Skip to main content
vCraft
Menu

Privacy policy

What personal information you give vCraft, what it is used for, who can see it and how you stay in control of it. This page is kept short so it reads well on a phone.

Last updated: 1 November 2026

Who handles your data

vCraft is a platform for managing one traditional craft village, operated by the village Management Board. The Management Board decides why and how personal data is processed on the platform.

What we collect

Only what each feature you use needs:

  • Account: email, full name and role. Your password is hashed and stored by Supabase Auth; vCraft cannot read it.
  • Artisan household registration: the representative's details, citizen ID number, photos of documents (ID card, proof of residence), workshop address and location, workshop photos.
  • Quotation requests: order details, budget, delivery address and contact details linked to your account.
  • Notifications, email preferences, the consents you gave (what, which policy version, when) and the audit trail of administrative actions.
  • Technical data: IP addresses are stored only as salted hashes; system logs contain no passwords, tokens or ID numbers.

What we use it for

To create and protect your account; to verify and approve artisan households; to send, receive and coordinate quotation requests, quotations and orders; to send the notifications you chose; and to prevent fraud and keep the system safe. We do not sell your data and do not use it for advertising.

Basis: your consent

We process personal data on the basis of your consent, in line with Vietnam's Decree 13/2023/ND-CP on personal data protection. You give it by ticking the confirmation box when you register, register a household or send a quotation request. You can withdraw consent at any time; withdrawing does not affect processing that already took place. Each consent is recorded: what you agreed to, under which version of the policy, and when.

Who can see your data

  • Identity document photos sit in a private store; only administrators can open them, through a signed link valid for 5 minutes. The ID number is encrypted at field level: you only ever see it masked, an administrator sees the full number only by asking for it while reviewing the application, and every such view is written to the audit log.
  • A quotation request is visible only to the invited households or, if you ask the Management Board to coordinate it, to the Management Board. One household's quote is never shown to another.
  • Infrastructure providers (Supabase for authentication, the database and file storage; an email delivery service) process data on our behalf.
  • The public information of an approved household (household name, story, products, showroom location) is visible to everyone.

How long we keep it

While your account is active. When you delete your account yourself on the Account page, your email, name, consents, notifications, email choices and every file you uploaded (identity papers included) are deleted, and the household profile, workshops, makers and news are taken down. Orders, quotations and the production journal of products are kept without your name, because other people rely on those records; delivery addresses on past requests are erased. An account with an order in progress cannot be deleted until the order is finished or the Management Board cancels it. Sign-in history is kept for 12 months and QR scan records for 24 months, then deleted automatically.

How we protect it

Data travels over HTTPS. Sessions use secure cookies, document photos live in a private store, ID numbers are encrypted with AES-256-GCM, and every access is checked against ownership.

Cookies

We use only the cookies needed for your session and the interface language, and no advertising cookies. The sign-in and registration forms may load Cloudflare Turnstile to block automation.

Your rights

You have the right to know, access, correct, download, restrict, object to, withdraw consent for and request deletion of your personal data, and to lodge a complaint. You can correct your details yourself in Account and Studio, download all of your data and delete your account yourself on the Account page. For anything else, or when you cannot delete yet (for example an order is in progress), send a request to the Management Board through dienhung01022005@gmail.com.

When the policy changes

We update this page and show the date at the top. Important changes are announced inside the system.