Privacy Policy

1. Scope and legal basis

We process personal data in line with Decree 13/2023/ND-CP on personal data protection and other applicable Vietnamese law.

We process data based on your consent and on the necessity of delivering the service you request. You may withdraw consent at any time; withdrawal does not affect the lawfulness of processing carried out before it.

2. Data we collect

• Account data: email, full name, profile picture and identifier supplied by Google when you sign in with Google; passwords are stored as a hash.
• Location data: GPS coordinates captured at the moment you verify a survey plot.
• Survey data: species, diameter, tree count, plot area, notes, project names and any other information you choose to enter.
• Technical data: device type, app version, error logs and access times.

3. Why we process it

• To provide survey, calculation, storage and report export features.
• To synchronise data between the web app and the Zalo Mini App when you are signed in.
• To support users, fix incidents and improve service quality.
• To protect the system, detect abuse and meet legal obligations.

4. Location data

GPS coordinates are captured only when you actively verify the plot location. The platform does not track your location continuously in the background.

If you decline the location permission, you can still use the calculator but cannot verify plot coordinates.

5. Data stored on your device

The app stores your sign-in token, survey drafts, the offline species catalogue and your language choice on your device. This data is cleared when you sign out or clear app data.

6. Sharing with third parties

We do not sell, rent or trade your personal data to anyone for commercial purposes.

• Google: sign-in verification when you choose to sign in with Google.
• Zalo: the Mini App distribution platform. We do not store Zalo user identifiers; when you revoke consent inside Zalo, our system records the notice and stops processing data through the Mini App.
• Infrastructure and technical service providers that keep the system running.

7. Retention

Account and survey data are retained while your account is active, or until you ask us to delete them.

Technical logs are kept only as long as needed for operations and security.

8. Security

Passwords are hashed with bcrypt, sessions use time-limited JWTs, traffic is encrypted with HTTPS and access is role-based.

No system is perfectly secure. If an incident affects your data, we will notify you as required by law.

9. Your rights

Send requests to [email protected]; we respond within the period required by law.

• Access, review and request a copy of your personal data.
• Correct inaccurate information.
• Request deletion of your data or your account.
• Withdraw consent, object to or restrict processing.
• Lodge a complaint with a competent authority if your rights are infringed.

10. Children

The platform is intended for people aged 16 and over. We do not knowingly collect data from children under 16; if we learn we have, we will delete it.

11. Storage and transfers

Data is stored on servers of the infrastructure providers CarbonTrack uses; those servers may be located in Vietnam or abroad. In that case we apply appropriate safeguards required by law.

12. Changes to this policy

This policy may be updated; the update date appears at the top of this page. Significant changes will be announced on the platform.

13. Contact

Email: [email protected]. Technical support: [email protected]. Address: Can Tho, Vietnam.