Manivo
Đăng nhậpBắt đầu

MANIVO PRIVACY POLICY

Version: 1.2 Effective date: 2 September, 2026 Last updated: 3 October, 2026

1. Introduction

1.1. Manivo ("we", the "Platform") is operated by Công ty TNHH Avio Group (business registration/tax number: 5702128465; registered office at Thôn 11, Đặc khu Vân Đồn, tỉnh Quảng Ninh, Vietnam) and is committed to respecting User privacy and protecting personal data.

1.2. This Policy explains how we collect, use, share, store and protect personal data when Users interact with the Platform (website, mobile app, API).

1.3. This Policy applies together with the Manivo Terms of Service and forms an integral part of the agreement between Manivo and the User.

1.4. By using the Platform, the User acknowledges that they have read and agreed to this Policy and consents to Manivo processing personal data as described.

2. Definitions

  • "Personal data": any information in the form of symbols, letters, numbers, images, sound or similar electronic form attached to, or used to identify, a specific individual, including basic and sensitive personal data under Vietnamese law.
  • "Data subject": the individual to whom the personal data relates.
  • "Data controller": Manivo, which determines the purposes and means of processing.
  • "Data processor": a third party that processes personal data on behalf of Manivo under a written agreement.
  • "Processing": collection, recording, analysis, storage, alteration, disclosure, transmission, sharing, deletion, destruction and related operations.

3. Data we collect

3.1. Data from the Zalo account (with the User's consent)

Most Users sign in to Manivo with Zalo. When they do, Manivo receives from Zalo, only within what the User approves on Zalo's permission screen:

  • Display name and avatar: used as the name and picture on the Manivo profile.
  • Zalo identifier (zaloId): to recognise the User on later visits, and so that the web account and the Zalo Mini App account are one and the same.
  • Phone number verified through Zalo: only when the User approves it on a separate permission screen in the Zalo Mini App. Users who do not verify can still use Manivo; see Section 3.1bis on self-entered phone numbers.

Users can also sign in with Google (Manivo receives the Google account's name, email and picture) or with email and password. All three routes lead to the same Manivo account when they match on the Zalo identifier or a phone number verified through Zalo. Manivo does not send verification codes by SMS.

Manivo does not store Zalo access tokens and does not read messages, contacts or any other data in the User's Zalo account.

3.1bis. Data the User enters

  • Account information (for email sign-up): full name, email, password (hashed; Manivo cannot see the original).
  • Posting content: job description, field, area, budget range, desired deadline. Postings are publicly visible to all other users, so private information does not belong there.
  • Self-entered phone number (unverified): required to post a job. Without a phone number Users can still browse jobs and edit their profile; quoting requires a number verified through Zalo (Section 3.1). Phone numbers are never shown publicly (Section 5).
  • Quote content: price, number of days, message to the Client.
  • In-app messages between the two parties of a job, and between a User and Manivo, including images and attachments.
  • Deliverables: files, links and notes the Pro delivers on the contract page.
  • Community content: questions, answers and illustrative images. This content is public.
  • Stories: the post link or a screenshot of the post that a User submits for Manivo to review.
  • Freelancer profile: field, experience, introduction, portfolio photos, service area, indicative pricing.
  • Self-declared professional information: certificates and qualifications (with a proof image if the User uploads one); for Pros that are organisations: legal name, tax code, address and representative. Manivo currently does not collect identity documents (ID card or passport).
  • Reviews, feedback, complaints and supporting documents.
  • Community Points and Reward wallet: points history, level, Referral Rewards and First Job Gifts, payout requests. To pay out a reward, Manivo contacts the User through in-app messages or the Zalo OA; the app does not ask for or store bank account numbers for this.

3.2. Automatically collected data

  • Device and technical data: IP address, device type, operating system, device identifiers, browser version, language.
  • Usage logs: access time, click behaviour, features used, error logs.
  • Approximate location based on IP, or precise location where permitted.
  • Cookies and similar technologies (see Section 9).

3.3. Data from third parties

  • Information from authentication providers (Zalo, Google) within the scope authorised by the User, see Section 3.1.
  • Information from anti-fraud and analytics partners.
  • Publicly available information used for professional verification.

3.4. Sensitive personal data

Manivo minimises processing of sensitive personal data. Where processing is required (e.g., ID numbers for identity verification under the 2025 E-commerce Law), Manivo discloses the purpose and obtains specific consent.

4. Purposes and legal bases

Manivo processes personal data for the following purposes:

  1. Providing and operating the Platform: account creation and management, authentication, Pro profile display, Client–Pro connection, transaction support. Basis: performance of contract.
  2. Charging Select Fees: quoting, invoicing and reconciliation for Select Requests. The Open tier is free, so no payment data is processed for it. Basis: performance of contract and legal obligation.
  3. Customer support and dispute facilitation: complaint handling, facilitation between Clients and Pros. Basis: legitimate interest and consent.
  4. Security and fraud prevention: detecting unusual behaviour, preventing fraud, protecting accounts. For example: checking referral rewards against hashed device footprints (IP address and browser, kept 60 days); postings, Community posts and messages are moderated automatically with AI tools. Basis: legitimate interest and legal obligation.
  5. Legal compliance: complying with the 2025 E-commerce Law, tax law, anti-money-laundering rules, and providing information to competent authorities upon lawful request. Basis: legal obligation.
  6. Product improvement: statistical analysis, UX improvement, feature testing. Basis: legitimate interest, without disproportionate impact on privacy.
  7. Marketing communications: product announcements, promotions, surveys. Basis: consent; the User may withdraw consent at any time.

Manivo does not use personal data for fully automated decision-making that produces legal or similarly significant effects on the User without an appropriate legal basis.

5. Data sharing

Manivo only shares personal data in the following cases:

  1. Between Client and Pro: phone numbers are released only after a match. This is the rule Manivo enforces most strictly:

- Before the Client chooses a Pro: Pros see the posting content and the Client's display name; Clients see the Pro's public profile (name, picture, field, area, rating, completed jobs, portfolio). Neither party's phone number appears anywhere: not in postings, not in public profiles, not in the quote list. In messages sent before a match, phone numbers and Zalo links are masked from the other party. - After the Client chooses a Pro: those two parties (and only those two) see each other's phone number in order to talk on Zalo. Manivo releases it through a dedicated function and records when it was released. - Phone numbers are never shared with Pros who were not chosen, with other users, or with third parties for marketing.

  1. Service providers (processors): cloud infrastructure and file storage, AI model providers (processing postings, profiles, messages and Community posts for writing suggestions and moderation), email providers, anti-fraud tools, customer support; bound by written data processing agreements that meet PDPA requirements.
  2. Competent authorities: upon lawful request under Vietnamese law (tax authorities, police, courts, e-commerce regulators).
  3. Operational partners: payment providers used to collect Select Fees; Zalo, when Manivo sends job notifications through Manivo's Zalo Official Account to a linked Zalo account; and email providers when notifications are sent by email. Note: Manivo does not share card data with any party other than a licensed payment provider.
  4. Corporate restructuring: in the event of merger, spin-off, transfer or similar event, data may be transferred to the successor with a commitment to continued protection.
  5. User's explicit consent: for any sharing beyond the scope above.

Manivo does not sell personal data to any third party.

6. Cross-border data transfers

6.1. Manivo's application servers, database and file storage are located in Singapore. Content sent to AI model providers (Section 5.2) may be processed in other countries. As a result, personal data is transferred, stored and processed outside the territory of Vietnam.

6.2. When transferring data abroad, Manivo undertakes the following:

  • Conducts a cross-border data transfer impact assessment under Decree 13/2023/ND-CP;
  • Submits the cross-border transfer impact assessment dossier to the Department of Cyber Security and High-Tech Crime Prevention (A05) of the Ministry of Public Security, as required;
  • Signs standard data processing agreements with the receiving party, containing protection obligations equivalent to Vietnamese law.

6.3. For data subjects in the EU/EEA, Manivo relies on valid transfer mechanisms under GDPR (e.g., EU Standard Contractual Clauses).

7. Retention

7.1. Manivo retains personal data only for as long as necessary to fulfil the purposes of processing or to meet legal requirements:

  • Active account data: for as long as the account remains active.
  • Closed account data: up to 12 months after closure, unless law requires longer retention (e.g., tax records must generally be kept for at least 10 years under the Accounting Law).
  • Transaction and invoice records: in line with tax and accounting legislation (typically 5–10 years).
  • Deliverable files: kept for at least 12 months after the job closes, so both parties can download them again.
  • Technical and security logs: 12 to 24 months for incident investigation.
  • Marketing data: until the User withdraws consent.

7.2. After the retention period ends, Manivo deletes or anonymises the data through an internal technical procedure.

8. Data subject rights

Under Vietnamese law and the GDPR (where applicable), Users have the following rights in respect of their personal data:

  1. Right to be informed about processing.
  2. Right to give and withdraw consent.
  3. Right to access personal data.
  4. Right to rectification of inaccurate data.
  5. Right to erasure (where permitted by law).
  6. Right to restriction of processing.
  7. Right to object to processing in certain cases.
  8. Right to lodge complaints with competent authorities.
  9. Right to data portability: applicable under GDPR.
  10. Right not to be subject to purely automated decisions that produce legal effects.
  11. Right to seek compensation for damages in accordance with the law.

Exercising rights (three routes, any of them works):

  1. Message Manivo's Zalo Official Account: fastest, and Manivo recognises you immediately because the account is linked to Zalo.
  2. Email privacy@manivo.co, including requests to delete your account or receive a copy of your data.
  3. Do it yourself in the app: view and edit your profile under Profile. In the Zalo Mini App, removing Manivo's permission in Zalo's settings is also treated as an account deletion request.

Manivo responds within 72 hours or within the period required by law, and may request identity verification first, so that nobody can obtain your data by impersonating you.

Note on the right to erasure: on receiving the request, Manivo immediately anonymises the account (name, picture, email, phone number) and blocks sign-in; you can cancel the request within 30 days, after which the remaining data is deleted. Manivo deletes your profile and personal data, but retains completed transaction records in anonymised form (no name, picture or phone number). The reason: a review your counterparty received is their reputation, and erasing it would take away something that is not yours. Such retention follows Section 7.

9. Cookies and similar technologies

9.1. Manivo uses cookies and browser storage (local storage) to:

  • Maintain login sessions (manivo_session, 30 days);
  • Remember language and the role in use (NEXT_LOCALE, manivo_role);
  • Record who referred you and which campaign you came from (manivo.ref, manivo.s, manivo.utm, 30 days), so Referral Rewards and Community Points go to the right person;
  • Keep a draft of a posting you are writing, on your own device.

Manivo currently does not use advertising cookies, pixels or third-party analytics tools.

9.2. Cookie categories:

  • Strictly necessary cookies: cannot be declined as they are essential for core functionality.
  • Optional cookies: analytics, personalisation, marketing; these require User consent.

9.3. Users may view, delete or block cookies through browser settings. Disabling strictly necessary cookies may make some features unavailable.

10. Data security

10.1. Manivo applies reasonable technical and organisational measures to protect personal data, including:

  • Encryption in transit (TLS) and encryption at rest for sensitive fields;
  • Access control based on the principle of least privilege;
  • Logging, monitoring and anomaly detection;
  • Security incident response procedures;
  • Staff training on personal data protection;
  • Periodic reviews and risk assessments.

10.2. Despite these efforts, no system can guarantee absolute security. In the event of a personal data incident, Manivo notifies Users and the competent authorities within the statutory deadline (e.g., within 72 hours under Decree 13/2023/ND-CP and GDPR).

11. Children's data

The Platform is not intended for anyone under 18. Manivo does not knowingly collect children's personal data. If we become aware of such data, we will delete it and notify the guardian where appropriate.

12. Data Protection Officer (DPO)

Manivo appoints a Data Protection Officer (DPO) to oversee compliance and serve as the contact point for Users and regulators.

  • Name: Trần Anh Tuấn
  • Title: Head of Security
  • Email: privacy@manivo.co
  • Address: Thôn 11, Đặc khu Vân Đồn, tỉnh Quảng Ninh, Vietnam
  • Target response time: 72 hours from receipt of the request

13. Information for EU/EEA users (GDPR)

Where Manivo processes the data of EU/EEA data subjects, Manivo additionally applies:

  • Legal bases in accordance with Article 6 GDPR (performance of contract, legal obligation, legitimate interests, consent).
  • EU representative: to be appointed and published when Manivo offers services directly in the EU.
  • Right to lodge complaints with the supervisory authority in the Member State of residence.
  • Cross-border transfers outside the EEA are safeguarded by Standard Contractual Clauses or other lawful mechanisms.

14. Changes to this Policy

14.1. Manivo may update this Policy to align with legal or operational changes. Updates will be posted on the Platform with an effective date.

14.2. Material changes will be notified by email or in-app notice at least [X] days before taking effect. Continued use of the Platform constitutes acceptance of the updated Policy.

15. Contact

  • Operating entity: Công ty TNHH Avio Group
  • Business registration/tax number: 5702128465
  • Registered office: Thôn 11, Đặc khu Vân Đồn, tỉnh Quảng Ninh, Vietnam
  • General and support email: hello@manivo.co
  • Personal data and legal email: privacy@manivo.co
  • Hotline: 0899772886
  • Website: https://manivo.co