Privacy policy

CauVelo is a service in development, built by its two founders, Krystian (Thailand) and Patryk (Vietnam). It starts in Đà Nẵng, Vietnam.

The company that will run CauVelo is not registered yet. Until it is, the two founders decide how the data on this page is used and are responsible for it. We will add the company's name and address here when it exists.

• Traveller sign-up: your email address, the dates you'll be in Đà Nẵng, the language of the page, the link that brought you here (if there was one) and the time you agreed.
• Venue application: the venue's name, type and street, your name and role, your Zalo or phone number, the language of the page, the link that brought you here and the time you agreed.
• Technical logs: when you open a page or send a form, our servers record the time, the page, the result and the network address the request came from. Logs never contain what you typed into a form.

We use your network address for up to 10 minutes to stop the forms being flooded. We don't store it with your sign-up or application.

The guest app is not open yet. This is how it is designed to work, and we will update this page before it opens.

• Your preferences (language, diet, allergies) stay on your phone. We receive them only when you add them to an order, and allergies only after you agree on a separate screen.
• Orders: the dishes, your notes and the table, sent to the venue's staff so they can confirm and prepare them.
• Chat with the AI assistant: your messages and its answers, kept for 30 days and then reduced to anonymous totals, such as which dishes guests asked about. Voice recordings are not stored.

Allergies are chosen with buttons. Health details typed as free text are not sent to the AI. For orders, the venue decides what it needs, and we handle the data on its behalf.

• To send the one email you asked for, a few days before your trip.
• To talk to a venue that applied about a pilot.
• To keep the site working and secure, and to stop spam on the forms.
• In the app, later: to pass your order to the staff and to answer your questions about the menu.

We don't sell or rent your data, we don't use it for advertising, and we don't use it to train AI models.

We follow Vietnam's Law on Personal Data Protection (Law 91/2025/QH15) and Decree 356/2025/ND-CP. Where the EU General Data Protection Regulation (GDPR) applies, for example when a company in the EU handles the data, we follow it too.

• Consent: traveller sign-ups, venue applications and, in the app, any allergy you share. The box is never ticked for you, and you can withdraw consent at any time.
• Contract: in the app, handling your order so the venue can serve it.
• Legitimate interest under the GDPR, and the cases Vietnamese law allows without consent: security logs and protecting the forms from abuse.

• Traveller email and dates: deleted after we send the pre-trip email, or 7 days after your trip ends, whichever comes first. If you don't confirm your address within 7 days, the link expires and we never write to you.
• Venue applications: kept while we talk about a pilot, and deleted when you ask.
• Technical logs: kept for a short time to fix problems and look into abuse, then deleted.
• App chats, later: 30 days, then only anonymous totals remain.

A few service providers handle data for us, only on our instructions and only for the purposes above:

• Hosting: our server and database are in Singapore.
• Network: a provider that delivers the pages and protects the site from attacks.
• Email: a transactional email provider sends the confirmation and the pre-trip email.
• AI models, in the app later: providers of AI models process a conversation to answer it.

We will name each provider on this page before the app opens.

Our server is in Singapore, and some providers may handle data in other countries, including the United States. The two founders work from Vietnam and Thailand, so data is also accessed from both countries. When data leaves Vietnam, we follow the transfer rules of Vietnamese law, including the transfer impact assessment. Where the GDPR applies, we use the EU standard contractual clauses.

• See the data we hold about you and get a copy.
• Correct it if it's wrong.
• Delete it.
• Withdraw consent at any time. This doesn't affect what we did before.
• Object to or limit how we use it, where the law gives you that right.
• Complain to the authority: in Vietnam, the Ministry of Public Security, which oversees personal data protection; in the EU, the data protection authority in your country.

Using these rights is free. We may ask you to confirm who you are first.

This website is not meant for children, and we don't knowingly collect data from anyone under 16. If you think a child has sent us their details, tell us and we will delete them.

Only the two founders can open the database. Everything travels encrypted (HTTPS), and our logs carry reference numbers, never what you typed.

When we change this page, we update the date at the top. If a change affects data you already gave us, we will tell you or ask again before it applies.