Privacy Policy

1. Who we are and how to contact us

Your data is managed by PUPO SOFT COMPANY LIMITED (Tax ID 0318629720), registered at 618/61/53 Quang Trung, Thong Tay Hoi Ward, Ho Chi Minh City, Vietnam. Send any privacy request or question to support@pupo.vn.

The App is built for restaurants and businesses. The restaurant owner decides which supplier, staff and purchase information is entered into the App and is responsible for having any consent or legal basis required for that information.

2. Data we collect

Account: name, email, password (stored only as a one-way hash that nobody, including us, can read back), restaurant name, time zone and currency.

Team members: name, role, email or phone number (if the owner enters it), last sign-in time, invite codes and the device identifier used when joining with an invite code.

Content you enter: suppliers (name, phone, address, notes), shopping lists, items, purchase history and prices (if you record them), stock levels, to-dos and recurring chores.

Technical: push notification token and device type, app language and app version; ratings and feedback you choose to send.

The App does NOT access your location, contacts, camera, photo library or microphone. Face ID or fingerprint lock (if you turn it on) runs entirely on your device; we never receive biometric data.

The App shows no ads and uses no advertising trackers.

3. How we use data

To provide and maintain the App; sync data across your devices and team; send notifications and password reset codes; secure accounts and prevent abuse; and support you when you contact us.

To generate suggestions (items often bought together, day-of-week reminders, price alerts) from your own restaurant purchase history.

To improve the App using aggregated or de-identified data that does not identify you or your restaurant.

We do not sell your personal data.

4. Sharing with third parties

Infrastructure providers (servers, storage, email delivery) process data on our behalf, only as needed to run the App.

Push notifications are delivered through Expo, Apple Push Notification service and Google Firebase Cloud Messaging.

Search and suggestion features may send the item names you type (without your name, email or phone) to artificial intelligence providers (such as Groq or Google) to normalize item names.

When in-app purchases are available, payments are processed by the Apple App Store or Google Play and a subscription management provider; we never receive your card number.

Competent authorities when required by law; or a successor entity if PUPO SOFT is involved in a merger or business transfer, which must continue to protect data under this policy.

Third-party services operate under their own terms and policies as updated from time to time. Some providers may process data in countries other than your own. By using the App, you agree that your data may be transferred to, stored and processed in such countries, whose data protection laws may differ from those where you live.

5. Storage and security

Data is stored and processed on infrastructure chosen by PUPO SOFT, which may be operated by third-party providers. Connections between the App and our servers are encrypted. Sign-in sessions are kept in your device secure storage.

Each restaurant can only see its own data; member permissions are set by the owner.

No system is completely secure. We use reasonable safeguards but cannot guarantee that data will never be accessed without authorization.

6. Your responsibilities

Keep your password and verification codes secret, do not share accounts, keep your phone and email account secure, and consider turning on the Face ID or fingerprint lock in the App.

Owners should remove staff who leave, keep invite codes private, and are responsible for information about other people that they enter into the App.

We will never ask for your password or verification codes. Data exposed because your password, codes, device or email were lost or compromised is handled under the Terms of Service.

7. Retention and account deletion

We keep data while your account is active.

You can delete your account inside the App (Profile, Delete account). When an owner deletes their account, that restaurant data is removed from the App immediately and can no longer be accessed; when a member deletes their account, their membership is removed. Within 30 days, personal data and remaining records on our servers are permanently deleted or de-identified; older backups expire on their normal rotation. The exception is data we must keep them to comply with law, resolve disputes or prevent fraud.

Owners can also delete specific data (lists, history, inventory, vendors) from settings.

8. Your rights

You can view and edit your account details in the App, and request a copy of your data, deletion, or withdrawal of consent by emailing support@pupo.vn. We respond within the time required by applicable law and may need to verify that you own the account.

If your information was entered into the App by a restaurant (for example, you are a supplier or employee), please contact that restaurant first, as it decides what to store.

Depending on where you live (for example, certain US states or the EU), you may have additional rights under local law; we honor such requests as required by that law.

9. Children

The App is for businesses and is not intended for anyone under 16. We do not knowingly collect data from children; if we learn that we have, we will delete it.

10. Changes to this policy

We may update this policy and post it here with a new date. Material changes will be announced in the App or by email. Continuing to use the App after the effective date means you accept the updated policy.