Privacy policy

• Account: when you log in with Facebook, Google or GitHub we receive that provider's user ID, display name, avatar, username and verified email (if the provider shares it). When you verify your X account we receive your X user ID, name, handle and avatar (no email). Your profile picture is copied to our storage (resized to 256×256, metadata removed) so pages don't load it from the provider. Pictures you upload yourself are processed the same way.
• Profile: bio, website and X/Facebook/LinkedIn links you add. If you turn on anonymous founder, your name, picture, username and these links are withheld from every public page, the API and MCP; your startups stay listed with "Anonymous founder".
• Startups: what you enter (name, description, website, category, tech stack, marketing channels, city, GitHub repo…).
• Payment-provider credentials: API keys/tokens you provide are AES-256 encrypted and used only to read transactions. We recommend read-only keys and require them for Stripe.
• Revenue data: amounts, currencies, dates and transaction IDs; for subscriptions, monthly amounts. From point-of-sale software (KiotViet, Sapo) we only keep the total, date and ID of each invoice/order and return; no customer or item details are stored. For bank feeds (SePay, Casso, Pay2S) we only count transfers matching the memo pattern you declare, and keep the memo/sender text so large transfers held for review can be checked.
• Content you create: posts, likes, co-founder profiles, listings and messages to sellers.
• Newsletter: your email and language when you subscribe.
• Technical: IP addresses are used transiently for rate limiting (counters expire within 2 hours and aren't stored in our database), plus server logs for operations.
• Usage statistics: Google Analytics via Firebase records the pages you view (path only, no URL parameters), device, browser and an approximate location Google derives from your IP. We never send your name, email or username to Google. You can turn this off in the Cookies section below.

• Startup pages show revenue according to the visibility you choose (exact, range or hidden).
• Founder profiles, posts and co-founder profiles are public; contact details on co-founder profiles and listings are shown only to logged-in users.
• In anonymous mode, the name, website, logo, description, city, GitHub and founders are never shown publicly, including in the API and MCP.
• Public data is also available through the public API, MCP, llms.txt, the sitemap and revenue badges.

• To verify and display revenue and run accounts, the leaderboard, marketplace, feed and co-founder search.
• To send transactional email (buyer messages and failing revenue sources — you can turn these off in Settings) and the weekly newsletter if you confirmed your subscription.
• For security, fraud and abuse prevention (for example, holding unusual bank transfers for review).
• For aggregated, non-identifying statistics.

We don't sell personal data and don't use advertising cookies. We share data only with parties needed to run the service:

• Infrastructure providers (servers, database, cache) and Cloudflare R2 (profile picture and startup logo storage).
• Cloudflare DNS (1.1.1.1): when you verify a domain we look up its TXT record through this service and may fetch your website's home page to find the verification tag and an icon to use as your logo; the check repeats weekly.
• Ha Tang (hatang.dev), our email provider: receives email addresses and email content.
• Google (Firebase / Google Analytics): receives the usage statistics described in section 1 unless you opt out; data may be processed outside Vietnam.
• The login provider you choose (Facebook, Google, GitHub) during login, and X when you verify your X account.
• Payment providers you connect: we call their APIs with your key to read transactions.
• The GitHub API (only for a public repo you declare) to estimate lines of code; an exchange-rate service (no personal data).

We may disclose data where the law requires it.

We use necessary cookies, cookies that remember your choices and Google Analytics cookies for usage statistics (no ads). You can turn Google Analytics off in this browser at any time with the button below; we then stop collecting and delete the _ga cookies.

• Account, startup and revenue data: until you delete the startup or your account.
• Startups added before logging in: at most 24 hours if not completed.
• Login sessions: 30 days.
• Addresses that bounced or marked our email as spam: kept so we never email them again.
• Security logs: a pseudonymous ID only, without name, email or username.
• Google Analytics data: according to the retention period configured in Google Analytics.

• View and edit your profile, startups and visibility settings in the dashboard.
• Disconnect a revenue source at any time; the stored key is deleted. You should also revoke the key in the provider's dashboard.
• Turn off notification emails in Settings; unsubscribe from the newsletter with the link in every issue; turn off Google Analytics in section 5.
• Delete your account in Settings (see section 8).
• For other requests (access, a copy of your data, objection…), contact our contact page.

Go to Dashboard → Settings → Delete account and type your username to confirm. When you delete:

• Startups you own pass to a co-founder if there is one; otherwise they are deleted with their connections (including encrypted keys), revenue data and listings.
• Your posts, likes, co-founder profile, messages to sellers, API keys, sessions, login links, stored profile pictures and newsletter subscription are deleted.
• Email queued for or sent to you is removed from our systems.

This can't be undone. If you logged in with Facebook and can no longer access your account, contact our contact page to request deletion.

Payment-provider keys are encrypted with AES-256-GCM and never shown again; data travels over HTTPS; webhooks are signature-verified. No system is perfectly secure — if you find a vulnerability, please tell us at our contact page.

VietMRR is not intended for people under 16.

When this policy changes we update the date at the top; significant changes are announced on the site or by email.