Privacy Policy
This Policy explains the data that Virava Auto Content (the WordPress plugin, the Chrome extension “Virava – Rank Checker” and the content server content.wiwi.vn) collects, the purposes of use, the recipients, the retention periods and your rights. We have developed this Policy in accordance with Vietnamese law on personal data protection, including the Law on Personal Data Protection No. 91/2025/QH15 and Decree No. 356/2025/ND-CP, together with their implementing documents.
1. Who is responsible for the data
Wiwi Agency — WIWI Co., Ltd., tax code 0316249219. Head office: 140/18/31/30 TX22, Thoi An Ward, Ho Chi Minh City. Business office: 39A Nguyen Van Dau, Binh Loi Trung Ward, Ho Chi Minh City. Wiwi is the controller and processor of the data on the content server. Data located in your WordPress site (articles, plugin settings) is managed by you.
2. Data we receive
Most of the data is information about the website and the business. Personal data is present only when you enter it yourself (for example, an author name, a contact person, or an email address for receiving invoices). Please do not enter sensitive personal data (health, personal finances, identity document numbers, etc.) into content requests.
| Data category | What it includes | When |
|---|---|---|
| Website connection | Home page and admin page addresses, the plugin’s result-receiving URL, installation ID, WordPress and plugin versions, domain name. WordPress passwords are not collected. | When you click “Connect website” |
| Contact and subscription preferences | The website’s contact email (by default the WordPress admin email, which you can change); your choice to receive or not receive guides, updates and offers, the time of the choice and the wording version of the checkbox. The subscription checkbox is not pre-ticked and is not mandatory; an existing contact email is not deemed consent to receive messages. | When connecting the website, or when you change it under Settings → “Contact & subscriptions” in the plugin |
| Brand information | Brand name, product/service information, writing voice, calls to action, author bio. | When saving settings or creating articles |
| Content requests | Ideas, keywords, notes, categories, objectives, target customers, reference links and materials; titles and URLs of similar existing articles for de-duplication. | When suggesting ideas or creating articles |
| Drafted content and usage | Results of each processing step (research, search intent, outline, draft, finished article), suggested ideas/briefs, illustrative images; AI usage figures for each run (model, number of tokens, number of images, cost) for credit calculation. The server does not store the verbatim prompts sent to the AI. | When the system processes a request |
| Google results via the extension (optional) | Position, URL, title and description snippet of the top 10 results, related questions and searches; the extension’s device ID. Page HTML, cookies and browsing history are not sent. | When you pair the extension and turn on “Allow fetching Google results” |
| Payment | Top-up order ID, amount, number of credits, status; bank transaction information forwarded by SePay (transaction ID, amount, transfer description, time, receiving account). Card information is not collected. | When topping up credits |
| Invoicing information | Entity name, tax code, address, email for receiving invoices. | When topping up credits |
| Technical | Web server access logs (time, path, response code, IP address); security logs when a request is rejected (invalid signature, replayed request, failed admin login — including IP address); signatures and request anti-replay codes; banner clicks (stored as a daily IP hash, the IP is not stored). | When the plugin, extension or browser calls the server |
Some data does not pass through our server: rank checking (the extension reads Google in your browser and sends results directly to WordPress), Google Search Console and Google Drive (the plugin uses the Google account/key you configure in WordPress).
3. Purposes of use
- Verifying and connecting websites, and managing each website’s own credit wallet.
- Suggesting ideas, researching, drafting articles, creating illustrative images and delivering articles to WordPress at your request.
- Calculating credits, reconciling payments, issuing invoices, and refunding credits or money.
- Security, prevention of fraud and abuse, troubleshooting, complaint resolution, and support when you contact us.
- Using the contact email to send notices about transactions (credit top-ups, credit/money refunds), incidents, changes to the terms, and support.
- Only if you opt in to receive messages: sending Virava guides, updates and offers to the contact email. You may withdraw at any time by unchecking this box under Settings → “Contact & subscriptions” in the plugin and clicking Save; withdrawal does not affect your use of the service.
- Operational statistics in aggregate form (number of requests, processing time, banner clicks).
We do not sell your data and do not use your data, requests or articles to train AI models.
4. Data recipients
| Recipient | Role | Data received |
|---|---|---|
| Virtual private server (VPS) provider located on VNPT network infrastructure in Vietnam: | Leases the infrastructure hosting the content server and backups | All data stored on the server (stored only; the provider does not use it for its own purposes) |
| Google LLC — Gemini API | Provider of the AI models that draft content and create images | The necessary portion of each request: brand information, ideas, keywords, notes, reference materials, results of previous steps. Processed under Google’s API terms of service. |
| SePay | Bank transaction reconciliation party (not a payment gateway; Wiwi does not receive money through SePay) | Information on transactions transferred into Wiwi’s receiving account: transaction ID, amount, transfer description, time |
| Receiving bank: VPBank (Vietnam Prosperity Joint Stock Commercial Bank) | Receives bank transfers, processes refunds | The transactions you transfer and the account receiving refunds |
| SePay — QR image generation service (qr.sepay.vn) | Generates the transfer QR code image (VietQR standard) displayed in the plugin | Wiwi’s receiving bank and account number, amount, transfer description (site domain + number of credits) — your browser loads the image directly from this service |
| Competent state authorities | When required by law | As lawfully requested |
Virava currently does not use any customer email delivery service, CDN or cloud backup service. Backups are encrypted and stored on the server, and are also copied to a computer managed by Wiwi; the decryption key is held separately by Wiwi. If a new recipient is added, this list will be updated before use.
5. Server location and cross-border data transfer
The content server is a virtual server located in Vietnam (VNPT network infrastructure). The second backup copy is located on Wiwi’s computer at: . Regardless of where the server is located, when content is drafted, request data (which may include personal data you enter) is sent to Google for processing, so a cross-border data transfer may occur. We send only the data necessary for each step and carry out the cross-border data transfer impact assessment procedure as required by regulations.
6. Retention periods
| Data | Retention period on the server |
|---|---|
| Article results and images awaiting delivery to WordPress | 7 days from completion (extended up to a maximum of 30 days if delivery requires more time). The copy in your WordPress site is not affected. |
| Keys of paired extensions | Up to 30 days, or until you revoke them. |
| Website information, brand information | For as long as you use the service. Disconnecting only revokes access and stops synchronization; it does not delete the wallet or credits. When you request closure of the service: within 30 days you may request an export of your data, after which Wiwi deletes the content data (currently done manually upon receipt of the request). |
| Request content and results of each processing step (ideas, keywords, notes, drafts) for completed requests | 90 days from when the request ends; after that the text content is deleted, and only figures (request ID, status, number of credits, AI usage) are kept for reconciliation. Deletion runs automatically every day. Requests that are being processed, awaiting credits, have undelivered results, or are subject to a complaint/incident are kept until resolved. |
| Contact email and subscription preferences | Contact email: for as long as you use the service; you can change it at any time. Current subscription preference and the history of opting in/out (time, wording version, no IP address): kept with the website’s records to evidence consent or withdrawal. Deleted together with the website data when you request closure of the service. |
| Records of acceptance of the terms | The version of the terms and the time you accepted: kept with the website’s records. IP address at the time of acceptance: 12 months, then automatically deleted. |
| Logs | Web server access logs (with IP): 14 days. Application logs: 30 days. Article processing logs (article ID, status, no IP): 60 days. Security logs (with IP) and resolved alerts: automatically deleted after 12 months. Admin activity logs (with IP) are locked against modification/deletion to serve as evidence; they are currently not automatically purged, and are expected to be kept for 12 months and then moved to archival storage. |
| Backups | Periodic backups (encrypted): 7 days on the server and 60 days on Wiwi’s computer. Data deleted from the main system may still remain in backups until the backups expire (7 days on the server, 60 days on Wiwi’s computer). |
| Credit ledger, top-up orders, bank transactions, invoices, AI usage figures used for reconciliation; data related to disputes | Under a separate records retention policy, consistent with the retention periods required by law (accounting, tax), or until the dispute is resolved. |
7. Security
- HTTPS-encrypted connections; each request from the plugin is signed with the website’s own key and protected against replay.
- The connection key is stored encrypted in WordPress; the extension’s key resides only in the extension’s storage and cannot be read by web pages.
- The server admin site requires two-factor authentication, with role-based access control and activity logs (including logins).
- Backups are encrypted before leaving the server and are integrity-checked upon restoration.
- No system is absolutely secure. When an incident affects data, we notify you and the competent authorities within the time limits prescribed by law.
8. Your rights
Under the law on personal data protection, you have the right to be informed, to consent or withdraw consent, to access, to rectify, to request erasure, to restrict or object to processing, to request provision of data, to lodge complaints, and to claim compensation as prescribed. Some rights may be limited where data must be retained under legal obligations (for example, payment records and invoices).
How to exercise them: edit brand information in the plugin (Settings); change the contact email or opt out of messages under Settings → “Contact & subscriptions”; revoke the extension under “SERP Extension”; remove the connection or uninstall the plugin; or send a request through the contact channel in Section 10. Requests to export, delete or restrict processing of data on the server are currently carried out manually by Wiwi after verifying that you are the website administrator. We respond within the time limits prescribed by law.
9. Cookies
These terms pages do not set cookies. The server admin site uses session cookies only for Wiwi staff logins. The plugin runs in your WordPress site and uses WordPress’s login cookies.
10. Contact
Wiwi Agency — WIWI Co., Ltd., tax code 0316249219. Head office: 140/18/31/30 TX22, Thoi An Ward, Ho Chi Minh City. Business office: 39A Nguyen Van Dau, Binh Loi Trung Ward, Ho Chi Minh City.
huy.tn@wiwi.vn · Phone: 0971808330 · Website: https://wiwi.vn