Privacy policy

Updated: 22 September 2026. This page explains what data Kerrax collects, what we use it for, who we share it with and what rights you have.

1. What we collect

You give us when signing up and buying

• Email address, phone number, password (stored hashed — we cannot read it), preferred email language.
• The moment you accepted the terms and this policy.
• Order notes, including the recipient email for products upgraded on your own account.
• Product reviews you write.

Created as you use the service

• Orders: product, quantity, amount, status, timestamps.
• The account details we delivered to you (and earlier versions when they are replaced under warranty).
• Wallet history: every credit, charge and refund.
• Bank transfers you send to our account, as reported by the payOS payment gateway: amount, transfer content, bank transaction reference, and the sending bank and account number.
• IP address and time of sign-in, sessions, and a log of actions on your account.
• Technical logs of the calls our system makes to suppliers and the payment gateway to process your orders.

We do not collect location data, contacts, card details (we don't take card payments), or your banking passwords or OTP codes.

2. What we use it for

• Creating and protecting your account, and authenticating sign-ins.
• Processing orders, delivering them, keeping your wallet balance, handling warranty claims and refunds.
• Contacting you about your orders (by email, or by phone when an order has a problem).
• Fraud prevention: spotting unusual transfers, warranty abuse and suspicious sign-ins.
• Bookkeeping and reconciling money.

We do not sell your data and do not use it for third-party advertising.

3. Legal basis

We process your data to perform the sales contract with you, to meet accounting obligations, and on the consent you give at sign-up (the checkbox accepting the terms and this policy).

4. Who we share it with

• Suppliers: they receive only the recipient email you entered, to activate the service. We do not send them your name, phone number or purchase history.
• payOS (payment gateway): creates the VietQR code for each order and notifies us when the money arrives; payOS receives the amount and transfer content, not your email or phone number.
• Cloudflare: forwards traffic to our servers, so traffic passes through Cloudflare's infrastructure.
• An email delivery service: sends confirmation codes and order notifications to your inbox.
• Infrastructure providers (servers and database located in Singapore).
• Authorities, on a lawful request.

5. Where it is stored

Our servers and database are located in Singapore. Using the service means your data is transferred to and stored outside Vietnam.

6. How long we keep it

• Orders, wallet history and delivered account details are kept permanently — so you can look up what you bought, so we can handle warranty claims, and for bookkeeping.
• Sessions: 30 days. Email confirmation codes: 15 minutes.
• Customer sign-in logs: 180 days. Notification logs: 90 days. Technical supplier-call logs: 7 days for calls that completed.

7. Security

• Passwords are stored hashed (bcrypt) and cannot be turned back into the original.
• Sessions use an HttpOnly cookie, which browsers keep out of reach of JavaScript.
• The database is not exposed to the internet; administrator accounts require two-factor authentication.
• Backups are encrypted.

No system is perfectly secure. If you see signs your account was accessed by someone else, change your password and tell us immediately.

8. Cookies

We only use necessary cookies: the sign-in session and your language choice. Your cart is stored in your own browser. There are currently no advertising cookies or third-party trackers; if we add any, we will ask you first.

9. Your rights

• See and correct: email, phone and language on the Profile page; order and wallet history in your account area.
• Request a copy of your data.
• Withdraw consent and ask us to delete your account: your email and phone are anonymised and you can no longer sign in; orders and wallet entries are kept for accounting duties and are no longer tied to your identity.
• Complain about how we handle your data.

Send requests to [email protected] from the email address you registered with. We reply within 72 hours and complete the request within 30 days.

10. Children

The service is not intended for people under 16. Anyone under 16 may only use it with the consent of a parent or guardian.

11. Changes and contact

We may update this policy; the date at the top shows when. Significant changes are announced by email.

Questions about personal data: [email protected].