Privacy Policy
This policy explains what personal data Vinabase collects, why, who it is shared with and the choices you have. We collect as little as we can and never sell your data. Vinabase is operated by Thanh Thai Doan, who is responsible for your personal data (the data controller).
1. What we collect
- Account data: your name, email address, password (stored hashed), language and appearance settings.
- Workspace content: the tables, records, files, comments and automations you and your team create. We process it only to provide the service to you.
- Billing data: the plan, number of seats and billing country. Card details are handled by Paddle and never reach our servers.
- Technical data: IP address, browser and device type, and logs of requests and errors, kept to secure the service and fix problems. Workspace admins can see an audit log of actions in their workspace.
2. Why we use it
To run your account and workspaces (contract), to bill paid plans (contract and legal obligations), to keep the service secure and working (legitimate interest), and to send service emails such as password resets, invitations and notifications you have turned on. We do not send marketing emails without your consent.
3. Who we share it with
We use these service providers (subprocessors) to run Vinabase. They may only use your data to provide their service to us:
- Cloudflare — content delivery, file storage (R2) and sending emails.
- Paddle — payments, invoices and sales tax for paid plans, as Merchant of Record.
- AI providers (such as OpenAI and Anthropic) — only the content you send to an AI feature, only when you use it. They do not train on it.
- Our hosting provider — the servers that run the app and its database.
We may also disclose data when the law requires it. Some providers process data outside your country; where needed we rely on standard contractual clauses to protect it.
4. Cookies
We use only cookies needed for the service to work:
- a sign-in token that keeps you logged in;
- your language choice;
- your light or dark theme choice (
vb_theme).
We do not use advertising or third-party tracking cookies, and this website has no analytics.
5. How long we keep it
We keep your data while your account exists. When you delete your account or a workspace, its data is removed within 30 days and from backups within 90 days. Billing records are kept as long as tax law requires.
6. Your rights
Depending on where you live (for example under the GDPR or the CCPA), you can ask to access, correct, export or delete your personal data, object to or restrict how we use it, and withdraw consent. You can change most account data and export your tables yourself in the app. For anything else, email us and we will answer within 30 days. You can also complain to your local data protection authority.
7. Security
Data is encrypted in transit, passwords are hashed, two-factor authentication is available, and access to production systems is limited to the people who need it.
8. Children
Vinabase is not meant for children under 16, and we do not knowingly collect their data.
9. Changes
We will tell you about important changes to this policy by email or in the app before they apply.
10. Contact
Privacy questions and requests: hello@vinabase.app.