Privacy Policy

This policy applies to all data collected through PUPO's applications, website and official systems. Third-party linked pages fall outside the scope of this policy.

We process personal data in accordance with Decree 13/2023/ND-CP on personal data protection and applicable Vietnamese regulations on electronic transactions, accounting and information security.

Your personal data is controlled by PUPO SOFT CO., LTD (Business ID: 0318629720), registered at 618/61/53 Quang Trung, Thong Tay Hoi Ward, Ho Chi Minh City, Vietnam.

For any data request (access, correction, deletion, withdrawal of consent) or privacy complaint, contact support@pupo.vn. We respond within 72 hours, as required by Decree 13/2023/ND-CP.

Identifying information: name, phone number, email, address -used for service delivery, account authentication and contact.

Device & technical data: device type, operating system, IP address, access logs -to improve performance and user experience.

Cookies & session tracking: records sessions, analyses performance, enhances experience within the application.

Some products (e.g. the TripSync travel app) can access your device location. Precise location is collected ONLY when you actively turn on location sharing within a trip, or when you send an SOS alert - never silently and never by default.

When enabled, your location is shared with the other members of that trip so the group can coordinate, and it stops automatically after the duration you choose or when the trip ends. You can turn it off at any time. Location is used only for the in-app map and SOS; it is never sold.

Location is collected only while the app is in use (foreground) - we do not track your location in the background.

With your permission, the app uses your camera and photo library so you can add trip cover photos, a profile avatar, expense receipts, booking tickets and shared trip-album photos.

Photos you upload are stored on our storage provider and shared with members of the same trip. Images may contain embedded metadata (e.g. EXIF location/time). You can delete photos you uploaded at any time.

Content you create in a trip - chat messages, itinerary items, expenses, polls and shared location - is visible to the other members of that trip. Please share only what you are comfortable letting the group see.

Chat messages pass through automated content moderation and are stored to deliver the conversation; a trip's messages are automatically purged 30 days after the trip ends.

We are not responsible for how other trip members use content you choose to share with them.

If you allow notifications, we register your device push token with our notification delivery provider (Expo) to send you alerts (e.g. a new expense, a poll, an SOS). You can disable notifications any time in your device settings.

We share the minimum data necessary with processors that help operate the app, under confidentiality/data-processing agreements: Expo (push notification delivery), Mapbox and Goong (map tiles and place search), OpenStreetMap/Nominatim (place search), our cloud storage provider (photos and files), and our email provider (verification codes).

Some of these providers process limited technical data (e.g. approximate coordinates for map/search, IP address, device token) on servers that may be outside Vietnam. We do not sell your data to any of them.

If you enable the optional Face ID / Touch ID app lock, biometric verification is performed entirely on your device by the operating system. PUPO never receives, stores or has access to your biometric data.

To operate and improve our products and services; to respond to your requests.

We do not sell personal data for commercial purposes.

Government agencies: when legally required.

Technology partners: cloud storage, electronic payment (under confidentiality agreements).

Research & statistics: anonymised or aggregated data only.

A small number of authorised PUPO staff can access trip data through an internal administration tool - including trip details, members, itineraries and expense records - strictly to provide support, investigate a reported problem, prevent abuse, or comply with a legal request.

Staff cannot read your group chat messages. No internal tool exposes conversation content, and chat is automatically deleted 30 days after a trip ends.

Every staff access to personal data is recorded in an internal audit log (who accessed what, and when). Access is limited to the purposes above - we do not browse your data otherwise, and we never use it for advertising.

Data is encrypted in transit (HTTPS). Passwords and OTP codes are stored only as hashes, never in plain text. We control access permissions and keep activity logs. In the event of a security incident affecting personal data, we notify affected users and the relevant authorities within the time limits required by law.

We only collect and process personal data when you actively consent - by registering an account, submitting a contact form or accepting this policy.

You can use the app as a guest without registering: a guest session is anonymous and holds no identifying information such as your name, email or password. You only provide personal data if you choose to create a full account (for example, to join a group trip or invite others).

You may withdraw consent at any time by contacting support@pupo.vn. Withdrawal does not affect the lawfulness of processing carried out before the withdrawal.

This website uses essential cookies for operation (login sessions, language preferences) and analytics cookies to improve the experience.

Analytics cookies are only activated with your consent. You may disable non-essential cookies in your browser settings at any time without affecting core functionality.

We do not use advertising cookies or share cookie data with third-party advertising networks.

Account data is retained while you keep using the service. Accounts with no login for 12 consecutive months may be deleted.

Guest (anonymous) accounts are deleted automatically when abandoned: after 7 days if no trip was created, or after 30 days from the last activity.

You can delete your account and personal data at any time directly in the app (Profile - Delete account); your personal data is erased or anonymised at that moment.

Technical logs are kept for a maximum of 30 days. Logs recording staff access to personal data are kept for 12 months for audit and complaint purposes.

Any remaining technical backups are overwritten within 15 days. We retain data beyond these periods only where the law requires it.

PUPO's services are not directed at children under 13. We do not knowingly collect personal data from minors.

If we discover we have inadvertently collected data from a child under 13, we will delete it immediately. Parents or guardians may contact support@pupo.vn to request deletion.

To operate our services, your data may be stored on cloud servers located outside Vietnam (including but not limited to AWS, Google Cloud, Microsoft Azure).

We ensure these partners comply with international security standards equivalent to or higher than Vietnamese legal requirements, and sign data processing agreements prior to any transfer.

Access & correction: view and update your personal information.

Deletion: request deletion of your account and all personal data (except data required by law to be retained).

Right to object: object to specific processing activities without needing to delete your account.

Data portability: receive a copy of your data in a common format.

Send requests to support@pupo.vn; we respond within 72 hours.

This policy may be updated from time to time. Significant changes will be communicated via the application or email and reflected on this page with the updated date.

The Vietnamese version is the authoritative text. This policy is governed by Vietnamese law. Disputes will be resolved through negotiation; failing that, through competent Vietnamese courts.