Privacy Policy

Effective: 10 October 2026

1. Introduction

ViRFQ (virfq.com) is a platform that helps Vietnamese agricultural exporters ("Sellers") find and manage international buyers ("Buyers") through customs data, a Request for Quotation (RFQ) system and WhatsApp buyer care. This Privacy Policy explains how we collect, use, share, and protect information when you use our platform.

The data controller is VIRFQ Technology Solutions JSC(Công ty Cổ phần Giải pháp Công nghệ VIRFQ, tax code 0111373222), 1st and 2nd Floor, Building A3, Thanh Pho Xanh Urban Functional Area Project - Vinhome Gardenia, Ham Nghi Street, Tu Liem Ward, Hanoi, Vietnam. We process personal data in accordance with Vietnam's Law on Personal Data Protection (2025) and Decree 356/2025/NĐ-CP, and — for users in the EU/UK — the GDPR where it applies.

By using ViRFQ, you agree to the terms in this Privacy Policy. Please read carefully before providing any personal information.

2. Data Collection

2.1. Information You Provide

We collect information when you:

Register a Seller or Buyer account: Email, password, full name, phone number, company name, account type
Sign in with a one-time code: the code sent to your email and the time it was used
Are invited as a staff member by an account owner: name, email and the workspace you belong to
Build a company profile: Address, country, business sector, verification documents (business registration certificate, export proof)
Submit an RFQ as a Buyer: Name, email, phone number, WhatsApp, company name, country, and quotation request details
Chat with a Seller's connected WhatsApp number: your phone number and message content (see Section 5)
Make payments: Transaction and payment history (card details stay with Stripe / your bank)
Contact support, book a consultation or file a complaint: Message content, feedback
Register for a consultation: full name, phone number, email (if provided), and the topic you are interested in

2.2. Automatically Collected Information

IP address and device information
Browser type and operating system
Pages visited and access times
Usage behavior on the platform (via analytics and marketing tools, see Section 9)
ViRFQ Seller mobile app: a record of each signed-in installation (platform, device name, app version, last use) and, if you allow notifications, a push token. The push token is removed once our server confirms your sign-out or the installation is revoked; if you sign out while offline or our service is unavailable, the request is kept and retried, and the token may remain until it succeeds. The rest of the record is kept, marked as signed out, until you delete your account; an installation you stop using without signing out keeps receiving notifications until its session expires (60 days after it last connected) or is revoked (for example when you change your password), and keeps its record and push token until you delete your account.

3. Data Usage

We use your information to:

Provide and maintain our services, including matching Buyer RFQs with relevant Sellers
Verify identity, review verification documents, and secure your account
Send notifications about relevant RFQs in your industry
Process payments and manage Seller subscriptions and contact unlocks
Improve and develop our products
Provide customer support
Keep the Platform safe and review reports of abusive, fraudulent or spam content (see section 5)
Send marketing emails (you can unsubscribe)
Analyze trends and statistics

5. WhatsApp Business Messaging

ViRFQ offers Sellers an optional inbox connected to the WhatsApp Business Platform. When a Seller enables this feature for their WhatsApp business number, messages exchanged with that number are processed as follows:

Message processing:Inbound and outbound messages (text, images, stickers, voice messages, videos, documents, locations and contact cards, and related metadata such as phone numbers, timestamps, and delivery statuses) are transmitted through Meta's WhatsApp Business Platform and stored on our infrastructure so the Seller can read and answer them from their ViRFQ dashboard.
Messages sent on the Seller's behalf: Replies from a connected number may be written by the Seller or generated automatically by an AI assistant configured by the Seller. Automated replies are restricted to information the Seller has provided and are subject to safeguards the Seller controls.
Right to a human: If you are chatting with a connected number, you can request a human at any time; automated replies then stop for that conversation until the Seller responds personally.
AI processing and translation:Message content may be processed by Anthropic (Claude, to draft automated replies — inputs and outputs are kept for up to 30 days for abuse monitoring and are not used for training), OpenAI (to check incoming text, images, stickers and buyer profile names for sexual, violent, hateful, harassing and self-harm content) and Cloudflare Workers AI (to translate messages) acting as data processors. A flagged message or image is covered until the Seller taps to view it, and a flagged profile name is replaced by the phone number. The check is best effort: it can miss content, does not look for spam, scams, phishing links or malware, and does not cover voice messages, videos, documents, locations or contact cards. Under these providers' API terms, message content is not used to train their models.
Blocking and reporting:A block stores the buyer's WhatsApp number, which account blocked them and the time. A report also stores the reason, the optional note and which account reported. When a report is filed, authorised ViRFQ staff read the reported conversation, including its attachments, to review it. When a company account owner is deleted, the company's blocked-buyer list is deleted and the notes on its reports are removed; the report records themselves (buyer number, reason, time) are kept for up to 24 months from when the report was filed, then deleted automatically. When a staff member is deleted, the company's reports, notes and blocks stay with the company, attributed to the account owner.
Conversation storage:Conversation history is retained while the Seller's inbox remains active so both sides keep context. You may request access to or deletion of your messages via the contact section below.

WhatsApp itself is operated by Meta Platforms, Inc. and governed by Meta's own terms and privacy policy in addition to this policy.

6. Meta Advertising and Facebook Page Data

Sellers may optionally connect their own Meta (Facebook) ad account to ViRFQ so their advertising results appear inside the ViRFQ dashboard. This connection is entirely opt-in and can be revoked at any time.

Basic connection: ads_read only — a READ-ONLY permission. With it ViRFQ cannot create, edit, pause or spend on your campaigns. ViRFQ never has access to your payment methods.
Optional management mode: if you separately choose to let ViRFQ manage your ads and Facebook Page, we additionally request ads_management, pages_show_list, pages_read_engagement, read_insights, pages_manage_posts and pages_manage_ads. ViRFQ then acts ONLY on the ad accounts and Pages you select and ONLY when you ask it to: pause or resume a campaign, change its daily budget, create an ad for your Page (always created paused — it spends nothing until you switch it on), and publish, schedule, edit or delete a Page post. Any change that could raise spending is refused unless it fits under the daily spend ceiling you set for that ad account.
What we read: the list of ad accounts you own or manage (id, name, currency, timezone, status), your campaigns (id, name, status), and daily performance metrics for the last 30 days (spend, impressions, clicks). We do not read Lead Ads form data, audiences, or any personal data about the people who saw your ads.
What we store: the metrics above, in aggregate form per account, campaign, and day, so the dashboard can render trends without re-querying Meta on every page view. Your access token is encrypted at rest (AES-256-GCM) and is never exposed to a browser, log, or any third party. In management mode we also store the Pages you selected (id, name, picture, your role on the Page) and a history of every change ViRFQ made on your behalf; we do not store Page access tokens, and Page posts and their metrics are read live from Meta, not copied.
Why: the sole purpose is to show a Seller their own advertising performance next to the leads those ads produced on ViRFQ. We never use this data for profiling, never share it with other Sellers, and never sell it.
Disconnecting and deletion: click Disconnect on the Ads tab of your dashboard. ViRFQ then revokes every advertising and Page permission listed above with Meta (never your WhatsApp permissions), deletes the stored token immediately, and removes the synced metrics and your selected Pages. The history of changes ViRFQ made on your behalf is kept as an audit record and deleted on request. You may also revoke access at any time from Facebook Settings → Business Integrations, or request full deletion via the contact section below.

7. Data Security

We apply industry-standard security measures to protect your data:

SSL/TLS encryption for all connections
Password encryption using bcrypt algorithm (custom authentication, not third-party login)
Verification documents (business registration, export proof) stored in a private Cloudflare R2 bucket, accessible only to the document owner and admin through an authenticated proxy
Public images (product and company photos) served via CDN; no personal documents are exposed publicly
Continuous error and intrusion monitoring via Sentry
Regular data backups
Periodic security review

8. Your Rights

You have the following rights regarding your personal data:

Right to access: Request a copy of your data
Right to rectification: Update inaccurate information
Right to erasure: Request account and data deletion (how to delete your account)
Right to object: Refuse processing for marketing purposes
Right to portability: Receive data in a transferable format
Right to withdraw consent: Withdraw consent you have given at any time, without affecting processing already carried out
Right to complain: Lodge a complaint with the competent data protection authority

If you have an account: update your information directly in the dashboard (Profile / Account settings), or email contact@virfq.comfrom your registered address with the subject "Personal data request".

If you do not have an account (you only booked a service consultation or submitted an RFQ): send your request from the same email or phone number you provided to contact@virfq.com or hotline +84 866 696 212 (Mon–Fri, 9:00–18:00); we verify you by contacting you back at that same email or phone number before we access, correct or delete your data.

We may ask for additional identity verification. We acknowledge every valid request within 2 working days and carry it out within 20 days (30 days where a third-party processor must be involved); if the request is unusually complex we may extend once, as the law allows, and will tell you why. Buyer contact details that a Seller has already unlocked may remain in that Seller's own records; we will ask Sellers to stop using them when you request deletion.

Complaints about personal data

If you believe your personal data has been collected or used for the wrong purpose, you can complain through: email to contact@virfq.com with the subject "Personal data complaint", hotline +84 866 696 212 (Mon–Fri, 9:00–18:00), or the form on our Complaint page. We acknowledge every complaint within 2 working days and handle it within the timelines above. You have the right to complain to the competent state authority on personal data protection if you are not satisfied with how ViRFQ resolves it. ViRFQ never sells or rents your personal data to any party.

9. Cookies and Tracking

9.1. Cookies and Tools We Use

Essential cookies: To maintain login sessions and remember your language
Analytics: Google Analytics (GA4), Microsoft Clarity and Ahrefs Analytics to understand how the site is used; Sentry to capture errors
Marketing/advertising: Meta Pixel, the Meta Conversions API (server-side) and Google Ads conversion tracking, to measure advertising effectiveness. When you register, submit a contact, consultation or RFQ form, view or search RFQs while signed in, start a checkout or complete a payment, we send Meta a server-side event through the Conversions API. Such an event can contain hashed identifiers (email, phone number, account ID, country), your IP address and browser user-agent, Meta's click and browser identifiers (the _fbc and _fbp cookies) when present, and event details such as the form or product category, product name, RFQ or listing reference, search text, plan, payment method and amount paid

9.2. Managing Cookies

You can refuse cookies through your browser settings. However, some features may not work properly if cookies are disabled.

Blocking cookies does not stop server-side advertising events. You can ask us about or object to this processing at contact@virfq.com.

For the full list of cookies and measurement tools we use, see our Cookie Policy.

10. Data Storage

Your data is stored with our infrastructure providers (Neon for the database, Cloudflare for file storage, Vercel for hosting) and protected according to industry-standard access controls.

We keep account and profile data while your account is active. If you simply stop using ViRFQ, or close your account without asking for erasure, we delete or anonymise your data as a routine matter within 90 days of closure. If you exercise your right to erasure, the shorter statutory deadlines in Section 8 apply instead. In both cases we keep only what is still needed for the purposes above or what the law requires us to keep longer: payment and invoice records (up to 10 years under Vietnamese accounting law), records needed to resolve disputes or comply with legal requests, records of abuse reports (buyer number, reason, time; up to 24 months from filing), and security logs (up to 12 months). Aggregated statistics that cannot identify you may be kept indefinitely.

People without an account(service consultation bookings, RFQs submitted without an account): we keep your information until you ask us to delete it, since there is no "account closure" event to start the 90-day clock above.

11. Policy Changes

We may update this Privacy Policy periodically. Any significant changes will be notified via email or platform notification at least 7 days before taking effect.

You should check this page regularly for the latest information.

12. Data controller

If you have questions about this Privacy Policy, please contact:

Company: VIRFQ Technology Solutions Joint Stock Company (Công ty Cổ phần Giải pháp Công nghệ VIRFQ)
Enterprise / tax code: 0111373222
Issued on: 30/01/2026 (first registration); amendment no. 1 on 15/09/2026
Issued by: Business Registration and Corporate Finance Office – Hanoi Department of Finance
Registered office: Floors 1 and 2, Commercial Unit SO15, Apartment Building CT03 (A3), Thanh Pho Xanh Urban Functional Area Project – Vinhome Gardenia, Ham Nghi Street, Tu Liem Ward, Hanoi, Vietnam
Phone: +84 866 696 212
Email: contact@virfq.com
Website: virfq.com
Working hours: Monday – Friday, 9:00 – 18:00 (GMT+7)

Effective: 10 October 2026

1. Introduction

By using ViRFQ, you agree to the terms in this Privacy Policy. Please read carefully before providing any personal information.

2. Data Collection

2.1. Information You Provide

We collect information when you:

Register a Seller or Buyer account: Email, password, full name, phone number, company name, account type
Sign in with a one-time code: the code sent to your email and the time it was used
Are invited as a staff member by an account owner: name, email and the workspace you belong to
Build a company profile: Address, country, business sector, verification documents (business registration certificate, export proof)
Submit an RFQ as a Buyer: Name, email, phone number, WhatsApp, company name, country, and quotation request details
Chat with a Seller's connected WhatsApp number: your phone number and message content (see Section 5)
Make payments: Transaction and payment history (card details stay with Stripe / your bank)
Contact support, book a consultation or file a complaint: Message content, feedback
Register for a consultation: full name, phone number, email (if provided), and the topic you are interested in

2.2. Automatically Collected Information

IP address and device information
Browser type and operating system
Pages visited and access times
Usage behavior on the platform (via analytics and marketing tools, see Section 9)
ViRFQ Seller mobile app: a record of each signed-in installation (platform, device name, app version, last use) and, if you allow notifications, a push token. The push token is removed once our server confirms your sign-out or the installation is revoked; if you sign out while offline or our service is unavailable, the request is kept and retried, and the token may remain until it succeeds. The rest of the record is kept, marked as signed out, until you delete your account; an installation you stop using without signing out keeps receiving notifications until its session expires (60 days after it last connected) or is revoked (for example when you change your password), and keeps its record and push token until you delete your account.

3. Data Usage

We use your information to:

Provide and maintain our services, including matching Buyer RFQs with relevant Sellers
Verify identity, review verification documents, and secure your account
Send notifications about relevant RFQs in your industry
Process payments and manage Seller subscriptions and contact unlocks
Improve and develop our products
Provide customer support
Keep the Platform safe and review reports of abusive, fraudulent or spam content (see section 5)
Send marketing emails (you can unsubscribe)
Analyze trends and statistics

5. WhatsApp Business Messaging

Message processing:Inbound and outbound messages (text, images, stickers, voice messages, videos, documents, locations and contact cards, and related metadata such as phone numbers, timestamps, and delivery statuses) are transmitted through Meta's WhatsApp Business Platform and stored on our infrastructure so the Seller can read and answer them from their ViRFQ dashboard.
Messages sent on the Seller's behalf: Replies from a connected number may be written by the Seller or generated automatically by an AI assistant configured by the Seller. Automated replies are restricted to information the Seller has provided and are subject to safeguards the Seller controls.
Right to a human: If you are chatting with a connected number, you can request a human at any time; automated replies then stop for that conversation until the Seller responds personally.
AI processing and translation:Message content may be processed by Anthropic (Claude, to draft automated replies — inputs and outputs are kept for up to 30 days for abuse monitoring and are not used for training), OpenAI (to check incoming text, images, stickers and buyer profile names for sexual, violent, hateful, harassing and self-harm content) and Cloudflare Workers AI (to translate messages) acting as data processors. A flagged message or image is covered until the Seller taps to view it, and a flagged profile name is replaced by the phone number. The check is best effort: it can miss content, does not look for spam, scams, phishing links or malware, and does not cover voice messages, videos, documents, locations or contact cards. Under these providers' API terms, message content is not used to train their models.
Blocking and reporting:A block stores the buyer's WhatsApp number, which account blocked them and the time. A report also stores the reason, the optional note and which account reported. When a report is filed, authorised ViRFQ staff read the reported conversation, including its attachments, to review it. When a company account owner is deleted, the company's blocked-buyer list is deleted and the notes on its reports are removed; the report records themselves (buyer number, reason, time) are kept for up to 24 months from when the report was filed, then deleted automatically. When a staff member is deleted, the company's reports, notes and blocks stay with the company, attributed to the account owner.
Conversation storage:Conversation history is retained while the Seller's inbox remains active so both sides keep context. You may request access to or deletion of your messages via the contact section below.

WhatsApp itself is operated by Meta Platforms, Inc. and governed by Meta's own terms and privacy policy in addition to this policy.

6. Meta Advertising and Facebook Page Data

Basic connection: ads_read only — a READ-ONLY permission. With it ViRFQ cannot create, edit, pause or spend on your campaigns. ViRFQ never has access to your payment methods.
Optional management mode: if you separately choose to let ViRFQ manage your ads and Facebook Page, we additionally request ads_management, pages_show_list, pages_read_engagement, read_insights, pages_manage_posts and pages_manage_ads. ViRFQ then acts ONLY on the ad accounts and Pages you select and ONLY when you ask it to: pause or resume a campaign, change its daily budget, create an ad for your Page (always created paused — it spends nothing until you switch it on), and publish, schedule, edit or delete a Page post. Any change that could raise spending is refused unless it fits under the daily spend ceiling you set for that ad account.
What we read: the list of ad accounts you own or manage (id, name, currency, timezone, status), your campaigns (id, name, status), and daily performance metrics for the last 30 days (spend, impressions, clicks). We do not read Lead Ads form data, audiences, or any personal data about the people who saw your ads.
What we store: the metrics above, in aggregate form per account, campaign, and day, so the dashboard can render trends without re-querying Meta on every page view. Your access token is encrypted at rest (AES-256-GCM) and is never exposed to a browser, log, or any third party. In management mode we also store the Pages you selected (id, name, picture, your role on the Page) and a history of every change ViRFQ made on your behalf; we do not store Page access tokens, and Page posts and their metrics are read live from Meta, not copied.
Why: the sole purpose is to show a Seller their own advertising performance next to the leads those ads produced on ViRFQ. We never use this data for profiling, never share it with other Sellers, and never sell it.
Disconnecting and deletion: click Disconnect on the Ads tab of your dashboard. ViRFQ then revokes every advertising and Page permission listed above with Meta (never your WhatsApp permissions), deletes the stored token immediately, and removes the synced metrics and your selected Pages. The history of changes ViRFQ made on your behalf is kept as an audit record and deleted on request. You may also revoke access at any time from Facebook Settings → Business Integrations, or request full deletion via the contact section below.

7. Data Security

We apply industry-standard security measures to protect your data:

SSL/TLS encryption for all connections
Password encryption using bcrypt algorithm (custom authentication, not third-party login)
Verification documents (business registration, export proof) stored in a private Cloudflare R2 bucket, accessible only to the document owner and admin through an authenticated proxy
Public images (product and company photos) served via CDN; no personal documents are exposed publicly
Continuous error and intrusion monitoring via Sentry
Regular data backups
Periodic security review

8. Your Rights

You have the following rights regarding your personal data:

Right to access: Request a copy of your data
Right to rectification: Update inaccurate information
Right to erasure: Request account and data deletion (how to delete your account)
Right to object: Refuse processing for marketing purposes
Right to portability: Receive data in a transferable format
Right to withdraw consent: Withdraw consent you have given at any time, without affecting processing already carried out
Right to complain: Lodge a complaint with the competent data protection authority

Complaints about personal data

9. Cookies and Tracking

9.1. Cookies and Tools We Use

Essential cookies: To maintain login sessions and remember your language
Analytics: Google Analytics (GA4), Microsoft Clarity and Ahrefs Analytics to understand how the site is used; Sentry to capture errors
Marketing/advertising: Meta Pixel, the Meta Conversions API (server-side) and Google Ads conversion tracking, to measure advertising effectiveness. When you register, submit a contact, consultation or RFQ form, view or search RFQs while signed in, start a checkout or complete a payment, we send Meta a server-side event through the Conversions API. Such an event can contain hashed identifiers (email, phone number, account ID, country), your IP address and browser user-agent, Meta's click and browser identifiers (the _fbc and _fbp cookies) when present, and event details such as the form or product category, product name, RFQ or listing reference, search text, plan, payment method and amount paid

9.2. Managing Cookies

You can refuse cookies through your browser settings. However, some features may not work properly if cookies are disabled.

Blocking cookies does not stop server-side advertising events. You can ask us about or object to this processing at contact@virfq.com.

For the full list of cookies and measurement tools we use, see our Cookie Policy.

10. Data Storage

Your data is stored with our infrastructure providers (Neon for the database, Cloudflare for file storage, Vercel for hosting) and protected according to industry-standard access controls.

11. Policy Changes

We may update this Privacy Policy periodically. Any significant changes will be notified via email or platform notification at least 7 days before taking effect.

You should check this page regularly for the latest information.

12. Data controller

If you have questions about this Privacy Policy, please contact:

Company: VIRFQ Technology Solutions Joint Stock Company (Công ty Cổ phần Giải pháp Công nghệ VIRFQ)
Enterprise / tax code: 0111373222
Issued on: 30/01/2026 (first registration); amendment no. 1 on 15/09/2026
Issued by: Business Registration and Corporate Finance Office – Hanoi Department of Finance
Registered office: Floors 1 and 2, Commercial Unit SO15, Apartment Building CT03 (A3), Thanh Pho Xanh Urban Functional Area Project – Vinhome Gardenia, Ham Nghi Street, Tu Liem Ward, Hanoi, Vietnam
Phone: +84 866 696 212
Email: contact@virfq.com
Website: virfq.com
Working hours: Monday – Friday, 9:00 – 18:00 (GMT+7)

Privacy Policy

1. Introduction

2. Data Collection

2.1. Information You Provide

2.2. Automatically Collected Information

3. Data Usage

5. WhatsApp Business Messaging

6. Meta Advertising and Facebook Page Data

7. Data Security

8. Your Rights

Complaints about personal data

9. Cookies and Tracking

9.1. Cookies and Tools We Use

9.2. Managing Cookies

10. Data Storage

11. Policy Changes

12. Data controller

Have questions about our policies?

Privacy Policy

1. Introduction

2. Data Collection

2.1. Information You Provide

2.2. Automatically Collected Information

3. Data Usage

5. WhatsApp Business Messaging

6. Meta Advertising and Facebook Page Data

7. Data Security

8. Your Rights

Complaints about personal data

9. Cookies and Tracking

9.1. Cookies and Tools We Use

9.2. Managing Cookies

10. Data Storage

11. Policy Changes

12. Data controller

Have questions about our policies?

Privacy Policy

1. Introduction

2. Data Collection

2.1. Information You Provide

2.2. Automatically Collected Information

3. Data Usage

4. Data Sharing

5. WhatsApp Business Messaging

6. Meta Advertising and Facebook Page Data

7. Data Security

8. Your Rights

Complaints about personal data

9. Cookies and Tracking

9.1. Cookies and Tools We Use

9.2. Managing Cookies

10. Data Storage

11. Policy Changes

12. Data controller

Have questions about our policies?

Privacy Policy

1. Introduction

2. Data Collection

2.1. Information You Provide

2.2. Automatically Collected Information

3. Data Usage

4. Data Sharing

5. WhatsApp Business Messaging

6. Meta Advertising and Facebook Page Data

7. Data Security

8. Your Rights

Complaints about personal data

9. Cookies and Tracking

9.1. Cookies and Tools We Use

9.2. Managing Cookies

10. Data Storage

11. Policy Changes

12. Data controller

Have questions about our policies?