Sign up free
← All legal documents

Privacy policy

Version 1 · In effect from Oct 23, 2026

1. Scope

This policy covers hostbooking.vn, the booking sites running on the platform and the console, operated by Mr Lê Anh Tuấn (an individual). It follows Vietnam’s Personal Data Protection Law No. 91/2025/QH15 and Decree 13/2023/ND-CP.

For the data of guests booking with a business, that business is the data controller and HostBooking processes on its behalf. Each booking site has the business’s own privacy policy in its footer.

2. Data collected

  • Owners and staff: name, email, phone, password (stored only as a hash), business details, payout bank account, tax code if any.
  • Guests: name, phone, email, country, dates, party size, notes, invoice details if asked for, booking and payment history, reviews.
  • Technical: IP address, browser, device, time of access, pages viewed, console activity log.
  • Session recording: see section 3.

HostBooking does not collect biometric or health data or card numbers. Card payments, where a business enables them, happen on the payment gateway’s own page.

3. Session recording (replay)

To find bugs and improve the interface, the platform may record what happens on a page (pointer, scroll, clicks, what is shown and what is typed into fields) and play it back as video.

  • Password, one-time-code and card fields are always masked and never recorded.
  • Only HostBooking’s platform administrators can view recordings; business owners and others cannot.
  • Recordings are kept for at most 31 days on the server, outside backups, then deleted automatically.
  • Recordings are never used for advertising, sold or shared with third parties.

4. Purposes

  • Providing the service: sites, bookings, confirmations, payments, notifications by email and Zalo.
  • Security: sign-in, detecting unusual access, preventing abuse, logging.
  • Support, fixing bugs, improving the product.
  • Telling owners about plans, invoices and how to use the product. Feature news carries an unsubscribe link.
  • Legal obligations (accounting, lawful requests from the authorities).

5. Safeguards

  • HTTPS throughout; firewall and attack protection through Cloudflare.
  • Each business’s data is isolated in the database (row-level security): one business cannot read another’s.
  • Passwords are one-way hashed; payment gateway keys and other secrets are encrypted at rest.
  • Role-based permissions; an activity log of who changed what and when.
  • Daily backups, kept in Vietnam.

No safeguard is absolute. If the server itself were compromised, data could be exposed despite partial encryption; HostBooking would notify as in section 9.

6. Sharing

HostBooking does not sell data. It goes only to providers needed to run the service:

  • Servers and database: a VPS provider in Vietnam.
  • Content delivery, firewall, bot protection: Cloudflare (USA).
  • Transfer matching: SePay; any gateway a business chooses (VNPay, MoMo, ZaloPay, Stripe).
  • Notifications: Zalo (VNG), Google Gmail; Google Firebase for sign-in with Google or phone.
  • AI assistant and translation: Google Gemini, Groq, OpenRouter (USA) — only the content being processed.
  • Owner relationship management: an email marketing service operated by HostBooking.
  • Authorities, on a lawful request.

Some providers host data abroad. HostBooking keeps the cross-border transfer impact assessment the law requires and uses only providers with confidentiality commitments.

7. Cookies

The platform uses cookies needed for sign-in and language. A business may turn on Google Analytics or Meta Pixel on its site; their cookies then apply under their own policies.

8. Retention

  • Accounts and business data: while the service is used and 30 days after it ends.
  • Bookings and payments: for as long as the business uses the service; plan payment records as accounting law requires.
  • Console activity log: while the business uses the service. Session recordings: 31 days.

9. Your rights

You may be informed, consent or withdraw consent, access, correct, have data deleted, restrict processing, receive a copy, object and complain. A business’s guests ask that business; owners ask HostBooking through the contacts at the foot of this page. Requests are answered within 72 hours and handled within the legal time limit.

In a data breach, HostBooking notifies the authorities and the affected businesses within 72 hours of discovering it.

10. Contact

Questions about personal data: the email, phone or Zalo at the foot of this page.