Sign up free
← All legal documents

Privacy policy

Version 2 · In effect from Nov 1, 2026

1. Scope

This policy covers hostbooking.vn, the booking sites running on the platform and the console, operated by Mr Lê Anh Tuấn (an individual). It follows Vietnam’s Personal Data Protection Law No. 91/2025/QH15 and Decree 13/2023/ND-CP.

For the data of guests booking with a business, that business is the data controller and HostBooking processes on its behalf. Each booking site has the business’s own privacy policy in its footer.

2. Data collected

  • Owners and staff: name, email, phone, password (stored only as a hash), business details, payout bank account, tax code if any.
  • Guests: name, phone, email, country, dates, party size, notes, invoice details if asked for, booking and payment history, reviews.
  • Technical: IP address, browser, device, time of access, pages viewed, console activity log.
  • Session recording: see section 3.

HostBooking does not collect biometric or health data or card numbers. Card payments, where a business enables them, happen on the payment gateway’s own page.

3. Session recording (replay)

To find bugs and improve the interface, the platform may record what happens on a page (pointer, scroll, clicks, what is shown and what is typed into fields) and play it back as video.

  • Password, one-time-code and card fields are always masked and never recorded.
  • Only HostBooking’s platform administrators can view recordings; business owners and others cannot.
  • Recordings are kept for at most 31 days on the server, outside backups, then deleted automatically.
  • Recordings are never used for advertising, sold or shared with third parties.

4. Purposes

  • Providing the service: sites, bookings, confirmations, payments, notifications by email and Zalo.
  • Security: sign-in, detecting unusual access, preventing abuse, logging.
  • Support, fixing bugs, improving the product.
  • Telling owners about plans, invoices and how to use the product. Feature news carries an unsubscribe link.
  • Legal obligations (accounting, lawful requests from the authorities).

5. Safeguards

  • HTTPS throughout; firewall and attack protection through Cloudflare.
  • Each business’s data is isolated in the database (row-level security): one business cannot read another’s.
  • Passwords are one-way hashed; payment gateway keys and other secrets are encrypted at rest.
  • Role-based permissions; an activity log of who changed what and when.
  • Daily backups, kept in Vietnam.

No safeguard is absolute. If the server itself were compromised, data could be exposed despite partial encryption; HostBooking would notify as in section 9.

6. Sharing

HostBooking does not sell data. It goes only to providers needed to run the service:

  • Servers and database: a VPS provider in Vietnam.
  • Content delivery, firewall, bot protection: Cloudflare (USA).
  • Transfer matching: SePay; any gateway a business chooses (VNPay, MoMo, ZaloPay, Stripe).
  • Notifications: Zalo (VNG), Google Gmail; Google Firebase for sign-in with Google or phone.
  • AI assistant and translation: Google Gemini, Groq, OpenRouter (USA) — only the content being processed.
  • Owner relationship management: an email marketing service operated by HostBooking.
  • Authorities, on a lawful request.

Some providers host data abroad. HostBooking keeps the cross-border transfer impact assessment the law requires and uses only providers with confidentiality commitments.

7. Cookies

The platform uses cookies needed for sign-in and language. A business may turn on Google Analytics or Meta Pixel on its site; their cookies then apply under their own policies.

8. Retention

  • Accounts and business data: while the service is used and 30 days after it ends.
  • Bookings and payments: for as long as the business uses the service; plan payment records as accounting law requires.
  • Console activity log: while the business uses the service. Session recordings: 31 days.

9. Your rights

You may be informed, consent or withdraw consent, access, correct, have data deleted, restrict processing, receive a copy, object and complain. A business’s guests ask that business; owners ask HostBooking through the contacts at the foot of this page. Requests are answered within 72 hours and handled within the legal time limit.

In a data breach, HostBooking notifies the authorities and the affected businesses within 72 hours of discovering it.

10. Google, Facebook and Instagram accounts an owner connects

An owner turns these connections on in the console and can turn them off at any time (Integrations → Disconnect). Guests never connect anything.

  • Google Calendar: HostBooking creates its own calendar in the owner’s Google account and writes, updates and deletes one event per booking (dates, booking code, guest name, room). HostBooking does not read your other calendars.
  • Google Sheets: HostBooking creates one bookkeeping spreadsheet (bookings, payments, expenses) and writes to it; with two-way mode on, it reads back the status and note columns of that same spreadsheet to propose changes, which the owner approves before they apply. When the owner chooses to import from a spreadsheet, HostBooking reads only that spreadsheet.
  • Google email address: to show which account is connected.
  • Facebook and Instagram: the Pages and Instagram business accounts the owner selects; messages guests send to that Page or Instagram account and the replies sent from HostBooking; posts the owner creates from HostBooking. HostBooking does not read personal messages, friends or other Pages.

Google and Meta access tokens are encrypted at rest. Data received is used only to run the features above for the business that connected it; it is not used for advertising, not sold, not transferred to others (unless the law requires it) and not used to train AI models. No one at HostBooking reads it, except with the owner’s agreement for support, for security, or where the law requires.

HostBooking’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

When an owner disconnects, HostBooking deletes the access token and the sync links at once; calendars and spreadsheets it created stay in the owner’s Google account. You can also revoke access at myaccount.google.com/permissions or in Facebook’s Business Integrations settings, and ask for deletion under Account and data deletion.

11. Contact

Questions about personal data: the email, phone or Zalo at the foot of this page.