Privacy policy

1. Who is responsible

HERIO is operated by HERIO VIETNAM COMPANY LIMITED (Herio Vietnam; in Vietnamese: Công ty TNHH Herio Vietnam), enterprise and tax code 0107389011, registered office: 2nd Floor, No. 5 Tu Mo Street, Yen Hoa Ward, Hanoi, Vietnam.

HERIO is responsible for the personal data of people who sign up and sign in. For the data a company puts in its workspace (its team, its plan, its hires), the company decides, and HERIO processes it on the company's behalf under the data processing terms.

Contact for privacy: support@heriovietnam.com.

2. What we collect

• Account: name, email address, language, currency, sign-in method, two-step login status and the remembered devices.
• Company workspace: company profile and logo, team and roles, invitations, brief, plan, cash model, visits, questions to Ask HERIO and the answers.
• Use and security: the audit log of changes, sign-in events, and technical logs kept for security.
• Acceptance of these terms: which version and when.
• Billing: invoices. Card details are handled by Paddle, our merchant of record, never by HERIO.

3. Why we use it

No advertising, no profiling for marketing, no sale of data.

• To run the platform for you and your company (the contract).
• To keep accounts and data safe (legitimate interest and legal duty).
• To send the emails the platform needs: confirm your address, reset a password, an invitation.
• To keep invoices as tax law requires (legal duty).

4. AI

Ask HERIO and the support assistant send your question and the needed context to our AI provider to write the answer. We never use your data to train AI, and our provider does not train on it under its commercial terms.

5. Where the data lives

Data is hosted in Singapore (database, files and sign-in). The app is served by our hosting provider. Data is encrypted in transit and at rest, and every company sees only its own data.

6. Who else handles it

Each works under a data processing agreement. Transfers outside the EU and outside Vietnam follow the safeguards the law requires.

• Supabase: database, file storage, sign-in and emails, in Singapore.
• Vercel: hosting of the app.
• Anthropic: answers for Ask HERIO and the support assistant.
• Paddle: payments, invoices and refunds as merchant of record, once a plan is chosen.

7. How long we keep it

• As long as the account and the company workspace exist.
• Delete all company data from Settings, Data and privacy: the data is removed at once, backups clear within 30 days.
• Invoices are kept as long as tax law requires.

8. Your rights

Under the GDPR and Vietnam's Personal Data Protection Law (Law 91/2025/QH15, with Decree 356/2025) you may ask for access, correction, deletion, a copy to take elsewhere, restriction, and you may object or withdraw consent. Most of this is self-service: Settings for your profile, Data and privacy for the export and the deletion. Anything else: support@heriovietnam.com. We answer within one month, sooner where the law asks.

You may also complain to your data protection authority.

9. Cookies

Only the cookies the platform needs: the session, the remembered device for two-step login, the chosen company, language and currency. No tracking or advertising cookies.

10. Changes

When this policy changes in a way that matters, the app shows the new version and asks you to accept it.