Privacy Policy
Effective from: 22 October 2026. Governed by the Law on Personal Data Protection No. 91/2025/QH15 and Decree 356/2025/ND-CP.
Updated 22 October 2026.
This is an English translation of the Vietnamese Chính sách bảo mật. If the two versions differ, the Vietnamese version prevails.
This version replaces the previous one. Accounts registered from 22 October 2026 are bound by this version as soon as they accept it. For accounts that accepted the previous version, this version applies 30 days after 22 October 2026; until then, the previous version continues to apply.
1. Who processes data
Soluta processes businesses’ accounting data. Soluta does not exploit personal data in your books for its own purposes.
- Account and usage-log data (sign-in email, hashed password, payment information, IP address, access logs): Công ty TNHH Soluta is the controller. This is the personal data Soluta collects itself, for sign-in, billing and security (see section 2).
- Data in your accounting books belongs to your business. If the books contain information about individuals (employees, individual customers…) that you record for accounting, you are the controller; Soluta processes it only according to your instructions.
2. What Soluta collects
| Category | Examples | Purpose |
|---|---|---|
| Account | email, account ID, password (stored only as a hash) | sign-in, communication |
| Payments | wallet balance, top-up and charge history; invoice details (company name, tax ID, address, invoice email) | collecting subscription fees, issuing and sending e-invoices |
| Accounting books | journal entries, counterparties, document details (number, date, tax ID, amount), file fingerprints | providing the ledger service |
| Cas Link connections | link status for each item, the access token issued by Casso (no bank or tax portal passwords) | bringing invoices and bank transactions into your books when you link |
| Logs | time, IP address, tool called, result | security, abuse prevention, incident investigation |
| Missing legal lookups | legal search queries, documents or articles not yet in the library (excluding ledger data) | expanding the legal library |
| Error reports / suggestions | content the AI assistant sends when a tool fails or when you give feedback (with tax IDs, account numbers, emails and phone numbers filtered out) | fixing errors, improving the product |
Not collected: original document files (Soluta does not store files) · the content of your conversations with the AI assistant · passwords in plain text.
Sensitive data. Accounting books may contain personal data that the law treats as sensitive: bank account transaction history (statements), salaries, employees’ identification numbers. Soluta processes this data only at your request, to keep the books. For other people’s data in the books (employees, customers…), you are the controller and are responsible for informing them and obtaining their consent under the law.
Automated processing. Soluta uses fixed computer rules to check entries (debits = credits, correct accounts, correct counterparties, legal basis still in force) and to calculate figures in reports and tax returns. Reading documents and drafting proposals is done by the AI assistant you choose. No entry is posted and no decision binds you until you approve it. You can choose not to use an AI assistant.
3. Where data is stored
Servers located in Vietnam.
4. Who we share data with
- The AI assistant provider you choose (Anthropic, OpenAI…): only the data the assistant requests, when you connect it and allow it. You initiate this; the provider processes the data outside Vietnam. In this case you are the party making the cross-border transfer of personal data. Before you put data in, you are responsible for having a lawful basis, preparing the filing when the law requires it, and choosing suitable data protection settings (see the Terms of Use, section 3).
- Công ty TNHH Casso (servers in Vietnam): transfers your business’s e-invoices and bank transactions to Soluta when you link through Cas Link (see the Terms of Use, section 3); creates payment QR codes and notifies Soluta when payment arrives, through its payOS service; issues e-invoices for Soluta’s service fees.
- Infrastructure providers (servers, email, e-invoicing) under confidentiality agreements.
- Government authorities when required by law.
- Soluta does not sell data, and does not use your ledger data to train AI models.
- Soluta may create anonymised statistics, from which no business or individual can be identified, to operate and improve the service.
5. How long we keep data
- Account: for as long as you use the service; deleted at the same time as your last book is deleted.
- Accounting books and ledger access logs: for as long as you use the service, plus 30 days after the contract ends so that you can download them; then deleted. You can ask for earlier deletion.
- Access logs (IP address, time, path) and sign-in logs: 13 months, as required by cybersecurity law. Other web server logs: 14 days.
- Payment and invoice information: 10 years, because these are Soluta’s own accounting records (Law on Accounting).
6. How we protect data
Encrypted connections (HTTPS) · OAuth sign-in, each app receives only the minimum permissions · each person sees only the books assigned to them · books are recorded as a hashed chain, so unauthorized changes can be detected · every call is logged · passwords stored as hashes.
7. Your rights
To be informed · access · rectification · erasure · restriction of processing · objection · withdrawal of consent · a copy of your data · complaint.
How: (1) email info@soluta.vn from your sign-in email, stating your request. (2) Soluta responds within 02 working days, with the procedure. (3) Soluta carries out the request within the time limits set by Decree 356/2025/ND-CP: viewing, correcting or providing data 10 days; withdrawing consent, restriction or objection 15 days; erasure 20 days (may be extended once when needed, with the reason given). You can correct your account and invoicing details yourself under Account. (4) If you disagree with how your request was handled: complain via soluta.vn/en/khieu-nai.
8. Incidents
If a data breach occurs, Soluta notifies the competent authority within 72 hours of discovering it (Law 91/2025/QH15) and notifies you as soon as the affected data has been identified.
9. Contact
info@soluta.vn · Công ty TNHH Soluta · Tầng 29, Tòa Đông Lotte Center Hà Nội, số 54 Liễu Giai, Phường Giảng Võ, Thành phố Hà Nội, Việt Nam
See also: Terms of Use