INVIE
Privacy Policy
This policy explains how INVIE collects, uses, shares and protects personal data when you use app.invie.net and related services (the “Service”), and what rights you have. It follows the principles of the EU General Data Protection Regulation (GDPR) and Vietnam’s Decree 13/2023/ND-CP on personal data protection.
1. Who is responsible for your data
Lê Bùi Hoàng Viên, 203/36 Đinh Thiên Hoàng, Buôn Ma Thuột Ward, Đắk Lắk Province, Vietnam, is the controller of the account, billing and technical data described below. For personal data contained in content customers put into their workspaces, the customer is the controller and INVIE is a processor under the Data Processing Agreement. Privacy contact: privacy@invie.net.
2. Data we collect
| Category | What it includes | Source |
|---|---|---|
| Account | Email, display name, your workspaces and roles, workspace invitations | You and members who invite you |
| Sign-in | One-time sign-in links (stored only as hashes), a session held in a secure cookie | Generated by the system |
| Workspace content | Projects, notes, evidence, uploaded files, findings, briefs, results, watchlists, saved filters | You and workspace members |
| Billing | Plan, status, customer ID at the payment processor, payment amounts and dates. We never receive or store card numbers. | You and the payment processor |
| Technical and security | IP address (used transiently for rate limiting and bot checks; counters keep only a one-way hash), browser type, error and request logs | Your browser |
| Support | Emails and information you send us | You |
Interface preferences (language, light/dark theme), the open workspace and Project, and unsaved drafts are kept in your browser’s local storage and are not sent to our servers.
Public market data
To provide the Service we collect public data from app stores, ad libraries and search trend tools: rankings, app details, ads and user reviews. Stored reviews include the text, rating, date and a link to the original; we do not store reviewer names, but the original link may lead to a public profile. If you wrote a review and want it removed, contact privacy@invie.net.
3. Purposes and legal bases
| Purpose | Legal basis |
|---|---|
| Create accounts, sign in, provide and operate the Service, store workspace content | Performance of a contract (Terms of Service) |
| Payments, invoices, plan management | Contract; legal obligations (accounting, tax) |
| Security: bot protection, rate limiting, abuse detection, incident investigation | Legitimate interest in protecting the Service and its users |
| Transactional email (sign-in links, invitations, billing notices, important changes) | Contract |
| AI processing of data you select | Your consent, given for each use |
| Collecting and analysing public market data | Legitimate interest in providing a market research service |
| Customer support, improving the Service | Legitimate interest; contract |
We do not sell personal data, do not use your data for advertising, and do not embed third-party advertising or behavioural analytics trackers.
4. AI features
When you use an AI feature (for example review topic analysis, idea suggestions or brief generation), only the data you selected is sent to the AI provider, and only after you confirm. We ask providers not to retain requests where their service supports this. If you do not use AI features, your data is not sent for AI processing.
5. Who we share data with
We share personal data only with the following categories of recipients, as needed, under contracts with confidentiality and data protection obligations:
- Cloud infrastructure and network security providers: database and file storage, running the application, content delivery, attack protection and bot checks.
- Transactional email service: sending sign-in links and notices.
- Payment processor: transactions, invoices, taxes and subscription management.
- AI model providers: only when you use AI features, as described in section 4.
- Market data providers: receive lookup requests such as app IDs, keywords and markets; they do not receive your personal data.
- Competent authorities: where required by law.
- Successors: in a merger, acquisition or transfer of business, provided they keep protecting data under this policy.
When you view ad images or videos or app icons, your browser may load them directly from the original platform (app stores, ad platforms, video players), and interface fonts may be loaded from a font service. These parties may receive your IP address and browser details under their own policies.
6. International transfers
Primary data is stored on cloud infrastructure in the Asia-Pacific region and may be processed in other countries where our providers operate. When data leaves your country, we use appropriate safeguards required by applicable law, such as approved standard contractual clauses, and complete the formalities required by Vietnamese law.
7. Retention
| Data | Retention |
|---|---|
| Sign-in links | 15 minutes, single use |
| App / admin sessions | 14 days / 8 hours, or until sign-out |
| Rate-limit counters (hashed IP) | Up to 10 minutes per window |
| Account and workspace content | While you use the Service; deleted within 30 days of a deletion request or the end of the contract |
| Backups | Rotated automatically, up to 30 days |
| Technical logs | Up to 30 days |
| Billing records, invoices | As long as accounting and tax law requires |
8. Security
We apply appropriate technical and organisational measures, including: encryption in transit (HTTPS/TLS); encrypted system secrets; passwordless sign-in with one-time links; session cookies sent only over HTTPS and not readable by JavaScript; two-factor authentication for administrators, whose identities are separate from application accounts; role-based access and separation between workspaces; rate limiting and bot checks; backups and point-in-time recovery. No system is perfectly secure. If an incident affects personal data, we will notify you within the time the law requires.
9. Your rights
Depending on applicable law, you have the right to be informed; to access and receive a copy of your data; to rectification; to erasure; to restrict processing; to object; to data portability; to withdraw consent (without affecting earlier processing); and to complain to a data protection authority. In Vietnam, this is the personal data protection authority of the Ministry of Public Security; in the EU/EEA, the supervisory authority where you live.
To exercise these rights, email privacy@invie.net from your account email. We may need to verify your identity and will respond within the time the law sets, normally within 30 days. You can change your display name in Account settings and export Project data from the app. If content belongs to an organisation’s workspace, we may forward your request to that organisation as controller.
10. Cookies and browser storage
The Service uses only essential cookies: one sign-in session cookie, which the Service needs to work, so no consent is required. The bot check on the sign-in page is performed by a security provider solely to tell people from bots. We do not use advertising or behavioural analytics cookies.
11. Children
The Service is meant for professionals working in games and apps and is not intended for anyone under 16. We do not knowingly collect children’s data and will delete it if we find it.
12. Changes to this policy
We may update this policy. Material changes will be announced by email or in the Service before they take effect. The version and effective date are always shown at the top.
13. Contact
Lê Bùi Hoàng Viên · 203/36 Đinh Thiên Hoàng, Buôn Ma Thuột Ward, Đắk Lắk Province, Vietnam · Email: privacy@invie.net