Privacy Policy
Effective October 30, 2026 · Raccoon Hub — [PROJECT OWNER NAME] · [CONTACT EMAIL]
This is a portfolio demo. The policies are written as they would be for a real product, for illustration, but no commercial transactions take place yet.
This policy explains what personal data Raccoon Hub collects, what we use it for, who we share it with, how long we keep it, and what rights you have. It is written in line with Vietnam’s Law on Personal Data Protection No. 91/2025/QH15 (in force since January 1, 2026) and its implementing Decree 356/2025/ND-CP.
- We only collect the data needed to run the service. We do not sell data and do not use advertising cookies.
- WordPress Application Passwords and 2FA secrets are encrypted with AES-256-GCM before storage.
- Your website content is not used to train AI models.
- You can view, correct, export or request deletion of your data at any time.
1. Data controller
[PROJECT OWNER NAME] (Hanoi, Vietnam) is the controller of the personal data of account owners and team members. For data stored on customers’ websites (for example WordPress user records, comments, orders), the customer is the controller and Raccoon Hub acts as a processor on the customer’s instructions.
2. Data we collect
| Category | Examples | Source |
|---|---|---|
| Account | Name, email, organization name, password (stored only as a scrypt hash), 2FA secret (encrypted) | Provided by you |
| Website connections | Site URL, WordPress user, Application Password (encrypted), plugin connector key | Provided by you |
| Technical site information | WordPress/PHP versions, plugins needing updates, connection check results | Hub Connector plugin |
| Search data (when enabled) | Clicks, impressions and queries from Google Search Console and Bing Webmaster Tools | Accounts you connect |
| Payments | Plan, amount, PayPal transaction ID or Tron on-chain transaction ID | PayPal, Tron network |
| Logs | Sign-ins, actions on sites, timestamps, who performed them | Automatic |
We do not receive or store card numbers: card payments happen entirely on PayPal. For USDT, we only store our own receiving wallet address and the public on-chain transaction ID, and we will never ask for your private keys.
3. Purposes and legal bases
- Providing the service (performance of contract): sign-in, connecting and managing websites, generating reports.
- Payments and accounting (performance of contract, legal obligation): activating plans, keeping records.
- Security (legitimate interest): detecting unusual sign-ins, locking accounts after repeated failed attempts, audit logging.
- Service notices: site-down alerts, upcoming plan expiry, policy changes. Marketing emails are sent only with your consent, and you can unsubscribe at any time.
4. Third-party processors
| Provider | Purpose | Location |
|---|---|---|
| DigitalOcean | Application server and database | Singapore |
| PayPal | Payment processing and renewals | Per PayPal |
| TronGrid | Reading public USDT transactions on-chain | Per TronGrid |
| Google, Microsoft | Search Console and Bing Webmaster data (when you connect them) | Per provider |
| Cloudflare | Managing DNS and cache for your sites (when you connect it) | Per Cloudflare |
| Anthropic (Claude), Black Forest Labs (FLUX) | AI writing and image generation (once launched and when you use it) | United States / EU |
Data sent to AI providers is limited to what a specific request needs (for example keywords or an outline). Under these providers’ commercial API terms, data sent through the API is not used to train their models. We do not use your content to train any model either.
5. International transfers
Our servers are located in Singapore and some providers are abroad, so your data is transferred outside Vietnam. We prepare the cross-border data transfer impact assessment required by law and only choose providers with equivalent data-protection commitments.
6. Retention
- Account and website data: for as long as you use the service, plus 30 days after your plan expires or you request deletion.
- Audit logs: 12 months.
- Payment records: for the retention period required for accounting records by law (usually 10 years), keeping only the minimum information.
- Database backups: rotated automatically, kept for up to 7 days.
7. Your rights
Under the Law on Personal Data Protection, you have the right to:
- be informed about the processing of your data;
- give, refuse or withdraw consent;
- access and correct your data, and obtain a copy of it;
- request deletion or restriction of processing, and object to processing;
- lodge complaints, take legal action and claim compensation for damages.
Send your request to [CONTACT EMAIL] from the email address registered to your account. We respond within the time limits set by law and aim to handle requests within 7 working days. If you are in the European Union or the United Kingdom, you have the corresponding rights under the GDPR / UK GDPR, including the right to lodge a complaint with the data protection authority where you live.
8. Security
Our measures are described in detail on the Security page. In the event of a personal data breach, we will notify the authorities and affected individuals within the time limits required by law.
9. Children
The service is not intended for anyone under 18, and we do not knowingly collect children’s data.
10. Cookies
See the Cookie Policy.
11. Changes to this policy
Material changes will be announced in advance by email or in the app. Previous versions are archived and available on request.
12. Contact
[PROJECT OWNER NAME] · [CONTACT EMAIL] · Hanoi, Vietnam