Privacy policy and personal data processing notice

This is a translation. The Vietnamese text at /phap-ly/chinh-sach-quyen-rieng-tu prevails, except where the law requires the version more favourable to a consumer.

This document is both XNK24's Privacy Policy and its Personal Data Processing Notice. It applies to the xnk24.com website (including Articles, the Hỏi đáp (Q&A community) and the Account page) and to the XNK24 Pro application on Windows and macOS.

Version 1.1, effective from 28/10/2026. Version 1.1 records that connections to xnk24.com no longer pass through Cloudflare and that the payment QR code image is generated by the XNK24 server.

Chapter I. General provisions

Article 1. Who processes your data

1. The controller and processor of personal data is CÔNG TY TNHH GIẢI PHÁP VIETFLOW (VIETFLOW SOLUTION COMPANY LIMITED), enterprise code 0111623049, with its registered office at 6th Floor, Viet A Building, 9 Duy Tan Street, Cau Giay Ward, Hanoi City, Vietnam. In this document it is called "XNK24" or "we". Full business details: Company information.
2. Contact point for personal data protection: email cto@xnk24.com, telephone 0941 221 183, or the Support section in the application.

Article 2. Core commitment: your documents stay on your machine

1. XNK24 Pro runs the AI assistant on your own computer. The following data is processed on your machine and is not sent to XNK24 in any form: not as request content, not as usage statistics, not as error reports, not as file names in logs:
   1. the content of chats with the AI assistant and files you attach (invoices, packing lists, bills of lading, contracts, scans, etc.);
   2. goods descriptions, HS codes you look up, and questions you search in Legal text lookup (Tra văn bản) and Trade statistics (Thống kê XNK);
   3. declaration worksheets and Excel files you export;
   4. freight quotations, forwarder books and your counterparty information;
   5. the Notebook (Sổ tay), Skills progress, Radar watchlists and Bulletin listening position.
2. The AI assistant has no Internet access and no web search tool. The application connects to the network only to manage accounts and licences, to download the AI model, Data Packs, updates, the Bulletin, Articles and Radar, and when you use Hỏi đáp or Support.
3. Data leaves your machine only when you send it, in the following cases:
   1. Support messages and feedback that you type. This content reaches XNK24. Do not paste document contents, contract numbers or customer information here.
   2. Posts in Hỏi đáp (questions, answers, comments). This content is public to everyone. Do not post details of invoices, schedules, declarations or customers' counterparty information.
   3. Crash reports (only if you turn them on). A report contains up to the last 200 lines of the application's log. The application is designed so that logs do not contain document content, and there is an additional filtering step that removes lines that look like paths or content. This filter works by pattern recognition and so is not an absolute guarantee. You can click "View report" (Xem báo cáo) to read exactly what will be sent. On a machine that handles sensitive files, you should preview each report or not turn this feature on.
4. The figures in usage statistics (Article 4) are counts only, for example the number of documents read by type. They contain no content, file names or text you typed.

Article 3. Other people's personal data in your files

Documents you process on your machine may contain other people's personal data (signatories, counterparty contacts, etc.). XNK24 does not receive this data. You or your organisation need a lawful basis to process that data and to protect the computer that holds it as recommended in clause 3 of Article 12.

Chapter II. Data XNK24 processes

Article 4. Types of data, purposes, bases, retention and recipients

1. The processing bases are abbreviated in the table as follows:
   1. Contract: necessary to perform the agreement between you and XNK24 when you open an account, take a trial or buy a plan (Article 19, clause 1, point d of the Law on Personal Data Protection (Luật Bảo vệ dữ liệu cá nhân) 2025).
   2. Protection of rights: protecting the lawful rights and interests of XNK24 and other members against infringing conduct, such as circumventing the licence or sharing accounts (Article 19, clause 1, point a of the Law on Personal Data Protection 2025).
   3. Law: XNK24 must retain the data under regulations on accounting, tax, e-commerce and cybersecurity.
   4. Consent: processed only when you turn it on; you can turn it off at any time.
2. Personal data XNK24 processes:

3. Payment data: when you open the payment screen on the website or in the application, the QR code image is generated by the XNK24 server in Vietnam; your amount and customer code are not sent to any other party. XNK24 Pro versions older than 0.2.22 still load the QR code image from the img.vietqr.io service: the image request contains the company's receiving account number, the amount, your customer code and your IP address. Update the application to use the new method. The customer code is a system-generated string that does not contain your name or email.
4. Usage statistics are tied to a random device identifier generated by the application. You can reset this identifier in Settings → Privacy. The current version of the application does not send the account identifier with these statistics. If we later need to send it, we will say so clearly on the consent screen and update this Policy first.

Article 5. Cookies and browser storage

1. The xnk24.com website does not use advertising cookies, does not use traffic analytics tools and does not embed third-party tracking code.
2. When you sign in on the website, the browser stores the sign-in token and basic account information in the browser's storage (localStorage) so that you do not have to sign in again each time you open a page. Click Sign out (Đăng xuất) to delete this data.

Article 6. Integrity Signals and abuse prevention

1. To protect the licence, the application records certain abnormal indicators: an invalid licence signature, the machine clock turned back, time-tracking data deleted, and touching certain pre-installed check points in the application that ordinary users never use. The server also records: an executable that differs from the official release, a machine used by several accounts, device-change requests exceeding the limit, a trial refused because the machine has already taken a trial, and a Data Pack download from a machine that is not the active device.
2. These signals travel with the next Licence Check, with no separate channel. They contain no documents, file names, paths or customer data.
3. Signals do not automatically lead to locking, restricting or slowing an account. XNK24 personnel review them. Before suspending an account for this reason, we notify you and give you 07 working days to explain. In an urgent security situation, we may suspend immediately and tell you the reason no later than 02 working days afterwards. Detailed procedure: Articles 37 to 39 of the Terms of use and the Acceptable use policy.
4. Signals and related logs may be used as evidence in resolving complaints and disputes, and are retained under clause 1 of Article 11.

Article 7. Sensitive data

1. XNK24 does not intend to process sensitive personal data and does not ask you to provide this type of data (for example identity card photos, health data, biometrics). Do not send such data through Support or Hỏi đáp.
2. Some data in Article 4 relates to how you use the service: device-change history, Integrity Signals and usage statistics (when you turn them on). Payment data includes information on transfers into the company's account. We describe the exact scope of this data in Article 4 and Article 6, use it only for the stated purposes, and restrict who can access it.
3. If a competent authority or guiding regulation determines that any of the above groups of data is sensitive data, we will notify you and apply the corresponding protective measures.

Article 8. Automated processing

1. No decision about you is made solely by machine without human review, other than the usage rules in clause 2. Integrity Signals are always reviewed by a person (Article 6).
2. Certain contract rules are applied automatically by program code, as published:
   1. a 7-day trial once per account and per machine; disposable email addresses are not accepted;
   2. one active device per account; you may change devices yourself up to 4 times in 30 days, and the 5th time requires contacting Support;
   3. Pro entitlement opens or ends according to the payments recorded;
   4. in Hỏi đáp, reputation points are calculated automatically from votes on your posts; members with fewer than 10 reputation points may ask at most 5 questions and post at most 20 answers per day.
3. If you believe an automatic rule has been wrongly applied to you, contact Support or cto@xnk24.com so that a person can review it.
4. The AI assistant in XNK24 Pro processes your documents on your machine, at your command; XNK24 does not receive the results.

Chapter III. Sharing, storage and transfer of data

Article 9. Who receives your data

1. XNK24 does not sell personal data and does not share personal data for advertising purposes.
2. The parties that process data on XNK24's behalf or take part in providing the service:
   1. Server provider in Vietnam: hosts the website, API and the account database.
   2. SePay: monitors transfers into the company's account and notifies the XNK24 system.
   3. Military Commercial Joint Stock Bank (MB Bank): the bank that receives the company's money.
   4. Email service provider: sends and receives mail for the xnk24.com domain.
3. Content you post in Hỏi đáp is displayed publicly to everyone, including people without accounts. Your email is never displayed publicly.
4. XNK24 provides data to competent state authorities when the law requires, within the scope of the request.
5. XNK24 uses certain external AI services on the server side to compile general content such as Radar, the Bulletin and reference rate tables, from public news sources. These services do not receive account data or your data.

Article 10. Where data is stored and transfer abroad

1. Your personal data is stored and processed on servers located in Vietnam.
2. Connections to xnk24.com go straight to the server in Vietnam, without passing through a relay network abroad. Cloudflare (United States) now only provides the domain name service (DNS), that is, it answers with the address of the xnk24.com server; Cloudflare does not receive the content of your connections, your sign-in data or your account data.
3. XNK24 does not transfer your personal data abroad. If this becomes necessary, we will update this Policy first and complete the procedures required by law.

Article 11. Retention, deletion and backups

1. The retention period for each data group is stated in Article 4. When the period ends, the data is deleted or made so that it no longer identifies you. When data is needed to resolve a complaint or dispute or at the request of a competent authority, XNK24 may keep the relevant data longer, until that matter ends.
2. When an account is deleted at your request:
   1. your posts, answers, comments, votes, violation reports, support tickets and device-change history are deleted with it;
   2. payment records are kept for the full 10 years under accounting law;
   3. Integrity Signals are kept until 12 months from recording;
   4. machine records (hashed machine identifier, trial date) are kept as stated in Article 4 to apply the rule of one trial per machine;
   5. consent records are kept as stated in Article 4, for at least 3 years after the contract terminates.
3. The server is backed up daily and the 7 most recent copies are kept. Deleted data may remain in backups for at most 7 days and then disappears when the old backup is replaced.
4. Data on your machine is managed by you. You delete individual chats, Notebook pages, quotations, etc. in the application, or delete everything at Settings → Data → "Delete all data…" (Xóa toàn bộ dữ liệu…). This command deletes assistants, chats, documents, declaration files, backups and logs on the machine and signs you out; the AI model and Data Packs are kept. Files you saved to other folders yourself (for example exported Excel files) you delete yourself.

Chapter IV. Data protection

Article 12. Protective measures

1. XNK24 applies technical and organisational measures, including:
   1. encrypting data in transit with HTTPS for every connection to xnk24.com;
   2. passwords stored only as hashes; the machine identifier sent only as a salted hash;
   3. digitally signed licences, Data Packs and application updates; the application rejects anything whose signature does not match;
   4. server services not exposed directly to the Internet, a firewall that blocks by default, server administration only through SSH keys;
   5. Integrity Signal data accessible only with the server's service key; member emails do not appear in publicly returned data;
   6. payment notifications from SePay authenticated by signature; logs do not record transfer content;
   7. only assigned personnel access personal data, within the scope of their work.
2. Details and how to report security vulnerabilities: Security and vulnerability reporting.
3. For data on your machine, each side does its part. XNK24 is responsible for the safety of the software and does not send your documents off your machine. Data in XNK24 Pro is in database files on your machine and is not separately encrypted by the application; the machine, the operating-system account and the passwords are under your control, so that protection is yours to provide. We recommend that you turn on full-disk encryption (FileVault on macOS, BitLocker or Device Encryption on Windows), set a sign-in password for the machine, not share a computer account, and not reuse your XNK24 password on other services.

Article 13. When a data leak incident occurs

1. When a personal data protection breach is discovered, XNK24 prepares a record, contains it and remedies it immediately.
2. XNK24 notifies the specialised personal data protection agency under the Ministry of Public Security no later than 72 hours after discovery, as required by the Law on Personal Data Protection 2025.
3. If a system holding customer information is attacked, XNK24 notifies the competent state management authority within 24 hours of discovery, as required by the Law on Protection of Consumers' Rights (Luật Bảo vệ quyền lợi người tiêu dùng) 2023.
4. If you are affected, XNK24 tells you by email and in the application as soon as it is determined, without delay: what happened, what data is involved, what we have done and what you should do.

Chapter V. Your rights

Article 14. Your rights

Under the Law on Personal Data Protection 2025, you have the right to:

1. be informed about the processing of your personal data (this document);
2. consent or not consent, and withdraw consent for optional features;
3. view, correct or request correction of your data;
4. request a copy of your data;
5. request deletion of data or deletion of the account;
6. request restriction of processing, and object to processing;
7. complain, denounce, bring a claim and seek compensation for damage as provided by law;
8. request a competent authority or XNK24 to apply measures to protect your data.

Withdrawing consent does not affect the lawfulness of processing carried out before. Some requests for deletion or restriction may not apply to data that XNK24 is required by law to keep (Article 11).

Article 15. How to submit a request and response times

1. Submit a request by one of the following means:
   1. in the application: Settings → Account → "Request a copy of my data" (Yêu cầu bản sao dữ liệu của tôi) or "Request account deletion" (Yêu cầu xoá tài khoản). This link opens a pre-filled Support ticket;
   2. email cto@xnk24.com, sent from the account's email address, stating the request clearly;
   3. a letter to the company's registered office (Article 1).
2. To protect you, we may ask you to confirm the request from the account's email address before carrying it out.
3. XNK24 gives a first response within 02 working days of receiving the request, and completes it within the following periods under Decree No. 356/2025/NĐ-CP:

4. If an extension is needed, we tell you before the period expires, with the reason.
5. A copy of the data is provided in a common, machine-readable format (for example JSON or CSV). You pay no fee for a reasonable request.
6. Data on your machine needs no request: you view, export and delete it directly in the application (Article 11, clause 4).
7. If you do not agree with how XNK24 resolves a request, you have the right to complain to the specialised personal data protection agency under the Ministry of Public Security or to bring a claim in court.

Article 16. Consent and withdrawal of consent for optional features

1. The following three features operate only when you turn them on, and all are off by default: crash reports, usage statistics, performance measurement. Each feature has its own choice; silence or failure to choose is not treated as consent.
2. You preview exactly the data to be sent before turning a feature on, and may turn it on or off at any time in Settings → Privacy. Turning off takes effect immediately for the next transmission.
3. Not turning on these features does not affect your right to buy or use XNK24 Pro.
4. To delete data already sent before you turned a feature off, submit a request under Article 15.

Article 17. Your responsibilities

1. Provide accurate account information and update it when it changes.
2. Do not post other people's personal data on Hỏi đáp or send it through Support without authority. Detailed rules: Community rules.
3. Protect your computer, passwords and sign-in tokens (Article 12, clause 3); tell XNK24 immediately if you suspect your account has been exposed.

Chapter VI. Other provisions

Article 18. Children

XNK24 is a professional tool and is not aimed at children. Users must be at least 18 years old, or use the Service with the consent and supervision of a parent or guardian, under Article 11 of the Terms of use. If we learn that we have received a child's data without valid consent, we will delete that data.

Article 19. Changes to this Policy

1. Each time it is amended, the Policy has a new version number and effective date. The previous version is kept; you can request it via cto@xnk24.com.
2. For a material change, we give notice by email and in the application at least 15 days before the effective date, and the application will ask for your consent again. A change that must be made immediately to comply with the law may take effect sooner; in that case we give notice as early as possible.
3. If you do not agree to a change, you have the right to terminate the contract under Article 7 of the Terms of use and to be refunded the prepaid but unused part of the term under Payment, renewal, refund and trial policy.
4. This Policy is written in Vietnamese. If the English version differs from the Vietnamese version, the Vietnamese version applies; for Consumers, however, the version more favourable to the Consumer applies.

Article 20. Contact

Please send any questions about privacy and personal data to:

• CÔNG TY TNHH GIẢI PHÁP VIETFLOW (VIETFLOW SOLUTION COMPANY LIMITED), 6th Floor, Viet A Building, 9 Duy Tan Street, Cau Giay Ward, Hanoi City, Vietnam;
• email: cto@xnk24.com;
• telephone: 0941 221 183;
• the Support section in the XNK24 Pro application.

Related documents: Terms of use · Payment, renewal, refund and trial policy · Security and vulnerability reporting · Community rules.