1. Introduction
Chot-Coc ("we", "our", or "the platform") respects your privacy and is committed to protecting personal data. This Privacy Policy details how we collect, use, and safeguard information when you use our Zalo Mini App and optional Google Calendar synchronization service.
2. Data Collected & Purpose of Use
- Zalo Identity Information: We collect your numeric Zalo User ID and display name upon authorization to authenticate merchant ownership, manage presets, and save store settings.
- Booking & Deposit Information: Customer name, phone number, appointment time, and deposit amount are processed strictly to track reservations and generate dynamic VietQR transfer instructions.
3. Google Calendar Integration & Limited Use Disclosure
When a merchant connects their Google account to enable schedule synchronization, the application requests the following OAuth scope:
https://www.googleapis.com/auth/calendar.app.created
Commitment to User Data Protection:
- Strict Least Privilege: This scope only grants permission to create and manage an isolated, dedicated secondary calendar named "Chot-Coc". The application has no access to read, view, modify, or delete your primary calendar or personal events.
- Sole Purpose: Calendar events are created and updated solely to sync appointment slots and deposit statuses for your store.
- No Transfer or Advertising: We never sell, transfer, or share Google user data with third parties or advertising networks.
Chot-Coc's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
4. Data Security & Storage
Authentication tokens (including Google OAuth refresh tokens) are encrypted and stored within Supabase PostgreSQL protected by Row Level Security (RLS). Only authenticated server-side Edge Functions have access to perform synchronization operations.
5. Revocation & Data Deletion
You can revoke Google Calendar access at any time in the app settings or directly via Google Account Permissions. Upon disconnection, stored authentication tokens are permanently purged from the database.
6. Contact Us
If you have any questions regarding this Privacy Policy, please contact: support@chotcoc.vn.