Data processing terms

1. Roles

HERIO is operated by HERIO VIETNAM COMPANY LIMITED (Herio Vietnam; in Vietnamese: Công ty TNHH Herio Vietnam), enterprise and tax code 0107389011, registered office: 2nd Floor, No. 5 Tu Mo Street, Yen Hoa Ward, Hanoi, Vietnam.

The company that owns the workspace is the controller. HERIO is the processor. These terms are part of the terms of use and apply under the GDPR and Vietnam's Personal Data Protection Law (Law 91/2025/QH15, with Decree 356/2025).

2. What is processed

• People: the company's team members, invited people, candidates and contacts the company adds.
• Data: names, email addresses, roles, notes, plans, budgets, visits, questions and answers.
• Purpose: running the HERIO platform for the company, nothing else.
• Duration: as long as the workspace exists, then deletion as set out below.

3. HERIO's commitments

• Process the data only on the company's documented instructions, which are these terms and the use of the platform.
• Keep it confidential; people with access are bound to confidentiality.
• Never sell it, never use it for advertising, never use it to train AI.
• Help the company answer the requests of the people concerned and meet its own duties.
• Tell the company without undue delay, and within 48 hours, after becoming aware of a personal data breach.

4. Security

• Hosting in Singapore, encryption in transit and at rest.
• Each company sees only its own data, enforced in the database.
• Permissions by role, two-step login for owners, every change in the audit log.
• Daily backups, kept 30 days.

5. Subprocessors

HERIO announces a new subprocessor in the app before it is used. The company may object; if no solution is found, the company may end the plan.

• Supabase: database, file storage, sign-in and emails, in Singapore.
• Vercel: hosting of the app.
• Anthropic: answers for Ask HERIO and the support assistant.
• Paddle: payments, invoices and refunds as merchant of record.

6. Transfers

Transfers outside the EU use the EU standard contractual clauses or another safeguard the GDPR allows. Transfers outside Vietnam follow the transfer impact assessment that Law 91/2025/QH15 requires.

7. End of processing

The owner can export all data at any time and delete all of it from Settings, Data and privacy. Deleted data is removed at once and clears from backups within 30 days. Invoices are kept as long as tax law requires.

8. Checks

HERIO gives the information needed to show it meets these terms. Questions: support@heriovietnam.com.