Terms of Service

1. Definitions

In these Terms, the following words have the meanings below:

Service

Easy OTP for Indie Developer (eOTP): a platform for generating, sending and verifying one-time passwords (OTPs) via SMS and Zalo ZNS, including the account dashboard, API, documentation, sample code and all related features, operated by ViHAT at https://eotp.com.vn/.

Developer (you)

An individual who registers an eOTP account to integrate the Service into their own app or website. You do not need to be a company or organisation; if you use the Service on behalf of an organisation, you represent that you have authority to bind it to these Terms, and both you and that organisation are responsible.

End User

A user of your app or website who owns the phone number receiving the OTP.

Project

An app (Android, iOS) or website you register on eOTP. Each Project has its own API key, review status, Tier and quota.

API key

A secret string (starting with eo_live_) issued to a specific Project and used to authenticate every request to the eOTP API.

Wallet

The prepaid balance in your account, denominated in Vietnamese dong (VND), used to pay for Messages beyond the free allowance of Tier 1.

Message

One delivery of one OTP to one phone number over one Channel. A single OTP send request may result in one or two Messages depending on the channel mode you choose.

Tier

The monthly OTP quota level of a Project (Tier 1 – FREE plan, Tier 2 – DEVELOPER plan, Tier 3 – BUSINESS plan), as set out in section 6.

Channel

The route by which a Message reaches the End User: SMS (primary channel) and Zalo ZNS (secondary channel, applicable to recipients with a Zalo account). The supported scope of each Channel is set out in section 6. The channel mode of a request is one of four values: sms, zalo, both (send on both at the same time) and zalo_then_sms (send via Zalo, with an automatic SMS fallback if Zalo is not delivered).

2. Eligibility

1. You must be at least 18 years old and have full legal capacity under the laws of Vietnam and of the country where you reside.
2. The information you provide at sign-up (full name, email, phone number) and throughout your use of the Service must be true, accurate and your own, and must be updated promptly when it changes. Providing false information or using another person's information is a serious breach.
3. Your account is fully usable only after you verify your phone number with an OTP sent to that number.
4. Each person may hold only one account. You must not create multiple accounts to circumvent quotas or review, to obtain the free allowance again, or to continue using the Service after suspension or termination. You must not share, rent, sell or transfer your account.
5. Individuals may use the Service without a company standing behind them. Whether you are an individual or an organisation, you bear full legal responsibility for your Projects, including their content, products, operations, how you collect phone numbers, and compliance with applicable law.
6. You must not use the Service if you, or the organisation you represent, have had an account previously terminated by ViHAT, or are prohibited from transacting under Vietnamese law or international sanctions applied by Vietnam.

3. Account and security

1. You are responsible for keeping your password, login sessions and API keys confidential. API keys may only be stored and called from your server (backend); you must not embed them in mobile app source code, JavaScript running in a browser, public code repositories or anywhere else others can read them.
2. An API key is shown only once when created. Each API key may only be used for the Project it was issued to; you must not use an API key for any app or website other than the registered Project, nor share it with any third party.
3. Every request sent with your API key or action taken from your account is deemed to be made by you, including where the API key or password has been leaked, stolen or used by someone else. Fees for such requests are still deducted from your Wallet and are not refunded.
4. If you know or suspect that an API key, password or your account has been exposed or accessed without authorisation, you must immediately create a new API key to invalidate the old one, change your password and notify ViHAT under section 15. You bear any loss arising before you take these steps.
5. ViHAT may revoke, disable or force rotation of any API key at any time without prior notice if the key is publicly exposed, used for the wrong Project, shows signs of abuse, or to protect End Users and the system.
6. ViHAT will never ask for your password or API key by phone, email or message. You must not give this information to anyone, including people claiming to be ViHAT staff.

4. Acceptable use policy

The Service may only be used to send verification codes to End Users who have actively requested a code. You may send an OTP to a phone number only when the owner of that number has just requested a code in your app or website (for example: sign-up, login, phone number verification, or confirming their own transaction). You must not, directly or indirectly, yourself or by allowing others, use the Service to:

1. Send spam, advertising, promotions, customer-care messages or any content other than a verification code.
2. Commit fraud, misappropriate property or take over accounts, or lure End Users into providing information, passwords or OTP codes.
3. Phish, or collect, steal or trick others into providing OTP codes of other services (banks, e-wallets, social networks, e-commerce marketplaces, etc.), including in the form of "receive codes on someone's behalf" or "rent numbers to receive OTPs".
4. Impersonate or create confusion with any brand, bank, financial institution, e-wallet, exchange, government authority (police, tax, social insurance, public service portals, etc.), mobile network operator, Zalo or any other organisation or person.
5. Carry out or facilitate OTP bombing, OTP flooding, SMS pumping (inflating message traffic to profit from carrier fees), or any form of mass sending to one or more phone numbers.
6. Send to phone numbers without a request from the End User themselves, send to purchased, harvested or generated number lists, or use OTPs to probe whether a phone number exists or has Zalo.
7. Unlawfully collect, buy, sell or exchange phone numbers or personal data.
8. Serve gambling, betting, lotteries or casinos; predatory or unlicensed lending or unlawful debt collection; pharmaceuticals, prescription drugs, controlled substances, weapons, or any goods or services that are prohibited or restricted without a valid licence.
9. Serve adult, pornographic, violent, abusive or discriminatory content, child exploitation, or any content or activity that is unlawful in Vietnam or in the End User's country.
10. Exceed or attempt to circumvent quotas, review, verification or any other protection of the Service, including by splitting requests across multiple Projects, API keys or accounts.
11. Reverse-engineer, decompile, disassemble, scan, penetration-test, attack, inject malicious code into or overload eOTP systems, or access other people's data without authorisation. Security testing may only be performed with ViHAT's prior written consent.
12. Resell, rent, sublicense or repackage the Service, or let third parties send OTPs through your account, without a written agreement with ViHAT.
13. Misstate a Project's purpose, describe a Project inaccurately, or change a Project after approval to a prohibited purpose or one different from what you declared.

You must comply with the laws of the place where End Users receive Messages and the laws applicable to you, including but not limited to: Vietnamese law on telecommunications, cybersecurity, personal data protection and anti-spam messaging (including Decree 91/2020/ND-CP); the personal data protection laws of the place where you reside or operate; and the policies of each mobile network operator and of Zalo. You must implement anti-bot measures (captcha, limits on requests per phone number, device and IP address) in your app or website.

Consequences of breach: ViHAT may, immediately and without prior notice, suspend or terminate the Project and account, revoke API keys, retain the Wallet balance to offset losses (traffic charges, penalties from carriers or Zalo, handling costs) and will not issue refunds. ViHAT may preserve evidence, provide account, Project and sending log information to carriers, Zalo and competent authorities, and proactively report conduct showing signs of a crime. You bear full legal responsibility and must indemnify ViHAT under section 9.

5. Project review and approval

1. To send OTPs, you submit a Project including its name, type (app or website), a description of how OTPs are used, and the app store link (Google Play, App Store) or domain. A Project can send OTPs only after it is approved.
2. Each Project is reviewed by artificial intelligence (AI) combined with ViHAT staff. The system reads the information you provide and the public content of the website or app store page (title, description, developer, domain age, SSL certificate, contact details). The outcome may be: approved, referred to manual review, or rejected.
3. Projects showing signs of brand impersonation, fraud, gambling, predatory lending, spam, adult content, harvesting other people's OTP codes, or misleading descriptions are rejected. Newly created domains, pages without contact details, pages that fail to load, or vague descriptions are referred to manual review.
4. ViHAT has full discretion to approve, reject, suspend, downgrade or request additional information (identity documents, proof of ownership, explanation of purpose, sample sign-up flow, etc.) for any Project at any time, including Projects previously approved. ViHAT will state a reason but is not obliged to prove it or disclose the criteria, data or internal rules behind the decision.
5. To move up to Tier 2, you must verify ownership: for a website, publish a DNS TXT record at _easyotp.<domain> containing the verification code issued by the system; for an app, place the verification code in the app description on Google Play or the App Store. Once verified, you must keep the record or code in place for as long as you use the Service; removing it may result in a downgrade.
6. A rejected Project may be edited and resubmitted. Repeatedly resubmitting the same violating content, or attempting to deceive the review system (including inserting instructions intended to manipulate the AI into the name, description or page content), breaches section 4 and may lead to account termination.
7. Approval of a Project does not mean ViHAT endorses, guarantees or is responsible for the content, products, legality or operations of that Project.

6. Tiers, quotas and channels

Each Project has one Tier. The Tier determines how many OTPs can be sent each month and whether the Wallet is charged.

1. Months are calendar months in Vietnam time (GMT+7). Quotas reset at 00:00 on the first day of each month. Unused quota does not roll over and cannot be exchanged for money.
2. When a Project has used up its monthly quota, the API returns the error quota_exceeded and does not send until the next month or until the Project moves to a higher Tier. "No volume cap" in Tier 3 does not exclude measures against unauthorised access and abuse.
3. The Service applies plan quotas as published on the pricing page. Requests over quota receive the error quota_exceeded or daily_quota_exceeded. The Service may apply technical measures to prevent unauthorised access and abuse. The system may temporarily refuse requests (error unavailable) while under maintenance or handling an incident.
4. The countries, carriers and Channels supported are those listed in your account from time to time. ViHAT may expand or narrow this scope with prior notice. Sender names and deliverability depend on the rules of each carrier.
5. Zalo ZNS is a secondary channel, applicable to recipients with a Zalo account, sent using a fixed message template registered by ViHAT and approved by Zalo. You do not set the content of Messages on any Channel.
6. ViHAT does not guarantee that the Service can reach every country, carrier or phone number, and may immediately stop supporting a country, carrier or Channel when a carrier, Zalo or a regulator requires it, or when abuse risk is detected.
7. ViHAT may change quotas and Tier conditions by giving at least 7 days' notice by email or in the dashboard. Changes made to meet legal, carrier or Zalo requirements, or to stop abuse or a security incident, may take effect immediately.
8. If ViHAT detects unusual activity on a Project, such as a sudden spike in volume, an abnormally low code-entry rate, sequential numbers or unusual number ranges, or complaints from recipients, ViHAT may immediately pause sending for that Project to investigate and will only resume it once you provide a satisfactory explanation.

7. Fees, wallet and payment

1. Prepaid. The Service is prepaid: you top up your Wallet and fees are deducted as you use it. If the Wallet does not hold enough for a request, the API returns the error insufficient_balance and does not send.
2. Prices. The price of each Message depends on the Channel (SMS or Zalo) and is shown in your account dashboard. The both and zalo_then_sms modes are charged the price of both Zalo and SMS. ViHAT may change prices by giving at least 7 days' notice by email or in the dashboard; new prices apply to Messages sent after the effective date. If a carrier or Zalo raises its charges unexpectedly, ViHAT may apply new prices sooner and will notify you as soon as possible.
3. When fees are charged. For Tier 2 and Tier 3, the fee for a Message is deducted from the Wallet as soon as the system accepts the send request. The fee is automatically refunded to the Wallet when: (a) the send is rejected immediately when handed to the carrier or Zalo; (b) the carrier or Zalo reports a failed delivery status; (c) in zalo_then_sms mode, Zalo reports delivery so the SMS fallback is not sent (the SMS portion is refunded). A Message accepted by the carrier or Zalo without a failure report is deemed sent and is not refunded, even if the End User did not receive, read or enter the code.
4. Top-ups. You create a top-up request in the dashboard (the minimum amount is shown on the top-up page) and transfer exactly that amount, quoting exactly the payment reference issued by the system (starting with EZOTP), to the bank account held by VIHAT TECHNOLOGY COMPANY LIMITED shown on the top-up page. The system reconciles automatically through a payment gateway; where manual reconciliation is needed, ViHAT handles it during business hours.
5. Incorrect top-ups. Transfers with a missing or wrong reference, the wrong amount, or sent to the wrong account are the sender's responsibility. You must contact support under section 15 with proof of transfer; ViHAT credits the Wallet only after the transaction has been reconciled. ViHAT is not responsible for money sent to any account other than the one shown on the top-up page.
6. No refunds. Wallet balances are non-refundable and cannot be withdrawn or converted to cash, except: (a) where a refund is required by law; (b) where an eOTP system error deducted an incorrect amount, in which case the incorrect deduction is refunded to the Wallet; (c) where ViHAT discontinues the entire Service through no fault of yours, in which case the remaining balance is refunded to a bank account in your name. Accounts suspended or terminated for breach are not entitled to a refund of the balance.
7. Nature of the balance. Wallet balances earn no interest, do not expire while the account remains active, may not be transferred, gifted or moved to another account, and are not a deposit or a means of payment.
8. Transaction disputes. If you believe a charge, refund or top-up is incorrect, you must raise a dispute within 7 days of the transaction, quoting the transaction ID or top-up reference. After that period, the transaction is deemed accepted by you. The eOTP system ledger is the basis for reconciliation.
9. Taxes and costs. Whether listed prices include value-added tax is stated in the price list. You bear transfer fees, bank charges, exchange-rate differences and all taxes and charges arising where you reside. Requests for receipts or invoices for top-ups are sent under section 15 and handled in accordance with Vietnamese law.

8. Service level and disclaimers

1. The Service is provided "as is" and "as available". To the extent permitted by law, ViHAT makes no warranty of any kind, express or implied, including merchantability, fitness for a particular purpose, continuity, or freedom from errors or interruptions.
2. ViHAT does not guarantee delivery time, delivery rate, or that Messages will reach every phone number. Delivery depends on carriers, Zalo, intermediary partners, the Internet, and End Users' devices and settings (message blocking, lack of coverage, roaming, spam filters, etc.), which are beyond ViHAT's control.
3. The Service may be suspended for maintenance, upgrades or incident handling. ViHAT tries to give notice of planned maintenance but is not obliged to do so for emergency maintenance.
4. You must design your app or website so that it still operates safely when the Service is slow, failing or unavailable (for example: allow resending a code, offer a backup verification method).
5. Not for life-critical use. The Service is not designed for, and must not be used for, emergency calls or messages, disaster alerts, medical devices, vehicle control, safety systems or any situation in which failure, delay or interruption could lead to death, personal injury or severe property or environmental damage.
6. ViHAT is excused from liability for failure or delay in performance caused by force majeure, including natural disasters, epidemics, war, strikes, widespread telecommunications or Internet outages, failures of carriers, Zalo or infrastructure providers, cyberattacks, and decisions of government authorities.

9. Limitation of liability and indemnity

1. To the maximum extent permitted by law, ViHAT, its affiliates, officers, employees and partners are not liable for any indirect, incidental, special, consequential or punitive damages, including loss of profit, revenue, data, customers or goodwill, or business interruption, even if advised of the possibility of such damages.
2. ViHAT is not liable for losses arising from: exposure of your API key, password or account; the content, products and operations of your Projects; your breach of these Terms or the law; the conduct of End Users or third parties; or Messages not delivered or delivered late for the reasons set out in section 8.
3. In all cases, ViHAT's total aggregate liability to you for all claims arising from or relating to the Service shall not exceed the total amount you actually paid to ViHAT (the amounts deducted from your Wallet for Messages) in the 3 months immediately preceding the first event giving rise to liability.
4. The limitations in this section do not apply to liability that cannot be excluded or limited under Vietnamese law.
5. Indemnity. You agree to indemnify, defend and hold harmless ViHAT, its affiliates, officers, employees and partners from and against all claims, demands, penalties (including penalties imposed by carriers, Zalo and government authorities), losses, costs and reasonable legal fees arising from or relating to: (a) your breach of these Terms, in particular section 4; (b) your Projects and all Messages sent with your API keys; (c) your violation of the law or of third-party rights, including End Users' privacy rights. ViHAT may set off these amounts against your Wallet balance.

10. Data and privacy

1. For End Users' phone numbers and the data accompanying OTP send requests, you are the data controller: you decide the purposes and means of processing. ViHAT is the data processor, processing only on your behalf and according to the requests you send through the API, in order to generate, send and verify OTPs, charge fees, prevent abuse and meet legal obligations.
2. You represent that you have a valid legal basis (usually the End User's consent or active request) for passing their phone numbers to ViHAT for processing, and that your Project's privacy policy discloses that phone numbers are used to send verification codes via SMS or Zalo through a service provider.
3. You handle End Users' requests and complaints about personal data and about Messages sent from your Projects. When ViHAT receives a complaint or request concerning your Project, ViHAT will forward it to you and you must respond within the time ViHAT specifies.
4. OTP request logs (phone number, time, status, IP address calling the API) are kept for 90 days and then deleted automatically. OTP codes are stored only as hashes, never in readable form. Records of sent Messages and Wallet transactions are kept longer for reconciliation, billing and accounting and tax obligations under the law.
5. ViHAT does not sell or rent End Users' phone numbers or use them for advertising or any purpose other than providing the Service. ViHAT shares data only with carriers, Zalo and intermediary partners to the extent needed to deliver Messages, or with competent authorities as required by law.
6. Details of the data ViHAT collects about you as a Developer, its purposes, retention periods and your rights are set out in the Privacy Policy, which forms an integral part of these Terms.

11. Intellectual property

1. The Service, including its software, API, documentation, sample code, interface, the names eOTP and Easy OTP for Indie Developer, logos and all related content, is owned by ViHAT or its licensors and protected by intellectual property law.
2. While you comply with these Terms, ViHAT grants you a limited, non-exclusive, non-transferable, non-sublicensable, revocable right to integrate the Service into your Projects. You may copy and adapt the sample code in the documentation for use in your Projects.
3. You must not use the name, logo or brand of eOTP or ViHAT in a way that suggests ViHAT sponsors, partners with or endorses your Project without written consent.
4. You retain all rights in your Projects. You allow ViHAT to use public information about your Projects for review, verification and abuse prevention.
5. If you submit feedback or suggestions for improving the Service, ViHAT may use them freely without any obligation to pay or credit you.

12. Suspension and termination

1. Termination by you. You may stop using the Service at any time. To delete your account, send a request under section 15 from your registered email address.
2. Suspension or termination by ViHAT. ViHAT may suspend, downgrade or terminate a Project or your entire account, and revoke API keys: (a) immediately and without notice if you breach section 4, provide false information, show signs of fraud, create risk for End Users, the system or ViHAT's relationships with carriers or Zalo, or when a government authority, carrier or Zalo so requires; (b) after notice, if you breach other terms and fail to remedy the breach within the period ViHAT specifies; (c) if the account has had no login or sending activity for 12 consecutive months, after prior notice by email.
3. ViHAT may discontinue the entire Service with at least 30 days' notice by email; Wallet balances are then handled under section 7.
4. Effects. On termination for any reason: all API keys are disabled immediately; your right to use the Service ends; fees for Messages already sent are not refunded; Wallet balances are not refunded except as set out in section 7. For accounts terminated for breach, ViHAT may retain the Wallet balance to offset losses under section 9.
5. Data after termination. You cannot access the dashboard, logs or Project data after termination. ViHAT retains and deletes data according to the periods in section 10 and the Privacy Policy; data relating to a breach may be kept longer as evidence or for provision to competent authorities.
6. Sections 4 (consequences of breach), 7 (no refunds), 9, 10, 11, 12 and 14 survive termination.

13. Changes to these Terms

1. ViHAT may amend these Terms. The new version is posted on this page with a new effective date and version number, and notified to your registered email address or in the dashboard.
2. Changes take effect 7 days after notice unless the notice states a later date. Changes made to meet legal, carrier or Zalo requirements, or to stop abuse or a security incident, may take effect immediately.
3. If you do not agree with the new version, you must stop using the Service before the effective date. Continuing to log in or call the API after the effective date constitutes your acceptance of the new version.

14. Governing law and disputes

1. These Terms are governed by and construed in accordance with the laws of the Socialist Republic of Vietnam, regardless of where you reside.
2. Any dispute arising from or relating to these Terms or the Service shall first be resolved by negotiation. The party raising the dispute sends written or email notice describing it. If the dispute is not resolved within 30 days of receipt of the notice, it shall be submitted to the competent People's Court in Ho Chi Minh City, Vietnam.
3. If any provision of these Terms is held invalid or unenforceable by a competent authority, that provision is limited to the minimum extent necessary and the remaining provisions remain in full force.
4. ViHAT's failure or delay in exercising any right under these Terms does not constitute a waiver of that right.
5. You may not assign your rights and obligations under these Terms without ViHAT's written consent. ViHAT may assign them to an affiliate or a successor to the business of the Service, with notice to you.
6. These Terms, together with the Privacy Policy and any specific conditions agreed in writing between you and ViHAT (if any, for example when assigning Tier 3), constitute the entire agreement between you and ViHAT regarding the Service. If the Vietnamese and English versions differ, the Vietnamese version prevails.

15. Contact

• Operator: VIHAT TECHNOLOGY COMPANY LIMITED (Công ty TNHH Công nghệ ViHAT)
• Tax ID: 0312577096
• Address: 140-142 Street 2, Van Phuc 1 Residential Area, Hiep Binh Ward, Ho Chi Minh City
• Hotline: +84 901 888 484
• Email: mktvh@vihatgroup.com (subject line "eOTP")

Effective date: 10 November 2026 · Version: 2.0