Privacy policy

The Software runs locally on your computer. The Company's servers keep only what is needed to sell plans, issue and check licences, support you and comply with the law. We design for minimal collection and never trade in your data.

Account data (provided at sign-up): username; password — one-way hashed by the authentication system, the Company cannot read it; full name and phone/Zalo number if you volunteer them for support.

Order and payment data: chosen plan, amount, payment code, creation and payment time, status; bank transfer details forwarded by the SePay gateway and the bank (amount, transfer note, reference number, time, receiving account). We do NOT collect or store your card number, banking password or OTP; the sender's account number appears only if your bank includes it in the transfer note/reference.

Licence and device data (sent by the Software when you sign in to your ViraAi account in the Software and every 12 hours): a one-way hash of the Windows machine identifier (cannot be reversed to hardware details), the computer name (hostname) set in Windows, the operating system name and the check time. Used to ensure each account runs on exactly one machine.

Technical and log data: IP address, browser/application identifier (user-agent), sign-in time, sign-in source (web or software), and a log of actions relating to the account, orders and licences (order created, payment matched, plan issued/revoked, password reset). The security log is append-only — never edited.

Support data: messages, screenshots and transfer receipts you send us via Zalo, phone or email when you need help.

The following stays on your machine and is never sent to the Company's servers:

• Accounts, passwords, cookies, sessions and any credentials of third-party platforms (Google, Dola, …) that you load into the Software. If you enter a Google password so the Software can sign in for you, it is encrypted with Windows' own protection bound to your Windows user account and sent only directly to Google.
• Proxy lists including proxy usernames and passwords.
• Prompts, images, videos and audio you enter; videos and images the Software creates or downloads; scripts, generation history, settings and the Software's local technical logs.

When the Software works with a third-party platform (including the Gemini video-analysis feature), the connection goes directly from your machine to that platform using your account and does not pass through the Company's servers. That platform's processing follows its own policy.

• Performing our contract with you: creating and managing your account, processing orders, reconciling payments, activating and checking licences, renewals and upgrades, notifying you about order status and expiry, technical support.
• Complying with legal obligations: retaining accounting, tax and invoice records; responding to lawful requests from competent state authorities; incident reporting as required.
• The Company's legitimate interests: detecting and preventing payment fraud, licence sharing and attacks on the system; ensuring information security; resolving disputes and protecting legal rights.
• Your consent: for any other purposes introduced later (for example surveys or feature announcements); you may withdraw it at any time. The Company currently does not use your data for advertising or marketing and does not profile behaviour.

We do not sell, rent or exchange your personal data with anyone, and we do not use it for purposes other than those above without your consent.

To operate the Service the Company uses the following providers; they process data only on the Company's instructions, to the extent necessary, under confidentiality commitments:

• Supabase (database and authentication; servers in Singapore): stores accounts, orders, licences, devices and logs.
• Vercel (infrastructure running the website and API; compute in Singapore, global delivery network): handles requests from browsers and the Software.
• SePay (bank-transfer reconciliation gateway, Vietnam): reports bank transactions to match orders; SePay and your bank process payment data under their own policies.
• Zalo and telecom carriers: when you contact support through those channels.

Cross-border transfer: because the infrastructure is located in Singapore, your account, order and device data are stored and processed outside Vietnam. The Company carries out the cross-border transfer impact assessment procedures and safeguards required by the Law on Personal Data Protection 2025 and Decree 13/2023/ND-CP; by using the Service you consent to this transfer.

The Company may disclose data to competent state authorities upon lawful written request, within the scope requested; or to a successor in a merger or transfer of the Service, provided that party continues to comply with this Policy.

• Account data: for as long as the account exists; deleted within 30 days of your deletion request or after 24 months with no active plan.
• Orders, payment transactions and receipts: 10 years under accounting and tax law, even after account deletion (de-identified from the account where possible).
• Licences and devices: same lifecycle as the account.
• Sign-in sessions: 30 days from last use; deleted immediately on sign-out or password reset.
• Technical and security logs: 12 months, unless longer retention is needed for a dispute or required by a competent authority.
• Support data on Zalo/email: per that platform's retention; the Company deletes its own copies after 12 months.

Under the Law on Personal Data Protection 2025 you have the right to: be informed of processing; consent or refuse; access and obtain a copy of your data; rectify; erase; restrict or object to processing; withdraw consent; complain, denounce or sue; and claim compensation as provided by law.

• How to exercise them: send a request with your username and verification details (order code or the phone number on file) to support@lohatech.vn or Zalo 0399692275. The Company responds within 72 hours of receiving complete information; complex requests may take longer and we will tell you.
• Deleting your account stops all plans and licences without refund of the current term; data that must be kept by law (orders, receipts) is retained for the periods in section 7.
• Withdrawing consent does not affect the lawfulness of processing already carried out and may mean the Company can no longer provide the Service to you.
• You may lodge a complaint with the specialised personal data protection authority (Ministry of Public Security) if you believe your rights have been infringed.

The Service is not intended for anyone under 16 and the Company does not knowingly collect children's data. Persons aged 16 to under 18 need the consent of a parent or guardian. If we learn that children's data has been collected improperly we delete it immediately; parents or guardians may contact us to request this.

• All connections between the browser, the Software and the servers are encrypted (HTTPS/TLS).
• Account passwords are stored as one-way hashes; sessions are random, time-limited tokens kept in a server-only (HttpOnly) cookie or, in the Software, encrypted and bound to your Windows user account.
• Admin keys and the licence-signing key live only on the server, never inside the Software; licences are digitally signed so they cannot be altered or moved to another machine.
• The database enforces row-level access control: one account cannot read another's data; admin staff are role-scoped and every action is written to an append-only audit log.
• Sign-in rate limiting prevents password guessing; sessions are invalidated immediately on password reset.

No system is perfectly secure. If an incident affects your personal data, the Company notifies the specialised authority within 72 hours of discovery as required, and notifies you through your contact channel with guidance.

The website uses only strictly necessary technical cookies: one holds your sign-in session (server-only) and one marks that you are signed in so the navigation bar switches "Sign in" to "Account". There are no advertising cookies and no third-party marketing trackers. Display preferences (for example having seen the demo tour) are kept in your browser storage and not sent to the server.

These are cookies of viraailap.com. Cookies of third-party platforms that you load into the Software are an entirely separate matter: they stay on your machine and never reach the Company (section 4).

The Company may update this Policy when the law, infrastructure or features change. The update date is shown at the top; changes to the types of data collected, purposes or recipients are announced in the Software or on the Account page at least 7 days before they apply, and your consent is requested again where the law requires.

Personal data protection contact: Công ty TNHH Công nghệ LoHa (LoHa Tech Co., Ltd.) — Tax code 0111509748 — Address: Trần Phú, Hà Nội, Việt Nam — Phone/Zalo: 0399692275 — Email: support@lohatech.vn.