Privacy Policy

1. Information we collect

Account details: full name, email, phone number, password (stored only as a one-way hash), preferred language.

Profile details that are optional or needed for some roles: birth year, ID type and ID number. ID numbers are encrypted at rest.

Activity: classes you booked, seats, attendance, Mills Point balance and history, reviews, favourite classes and instructors.

Payment details: when you pay by bank transfer, we receive from SePay the amount, transfer note, transaction ID and time. We never receive or store your bank card number.

Technical data: IP address, browser and device type for sign-in sessions, session cookies.

2. How we use it

To create and protect your account, verify your email and send sign-in or password reset codes.

To book classes, check you in by QR code, manage Mills Points, process payments and add Mills Points once money arrives.

To show reviews and rankings, handle abuse reports and prevent fraud and misuse.

To send necessary transactional emails (verification codes, password change notices, role notices). We do not use your data to sell advertising.

3. Google user data

We use the Gmail API with a single permission, sending mail (gmail.send), from the studio's own mailbox, only to send this service's transactional emails to you.

We do not read, download, store or share anyone's mailbox content, and we do not use this permission for advertising or to train AI models.

Our use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

4. Sharing

We do not sell your personal information.

The brands and clubs you are a member of see what they need to run classes (name, contact, bookings, Mills Points).

Your reviews appear publicly under a nickname. Your real name shows only if you turn on a public profile.

Providers process data on our behalf: Supabase (database), Vercel (hosting), Google (email delivery), SePay (transfer confirmation). They may use the data only to provide the service.

We may disclose information when a competent authority requires it under the law.

5. Cookies

We use a session cookie to keep you signed in and a cookie that remembers your language. We use no third-party advertising or tracking cookies.

6. Storage and security

Passwords are hashed, ID numbers are encrypted, and database access is restricted to the server side. No system is perfectly secure, but we apply reasonable measures to reduce risk.

We keep data while you use the service and for the time needed to reconcile payments or comply with the law. You can ask for earlier deletion under section 7.

7. Your rights

You may access, correct or ask us to delete your personal data, withdraw consent or object to processing, as provided by applicable law, including Vietnamese personal data protection rules.

Send requests to 5millsgroupx@gmail.com. We will reply within a reasonable time. Some data may need to be kept where the law requires it.

8. Children

The service is not for children under 16 without a parent or guardian's consent. If you believe a child registered without consent, contact us and we will act on it.

9. Changes

When this policy changes we update this page and its date. Important changes will be announced in the app or by email.

10. Contact

5MILLS Group X Studio, email: 5millsgroupx@gmail.com.