Privacy policy

Ferry is operated by Đinh Nguyên Khánh (sole proprietor), email hi@getferry.store. Address and tax number: being updated.

Send any request about your personal data to hi@getferry.store. For data you give a store when you buy (email, invoice details), that store's owner (the creator) is the controller and Ferry processes it on their behalf.

• Your email, display name and the store details you enter.
• The SePay API token and the bank account you connect. The token is encrypted at rest; Ferry never holds your banking credentials.
• Your products, prices, uploaded files, orders and revenue.

• The email, name and invoice details you enter at checkout.
• Bank-transfer details SePay relays so the order can be matched: amount, transfer memo, reference code and time. Ferry does not see your balance or account history.
• The products you bought and your downloads.

• IP address, browser type and error logs, used for security and rate limiting.
• A session cookie and a cookie recording your consent choice (see section 6).

• Performing a contract – running your store, recording orders, delivering digital products, sending confirmation emails and download links.
• Legal obligations – keeping transaction records as accounting and tax law require, handling consumer complaints.
• Legitimate interests – securing the system, preventing fraud, aggregate usage statistics.
• Consent – Ferry's own newsletter or marketing email. Withdraw at any time with the unsubscribe link.

Ferry does not sell personal data and does not use buyers' data to advertise for third parties.

Ferry shares data only as needed to provide the service, with processors under contract:

• SePay – bank-transfer notifications to match and reconcile orders.
• Resend – transactional email (order confirmations, login links, invitations).
• Cloud storage provider – product files and images; buyers download through signed links that expire within minutes.
• Cloudflare – content delivery and protection against attacks.
• The store owner (creator) – receives the buyer's email, name and invoice details to deliver, support and file taxes.

Some processors host data outside Vietnam. Cross-border transfers follow the rules of Decree 13/2023/ND-CP.

• Account data: until you delete your account or store.
• Orders, transactions and invoices: for as long as accounting and tax law require, even after deletion.
• System logs: up to 12 months.
• Sent email: 12 months, for support lookups.

Connections are always HTTPS; tokens and credentials are encrypted at rest; internal access is limited. If an incident affects your data, Ferry notifies you and the competent authority within the statutory period.

Ferry uses only necessary cookies: a login session cookie and one recording whether you accepted or declined cookies. Ferry sets no advertising cookies. A store may enable its own ad tracking tag on its checkout; the page then asks for your consent first, and the store owner is responsible for that tag.

Under Decree 13/2023/ND-CP you have the right to:

• Be informed and to consent before processing.
• Access, view and obtain a copy of your personal data.
• Correct inaccurate or incomplete data.
• Withdraw consent, restrict or object to processing.
• Request deletion, except what the law requires us to keep.
• Complain, report and claim compensation as provided by law.

Send requests to hi@getferry.store. Ferry answers within 72 hours of a valid request. You may also complain to the Department of Cybersecurity and High-tech Crime Prevention (A05), Ministry of Public Security.

Ferry is not directed at people under 16. Children's data is processed only with a parent's or guardian's consent as the law requires. If you believe a child has given Ferry data, tell us and we will delete it.

When the policy changes, Ferry updates the date at the top and emails store owners if the change is material. Continuing to use the service after a change takes effect means you accept it.