Privacy Policy

1. Data we collect

Account: name, email, phone number, role (customer/garage/supplier), password (stored only as a one-way hash).

Business (garages/suppliers): company name, country, address, tax code, contact person and phone, logo.

Business activity: products, prices, stock, product photos, quote requests, quotes, orders, messages, import requests.

Garage vehicles and customers (when a garage uses the software): plate, make, model, year, VIN, repair history, customer names and phone numbers entered by the garage.

Technical: IP address, device, browser, access and error logs; location only with your permission.

Proof of consent: when you agreed to the Terms and this Policy, and the policy version.

2. Purposes and legal basis

Creating and managing accounts, verifying businesses, approving access — basis: your consent and performance of the service contract.

Operating the service: product listings, parts search, quotes, orders, messages, import cost estimates.

Sending account and transaction notifications (in-app, email, push).

Security, fraud prevention, troubleshooting and service improvement.

Legal obligations (accounting, tax, lawful requests from state authorities).

We do NOT sell personal data and do NOT use it for third-party advertising.

3. Who can see your data

Trading partners: business details and transaction content are shared with the garages/suppliers you send requests, quotes or orders to.

Korean suppliers: their name and supply price are not shown to Vietnamese businesses, which only see product information and WEVIKO's estimated price.

WEVIKO administrators: only as needed for approval, support and operation.

Competent state authorities: upon lawful request.

4. Processors (service providers)

Supabase — database, sign-in, photo storage; servers in Singapore.

Vercel — website hosting; processed in Singapore, content delivered over a global network.

Resend (email), Sentry (error monitoring), Vercel Analytics (cookieless visit statistics), Firebase Cloud Messaging (push notifications) — may process data outside Vietnam.

Anthropic, Google Gemini — only when you use AI-assisted features; the content you submit is processed to return a result.

VNPay — when you make a payment; only the necessary transaction data.

5. Storage location and cross-border transfer

Platform data is currently stored on Supabase servers in Singapore. Some processors in section 4 may process data in other countries.

By signing up you consent to this cross-border transfer. WEVIKO applies safeguards (encryption, access control) and completes the filings with the competent authority required by law.

If the storage location changes, we will update this policy and notify you.

6. Korean suppliers — data transferred from Korea

Items: company name, contact person name, email, phone number, address.

Destination and method: Vietnam (WEVIKO) and Singapore (servers); transferred over encrypted connections when you sign up and use the service.

Recipient: CÔNG TY TNHH TM XUẤT NHẬP KHẨU WEVIKO — privacy@weviko.com.

Purpose: supplier verification, product listings, receiving import requests and quotes.

Retention: as in section 8.

You may refuse; you then cannot register as a Korean supplier.

7. Security

Encryption in transit (TLS) and at rest; per-business access control (Row Level Security) — a business cannot see another business's data.

Passwords are one-way hashed (bcrypt) and never stored in readable form.

In the event of a data breach, we notify the competent authority and affected people within the time limits set by law.

8. Retention

Data is kept while your account is active and for up to 12 months after account deletion; accounting and tax records are kept for the period required by law.

9. Your rights

To be informed about processing; to give or withdraw consent.

To access, correct and request deletion of data; to restrict or object to processing; to receive a copy of your data.

To complain, denounce, sue and claim compensation as provided by law.

Withdrawing consent does not affect processing already carried out; if you withdraw consent needed for the service, your account may no longer be usable.

Send requests to privacy@weviko.com — we respond within the time limits set by law.

10. Cookies

Session cookies (required for the service) and a language cookie (wv-locale).

We do NOT use third-party advertising cookies.

11. Children

WEVIKO services are not intended for people under 16. We do not knowingly collect children's data.

12. Changes to this policy

We post updates on this page and notify you by email before they take effect. If the purposes of processing change, we will ask for your consent again.