Privacy Policy

DVRK ("DVRK," "we," "us") operates dvrk.com and the DVRK commerce platform, a multi-tenant service that lets merchants in Vietnam run online stores, manage orders and customers, and — where a merchant chooses to connect one — launch and manage advertising campaigns on third-party platforms such as TikTok, Meta (Facebook/Instagram), and Google Ads. This policy explains what data we collect, how we use it, and the choices you have.

This policy applies to DVRK's own operation of the platform. Each merchant using DVRK is separately responsible, as the data controller for their own store, for how they collect and use their customers' personal data — DVRK acts as the technology provider and processor on the merchant's behalf.

• Account data. When you sign up as a merchant, we collect your name, email address, and phone number, and store credentials needed to authenticate you.
• Store operational data. Merchants store data about their own customers and orders on the platform, including customer name, email, phone, shipping address, and order/purchase history.
• Contact form submissions. If you contact us through dvrk.com, we collect your name, email, phone (optional), message, and technical metadata (IP address, browser user agent) to respond and prevent abuse.
• Third-party integration credentials. If a merchant chooses to connect a third-party service — including ad platforms (TikTok Marketing API, Meta Marketing API, Google Ads API), payment providers, or shipping carriers — we store the resulting access tokens/credentials encrypted at rest (AES-256-GCM). These credentials are used only to act on that merchant's behalf, on that merchant's own connected account.
• Usage and session data. We use session cookies to keep you signed in and to remember which store you are operating. We do not use third-party advertising cookies on dvrk.com itself.

• To operate, maintain, and secure the platform.
• To carry out actions a merchant explicitly requests — for example, generating and launching an ad campaign on a connected ad account, or fetching performance reporting for that campaign.
• To respond to support and contact requests.
• To detect, prevent, and investigate fraud, abuse, and security incidents.
• To comply with legal obligations under Vietnamese law.

We do not sell personal data, and we do not share one merchant's data with another merchant. Data is shared with a third-party platform only when a merchant explicitly connects that integration — for example, when a merchant authorizes DVRK to manage ads on their own TikTok Ads, Meta Ads, or Google Ads account via OAuth. In that case, the relevant campaign, creative, and reporting data flows between DVRK and that merchant's own account on the third-party platform, governed by that platform's own privacy policy and terms. We also rely on infrastructure providers (cloud hosting and database providers) to operate the platform; they process data solely to provide that infrastructure to us.

Third-party integration credentials are encrypted at rest and are never returned to the browser or displayed in plaintext after they are saved. Access to merchant and customer data within the platform is scoped per store. No method of storage or transmission is completely secure, and we cannot guarantee absolute security.

We retain account and store data for as long as the account is active, and for a reasonable period afterward as needed for legal, accounting, or fraud-prevention purposes. You can request deletion of your data at any time — see our Data Deletion Instructions.

Under Vietnam's Law on Personal Data Protection (Law No. 91/2025/QH15, in effect since January 1, 2026) and its implementing decree, you have the right to access, correct, and request deletion of your personal data, to restrict or object to certain processing, to data portability, and to withdraw consent where processing is based on consent. To exercise any of these rights, contact us using the details below.

Some of the infrastructure and third-party platforms we rely on (cloud hosting, database hosting, and connected ad platforms) may process data outside Vietnam. Where this occurs, it is necessary to provide the service you have requested.

DVRK is a business platform and is not directed at, or knowingly used to collect data from, children.

We may update this policy from time to time. Material changes will be reflected by updating the "Last updated" date above.

For any questions about this policy, or to exercise your data rights, contact us at hello@dvrk.com.