Privacy Policy

1. Introduction and data controller

HPTAI respects and is committed to protecting your personal data in accordance with Decree 13/2023/ND-CP on personal data protection and related Vietnamese laws.

For the purposes of this policy, HPTAI acts as the personal data controller — the party that decides the purposes and means of processing your personal data.

2. Personal data we collect

We only collect the data needed to advise, sell and provide the Services:

• Identity and contact data: full name, email, phone number, Zalo account, company name and job role.
• Content you provide: quote requests, questions, products of interest and the number of seats needed.
• Payment information: bank transfer references and receipts, VAT invoicing details (company name, tax code, address).
• Technical data for licensing: hashed machine fingerprint (see Section 5), Revit version and license activation logs.
• Anonymous usage data: aggregate website visit statistics that do not identify individuals.

3. Purposes of processing

• Receiving, advising on and processing your quote requests and orders.
• Issuing and managing software licenses and unlocking course access.
• Issuing invoices and meeting accounting and tax obligations as required.
• Providing technical support, customer care and notifications about the services you use.
• Preventing fraud, protecting copyright and keeping our systems secure.

4. Legal basis for processing

• Your consent when you leave your information or create an account.
• Performance of the contract to provide software and courses to which you are a party.
• HPTAI's legal obligations, such as retaining accounting records and invoices as required by law.
• HPTAI's legitimate interests in protecting copyright and preventing fraud, balanced against your rights.

5. Machine fingerprint and copyright protection

To prevent unauthorised copying and sharing of licenses, the add-in generates a “machine fingerprint” from the device's hardware characteristics. This is where we place particular emphasis on compliance with Decree 13:

• We do NOT store raw hardware identifiers (such as disk serial numbers, MAC addresses or CPU IDs) on our systems.
• These characteristics are passed through a one-way hash function on your own machine; the system only receives and stores the resulting hash.
• The original hardware information cannot be reconstructed from the hash. The hash is used only to confirm the “correct registered machine” during activation and license verification.
• This lets us protect copyright while minimising the personal and device data we must store, following the data-minimisation principle of Decree 13.

6. Sharing data with third parties

We do NOT sell, rent or trade your personal data. Data is shared only with the processors needed to operate the Services:

• Storage and content-delivery infrastructure providers (storage gateway/CDN) to host the website and course videos.
• A transactional email service to send order notifications, account activation and support messages.
• Competent state authorities when there is a lawful request under the law.
• These third parties may process data only on our instructions and under a confidentiality agreement.

7. Retention period

We keep personal data for as long as needed for the stated purposes or for the period required by law:

• Consultation/quote data with no resulting transaction: kept for up to 24 months from the last contact, unless you request earlier deletion.
• Order, invoice and accounting data: kept for the period required by Vietnamese accounting and tax law.
• Machine fingerprint hashes and license logs: kept for as long as the license remains valid, for verification purposes.

8. Cookies and analytics

The website uses the minimum technical cookies needed to sign you in and remember your language and theme preferences.

We use Umami analytics — which uses no cookies and collects no personally identifying information, measuring only aggregate visits to improve content. We do not use advertising cookies that track behaviour across websites.

9. Security measures

• Data is transmitted over encrypted connections (HTTPS).
• Sensitive information such as machine fingerprints and passwords is one-way hashed.
• Internal access is granted on a least-privilege basis; only staff who need it can access customer data.

10. Your rights as a data subject

Under Decree 13/2023/ND-CP, you have the following rights over your personal data:

• The right to be informed about the processing of your personal data.
• The right to consent or refuse, and to withdraw consent at any time.
• The right to access, view and correct your personal data.
• The right to request the provision, deletion or restriction of processing.
• The right to object to processing in the cases provided by law.
• The right to complain, denounce, litigate and claim compensation as provided by law.
• To exercise these rights, send a request to our email; we respond within 72 hours under Decree 13 and may verify your identity before processing.

11. Children's data

The Services are aimed at engineers, students and professional organisations. We do not intentionally collect data from anyone under 16. If a user is under 16, processing requires the consent of a parent or guardian under Decree 13.

12. Cross-border data transfer

Some infrastructure providers may host servers outside Vietnam. Where personal data is transferred abroad, we do so in line with Decree 13, including preparing and retaining a cross-border transfer impact assessment dossier where one is required.

13. Changes to this policy

We may update this policy to reflect changes in law or in the Services. The new version takes effect once published, with the update date shown at the top. For significant changes, we will notify you through appropriate channels.