is for adults. You must be 18 or older to create an account. We do not knowingly collect data from anyone under 18. If you think a child has given us data, email us and we will delete it.

Changes and languages

We update this page and its date when our handling of data changes. Other language versions are available by switching the site language. If a translation differs from this English version, the English version prevails.