Privacy Policy

1. Who is responsible for your data

emtavi is used by companies and organizations as a workspace for their employees. The company you work for — the one that created your account or invited you — is the data controller: it decides which features are enabled (for example attendance by WiFi, GPS, selfie or face-recognition camera) and who in the company can see the data. ViHAT Group (emtavi) is the data processor and processes data on the company's instructions to provide the service. For the sign-up details of the person who creates a workspace and for website operation data, ViHAT Group is the data controller.

2. Account and profile information

When you sign up, your company creates an account for you, or you update your profile, we store:

• Your name, email address, phone number and password (stored only as a hash, never in plain text).
• Employee code, job title, unit/department, manager, start date and other profile details entered by your company or by you, such as date of birth, gender, profile photo, cover photo and bio.
• Company details when signing up for a trial: company name, web address, phone number, size and country.
• If you sign in with Google: your name, email address and profile picture from your Google account.

3. Attendance data

Collected only when your company enables attendance and when you perform a check-in or check-out:

• Check-in/check-out times, shifts, workdays, leave, business-trip and attendance-correction requests (with attached photos, if any) and their approval results.
• WiFi attendance: the network name (SSID) and access point address (BSSID) of the WiFi you are connected to — read only when you tap check-in, to compare against your office's WiFi list.
• GPS attendance: your location (coordinates, accuracy, mock-location indicator) — taken only at the moment you tap check-in while the app is open. emtavi does not track your location in the background.
• Selfie for GPS check-in (if your company requires it): encrypted and automatically deleted after 90 days.
• Customer visits (field staff): location at check-in and check-out, customer name, person met, notes, outcome and a check-in photo. Photos are encrypted and automatically deleted after the period set by your company (90 days by default).
• A random device ID generated by the app and the operating system type, sent with each check-in to prevent fraud. We do not collect advertising IDs, IMEI numbers or your contacts.

4. Face recognition (Hanet cameras)

If your company uses Hanet AI cameras for attendance, you or your HR team submit a face photo to register. This is biometric data and is used only for attendance:

• A photo you submit yourself is encrypted while awaiting HR review and is deleted from emtavi as soon as it is approved or rejected.
• On registration, the face photo together with your name and employee code is sent to Hanet to create a face profile on your company's camera system. Recognition is performed by Hanet's cameras and system; emtavi only receives the result (who, when, which camera) along with a link to the capture image stored by Hanet.
• emtavi does not use face data for advertising, does not sell it and does not use it for any purpose other than attendance.
• You can ask your HR team to remove your face at any time. When you delete your account, emtavi deletes your face data and sends Hanet a request to remove your face profile.

5. Newsfeed, AI assistant and other content

Content you create in emtavi is stored so it can be shown to colleagues in your company according to their permissions:

• Posts, photos, comments and hearts on the newsfeed; read confirmations for announcements; missions, contributions, reward points and gift redemptions.
• AI assistant: the questions you send and the answers are saved as chat history so you can review them; you can delete each conversation. To answer, your question together with relevant passages from your company's knowledge base is sent to the AI model provider (section 7). Please do not enter unnecessary sensitive information into the AI assistant.

6. Notifications

The app shows notifications directly on your phone (for example when a camera has recorded your attendance) and in the in-app notification bell; some notifications are sent by email, or via Zalo if you have linked your Zalo account yourself. emtavi does not send advertising. You can turn off notification permission in your phone settings at any time.

7. Service providers that process data

We do not sell personal data and do not share data for advertising. Data is only transferred to providers needed to run the service:

• Railway (United States): emtavi's servers, database and file storage.
• Hanet: AI face-recognition cameras — only if your company uses this feature.
• Anthropic (Claude models): generates answers for the AI assistant. Anthropic does not use data sent through its API to train models. When enabled, Cohere (re-ranking search results) and Tavily (web search) may receive the content of questions.
• Email service provider: sends verification codes, invitations, password resets and notifications.
• Google: only if you choose to sign in with Google. Zalo: only if you link your Zalo account yourself to receive notifications.
• Competent government authorities: only when required by law.

8. Storage and security

We apply appropriate technical measures to protect data:

• All connections between the app, the website and our servers are encrypted (HTTPS).
• Each company's data is isolated at the database level. Passwords are hashed; GPS selfies, customer-visit photos, face photos awaiting review and camera connection keys are encrypted.
• On your phone, your sign-in session is kept in the operating system's secure storage.
• Data may be stored and processed on servers located outside Vietnam.

9. Retention

We keep data only for as long as necessary:

• Account and profile information: for as long as you use emtavi; deleted immediately when you delete your account.
• Attendance selfies: automatically deleted after 90 days. Customer-visit photos: automatically deleted after the period set by your company (90 days by default).
• Face photos you submit: deleted as soon as they are approved or rejected. Face profile on Hanet: until it is removed or you delete your account.
• Attendance data, requests, timesheets, posts and reward-point history: kept for as long as your company uses emtavi, because the company needs them for employment and payroll records as required by law. When it stops using the service, the company may request deletion.
• AI assistant chat history: until you delete the conversation.

10. Deleting your account

You can delete your account at any time in the app (Cá nhân / Profile → Tài khoản & bảo mật / Account & security → Xoá tài khoản / Delete account), on the web (Profile page → Delete account) or by emailing hello@emtavi.com. When you do, your name, email address, phone number, photos, employee code, other profile details and face data are removed, and you can no longer sign in. Attendance data, posts and comments you created are kept by your company under the name "Deleted account". See detailed instructions on the Delete account page.

11. Your rights

Under personal data protection law, you have the right to be informed, to access, correct and delete your data, to withdraw consent, to object to or restrict processing, and to lodge a complaint. You can edit most profile details yourself in the app; for data managed by your company (such as attendance), please contact your company's administrator or HR team. You can withdraw location, camera, photo or notification permissions in your phone settings at any time — some attendance methods will then be unavailable. You can also send a request to hello@emtavi.com; we will work with your company and respond within the time limits required by law.

12. Website and cookies

The emtavi.com website uses only one cookie, to remember the language you choose. We do not use advertising cookies or analytics tools that track users; if you use the Sign in with Google button, Google may set cookies under its own policy. The emtavi app contains no ads and does not track you across other companies' apps or websites.

13. Children

emtavi is intended for working people and organizations and is not intended for anyone under 16. We do not knowingly collect children's data; if we find any, we will delete it.

14. Changes to this policy

We may update this policy as the service changes. The update date is shown at the top of this page; for significant changes, we will notify you in the app or by email before they take effect.

15. Contact

emtavi is developed and operated by ViHAT Group. For any privacy questions or requests, please email hello@emtavi.com.