Privacy policy

The data controller is CÔNG TY TNHH GIẢI PHÁP SỐ TOÀN TÂM. Please send any question about your data to supports@toantamltd.com.

Your account: the sign-in identifier, the sign-in method (Google, phone number or Apple), and the email address, phone number and display name the sign-in provider returns, to sign you in.

Each company you add: its MST and the details the taxpayer registry publishes.

The company’s Cổng Hóa đơn điện tử account: the username and password, kept encrypted and used only to sign in to the portal for that company’s invoices.

The invoices and XML files downloaded from the portal, which include counterparties’ names, tax codes, addresses and amounts; the exports, accounting marks and notes you make.

Device tokens, to deliver push notifications.

Webhook addresses and their secrets (kept encrypted), and the invoice data HDTM sends there at your request.

The Google Play or App Store purchase records that prove your plan.

No analytics, no advertising identifier, no tracking across apps or sites, no location, contacts or photos. This website collects nothing about its visitors and sets no cookie.

Account and invoice data is kept in HDTM’s database on Google Cloud, in Singapore (region asia-southeast1). Invoice files (the original XML, the exports) are kept in Google’s Cloud Storage for Firebase, in the United States (region US-WEST1). Both places are outside Vietnam.

Google Cloud is a data processor: Google runs the servers, database, file storage and logs HDTM uses, and processes the data on the instructions of CÔNG TY TNHH GIẢI PHÁP SỐ TOÀN TÂM.

Google Cloud: a data processor, running HDTM’s servers, database and logs.

Google Firebase: sign-in, push notifications and storage of invoice files.

Apple: Sign in with Apple, notifications to an iPhone, and the App Store when you buy a plan.

Google Play: when you buy a plan on Android.

The tax authority’s Cổng Hóa đơn điện tử: HDTM signs in with your own portal account to retrieve the invoices.

The MST lookup page (xinvoice.vn) and the tax authority’s taxpayer lookup: they receive an MST to return the company’s name and status.

The webhook addresses you set: they receive new invoices at your request.

HDTM sells no data and shares none for advertising.

Data is kept while the account exists. When you delete the account, your data is erased at once; HDTM keeps one anonymous record that a deletion happened, by whom and through which path.

When you stop tracking a company, its portal password and its sync are removed at once.

The database is backed up every day; each backup, and the transaction log used to restore to a point in time, is kept for 7 days and then deleted automatically. A deleted file can still be recovered for 7 days. Server activity logs are kept for 30 days. Deleted data may therefore remain in a backup for up to 7 more days and in the logs for up to 30 more days. If a backup ever has to be restored, deleted accounts are deleted again.

Under the Personal Data Protection Law (91/2025/QH15), you have the right to be informed, to access, correct and delete your data, to withdraw consent, to restrict and object to processing, and to complain.

You view and correct your account details, and delete your account, in the app. For any other right, please write to supports@toantamltd.com.

Portal passwords and webhook secrets are kept encrypted, data travels over encrypted connections, and only you, and operators acting on a recorded request, can access your data.

The service is for businesses and is not directed at children.

The date at the top changes when the text changes. A material change is announced in the app before it takes effect.