Privacy Policy

1. Scope and roles

1.1. eOTP, full name "Easy OTP for Indie Developer", is an API service for sending and verifying one-time passwords (OTP) via SMS (worldwide) and Zalo ZNS (Vietnam), built for independent developers and small businesses. The service is operated in Vietnam by VIHAT TECHNOLOGY COMPANY LIMITED (Công ty TNHH Công nghệ ViHAT, "ViHAT", "eOTP", "we" or "us").

1.2. This Policy applies to all personal data we process when you visit https://eotp.com.vn/ and its sub-pages, register and use an account, invite Members, create Projects, top up your Wallet, call the API, contact support, when End Users receive OTPs requested by your Project or verify through the eOTP popup or embedded button, and when End Users submit an abuse report from the verification popup.

1.3. Definitions: "Developer" (or "you") means the individual or organisation that registers an eOTP account; "Project" means the app or website a Developer declares in order to send OTPs; "End User" means a person who receives an OTP through a Project; "Wallet" means the prepaid balance of an account; "Member" means a person invited by the account owner to join the account with the Read or Edit role. Other terms have the meaning given in the Terms of Service.

1.4. We process data in accordance with Vietnamese personal data protection law, including the Personal Data Protection Law 2025 and its implementing regulations, and Decree 13/2023/ND-CP to the extent still in force. Where data relates to people in the European Union, the European Economic Area or the United Kingdom (for example OTPs sent to phone numbers there), we additionally apply the principles of the General Data Protection Regulation (GDPR): lawfulness, fairness and transparency; purpose limitation; data minimisation; accuracy; storage limitation; integrity and confidentiality; accountability.

1.5. This Policy does not cover websites or apps of Developers or third parties linked from eOTP. Each of them has its own policy.

2. Data we collect

2.1. We only collect data needed to operate, secure and bill the Service and to measure visits to the website. Full list:

2.2. We do not collect sensitive personal data (health, religion, biometrics, precise location, financial data such as card numbers or banking passwords), do not read the content of your app, do not buy data from others, and do not build behavioural profiles for advertising.

2.3. You must not put sensitive or unnecessary personal data into any field sent to eOTP (Project name, description, notes, API parameters).

2.4. When the eOTP verification popup or button loads on a Developer's website, eOTP receives the address of the embedding page (URL, stored only with query parameters removed) to confirm that the Project is integrated on the declared domain. When an End User opens the popup, in addition to the phone number, eOTP also records the End User's IP address, browser and operating system type (user-agent string) and the address of the page that opened the popup, in order to prevent fraud and abuse, investigate abuse reports and help Developers reconcile (see the row "Verification sessions via the popup or embedded button" in section 2.1).

3. Purposes and legal bases

3.1. We process data only for the purposes below. Under Vietnamese law, the basis is your consent given at registration and the cases where processing without consent is permitted by law (performance of a contract, legal obligations). For data subjects within the scope of the GDPR, the corresponding basis under Article 6 GDPR is shown in brackets.

3.2. We do not use your data or End User data for advertising, do not send marketing messages to End Users, do not use End User phone numbers for any purpose other than sending and verifying OTPs for the Project that requested them and reviewing abuse reports submitted by the End Users themselves (section 2.1), and do not use data to train AI models.

3.3. The AI review result is not a final decision that adversely affects you: Projects flagged for "manual review" are reviewed by ViHAT staff, and you may request human review of any rejection by resubmitting the Project or contacting us under section 13.

3.4. To detect the creation of multiple accounts to abuse the free quota, the system compares the IP addresses used at sign-up and sign-in across accounts. When such signs appear, eOTP administrative staff are alerted and the free accounts concerned may be suspended automatically; you receive a notification email. An automatic suspension is not a final decision: eOTP staff review it and reopen the account where appropriate if you contact us by replying to the notification email, by email or by calling the hotline in section 13.

3.5. If we need to process data for a new purpose not listed above, we will notify you and, where the law requires, obtain your consent first.

4. Sharing with third parties

4.1. We do not sell, rent or trade personal data. Data is shared only with the parties below, to the minimum extent needed for the stated purpose:

4.2. We send no End User data to OpenAI, and do not send your email, full name, phone number, password, API key or Wallet transactions. Under OpenAI's API policy, data sent via the API is not used to train models by default and may be retained temporarily by OpenAI (typically up to 30 days) for abuse monitoring.

4.3. Recipients may process data only for the purposes above and must keep it confidential under their contracts or terms of service. Adding or replacing recipients of End User data will be notified under section 11.7.

4.4. Apart from the parties above, we disclose data only: (a) when a competent authority requests it in accordance with law; (b) when needed to protect the life, health or property of others in an emergency; (c) in a merger, division or transfer of business, in which case the recipient must continue to comply with this Policy and you will be notified in advance.

4.5. ViHAT staff access data only according to their assigned role, when needed for their work (Project review, support, reconciliation), and are bound by confidentiality obligations. Authorised eOTP administrative staff can see End Users' full phone numbers, IP addresses, browsers, operating systems and the pages that opened the popup in the OTP log and abuse reports, in order to operate the Service, prevent abuse and handle complaints; staff in other roles see only partially masked phone numbers.

4.6. Abuse reports from the verification popup (section 2.1) are viewed only by authorised eOTP staff in order to review and handle abuse. We do not provide reports, phone numbers or the reporter's identity to the reported Developer, except in the cases set out in section 4.4.

4.7. Within your account: the account owner decides whom to invite as Members and is responsible for granting that access. Members can see the account's data according to their role: the Read role sees Projects, OTP logs (including the phone numbers of the Project's End Users, partially masked), the balance and top-up history; the Edit role can also create and edit Projects, API keys and sending settings, and top up. All Members of the account can see the member list and the account activity log (who did what, when, from which IP). Once a Member is removed or leaves the account, they can no longer see this data.

5. Cross-border transfers

5.1. The eOTP database is stored on servers located in Vietnam. Data leaves Vietnam only in the following cases:

5.2. We prepare and keep a cross-border personal data transfer impact assessment dossier as required by Vietnamese law. For data within the scope of the GDPR transferred outside the EU/EEA, we rely on a valid mechanism offered by the recipient (such as Standard Contractual Clauses) or on transfers necessary for the performance of a contract under Article 49 GDPR.

6. Retention and deletion

6.1. The retention period for each data category is set out in the table in section 2. Summary:

6.2. When you ask us to delete your account, we lock the account, revoke all API keys, delete account and Project data, and keep only the data the law requires us to retain (Wallet transactions, records), separated from day-to-day use. Any remaining Wallet balance is handled under the Terms of Service.

6.3. Backups: data is backed up periodically for disaster recovery. Backups are stored on servers in Vietnam, protected like the original data, used only for restoration, and deleted data disappears from a backup when that backup is rotated out. If we have to restore from a backup, we re-delete any data whose deletion had been requested earlier.

6.4. Fully anonymised data (for example total sends per channel, not linked to any person or phone number) may be kept for statistics.

7. Security and incidents

7.1. Technical and organisational measures we apply:

• Hashing of secrets: passwords are hashed with bcrypt; OTP codes are hashed with HMAC-SHA256 using a system secret key; API keys are stored only as SHA-256 hashes and the full key is shown once at creation; verification codes and password reset links are stored as hashes and expire.
• Encryption in transit: HTTPS is mandatory for all connections to the website and API; HTTP requests are redirected to HTTPS.
• Sessions and forms: session cookies carry the HttpOnly, Secure and SameSite=Lax flags; forms are protected by anti-forgery (CSRF) tokens.
• Access limits: limits on failed sign-ins, on OTP entry attempts and on API request rate per key; limits on the number of codes sent to the same phone number within a period, per Project and per IP address.
• Admin access control: a separate admin portal on its own subdomain, separate sessions, two-step sign-in, role separation (administrator, customer care), automatic sign-out after 2 hours of inactivity, and restriction to an allowlist of IP addresses.
• Audit logging: every important action by you, by the system and by ViHAT staff (API key rotation, status changes, approvals, Wallet credits and debits, admin sign-ins) is logged for traceability.
• Storage isolation: the database, configuration files and secret keys are kept outside the public web directory, with file permissions restricted to the service process.
• Minimisation: End User phone numbers are partially masked in the Developer's dashboard (including for Members) and for eOTP staff outside the administrator role; OTP logs are deleted automatically after 90 days.

7.2. No system is absolutely secure. You are responsible for keeping your password and API keys secret, not embedding API keys in client-side apps, and rotating keys immediately if you suspect exposure.

7.3. Incident notification: upon discovering a personal data breach, we will: (a) contain and remediate it immediately; (b) notify the competent personal data protection authority (Ministry of Public Security of Vietnam) within 72 hours of discovery, as required by law; (c) notify affected Developers without undue delay and no later than 72 hours, including a description of the incident, categories and scope of data, likely consequences, measures taken and planned, and a contact point; (d) for incidents involving End User data, provide the information Developers need to meet their own notification obligations. Information not available at the time of notice will be provided in phases.

8. Data subject rights

8.1. Under Vietnamese personal data protection law and, where applicable, the GDPR, you have the right to:

• Be informed about the processing of your data (which is the content of this Policy).
• Access and obtain a copy of the personal data we hold about you, in a common, machine-readable format (data portability).
• Rectify inaccurate data. You can edit your full name and password yourself on the Profile page; your phone number can be edited yourself only while it is not yet verified. A verified email address or phone number cannot be changed by yourself in the dashboard: send a correction request by email or hotline in section 13; after eOTP staff update it, you receive a notification email (section 3.1).
• Erase your data and account, except data the law requires us to keep (section 6). You can view remembered sign-in devices and sign out one or all of them yourself in the "Remembered devices" section of the Profile page.
• Withdraw consent. Withdrawal does not affect processing lawfully carried out before it; if data needed to operate the Service is withdrawn, we will no longer be able to provide the Service.
• Restrict or object to processing, including processing based on legitimate interests.
• Request human review of an automated review result (section 3.3) and of an automatic account suspension (section 3.4).
• Complain, denounce, sue and claim compensation as provided by law; lodge a complaint with the personal data protection authority (Ministry of Public Security of Vietnam) or, for people in the EU/EEA/UK, with the supervisory authority where you live.

How to exercise your rights

1. Email mktvh@vihatgroup.com from your registered email address with the subject "eOTP – Personal data", stating the right you wish to exercise.
2. We acknowledge receipt within 72 hours and may ask you to verify your identity (for example with a code sent to your registered phone number) before acting, so that data is not given to someone without the right to it.
3. Requests are completed within the time limit set by law for each right; for requests within the scope of the GDPR, within 30 days (extendable as permitted by the GDPR, in which case we will tell you why).
4. Exercising your rights is free of charge. We may refuse requests that are manifestly unfounded, excessively repetitive, or that would affect the rights of others, and will give reasons.

9. Cookies

9.1. eOTP uses cookies that are necessary for operation, cookies that remember your choices, and Google Analytics measurement cookies:

9.2. We use Google Analytics 4 to measure visits and sign-up performance. We do not use advertising cookies, do not place advertising-network tracking pixels, and do not send email addresses, full names, phone numbers, passwords, API keys or End User data to Google Analytics.

9.3. When you first open the website, you will see a cookie banner with two buttons, Accept and Decline. If you visit from the European Economic Area, the United Kingdom or Switzerland, measurement cookies are set only after you click Accept. Elsewhere, measurement is on by default and stops as soon as you click Decline. When you decline, we delete the _ga cookies and Google Analytics receives only cookieless signals that do not identify your browser. Your choice is remembered for 12 months; you can change it at any time by clicking Change cookie choice, or by installing the Google Analytics opt-out browser add-on. Declining measurement does not affect your use of eOTP. If you block the easyotp_sess cookie, you will not be able to sign in.

10. Children

10.1. eOTP accounts are only for people aged 18 or over with full legal capacity. We do not knowingly open accounts for, or collect account data from, anyone under 18. If we find such an account, we lock it and delete the related data, except data the law requires us to keep.

10.2. If your Project serves children, you are responsible for obtaining the consent of a parent or guardian as required by law (and, for children aged 7 or over under Vietnamese law, the child's own consent) before sending OTPs to a child's phone number, and for complying with the children's data rules of the country where the child lives.

11. Developer obligations regarding End User data

This section is the data processing agreement between you (controller) and ViHAT (processor) for End User data, and takes effect when you call the eOTP API. This section 11 does not apply to abuse reports submitted by End Users from the verification popup (section 2.1), which eOTP processes as controller.

11.1. Instructions: every API call to send or verify an OTP is your instruction. ViHAT processes End User data only to send and verify OTPs, report status, bill and prevent abuse, and for no other purpose of its own.

11.2. Legal basis and notice: you must have a valid legal basis to process End Users' phone numbers, and your Project's privacy policy must state that phone numbers are passed to an OTP service provider (ViHAT/eOTP) and to delivery parties (Zalo, carriers) to send verification codes.

11.3. OTP use only: send an OTP only when the End User themselves actively requests verification (sign-up, sign-in, phone verification, confirming their own transaction). It is forbidden to upload lists of phone numbers, send to numbers without consent or unrelated to an action of the number's owner, send marketing, customer care or debt reminder messages, or use eOTP to probe whether phone numbers exist or have Zalo.

11.4. Minimisation: do not put any other End User personal data into API parameters or Project names or descriptions.

11.5. End User requests: you receive and handle End User requests for access, rectification, erasure and withdrawal of consent. ViHAT assists by providing the relevant OTP logs and deleting OTP logs linked to a phone number when you request it by email under section 13, within the time limit set by law.

11.6. Your security: keep API keys secret, call the API only from your server, and notify ViHAT immediately if you suspect a key has been exposed or discover an incident involving End User data. Invite as Members only people who need access to the account's data, and remove them when they no longer need it (section 4.7).

11.7. Sub-processors: you authorise ViHAT to use the parties in section 4 when processing End User data. ViHAT will notify you by email at least 15 days before adding or replacing a sub-processor that receives End User data; if you do not agree, you may stop using the Service and request a refund of your Wallet balance under the Terms of Service. ViHAT binds sub-processors to confidentiality obligations no less protective than this Policy.

11.8. Personnel: ViHAT staff access End User data only when needed for their work and are bound by confidentiality.

11.9. Compliance assistance: upon reasonable request, ViHAT provides the information you need to demonstrate compliance (security measures, sub-processor list, storage location), assists with impact assessments and cooperates with competent authorities.

11.10. On termination: OTP logs continue to be deleted automatically after 90 days; popup verification session data is kept for the period stated in section 2.1; you may request earlier deletion. Beyond these periods, ViHAT does not keep End User data longer unless the law requires it.

11.11. Liability: you are responsible to End Users and authorities for collecting and using phone numbers in your Project, and you will indemnify ViHAT for damages and claims arising from your breach of this section. ViHAT may suspend a Project immediately upon detecting a breach of section 11.3.

12. Changes to this Policy

12.1. We may update this Policy when the Service, our processors or the law change. The new version is published on this page with a new version number and effective date.

12.2. Material changes (new purposes, new data categories, new recipients or transfer destinations, longer retention) are notified to your registered email at least 15 days before they apply, stating what changes. Where the law requires, we will ask for your consent again. Continuing to use the Service after the effective date means you accept the new version; if you do not agree, you may stop using the Service and request account deletion.

12.3. This Policy is published in Vietnamese and English with equivalent content. In case of any discrepancy, the Vietnamese version prevails.

13. Data protection contact

• Controller and processor: VIHAT TECHNOLOGY COMPANY LIMITED (Công ty TNHH Công nghệ ViHAT)
• Tax ID: 0312577096
• Address: 140-142 Street 2, Van Phuc 1 Residential Area, Hiep Binh Ward, Ho Chi Minh City
• Data protection email: mktvh@vihatgroup.com (subject "eOTP – Personal data")
• Hotline: +84 901 888 484
• Service: eOTP — Easy OTP for Indie Developer, https://eotp.com.vn/

Version 2.4, effective from 10 November 2026, supersedes all previous versions.