OakFlowBack to sign in

Last updated: 2026-04-19

Privacy Policy

OakFlow Co., Ltd. ("OakFlow", "we") respects your privacy. This Policy explains what personal and business data we collect, how we use it, and the rights you have. It applies to everyone who creates an OakFlow account or interacts with our platform.

1. Data we collect

  • Account data: your name, email, phone, company name, role, and password (hashed).
  • KYB data: tax ID (MST), business registration number (DKKD), registered address, business licence documents, representative identification, ownership structure, and sanctions screening results.
  • Transaction data: payments sent and received through the platform, counterparty details, amounts, currencies, rails used, timestamps.
  • Device and log data: IP address, browser, device type, and page activity for security and debugging.

2. How we use your data

  • Provide the Services — create and operate your account, execute your payment instructions, issue cards.
  • Comply with legal obligations — AML/CFT, sanctions screening, tax reporting, and SBV regulatory filings.
  • Protect the platform — detect fraud, investigate incidents, and enforce our Terms.
  • Improve the Services — analyse aggregated product usage; we do not sell personal data.

3. When we share data

We share the minimum data necessary with:

  • Bank and rail partners (MB Bank, Techcombank, Wise, Bridge/Stripe, Circle, Thunes) to execute your payments and maintain your accounts.
  • KYB/eKYC providers (VNPT eKYC, VCCI) to verify your business against the Vietnamese tax and business registry.
  • Infrastructure vendors (Supabase, Vercel, Resend, Upstash, Inngest) under written data-processing agreements.
  • Regulators and law enforcement when we receive a lawful request from the State Bank of Vietnam, tax authorities, or a competent court.

We never sell your data. We never share data with advertisers.

4. International transfers

Some of our vendors process data outside Vietnam (e.g. Supabase in Singapore, Vercel in the US/EU). We rely on Standard Contractual Clauses or equivalent safeguards to protect your data during these transfers.

5. Retention

We retain KYB, transaction, and audit-log data for at least 7 years after account closure, as required by Vietnamese AML law. Other personal data is kept only for as long as needed for the purposes above.

6. Your rights

You have the right to:

  • Access the personal data we hold about you.
  • Correct inaccurate data through the dashboard or by email.
  • Request deletion of data we are not legally required to retain.
  • Export a machine-readable copy of your account data.
  • Lodge a complaint with the Ministry of Information and Communications of Vietnam if you believe your rights have been violated.

To exercise any of these rights, email privacy@oakflow.vn.

7. Security

We use TLS in transit, AES-256 at rest, role-based access control, and continuous audit logging. We will notify you within 72 hours of a personal-data breach that affects you.

8. Cookies and analytics

We use a first-party session cookie for authentication. We use privacy-respecting product analytics to understand aggregate usage; these do not track you across other websites. We do not use advertising cookies.

9. Children

Our Services are for businesses and their authorised representatives. We do not knowingly collect data from anyone under 18.

10. Changes

We may update this Policy. Material changes will be announced in the dashboard and by email at least 30 days before they take effect.

11. Contact

Data Protection questions: privacy@oakflow.vn.