Privacy Policy
This Policy sets out what data we collect when you use Love Present, the purposes we use it for, who may receive it, how long we keep it, and the rights you hold over it. Where we deliberately collect nothing, that is stated here as well.
2026-09-05
1. Data controller
The data controller is Love Present — Nguyễn Công Trình. Every question, every request to see what we hold and every request to delete it goes to nguyencongtrinhltqb@gmail.com.
2. Data we collect from you
Your account email address and password; the password is stored hashed by the authentication service and we cannot read it. The contents of the gift pages you create, comprising photos, text, music and video. The time at which you accepted the Terms and the version then in force, together with the time you confirmed the rights to a song or a video where the page carries one. Payment records, comprising the amount, currency, status and the transaction identifier returned by the payment provider.
3. Data concerning the recipient of a gift page
We store exactly one item of data about the recipient: the moment the gift was first opened. We do not store a name, an email address, an IP address, browser details, or a count of visits. That timestamp exists for a single purpose, namely to establish whether the gift has been delivered, as the basis for deciding a refund. The recipient enters into no relationship with us and merely receives a link, so that is the limit of what we permit ourselves to know about them. It is recorded only where a real person interacts with the gift, specifically breaking the seal, opening the box, or the first touch on the page. A link pasted into Zalo or Messenger and fetched by that platform to build a preview card is not counted, because it is not the act of a user.
4. Usage statistics and third-party code
We record a small number of events in order to know which features are being used: an occasion page was opened, someone began composing a page, a payment was made, together with the template and language concerned. These events carry no identity, no IP address, and cannot be traced back to an individual. The site uses no Google Analytics and carries no advertising pixel. Exactly one piece of third-party code is loaded: where you choose to pay by card, we load Paddle's checkout library from cdn.paddle.com in order to display the card form. That code belongs to Paddle, sets its own cookies, and receives your IP address and device details under Paddle's own policy. It is loaded only on the payment screen and never on a gift page.
5. Cookies
A gift page sets no cookies at all, because the recipient needs no account and we do not follow them. On the remainder of the site there are two: a session cookie set by the authentication service to maintain your signed-in state, and one recording the language you selected. Both are necessary for the site to function and neither serves an advertising purpose. A third appears only where you open the card payment screen, being a cookie set and controlled by Paddle.
6. The link functions as the access key
A gift page is not protected by a password: anyone holding the link can open it. The page code is ten random characters and therefore cannot be guessed, and we instruct search engines not to index these pages. If the link is shared onward, however, it continues to work. You should pass it on with the same care you would give to a house key.
7. Recipients of the data
The database and the storage holding photos, music and video run on Supabase. Card payments are processed through Paddle; bank transfers are processed through SePay. The site itself runs on a rented server. Beyond those parties, no one receives your data. We do not sell it, rent it, or pass it to any party for advertising purposes.
8. Retention periods
A gift page exists until you delete it, and you may delete it at any time from My pages. Deletion is permanent: the record and its files are removed and the link returns a blank screen. Payment records are retained for longer than the page itself, because a refund dispute commonly arises after the page has been deleted, and a financial record must outlast the thing it records.
9. Data processed when you request a refund
If you paid by bank transfer, we must ask for the account name and account number in order to return the money, because a completed transfer cannot be reversed. Those two details are used once, for that refund alone, are never attached to your account, and are deleted from the mailbox once the money has been received. Card payments require none of this: Paddle refunds the same card, and we never see your card number.
10. Your right of access and right to erasure
You have the right to ask what data we hold about you and the right to require its deletion. Write to nguyencongtrinhltqb@gmail.com with your account email or a page code. A person answers, within 3 working days.
11. Effect and amendment
This Policy takes effect on 2026-09-05. Where something changes, we amend it here and change the effective date shown above; there is no separate archive. If an amendment narrows your rights, we notify the email address on your account before it takes effect.