Personal Data Protection Policy

1. Data collector, controller and processor

Personal data is controlled and processed by the operator of CIA, an individual. Their name, personal tax code, address and phone are published on the Seller information page (linked at the bottom of this page).

• Personal data email: [email protected]

2. What the service does and who this policy covers

CIA helps customers analyse public data on the Internet. This policy covers two groups:

• Group A — customers: people who sign up for and use CIA.
• Group B — people and organisations that appear in the public data analysed: owners of accounts, channels and pages; authors of public comments or reviews; advertisers; businesses and listing posters.

3. Customer data (group A)

We collect:

• account: email, name, language, one-way hashed password, your Google account if you sign in with Google;
• content you create: the parameters you enter when running a tool (keywords, account names, links) and the resulting reports;
• transactions: amount, transaction code, time. We do NOT store card numbers, bank account numbers or account holder names; PayOS and PayPal handle those;
• technical: IP address, session cookie, sign-in and tool usage logs;
• referral code if you signed up through a referral link.

4. Public data analysed (group B)

We only process data that was ALREADY PUBLIC when the customer ran the tool, by type:

• social profiles and posts: display name, account name, profile picture, bio, engagement figures, post content;
• public comments: the commenter's account name and the text;
• public reviews on Google Maps and review sites: ONLY the reviewer's display name and the review text; no profile picture, profile link or reviewer ID is stored;
• ads in public ad libraries: advertiser name, ad copy, landing page, run dates;
• businesses, products, job listings, apps, websites and real estate: the organisation's public information, including a business phone number published in a place directory;
• followers: only aggregate shares (country, language, share of empty accounts) are stored, never who they are.

5. What we do not collect

We do NOT provide personal email addresses or phone numbers: every email field is removed, email addresses inside text are masked, and phone numbers are removed from every source except business directories. We never sign in to anyone's account, never fetch private data, and offer no people-lookup tool for contacting individuals. We do not deliberately collect or analyse sensitive personal data; if public content contains it, the system does not extract, classify or infer anything from it.

6. Purposes

Data is used only for:

• group A: providing the service, payments, customer support, account security (detecting unusual sign-ins), transactional email;
• group B: producing the analysis reports customers request.

7. Legal basis

Group A: your consent at sign-up and the performance of the service contract. Group B: data the subjects made public themselves; we only process what is public, and subjects may object or ask for erasure as described in section 14.

8. How data is processed

Public data is fetched through data providers' programming interfaces (APIs), processed automatically on our servers, cleaned as described in section 5 before it is stored, and kept in an access-controlled database. We do not sell data, do not use your data to train artificial intelligence models, and do not embed third-party analytics or advertising tools in the app.

9. Recipients and other processors

Data may be shared with:

• PayOS (Vietnam) and PayPal (international): payment processing;
• our hosting and email providers;
• data API providers (servers outside Vietnam): they receive only a run's lookup parameters (keywords, account names, links), never your account details;
• Google LLC: when you sign in with Google;
• proxycheck.io (United Kingdom): receives your IP address at sign-in to detect VPNs/proxies;
• competent state authorities when the law requires.

10. Transfers outside Vietnam

Some recipients in section 9 host data outside Vietnam (PayPal, Google, proxycheck.io, data API providers). Transfers are limited to what each purpose needs. We prepare and keep a cross-border personal data transfer impact assessment as required.

11. Where data is stored, and for how long

Account, transaction and report data is stored on servers we rent and manage, in an access-controlled database; each customer's reports are visible only to that account. Sign-in records and the list of known devices — including IP addresses — are deleted automatically after 180 days; a device left unused that long is asked for a verification code again, like a new one.

12. Retention

We keep data for these periods, then delete it:

• account: until you delete your account;
• transaction history (amount, transaction code, time): up to 10 years, to reconcile payments and handle complaints, even after account deletion;
• report content: 90 days from creation, then deleted automatically; the record of the run and its credit is kept;
• technical logs: up to 90 days;
• data requests (erasure, objection, copyright): the requester's email and message are deleted 12 months after the request is handled; the account name, request type and outcome are kept as evidence it was handled.

13. Security measures

HTTPS encryption; one-way hashed passwords; role-based admin access; IP and device locks for the admin area; automatic lock after repeated failed sign-ins; email verification for sign-ins from VPNs/proxies or from a new device or network (devices are recognised by a dedicated cookie); no logging of raw payment data; regular backups. We keep customers' personal data confidential and do not use, transfer, provide or disclose it to third parties without your consent, except to the processors in section 9 and when a competent authority requires it by law.

14. Data subject rights

You have the right to: be informed; consent; access; withdraw consent; erasure; restriction; data provision; object; complain, denounce and sue; claim damages; self-protection. How to exercise them:

• customers (group A): edit details and delete your account in Settings, export reports with the Export button, or email [email protected];
• people and organisations in public data (group B): submit a request on the Data request page. Once accepted, we purge reports containing your account or display name and block it from further analysis (for Google Maps reviews: your reviews are left out of later reports).

15. Response times

Erasure requests are handled within 72 hours of a valid request. Other requests are answered within the legal deadlines. To prevent abuse we may verify that you own the account, for example by asking you to post a code in the account's bio.

16. Possible unintended consequences

Reports compiling public data could be misused by a customer, for example to harass a person or a reviewer. We mitigate this by prohibiting such use in the Terms, never providing personal email addresses or phone numbers, not storing follower identities, keeping only reviewers' display names, deleting reports after the retention period, and closing violating accounts.

17. Incident handling

If a personal data breach is detected, we notify the authority (Department of Cybersecurity and High-Tech Crime Prevention — Ministry of Public Security) within 72 hours and inform the people affected.

18. Cookies

Our own cookies are all necessary ones: sign-in session, form protection (CSRF), language, referral code, the channel you first arrived on (so we know whether you came from search, from an ad or from a referral), sign-in device recognition (so we ask for a verification code when you sign in from a new device) and devices allowed into the admin area. On top of that, the analytics tool described in section 22 sets cookies of its own; you can stop it by refusing analytics cookies in your browser.

19. Children

The service is for people aged 18 and over. We do not knowingly process children's data. If an analysed account belongs to a child, a legal representative can ask for erasure on the Data request page.

20. Changes

When this policy changes, we update the version number and effective date at the top, notify you in the app, and ask you to accept it again on your next visit.

21. Receiving and resolving complaints

Send any question, request or complaint about personal data to [email protected] or the Data request page. We acknowledge within 24 working hours and answer within 7 working days at most (erasure requests: 72 hours). If you disagree with the outcome you may complain to the competent authority or go to court. The full process is on the Complaints page.

22. Website measurement and analytics

We use third-party analytics (Google Analytics from Google LLC and/or the Meta Pixel from Meta Platforms) on the public pages and inside the signed-in app, to learn where people find CIA and which parts of the product get in their way. What leaves the site, and what you can do about it:

• Sent: your IP address, device and browser type, the pages you open, when you opened them, and a random identifier the tool stores in a cookie. We do NOT send your email, name, phone number or the contents of your reports.
• This is a cross-border transfer under section 10: these tools run their servers outside Vietnam.
• The basis for it is your consent. You can stop it by refusing analytics cookies in your browser, by using tracking protection, or by asking us through the Data request page.
• We do not use this data to make any automated decision about you, and we do not sell it.