Privacy Policy

1. Who is responsible

Infinite Oneness decides why and how your personal data is processed, which makes us the data controller for it. We have appointed a person responsible for personal data protection; the contact route is in section 10.

This policy is written against Vietnam's Law on Personal Data Protection (91/2025/QH15) and Decree 356/2025/NĐ-CP, both in force from 1 January 2026.

2. What we collect, and why

Account data — your name, email address, username, and the identifier from the sign-in provider you used. We need this to give you an account and to tell you about it.

What you write — debates, arguments, comments, projects, messages, and the files you attach. We store these to show them to the audience you chose.

Activity data — which pages you opened, what you interacted with, and technical records such as your IP address and browser. We use this to run the platform, to keep it secure, and to understand what is used.

Identity verification data — see section 3, which is separate because the rules are stricter.

Payment data — records of contributions you make to projects. Card and banking details are handled by the payment provider and do not reach us.

3. Identity verification, and sensitive data

To put money into a project or to take part in The Lab, you must verify your identity. We ask for a photograph of the front and back of your identity document, and a photograph of your face.

These are sensitive personal data under Article 4 of Decree 356/2025 — an image of an identity card, and biometric data. We are telling you so explicitly because the law requires it and because you should decide with the fact in front of you.

We store the photographs with access restricted to the small number of people who review verifications, and we do not publish them. From the verification we keep your name, date of birth, gender, province, and only the last four digits of your identity number. We do not store the full number.

The photographs are sent to VNPT eKYC in Vietnam, which performs the verification. Three things about VNPT you should know before you decide, taken from their published terms: they state that they have no obligation to delete data; their privacy policy allows them to store data outside Vietnam, including on cloud services, without naming where; and its stated purposes include marketing and sharing with partners. We cannot change those terms — VNPT is a self-service provider and there is no separate agreement available to us — so we tell you instead.

If you would rather not have your data processed on those terms, you can use the parts of the platform that do not require verification. You will not be able to contribute to a project or take part in The Lab.

4. The legal basis we rely on

Mostly your consent, which you give at the point we ask, for the purpose we describe at that point. You can withdraw it — see section 7.

For some processing we rely instead on performing our agreement with you, or on complying with a legal obligation. Where we do, we say so at the time rather than leaving you to work it out.

We do not use your personal data to make decisions about you by automated means without telling you. Where the platform uses AI — for suggestions, ranking, translation, or reviewing survey questions — we will say so where it happens and, where it affects you, offer you a way not to take part.

5. Who else sees your data

VNPT eKYC, for identity verification, as described in section 3.

Payment providers, to take and settle payments.

Infrastructure providers who host the platform and store its data, and services that send our email and notifications.

Other users — but only ever what you chose to publish. A debate you made public is public; a private project is visible to its members. The Lab is designed so that a survey creator never receives your identity.

A competent authority, where the law requires us to disclose. We do not sell your personal data, and we do not share it for another company's advertising.

6. Where your data is stored

Our servers, database and file storage are in Singapore, so your personal data is stored outside Vietnam. VNPT may additionally store verification data outside Vietnam at a location they do not disclose.

We keep the cross-border transfer records the law requires for this, and we apply the same protections to your data wherever it is held.

7. Your rights, and how long we take

You can ask to see the personal data we hold about you, to correct it, to have it deleted, to restrict or object to how we use it, and to withdraw consent you previously gave.

We will respond to any of these within 2 working days. Correcting data takes up to 10 days; withdrawal, restriction and objection up to 15 days; deletion up to 20 days, or up to 30 days where another company we work with has to act — which is the case for anything involving your verification photographs, because they are with VNPT.

If a request is genuinely complex we may extend once, and we will tell you why before we do.

Deletion has one limit we want you to know about rather than discover. Our records of what happened on the platform are append-only, so that a project's funding history cannot be quietly rewritten. We keep personal data out of those records by design, so deleting your data does not require breaking them — but the record that an event occurred remains.

8. How long we keep things

Account data, for as long as you have an account, and for a short period afterwards so a deletion can be completed and audited.

Verification data, for as long as your verified status is relied on, and then no longer than the law requires us to retain it.

What you published stays until you remove it or your account is deleted.

Where the law sets a minimum retention period, that period wins over a deletion request, and we will tell you when that applies to something you asked us to delete.

9. Security, and what we do if something goes wrong

Data is encrypted in transit and at rest. Sensitive data carries additional access restrictions, so that reaching it requires a specific role rather than simply being an employee.

No system is perfect. If a breach affects your personal data we will notify the competent authority and tell you what happened, what data was involved, and what you can do.

10. Contacting us about your data

Send requests about your personal data to the contact address published on the platform, saying which right you are exercising. We may need to confirm who you are before we act, so that nobody else can exercise your rights for you.

If you are not satisfied with how we handled a request, you may complain to the specialist personal data protection authority under the Ministry of Public Security.

11. Changes to this policy

Every version of this policy is published with a date, and the older ones stay readable, so you can see what you agreed to and when. If a change materially affects you we will tell you before it takes effect, and where the change needs your consent we will ask for it rather than assume it.