←Home/Docs
⌕

Privacy Policy

Tiếng Việt · Bản tiếng Việt

Last updated: 2026-11-02.

This Privacy Policy describes what personal data HABIFY COMPANY LIMITED (CÔNG TY TNHH HABIFY, Enterprise Code 0319523808, registered office: 251D/4 Luu Huu Phuoc, Phu Dinh Ward, Ho Chi Minh City, Vietnam; phone: 0367 465 952; email: crawlpipe@habifyhub.com) ("we", "us", "our"), the operator of CrawlPipe, collects through the CrawlPipe web portal, REST API, and MCP server (the "Service"), why we process it, where it is stored, and how you can exercise your rights under Vietnam's Personal Data Protection Law No. 91/2025/QH15 ("PDPL 91/2025") and Decree No. 356/2025/NĐ-CP.

1. Data Controller

CÔNG TY TNHH HABIFY (Enterprise Code 0319523808) is the Personal Data Controller and Processor for account, billing, and usage data collected on crawlpipe.com and api.crawlpipe.com.

2. What we collect

  • Account data. When you sign in via Habify Account (OIDC + PKCE) or register an account, we store your email address, display name, Habify Account identifier (hub_user_id), password hash (never your plaintext password), and your organization membership(s) and role (owner/admin/member).
  • API keys. Keys are generated in the format cp_live_…. We store only a SHA-256 hash of each key, never the key itself — the full key is shown to you exactly once at creation and cannot be recovered or displayed again afterward.
  • Usage, billing and VAT e-invoice data. Every metered API/MCP request generates a usage_event row (endpoint, unit cost, HTTP status, timestamp) and rolls up into monthly usage counters used for quota enforcement and billing. When you request a Vietnamese VAT e-invoice, we store buyer details (buyer name, company name, tax code, address, invoice email).
  • Query telemetry. We separately record telemetry about which endpoints and query shapes are used (see Section 4 below).
  • Webhook configuration. If you configure a webhook, we store the target URL you supply and the signing secret we generate for it, so we can deliver HMAC-signed event payloads to that URL.
  • Support correspondence. Tickets submitted via https://support.habifyhub.com or emails sent to crawlpipe@habifyhub.com are retained to respond to and resolve your request.

3. Why we collect it (purpose and legal basis)

We process this data based on your consent, performance of our service contract with you, and compliance with statutory accounting/tax obligations in order to:

  • Operate your account, authenticate Habify Account SSO sessions, and verify API/MCP requests;
  • Meter and bill usage against your plan, process payments, and issue electronic VAT invoices;
  • Detect and prevent abuse of quotas, rate limits, and metering;
  • Deliver webhook notifications and transactional emails about your account, quota alerts, and billing lifecycle;
  • Understand aggregate usage patterns to improve corpus coverage and system performance.

We do not sell personal data, and we do not use your account or usage data for third-party behavioral advertising.

4. Query telemetry — pseudonymized, not anonymous

To understand how the API and MCP server are actually used, we retain telemetry for each query: the endpoint called, normalized request parameters, the caller's plan, response latency, and result count. To identify repeat callers without storing your API key or account identifier directly in this telemetry table, we compute a caller hash using sha256 salted with a value that rotates monthly (telemetry_query.caller_hash). This lets us tell "the same caller queried X twice this month" apart from "two different callers each queried X once," and lets us see usage trends across months without a single persistent identifier following a caller indefinitely.

We want to be direct about what this means: this is pseudonymization, not anonymization. A monthly-salted hash of a caller identifier is not the same as removing the ability to distinguish callers — it is a technique to limit unnecessary correlation and reduce the sensitivity of the retained data, not a claim that the telemetry is impossible to link back to an account. If required (for example, in response to a verified data subject request or a legal obligation), we can correlate a given month's caller hash back to the account that generated it, because we control the salt and the hashing process.

5. Payment processing (VNPay, MoMo, ZaloPay, VietQR/PayOS & PayPal)

  • Domestic Vietnam payments (VND): Processed through licensed payment intermediaries (VietQR/PayOS, VNPay, MoMo, ZaloPay) via Habify payment-service, with electronic VAT invoices issued via invoice-service (Viettel S-Invoice).
  • International payments (USD): Recurring subscriptions are processed by PayPal. When you subscribe, PayPal collects and processes the card, bank, or PayPal account details required to run the subscription.
  • No card storage: CrawlPipe does not receive, process, or store your card numbers, CVV, or bank account login details — we receive only transaction/subscription status, identifiers, and billing lifecycle events (activated, past due, cancelled) via signed webhooks to keep your plan and quota in sync.

6. Cookies

The portal sets functional cookies required for authentication and security: dp_session (your signed-in session), locale preference, and a CSRF protection cookie used to validate state-changing form/API submissions from the portal. Both are strictly functional — required for the portal to work — and neither is used for advertising, cross-site tracking, or third-party analytics. We do not load third-party advertising cookies on the portal.

7. Server infrastructure, Vietnam data residency and cross-border data transfer

CrawlPipe operates a dual-region storage architecture designed to ensure both high availability and full compliance with Vietnamese cybersecurity and data protection laws:

  • Primary Application & Database Server (Singapore): Hosted at Contabo GmbH (Singapore data center, IP 217.216.34.96), running the CrawlPipe portal, FastAPI service, worker pipeline, primary PostgreSQL 18 cluster, and shared Habify core services.
  • Vietnam Replica & Backup Server (Vietnam Data Residency): Hosted in Vietnam at CÔNG TY TNHH CÔNG NGHỆ TDCLOUD (Tax Code 6001787246, server IP 160.187.228.182, VAT e-Invoice series 1C26TYY No. 00000312 dated 23/10/2026). Every change to the PostgreSQL database (user accounts, organizations, API key hashes, usage events, billing records, e-invoices, and support logs) is continuously replicated in real time (streaming replication over an encrypted SSH tunnel) and backed up daily to the server in Vietnam, fulfilling Article 26 of the 2018 Cybersecurity Law and Article 26 of Decree 53/2022/NĐ-CP.
  • Sub-processors outside Vietnam:
    • Contabo GmbH (Singapore): Primary compute and database hosting.
    • PayPal: International USD subscription processing.
    • Amazon Web Services — Amazon SES (Singapore): Delivery of transactional account and billing emails via email-service.
    • Alibaba Cloud (Singapore): LLM inference via ai-gateway for AI Legal Q&A queries (receives only the legal question and public law snippets, never your account credentials or billing details).
  • Domestic sub-processors in Vietnam: TDCLOUD (Vietnam replica server), VNPay, MoMo, ZaloPay, PayOS (VND payment gateways), and Viettel S-Invoice (electronic VAT invoicing).

In accordance with Article 20 of the Personal Data Protection Law No. 91/2025/QH15 and Decree No. 356/2025/NĐ-CP, CÔNG TY TNHH HABIFY is responsible for preparing and submitting the Cross-Border Personal Data Transfer Impact Assessment Dossier to the Department of Cybersecurity and High-Tech Crime Prevention (A05 — Ministry of Public Security) within 60 days from the commencement of processing/transfer, and requires all sub-processors to maintain confidentiality and technical safeguards.

8. Corpus exclusion of documents naming individuals

Separately from account/personal data above: our legal and bidding corpus pipeline is filtered so that văn bản cá biệt (individual/case-specific administrative decisions that name private individuals — e.g., a decision addressed to one named private citizen) are excluded from ingestion. This filter exists specifically to keep the legal corpus limited to normative legal documents of general application and to avoid processing personal data about private individuals through the corpus pipeline. If you believe a document naming an individual has nonetheless been ingested, please report it to crawlpipe@habifyhub.com so we can investigate and remove it within 72 hours.

9. Retention and deletion

Account, key, usage, and webhook data are retained for as long as your organization exists. Deleting an organization (available to owners from Settings) immediately revokes and removes its API keys, removes its webhooks, and removes its pending invites and members. Accounting vouchers, payment records, and issued electronic VAT invoices are retained for the statutory minimum period of 10 years under Vietnamese Law on Accounting and Tax Administration in anonymized form after account deletion. Query telemetry rows are identified only by the monthly-salted caller hash described in Section 4.

10. PDPL 91/2025 — your rights and how to exercise them

Under Vietnam's Personal Data Protection Law (91/2025/QH15), in force from 1 January 2026, you have 11 statutory rights over your personal data: (1) right to be informed; (2) right to consent; (3) right to access and view; (4) right to withdraw consent; (5) right to request deletion; (6) right to restrict processing; (7) right to request data provision; (8) right to object to processing; (9) right to complain, denounce, or file a lawsuit; (10) right to claim damages; and (11) right to self-protection.

You can exercise these rights at any time free of charge via your account settings, through https://support.habifyhub.com, or by emailing crawlpipe@habifyhub.com from your registered email address. We verify and respond to valid requests within 72 hours as required by law.

11. Security measures and breach notification

We apply strict technical and organizational controls: API keys are stored only as SHA-256 hashes; webhook payloads are signed with HMAC-SHA256; all traffic is encrypted over HTTPS/TLS; database replication uses encrypted SSH tunnels; and internal administrative access is role-restricted and audit-logged. If a personal data breach occurs that may affect your legitimate rights, we will take immediate containment measures, notify Department A05 — Ministry of Public Security within 72 hours, and notify affected users by email.

12. Contact and complaints

Questions, data subject requests, or complaints about this Privacy Policy can be sent to:

Privacy Policy — CrawlPipe Docs