Personal Data Privacy Policy

Legal role: Personal Data Controller. For data that an enterprise using the Platform collects or enters itself (the enterprise's shared listings and shared customers, staff records and ID numbers, face data, content that visitors send through forms on the enterprise's website), the enterprise is the controller and LandAIA processes the data on the enterprise's behalf; the accounts and personal data of people working for the enterprise remain under LandAIA's control under this Policy — see Sections 3.12, 5.1 and the Data Processing Agreement. Legal basis: Law on Personal Data Protection No. 91/2025/QH15; Decree 356/2025/ND-CP; Law on Data No. 60/2024/QH15; Law on Cybersecurity No. 116/2025/QH15.

1. SCOPE

This Policy describes how personal data is collected, processed, stored, and protected when You access and use:

• The LandAIA mobile application (iOS, Android)
• The website landaia.net and its subdomains
• The Customer Portal
• The work portals and websites of enterprises operating on the Platform
• Related APIs, SDKs, and integrated services

When You register an account, You are invited to read and tick to agree to this Policy together with the Terms of Service and the User Agreement; the system records the version You agreed to and the time of agreement. Silence, non-objection or continued use is not consent.

2. DATA PROCESSING PRINCIPLES

We commit to:

• Collecting only data that is necessary and fit for purpose
• Processing data for the purposes notified
• Applying appropriate security measures
• Respecting the rights of data subjects
• Never selling personal data to third parties

3. TYPES OF PERSONAL DATA COLLECTED

3.1. Account information

• Full name
• Email
• Phone number
• Password (one-way hashed, cannot be read back)
• Gender (for forms of address and personalization)

3.2. Professional information (for brokers)

• Citizen ID number (CCCD/CMND) — voluntary when You register yourself; required for staff accounts when an enterprise creates or invites You into the enterprise (the enterprise requires it to identify its staff). The ID number is encrypted at rest and deleted together with the account.
• Brokerage business information
• Practising licence (if any)
• Experience and expertise
• Public profile introduction

3.3. Location data (sensitive personal data — only if You allow it)

• GPS coordinates when You actively request Your location (surveys, map, working area, nearby search). The app shows an explanation before the operating system asks for permission, requests permission "while using the app" only, and does not track location in the background.
• Location, time and camera model of a survey photo (read from the photo's data): stored only if You turn on "Keep photo GPS location", as evidence that You own the photo in case of a dispute. While it is off, the server does not store this information (the mobile app does not send the coordinates either).
• Current location sent to the AI assistant while You are on the survey, add-property or CRM screens: only if You turn on "Share my location with the assistant".
• Navigation trips (the GPS points of a trip) when You use the navigation feature.
• Working area and default location chosen by You.

The options above are OFF by default; the app asks You once and You can change them at any time in Settings › Privacy. You can also revoke location permission in Your device settings.

3.4. Voice data

• Voice input when using speech-to-text
• Voice commands sent to the AI assistant

3.5. AI conversation history

• Questions and responses
• Input method (text/voice)
• Feature usage context
• User feedback ratings
• Assistant memory: notes drawn from conversations so the assistant understands You better

Detailed messages with the assistant are automatically deleted after 12 months. Assistant memory is not deleted on a schedule but fades over time, and is deleted entirely when You delete Your account. Before text containing customer data (CRM messages, notes, form content) is sent to an AI provider, the server automatically masks phone numbers, email addresses, ID numbers and bank account numbers; photos (photos You attach for the assistant, document photos for text recognition) are sent as they are, unmasked. The assistant reads CRM messages only if You turn this on (off by default).

3.6. Property survey data

• Property address and coordinates
• Technical, legal, and price information
• Survey photos
• Personal notes
• Owner and contact information (entered by the User; encrypted at rest)

3.7. Customer data (CRM)

If You use the customer management feature, the system stores:

• Customer name, phone number, email
• Needs and search criteria
• Interaction history and appointments
• Messages exchanged with customers via the Customer Portal (delivered in real time through the Pusher service)

3.8. Technical data

• IP address
• Device and operating system information
• Device ID, FCM token
• User-Agent
• Login sessions (time, device) and screens opened — for account security and operations; recorded even if You have not turned on "Remember my in-app activity" (section 3.9), and not used by the assistant
• Search keywords, filters and the results You click — to improve search quality

3.9. Usage data for the assistant (only when You turn on "Remember my in-app activity")

• Screens and pages viewed, actions, search keywords, scroll depth — in the app and on the landaia.net website

This data helps the assistant make suggestions in context. The option is OFF by default and the app asks You once; You can turn it off in Settings › Privacy and clear the recorded history at any time. While it is off, the server stores no activity events for the assistant; the technical logs in section 3.8 (login sessions, screens opened) are still kept for security and operations, for the periods in section 8.

3.10. Payment data

• Transaction ID
• Transaction amount
• Payment method and status

We do not store bank card information. Payments are processed by licensed payment gateways.

3.11. Customer Portal data

Each Customer Portal link is created by a broker for one specific customer (linked to the name and phone number the broker entered). When the customer views it, the system records:

• Views of each property: number of views, viewing time, photos opened, full-screen views, scroll depth, saved or shared
• Device type and browser (no IP address is recorded)
• Ratings, messages and appointments sent by the customer

3.12. Biometric data (face) — enterprise staff

Applies only to staff of enterprises that have enabled face verification. The enterprise decides whether to require its staff to register their face in order to use the enterprise's work system and sign electronic documents; LandAIA processes the data on behalf of the enterprise (as processor). Biometric data is sensitive personal data.

• Data: one reference photo and a numeric feature vector computed from it (which cannot be turned back into the photo); a face photo captured at the time of signing, stored with the signed document as evidence.
• Purpose: verifying the right person when signing electronic documents; not used for any other purpose and not shared with third parties.
• Storage: encrypted, on LandAIA's storage servers in Vietnam.
• Consent: You read a separate biometric consent text before registering. If You do not agree, please do not use the enterprise's work system: tap "Decline" and You are signed out immediately; after 72 hours, if You have not signed in again and registered, an account created by the enterprise (or created through the enterprise's invitation) is deleted, while Your own personal account that joined the enterprise leaves the enterprise and is kept. Within those 72 hours You can register to cancel the decline. If You cannot register for a legitimate reason, contact the enterprise's administrator for an exemption.
• Retention: the reference photo and feature vector are deleted as soon as You leave the enterprise or delete Your account; the photo taken at signing is kept with the signed document for the document's period of validity plus 5 years.

3.13. Data when using the AI content verification tool

The public verification tool at verify.landaia.net is designed to collect as little data as possible:

• Text pasted in to detect hidden signatures is processed in the browser and not sent to Our servers;
• Image files selected for checking are also processed in the browser and not uploaded; the browser only sends a short fingerprint string of the file, from which the image cannot be reconstructed;
• The tool requires no login and collects no identifying information about the person checking.

4. PURPOSES OF PROCESSING

Personal data is processed in order to:

• Provide and operate the service
• Verify identity and secure accounts
• Verify faces when signing electronic documents (staff of enterprises that enable this feature)
• Process payments
• Send notifications and support users
• Improve service quality and the AI assistant
• Analyse the market from de-identified data (Section 8.1)
• Prevent fraud and abuse
• Comply with legal obligations

5. DATA SHARING

Data is shared only:

• With authorized service providers listed in Section 6.1 (storage, content delivery, payments, email, notifications, maps, AI)
• When You actively post a listing to a partner real estate exchange whose account You have linked: We send the exchange the listing content (title, description with phone numbers masked, photos, videos, status, price, area, features, coordinates, street name) together with Your exchange account identifier. We do not send the house number, owner information, internal notes, or the name or phone number of Your LandAIA account. If You choose to post under the exchange's paid package, We also send the exchange the package You chose and the amount shown at the time You chose it, so the exchange can deduct exactly that amount from Your wallet at the exchange; We cannot see Your wallet balance at the exchange, We do not top up that wallet, and the deduction is carried out by the exchange under its own policy. We then automatically update or withdraw that listing on the exchange when it changes or may no longer be posted (the listing is removed from the inventory, You leave the company or You delete Your account). The exchange processes the listing under its own policy. When You link an account, We receive from the exchange and store the exchange account's name and masked phone number to show the link.
• When lawfully requested by competent State authorities
• When necessary to protect Our lawful rights and interests

5.1. Sharing within an Enterprise Workspace (Enterprise mode)

If You join an enterprise/agency on the Platform (Enterprise mode), the enterprise's administrators and authorized managers can see:

• Data in the enterprise's shared mode (the shared property inventory, customers shared under the enterprise's configuration);
• Your work activity statistics within the enterprise (number of surveys, listings, performance) and Your AI usage measured in credits.

The enterprise cannot see: Your personal survey data, customers in personal mode, AI assistant conversation history, or Your private account information. When You leave the enterprise, this personal data remains Yours.

6. STORAGE & CROSS-BORDER DATA TRANSFER

6.1. Storage and processors

The business database (accounts, surveys, CRM, enterprise data) is stored on servers located in Vietnam. Processors acting on Our behalf:

• Amazon Web Services (Singapore): attachments (photos, videos, survey documents, verification photos) and enterprise data export packages — private and encrypted; field-encryption keys are managed on AWS's dedicated key management service;
• Vietnix (Ho Chi Minh City, Vietnam): signed electronic documents, signature images and face photos (encrypted); chat attachments and AI-generated images; temporary photos for text recognition (OCR) — deleted right after reading, within 1 day at most;
• AI model providers (OpenAI, Anthropic, Google Gemini via OpenRouter — servers in the United States/Singapore): processing of AI request content, not used to train models under the providers' API policies; providers may retain it temporarily, for a limited period, under those policies (for example, to detect abuse);
• Google Firebase (United States): device tokens for push notifications;
• Pusher: real-time delivery of messages between brokers and customers;
• Google Maps: address search and matching;
• Google Cloud Text-to-Speech: reading the AI assistant's answers aloud;
• OpenStreetMap (Nominatim): looking up the street name for a point pinned on the map where LandAIA's own road data does not yet cover it (coordinates only, without identity);
• Google Fonts: loading fonts for some website pages (the browser's IP address);
• Cloudflare: content delivery, attack protection and traffic statistics; Cloudflare Turnstile anti-spam on enterprise website forms (when the enterprise enables it);
• Bunny CDN: delivery of public content (static assets, public listing photos);
• Google Drive: encrypted backups;
• Apple App Store / Google Play: in-app purchases of service plans;
• Sepay; VietQR (img.vietqr.io): VietQR bank transfer reconciliation and generating the payment QR image (transaction ID, amount, transfer description);
• PrivateEmail: transactional emails and password resets.

The per-processor table (data shared, safeguards) is in Section 05 of the Data Processing Agreement (LAND-PL-11).

6.2. Legal compliance

Cross-border transfers are carried out in accordance with the Law on Personal Data Protection No. 91/2025/QH15, Decree 356/2025/ND-CP and the Law on Data No. 60/2024/QH15. We prepare and maintain the cross-border personal data transfer impact assessment dossier as required by law, for inspection when needed.

7. DATA SECURITY

We apply industry-standard technical and organizational measures to protect Your data:

7.1. Data encryption

• Encryption in transit: All connections use SSL/TLS to protect data in transit
• Encryption at rest: Sensitive data (phone numbers, ID numbers, addresses, owner and contact information in survey listings, CRM customer data, payment information) is encrypted before being stored in the database; signed electronic documents, signature images and face data are encrypted at file level
• Key management: Encryption keys are managed separately from the data, using a dedicated key management service with strict access control

7.2. Account protection

• Passwords: One-way hashed with salt, cannot be read back
• Unusual sign-in detection: The system monitors and alerts on suspicious sign-in activity
• Automatic lock: Accounts are temporarily locked after repeated failed sign-in attempts

7.3. Access control

• Role-based access: Staff can only access data needed for their work
• Access logging: Each view of the phone or ID number of an owner or customer is recorded in the audit log (kept for 12 months)
• Security monitoring: The system detects and blocks unusual access behaviour

7.4. Backup and recovery

• Regular encrypted data backups
• Disaster recovery procedures tested regularly
• Backups stored in multiple geographic locations

8. RETENTION PERIODS

• Account information: until You delete Your account
• ID number: deleted together with the account
• Personal survey & CRM data: until You delete it or delete Your account. When You delete Your account, personal listings leave only a de-identified statistical record (Section 8.1); listings belonging to an enterprise or submitted to an enterprise inventory remain with the enterprise, detached from Your name
• Detailed messages with the AI assistant: 12 months
• Assistant memory: not deleted on a schedule, fades over time; deleted when You delete Your account
• Usage data for the assistant (when You turn on "Remember my in-app activity"): until You delete it
• Access logs, system security logs, login sessions: 12 months; screen views: 90 days
• Logs of views of phone/ID numbers: 12 months
• Search history (to improve search quality): 12 months; deleted earlier if You delete Your account
• Face reference photo and feature vector: deleted as soon as You leave the enterprise or delete Your account
• Electronic signing evidence (signed documents, signature images, face photos taken at signing): the document's period of validity plus 5 years
• Consent records (which documents You agreed to, and when): 3 years after account deletion, kept only with a one-way hashed email/phone number, to prove consent in case of a dispute
• Payment transactions: long-term, at least 10 years under accounting law
• De-identified statistical data: no time limit (Section 8.1)

8.1. DE-IDENTIFIED MARKET STATISTICS

a) Information stored (de-identified)

• Location: Province/city and commune/ward only (no detailed address)
• Area: Fixed buckets — under 50 m² in 10 m² steps; 50–200 m² in 25 m² steps; 200–1,000 m² in 100 m² steps; 1,000–10,000 m² in 1,000 m² steps; above that in 10,000 m² steps
• Price: Fixed buckets on the scale 1 – 1.5 – 2 – 2.5 – 3 – 4 – 5 – 6 – 8 × 10ⁿ VND (800 billion VND and above share one bucket)
• Frontage: Fixed buckets — under 10 m in 1 m steps; 10–20 m in 2 m steps; 20–50 m in 5 m steps; from 50 m in 10 m steps
• Features: Number of floors and bedrooms (6 and above grouped together), direction, position, car access, legal status
• Time: Quarter only (e.g., Q1.2026); the recorded date is the first day of the quarter
• Status: Sold or deleted

b) Information NOT stored

Records stored before the effective date of this Policy have also been reprocessed in the same way.

c) Legal basis

Retention of de-identified statistical data is based on the following:

• Personal data protection law (Law No. 91/2025/QH15; Decree 356/2025/ND-CP): data de-identified to the point that the data subject can no longer be identified is no longer personal data. Our statistical records contain no identifiers, are not linked to the original listing or the poster, and store only bucketed values.
• Apple App Store Guidelines (Section 5.1.1): Permits the collection of anonymous data for analytics and service improvement, provided users are clearly informed.
• Google Play Data Safety Policy: Permits retention of anonymized data without additional consent, subject to transparent disclosure in the privacy policy.

d) Purposes of use

• Analyse property price trends by area and time
• Market research to improve services
• Provide reference information to users (if applicable)
• Aggregate statistical reports (containing no personal data)

e) Your rights

f) No-sale commitment

Statistical data is not sold to third parties. It is only used internally or in aggregate reports that contain no identifiable information.

9. YOUR RIGHTS

Under Vietnamese law, You have the right to:

• Know what data is being processed
• Access and correct Your data
• Request that We provide Your personal data — send the request by email to hotro@landaia.net
• Request deletion or restriction of processing; delete Your account yourself in the app (Settings › Delete account) or on the web at landaia.net/delete-account
• Withdraw consent and turn off options in Settings › Privacy
• File complaints with competent authorities

10. LIMITATION OF LIABILITY

To the extent permitted by law, LandAIA is not liable for:

• Damages arising from data entered by Users themselves
• Financial or legal decisions based on information or AI suggestions
• Disputes between Users and third parties

11. POLICY UPDATES

We may update this Policy in response to changes in law or the service. When a change is material, We publish the new version with a new effective date and ask You to agree again on the web, in the app and on the enterprise work portal before You continue using the service. If You do not agree, You may stop using the service and request deletion of Your account.

12. CONTACT