Privacy policy

cdn.vapp.vn and the services under the vappcdn.com domain (DNS, asset CDN, image proxy, email relay) are run by ERPFIT CO., LTD (tax code 0317567782, Ho Chi Minh City). ERPFIT is the controller of dashboard users' personal data, and processes on the customer's behalf the data customers put into the services (DNS records, mail sent through the relay).

Contact for personal data: postmaster@vappcdn.com.

• Account (name, email, hashed password; or name, email and avatar from Google if you sign in with Google): to provide the dashboard. Basis: performance of the service agreement.
• Sign-in sessions (IP address, browser) and an activity log (who changed what, when): to keep accounts safe and changes traceable. Basis: performance of the agreement and system security.
• Data you put into the services: DNS records (public by the nature of DNS — do not put personal data there unless you mean to publish it), image and asset configuration, and mail sent through the relay (sender and recipient addresses, content while in transit). We process it on your instructions, only to provide the service.
• Technical logs (IP address, the name or URL requested, time) when anyone uses the DNS, CDN or image proxy: to operate the services, prevent abuse and handle incidents. Basis: system security.
• The DNS lookup box on the DNS service page: the domain you type is sent to Google's public resolver (dns.google) to get the answer. We do not store that domain.

This site uses no analytics and no advertising cookies. The dashboard sets one sign-in session cookie. We do not process sensitive personal data and do not sell personal data.

The service's servers are currently outside Vietnam. The personal data above is transferred to and stored at:

• OVH (OVHcloud) — Singapore: the account database, the primary DNS server, the CDN and the image proxy.
• OVH (OVHcloud) — Sydney, Australia: the secondary DNS servers and the email relay.
• Hetzner — Falkenstein, Germany: encrypted backups.
• Cloudflare, Inc.: delivers cdn.vapp.vn (traffic passes through Cloudflare's global network).
• Google LLC: Sign in with Google (if you choose it) and the resolver behind the DNS lookup box.

Authorities receive data only when the law requires it.

• Account and service configuration: while you use the service; deleted within 30 days of a request to close the account, except data the law requires us to keep.
• Sign-in sessions, the activity log and technical logs: at most 12 months.
• Mail through the relay: in the queue until it is delivered or bounced; mailboxes are managed by the customer.
• Backups: at most 12 months.

You have the right to be informed, to give or withdraw consent, and to access, correct, delete, restrict or object to the processing of your personal data, to receive a copy of it, and to complain, under the 2025 Personal Data Protection Law.

Send requests to postmaster@vappcdn.com from your account's email address. We confirm within 2 working days; if the law allows more time and we need it, we tell you why.

Connections use HTTPS, passwords are hashed, and backups are encrypted before they leave the server. No system is perfectly secure.

If personal data is breached, we notify the competent authority within 72 hours and notify the people affected where the law requires.

A new version is posted on this page with its date. A change of purpose that needs consent will be asked for again.