Privacy Policy

1. Scope

This policy explains what personal data is processed when you use kinhdichonline.com, why, who receives it and what rights you have, in accordance with Vietnamese law on personal data protection.

The data controller is the business operator named on the Contact page.

2. Data we process

• The question you type, the topic, the language, the hexagram cast and the reading. A question may contain private information that you write yourself, so please avoid entering full names, ID numbers or other people's information.
• Account identifier: a random identifier for the guest account. If you sign in with Google: the email, name and profile picture that Google provides.
• IP address: used to limit free credits and to block bots. In the database we store only a one-way hash of the IP, not the original IP.
• Payment data: order code, credit package, amount, time, transfer content and the reference code sent by the bank through SePay. This may include the sender's name as recorded by the bank. We do not receive or store card numbers, passwords or OTP codes.
• Credit ledger: the additions, deductions and refunds of credits on the account.
• Technical information needed for operation and security: browser type, access time, error codes. Logs do not record the content of questions.

3. Purposes of processing

• Casting hexagrams, writing and storing readings so you can review them, download a PDF and avoid being charged twice for the same cast.
• Confirming payments, adding and refunding credits, reconciliation and handling complaints.
• Blocking bots, preventing abuse of free credits, and protecting the system and its costs.
• Operational statistics in aggregate form (number of readings, topics, costs), which do not contain the content of questions.

We do not use your data for advertising, and we do not sell or rent data.

4. Basis of processing and consent

When you cast your first hexagram, you are asked to agree to the Terms and this Policy. The system records the time and the version you agreed to.

You can withdraw your consent at any time through the Contact page. We will then stop processing and delete your data, except data that the law requires us to keep (for example payment records). Withdrawal does not affect processing that took place before it.

5. Parties that process data with us

To run the service we use the providers below. Each receives only the data needed for its task:

• Supabase: database and sign-in, servers located in Singapore.
• Cloudflare: web servers, content delivery network and bot checks (Turnstile), processed on global infrastructure.
• Anthropic (United States): the Claude AI model that writes the reading. It receives the question, topic and hexagram data, and does not receive your identity or IP. Under Anthropic's commercial terms, data sent through the API is not used to train models.
• SePay and the bank: receive and reconcile transfer transactions.
• Google: only if you choose to sign in with Google.

Because the providers above host their servers outside Vietnam, your data may be transferred abroad. By agreeing to this policy, you agree to that transfer for the stated purposes only. We do not provide data to other parties, except when a competent state authority requires it under the law.

6. Retention period

• Questions and readings: kept until you delete your account or ask for deletion. Guest accounts that have never bought credits and have not been used for 12 months are deleted automatically.
• Orders, transactions and the credit ledger: kept for the period required by accounting and tax law, including after you delete your account (they are then no longer linked to an email or Google account).
• IP hashes and free credit counters: deleted automatically after 30 days.

7. Your rights

You have the right to be informed, to view, to correct, to request deletion, to restrict processing, to object to processing, to withdraw consent and to receive a copy of your data.

You can delete your account yourself on the Account page. Send other requests through the Contact page, with your order code or the link to the reading so that we can identify the right account. Deletion requests are handled within 72 hours. Other requests are answered within the period set by law.

You also have the right to complain to the competent state authority on personal data protection.

8. Security

Connections are always encrypted (HTTPS). The database uses row-level access control: each account can read only its own data. Secret keys exist only on the server. Changes to credits and payments are made only on the server and are recorded in a ledger.

If a data breach occurs, we will notify the competent authority and the affected people within the period set by law.

9. Children

The service is for people aged 18 and over. We do not knowingly collect data from children. If you are a parent and know that your child has used the service, please contact us so that we can delete the data.

10. Changes to this policy

When we change how we process data, we update this page, record it in the change history and ask for your consent again the next time you use the service.