Privacy Policy

GrowFly controls and processes the personal data described in this policy.

GrowFly has two different roles:

• Data controller for the account data of GrowFly customers — email, billing details, members, sign-in records — and for the data of visitors to our website and demo shop.
• Data processor for personal data held in shop data — each shop’s customers, staff and delivery recipients. For that data the shop is the controller; see “Personal data held by shops”.

Our website

• The website needs no sign-in, sets no cookies and uses no analytics or advertising tools. The server keeps ordinary technical logs (IP address, browser, time, page requested) to operate and to fend off attacks.
• If the contact form is available and you send it, we receive your name, phone number, email, shop name and message, plus your IP address and browser to fight spam.

Account site

• At sign-up: your email address. You may later add your full name, phone number and language.
• Receipt details: name, tax ID, address and receipt email (if you enter them).
• The shops you open, their plan, status and custom domain (if any); the members you invite and their roles; the support requests you send; your referral code and who referred you.
• One-time sign-in codes (OTP): we store only a hash of the code; it expires after 10 minutes and works once.
• Activity log and sign-in sessions: important actions (sign-in, opening or deleting a shop, payments…), their time, IP address, device type and browser. You can see your sessions in the account site.

Payments

• PayPal: we send PayPal your account email, the shop ID and the plan; PayPal sends back the subscription ID, its status and transaction details (amount, time, payer name and email). You enter your card or sign in to PayPal on PayPal’s own pages; we never receive or store card numbers.
• Bank transfer (VietQR via SePay): the QR code carries GrowFly’s receiving account, the amount and a payment code. When the money arrives, SePay tells us the amount, transfer description, reference and time. We never receive your banking credentials.

Google sign-in and passkeys

• Google sign-in asks only for the basic “openid”, “email” and “profile” scopes. We store your email address, your Google account ID (to tie the right Google account to your user) and your name if the account has none yet. We do not store your profile picture and never read your Gmail, contacts, Drive or any other Google data.
• GrowFly’s use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
• Passkeys: we store only the public key, the passkey ID, the name you give it and when it was last used. Your fingerprint, face or device PIN never leaves your device.

Inside a shop

• User accounts in the shop (name, email, roles, permissions) and a log of their actions.
• Shop data entered by you and your staff: customers (name, phone, address, tax ID…), orders, invoices, shipments, books, attachments, and the logs of calls to Viettel SInvoice and Viettel Post. We process this data on the shop’s behalf.

Mobile app

• The app asks only for camera access, to scan barcodes and serial numbers. It does not ask for location, contacts, photos, microphone or push notifications, and contains no third-party analytics or crash-reporting tools.
• Sign-in credentials are kept in the device’s secure storage (Keychain on iOS, Keystore on Android). The cart, the chosen till and a temporary copy of the catalogue and stock (up to 24 hours) stay on the device so the app is fast; uninstalling the app removes them.

Demo shop

• Each visit to the demo creates a temporary user. Your IP address is used only to limit how often the demo can be started, for a short time.
• Everything in the demo is visible to every visitor and erased when the demo is refreshed each night. Do not enter real data in it.

We use personal data to:

• create and manage accounts, sign you in, open and run shops — to perform our service contract with you;
• charge fees, issue receipts and send renewal reminders — to perform the contract and meet accounting and tax obligations;
• send sign-in codes, member invitations and notices about your account, changes to our Terms or incidents — messages needed to provide the service;
• help you when you ask for support and handle complaints;
• protect the system against unauthorized access, abuse, spam and attacks;
• comply with the law and valid requests from competent authorities;
• send product news — only with your consent; off by default.

Where we rely on your consent (such as Google sign-in, creating a passkey or product news), you can withdraw it at any time; withdrawing does not affect processing that happened before.

We do not sell or rent personal data, use it for advertising or ad profiling, or use your data or shop data to train AI models.

We share data only with providers that help us run the service, and only as far as their job needs:

• DigitalOcean — servers and storage (Singapore). All service data lives on this infrastructure.
• Cloudflare — domain names (DNS), custom-domain checks, and Cloudflare Turnstile to block bots when it is turned on (processes IP address and browser signals).
• Resend — sending email (sign-in codes, invitations, renewal reminders, receipts, support replies): email address and message content.
• PayPal and SePay — payments, as described under “Payments”.
• Google — only if you choose to sign in with Google.

When a shop turns on the matching feature, data goes to the service the shop chose, using the shop’s own account:

• Viettel SInvoice — issuing e-invoices: buyer details (name, company name, tax ID, address, email, phone, ID document number if given) and the invoice content.
• Viettel Post — creating shipments: sender and recipient name, phone and address, goods, weight, cash-on-delivery amount, notes.
• VietQR — generating the payment QR code at the till: amount, invoice number and the shop’s receiving account name.
• AI assistants — if a User connects an AI app (such as Claude) to the shop over MCP, that app accesses data within that user’s own permissions, and the data is handled under the user’s agreement with the AI provider. GrowFly itself does not send your data to any AI provider. Nothing flows until the user grants access, and access can be revoked at any time.

Beyond this, we disclose data only where the law requires it or a competent authority validly requests it, or where needed to protect the rights, property or safety of our users and ourselves. If GrowFly is transferred to another business (merger, acquisition), data may transfer with it, and we will tell you in advance.

Service data is stored on DigitalOcean servers in Singapore. Each shop has its own database. Some of the providers above (Resend, PayPal, Google, Cloudflare) process data in the United States or other countries.

By using the service you understand that personal data is transferred and processed outside Vietnam as described. We carry out the procedures Vietnamese law requires for transferring personal data abroad and work only with providers that commit to appropriate data protection.

• Account data: for as long as the account exists. When you close the account, members, phone number, password, passkeys and sessions are removed and the user is disabled; the email is kept so that signing in again can reopen the account.
• Payments and receipts: for the period accounting and tax law requires (usually 10 years), including after the account is closed.
• Activity log: kept with the account for security and to handle complaints.
• Shop data: for as long as the shop is active or locked for non-payment (locked shops are not deleted automatically). When a shop is deleted, its data is kept for 30 days so you can restore it; the shop’s database and files are then removed from the live system. One final backup is kept on the server in case of incidents, and you can ask us to delete it.
• Automatic backups: only the most recent ones (7 days at most) are kept, then deleted automatically. Backups you make in the shop are kept for about a day for you to download.
• Demo shop: erased every night at the refresh. Sign-in codes: 10 minutes.

Our website sets no cookies. The account site and shops use only the cookies needed for sign-in and security — no analytics or advertising cookies:

• sid and Frappe’s other session cookies — keep you signed in, for up to about 7 days or until you sign out.
• sd_account — remembers which account you are viewing when you are a member of several, 180 days.
• sd_google_nonce, sd_google, sd_app_flow — protect the Google sign-in and app sign-in flows, 10 minutes.
• sd_pk_login, sd_pk_register — one-time passkey challenge, 5 minutes.
• sd_pk, sd_pk_later — remember that this browser has a passkey (360 days) or that you chose “later” (90 days).

The web version of the mobile app keeps its session in browser storage (localStorage). Blocking the necessary cookies will stop you from signing in.

• Every connection uses HTTPS. Each shop has a separate database.
• Sign-in codes are stored only as hashes, with limits on sends and wrong attempts; passwords (if any) are hashed; passkeys store only a public key.
• Servers accept only SSH-key access and sit behind a firewall; Frappe’s telemetry is switched off.
• Permissions in shops and the account site are role-based. Our staff access shop data only when needed to support you at your request, to handle a security incident or as the law requires.
• Data is backed up automatically every day.

No system is perfectly secure. If a personal data breach occurs, we will contain it, notify the competent authority within the legal deadline and notify affected people where needed.

Under personal data protection law you have the right to be informed about processing; to give or withdraw consent; to access, correct and delete your data; to ask for processing to be restricted or to object to it; to receive a copy of your data; and to complain, report, sue and claim compensation as the law provides.

You can exercise most of these yourself in the account site (account.growfly.ai):

• edit your name, phone number and receipt details;
• turn off receipt, renewal-reminder and news emails;
• review and sign out sessions, and remove passkeys;
• delete shops and close the account.

The shop owner can download a copy of the shop’s data under Backups in the shop’s menu.

For anything else, contact us through Support in the account site. We may need to verify your identity first, and will answer within the time the law requires. If you are not satisfied, you may complain to the personal data protection authority under the Ministry of Public Security.

If you are a customer, delivery recipient or employee of a shop that uses GrowFly, your data is collected and controlled by that shop. Send requests to see, correct or delete it to the shop directly; if you contact us instead, we will pass your request on and help the shop act on it.

We process this data only on the shop’s instructions (through the way it uses GrowFly) to provide the service, apply the security measures above, and never use it for our own purposes.

The shop is responsible for having a legal basis to collect the data, informing its customers and answering their requests, including when it sends data to Viettel SInvoice, Viettel Post or other services it chooses.

GrowFly is for household businesses and companies; account holders must be 18 or over. We do not knowingly collect children’s data. If you believe we hold a child’s data outside shop data, contact us and we will delete it.

We may update this policy when the service or the law changes. For important changes we will notify you by email or in the account site before they take effect. The date of the latest update is shown at the top of this page.

For any question or request about personal data, contact GrowFly through Support in the account site.