- Published version
- 1.0.0
- Effective date
- 2026-09-23
1. Who we are
HOJA for Influencer (https://influencer.hoja.vn and the HOJA for Influencer mobile apps, together the "Service") is operated by CÔNG TY TNHH LN PARTNERS (tax code 0316801398, Tòa nhà Fimexco, số 231 - 233 Lê Thánh Tôn, Phường Bến Thành, Quận 1, Thành phố Hồ Chí Minh, Việt Nam) — "we" or "HOJA". We are the controller of the personal data described in this Policy.
This Policy applies to creators, KOLs and KOCs who use the Service. Brands that run campaigns on HOJA process the data they receive from you under their own responsibility and their own privacy notices; the collaboration contract is signed between you and the brand.
2. Personal data we collect
3. Sensitive personal data
Under Decree 356/2025/NĐ-CP, images of identity documents and financial data are sensitive personal data. We collect them only to prepare and perform a collaboration contract and to meet tax and accounting obligations, and only after you give separate, explicit consent on the contract information screen. We tell you there that the data is sensitive.
- Citizen ID numbers, tax codes, addresses and bank account numbers are encrypted at rest (AES-256-GCM); lists show masked values only (for example ••••7580).
- The original values are decrypted only when a contract is issued, and each access is logged.
- You can withdraw this consent at any time on the Contract details screen (Settings > Personal data for contracts). We then delete your identity details, ID photos and payout account immediately; contracts already issued keep their signed copies. Withdrawal does not affect processing that already took place, but we may then be unable to issue or perform a new contract.
4. Purposes and legal bases
Silence or inaction is never treated as consent, and we do not use pre-ticked consent boxes.
5. Who we share data with
- Public leaderboard: creators appear only under a masked name with aggregated metrics; your real name, brands, campaigns and payment details are never published.
- Brands: when you apply to or join a brand's campaign, that brand sees your creator profile, verified channel statistics and the content you submit. Contract and payment data is shared only with the brand you sign a contract with, and only as needed to perform it.
- Service providers acting on our instructions: Cloudflare (network security and content delivery), Google Firebase Cloud Messaging and Apple Push Notification service (push notifications), and Google Analytics (anonymized statistics on public pages). Our servers, file storage and email server are operated by us in Vietnam.
- Social platforms: when you connect an account, the platform (TikTok, Meta, Google/YouTube) processes your login under its own policy.
- Competent Vietnamese authorities when required by law.
We do not sell personal data, and we do not share it for third-party advertising.
7. Where data is stored and cross-border transfer
Personal data of users in Vietnam is stored on servers we operate in Vietnam, as required by the Law on Cybersecurity No. 24/2018/QH14 and Decree 53/2022/NĐ-CP. Some service providers listed in section 5 process limited data outside Vietnam (network traffic through Cloudflare, push tokens through Google and Apple, anonymized analytics through Google).
Before such a transfer we prepare a cross-border transfer impact assessment under the Law on Personal Data Protection No. 91/2025/QH15 and Decree 356/2025/NĐ-CP and keep it available to the competent authority. We do not transfer identity documents or bank data abroad.
8. How long we keep data
- Account and profile data: while your account is active. When you delete your account we erase it immediately and revoke your connected-account tokens with each platform; the creator record that collaboration and payment ledgers point to is kept only in anonymized form.
- Social account tokens: until you disconnect the channel or delete your account.
- Contracts, payment records and the identity data used in them: 10 years from the end of the financial year, as required by Article 41 of the Law on Accounting No. 88/2015/QH13. After that they are deleted automatically.
- Security and sign-in logs: up to 12 months.
9. Your rights
Under the Law on Personal Data Protection No. 91/2025/QH15 you have the right to be informed; to give, refuse or withdraw consent; to access, correct and delete your data; to restrict or object to processing; to request data protection measures; and to complain, denounce or sue for damages.
Most of these you can do yourself in the Service (edit your profile, disconnect channels, delete your account). For anything else, email the person in charge in section 12 from your account email. We respond within the time limits of Decree 356/2025/NĐ-CP: 10 days for access and correction, 15 days for withdrawal of consent and 20 days for deletion, extendable once with notice.
10. Deleting your data
- Web: Profile > Account > Delete account. App: Me > Delete account. Your profile and personal data are deleted immediately, connected-account tokens are revoked and every session ends.
- To remove only a social account, open Settings > Channels and disconnect it, or revoke access on the platform (section 6).
- By email: write to [email protected] from your account email. We confirm within 20 days.
11. Security and incidents
We use TLS encryption in transit, encryption at rest for tokens and sensitive data, password hashing, role-based access control and audit logs. If a personal data breach occurs we notify the specialized cybersecurity agency of the Ministry of Public Security (A05) within 72 hours of detection, and we also notify you when sensitive data is involved.
12. Person in charge of personal data protection
13. Age requirement
The Service is for people aged 18 and over. We do not knowingly collect personal data of children. If you believe a child has registered, contact us and we will delete the account.
14. Changes to this Policy
We show the version and effective date at the top of this page. We notify you in the Service before a material change takes effect and ask for your consent again where the law requires it. If versions differ, the Vietnamese version prevails.
6. Data from connected social accounts
You can verify that you own a channel by signing in to the platform. Every permission we request is read-only: we never post, comment, like, message or change anything on your accounts.
HOJA's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements. We use YouTube data only to verify channel ownership and show your channel statistics; we do not use it for advertising, do not sell it, and do not let people read it except with your consent, for security, or as required by law.
Access tokens are encrypted at rest and used only by our servers. When you disconnect a channel in the Service we delete its tokens. You can also revoke our access on the platform: TikTok — Settings and privacy > Security > Manage app permissions; Meta — Settings > Apps and websites (Facebook) or Settings > Website permissions (Instagram, Threads); Google — myaccount.google.com/permissions. When you remove HOJA for Influencer on Meta, Meta notifies us and we delete the tokens automatically.