Privacy Policy

SpacePOS operates the shopper website at spacepos.minno.vn and the seller/partner console at spaceposadmin.minno.vn. For marketplace orders, the seller you buy from also handles the personal data they need to ship and support that order (name, address, phone, order contents).

Questions: email the address on the Contact page (the same inbox used for transactional mail when configured).

We collect what you submit and what the product needs to run.

• Account: email, password (stored as a hash, never shown back), name, optional avatar image.
• Sign-in with Google, Facebook, or Apple: the provider’s user id and the name/email they send us. New OAuth accounts are treated as email-verified.
• Shipping addresses and phone numbers you save (signed-in) or keep in this browser as a guest.
• Cart, selected lines, coupons, orders, and order events (cancel request, received, return request).
• Wishlist/favorites, store follows, and recently viewed products.
• Affiliate click reference stored in this browser (attribution window defaults to 30 days).
• Guest cart token in this browser if you shop without an account.
• Session tokens: access token in memory; refresh token in an HttpOnly cookie on the API host (customer vs other roles use different cookie names).
• Technical logs and optional Sentry error reports if that key is configured.
• Signup accepts a marketing_opt_in flag for compatibility; it is not persisted on the user record yet.

We use this data to run the marketplace: create and secure your session, show catalog and your cart, quote shipping at checkout, take payment via Stripe or PayPal, place orders with sellers, send one-time email codes (sign-up, sign-in OTP, password reset), and show your order history when you are signed in.

We do not sell your personal information. We share only as needed to operate the product:

• Sellers: shipping details and line items for orders they must fulfill; they see return reasons you submit.
• Stripe and PayPal: payment confirmation; we do not store full card numbers.
• Google, Meta, or Apple: only during OAuth login you start.
• Email delivery (SMTP or SendGrid) for OTP and similar mail.
• Object storage / CDN for images you or sellers upload.
• Infrastructure hosts that run spacepos.minno.vn and the API.

Card payments use Stripe Elements in the checkout dialog. PayPal uses PayPal’s SDK. Cash on delivery is recorded as a method on the order when offered. Saved cards in Profile → Wallet are not enabled unless an explicit flag is turned on; by default that screen shows as coming soon.

We keep account and order records while the account is active and as needed for fraud prevention, dispute handling, and tax/accounting on marketplace transactions. Deactivating an account (see Rights) currently sets status to deactivated; it does not erase historical orders.

You can correct name and addresses in Profile. You can change your password. You can stop using social login by not clicking those buttons; unlinking is not a self-serve screen today.

Account deactivation exists as POST /v1/auth/delete-account and requires your password. It is not a full “right to be forgotten”: profile fields are not anonymized, and OAuth-only users (no password) receive an error. There is no Delete button on this website yet, and the documented data:export / data:delete customer APIs are not implemented. Email us if you need deactivation or a manual data request - we will handle it operationally, not via a self-serve download pack.

Depending on where you live (for example GDPR or CCPA), you may have additional rights. Contact us to exercise them. We will not pretend a 30-day automated archive exists until that pipeline ships.

SpacePOS is not directed at children under 13. Do not create an account if you are under 13. We do not knowingly collect data from children.

Passwords are hashed. Refresh tokens are rotated. OAuth uses PKCE; the client secret stays on the auth service. Access tokens are not written to localStorage. You should still use a unique password and complete email verification.

We will update the date at the top of this page when the policy changes. Material changes (new processors, new account-deletion behavior) will be reflected here when they actually ship in the product.

Use the Contact page or the support email listed there. Include the email address on the account and, if relevant, an order number. Do not send passwords or one-time codes.