Privacy policy
Draft awaiting legal review: SITE_LEGAL_NAME, SITE_LEGAL_ADDRESS, SITE_CONTACT_EMAIL.
This page explains what data MARZI collects when you use the apps, what it is used for, who it is shared with, how long it is kept, and what rights you have.
1. Who is responsible
MARZI is a platform that lets shops sell through mobile apps. It is operated by [not set yet], [not set yet], e-mail contact@example.invalid ("we").
- When you buy from a shop in the app, that shop is the seller and decides how your order data is used; we process the data on the shop's behalf so that the app works.
- When you buy in the MARZI Market app, we collect and process your data ourselves, and pass each shop's part of the order to that shop for delivery.
2. Data we process
| Data | When | Used for |
|---|---|---|
| E-mail, display name, password (stored only in a one-way scrambled form; we cannot read it) | You create an account with a shop that uses MARZI accounts, or in MARZI Market | Signing in, recognising your orders |
| Receiver's name, phone number, delivery address, note | You place an order or save an address | Delivery, contacting you about it, processing the order |
| Order contents (products, quantities, prices, status, payment method, transfer reference) | You place an order | Processing the order, showing your order history, reconciling payments, bookkeeping |
| Amount, transfer description, time and transaction ID of a payment | You pay by bank-transfer QR code and the shop uses a service that reports balance changes | Showing "paid" automatically |
| Device token for notifications (Firebase Cloud Messaging) | A shop owner or staff member turns on new-order notifications in the manager app | Sending new-order notifications |
| User name and actions of shop staff | Staff use the manager app or the web page for managing the shop | Signing in, recording who changed what |
| Name, phone, e-mail, company, message | You fill in the contact form on the promotion page or send an account-deletion request | Contacting and answering you |
| The questions you type to the AI assistant and its answers, with a random conversation code | You use the AI chat button in an app, the console or the promotion page | So that the assistant can answer. The question goes to our chat service (hani) together with a few facts needed to answer well (for example the shop name and related products) |
| IP address, device type, app version, time and result of each request | Every time an app or a web page calls the server | Security, preventing abuse, finding faults |
| Page views (which page, language, device type, where you came from) and an anonymous code that changes every day | You open the promotion page, the guides or the policy pages (no cookies are used) | Counting visits |
Kept on your phone (not sent to us, except what an order needs): your cart, favourite and recently viewed products, the language you chose, your sign-in session (in the phone's secure storage), and, in the manager app, a copy of the orders you have viewed so that you can see them when offline.
The camera is used only to scan QR codes (choosing a shop, signing in to a website). Pictures are neither saved nor sent. The apps do not use the microphone, contacts, location or photo library.
The AI assistant can be wrong: check anything important (prices, orders) with the shop. Do not type passwords, card numbers or sensitive personal details into the chat.
We do not knowingly collect sensitive data (health, religion, biometrics...). Please do not write such information in a note field.
3. Shops with their own website
For a shop connected to its website, shopper accounts live on the shop's website. When you sign in, the app sends your user name and password through our server to the website to be checked; we do not store that password. Products, prices and orders also stay on the shop's website and follow the shop's policy. We keep only what MARZI itself creates, such as the addresses you save in the app.
4. What we use data for
- Providing the apps: showing products, receiving and processing orders, reporting order status and payment.
- Keeping things safe: spotting unusual sign-ins, limiting floods of requests, fixing faults.
- Support: answering requests and feedback.
- Obeying the law: accounting records, requests from authorities.
We do not sell your data, we do not run advertising, we use no third-party trackers, and we do not use your data to build behavioural profiles.
5. Who it is shared with
- The shop you buy from receives your name, phone number, address and order contents in order to deliver. The shop has its own policy.
- The web agency or reseller that set the shop up for you can support the shop, so it may see that shop's data within that support.
- Carriers (for example GHN, GHTK) when the shop creates a waybill: they receive the receiver's name, phone number and address.
- The AI chat service (hani, run by us, which may use a third-party AI model provider to compose answers) receives what you type in the chat.
- Infrastructure providers for server hosting, push notifications (Google Firebase Cloud Messaging), e-mail alerts for contact requests, and a balance-change service (for example SePay) if the shop chooses one.
- Public authorities when the law requires it.
Some providers (such as Google) may process data outside Vietnam. We send only what is needed for that purpose (for example the device token for notifications).
6. How long we keep it
- Account and saved addresses: until you delete your account (see Delete account).
- Orders and payment records: kept for the period that accounting and tax law require (depending on the document, usually 5 to 10 years) for bookkeeping and settling disputes. After you delete your account, orders are no longer linked to your sign-in account.
- Server logs (IP address, requests): at most 90 days.
- Contact requests from the promotion page: at most 24 months after the last contact.
- Conversations with the AI assistant: at most 12 months, to improve it and to handle complaints.
- Page-visit figures: at most 400 days, with no identifying information.
- Device tokens for notifications: until you sign out, turn notifications off, uninstall the app, or the provider reports the token as no longer valid.
7. Your rights
You have the right to know about, see, correct and delete your data, to withdraw consent, to restrict or object to processing and to complain, under Decree 13/2023/ND-CP on personal data protection and related rules (and under the law where you live, where it applies).
- Delete your account: tap "Delete account" on the Account screen of the app, or send a request on the Delete account page.
- See, correct, other rights: write to us at contact@example.invalid. We answer within 30 days, or sooner if the law requires.
- Order data is held by the shop: you may also ask the shop directly.
8. Security
Data travels over HTTPS. Passwords are scrambled one way. Each shop's data is kept apart and checked by automated tests. The secret keys that connect websites are encrypted before they are stored. Sign-in attempts are limited and actions in the console are logged. No system is perfectly safe; if an incident affects your data we will notify you as the law requires.
9. Children
The apps are not meant for children under 16. If you are a parent or guardian and know that a child has given us data, please contact us and we will delete it.
10. Changes to this policy
When something important changes we update this page and the "Last updated" date at the top.
11. Contact
[not set yet]
[not set yet]
E-mail: contact@example.invalid