Privacy Policy

This policy applies to the entire MiKiName website, application, user accounts, analysis features, reports and support services. Depending on how you interact with the service, we may collect and process the following categories of data:

• Account information: email address, display name, avatar, login authentication details, email verification status and account role. Passwords are always stored as a one-way hashed value; we do not store and cannot view your original password.
• Data you actively provide for analysis: full name, date of birth, gender, information about your child or family members (father, mother, grandparents), names under consideration, relationships between members and any content you enter to calculate Numerology. If you enter another person's data (for example a child or relative), you confirm that you are entitled or authorised to provide and process that data.
• Data generated when using the service: analysis sessions, saved name lists, generated reports, favourited names, the plan you have chosen, order and transaction history, support request content and personal preferences (language, cookie consent).
• Payment data: order code, amount, product/plan type, transaction status, reference code and payment method. For international cards, card details are processed directly by Dodo Payments; MiKiName does not collect or store your full card number, expiry date or security code (CVV).
• Technical and device data: IP address, device type, operating system, browser type and version, screen resolution, language, access time, pages viewed, error logs, security events and interaction measurement data - collected to the extent necessary or when the corresponding cookies are switched on as described in section 6.

Data is collected in three ways: (i) directly from you when you enter information or make contact; (ii) automatically from your device and browser when you use the service; and (iii) from payment or authentication providers when they return transaction or login results to us.

We only process personal data to the extent necessary, corresponding to each specific purpose and with a clear legal basis:

• Providing core services: creating and managing accounts, authenticating users, maintaining login sessions, calculating Numerology metrics, suggesting and comparing names, generating reports and saving results at your request.
• Processing transactions: creating, confirming and reconciling orders; activating your report credits after payment; supporting refunds or credit restoration where applicable.
• Operational communications: sending account verification emails, password resets, order status notifications, PDF reports, reminders to revisit reports you have created and important notices about the service or policies.
• Security and system stability: detecting and preventing fraud, unauthorised access and abuse; logging, backing up, troubleshooting and maintaining performance.
• Product improvement and advertising measurement: analysing how features are used in order to improve the experience, and measuring the effectiveness of the advertising campaigns that bring you to MiKiName using Google Analytics, Google Ads conversion tags and the Meta (Facebook) Pixel. These tools operate according to the cookie settings described in section 6. MiKiName does not display advertising on the site.
• Legal compliance: fulfilling accounting, tax and record-keeping obligations; responding to lawful requests from competent authorities; resolving complaints and protecting the legitimate rights of MiKiName and its users.

Depending on the case, the basis for processing may be: your consent (for example analytics/advertising cookies), the performance of a contract/service you request, a legal obligation we must comply with, or a legitimate interest in security and operations that does not unduly infringe your rights. For activities based on consent, you may withdraw it at any time; withdrawal does not affect the lawfulness of processing carried out beforehand and may cause some features to stop working.

MiKiName does not sell or rent your personal data to any party for commercial purposes. We only share the minimum data necessary with the following categories of partners; each processes the data under its own terms of service and privacy policy or, for competent authorities, under applicable law:

• Payment providers: SePay processes VND transactions for the Vietnam market by bank transfer or QR code. Dodo Payments is our payment processor/Merchant of Record for international markets, charging in USD with applicable taxes already included in the displayed price; it processes card, order and transaction-status data on infrastructure located outside Vietnam and may act as an independent data processor or controller under its own policies. Both providers receive only the data needed to initiate transactions, confirm payments, prevent fraud and process refunds where applicable.
• E-invoicing system (VND transactions): When you request an invoice, MiKiTech is the issuer, via MiKiOS Gateway integrated with MISA meInvoice; SePay is not involved in this step. Data sent to this system includes the company name, tax code and address (for a company invoice), or name and address (when an individual chooses to provide them), and the email address to receive the invoice.
• AI service providers: The analysis in the name-suggestion report and the full Numerology report is written using AI models, processed by third-party AI service providers (including AI model developers and AI model connection platforms). Each request only includes the data needed to write the report: the family name and the names being analysed; your child's date of birth and gender; if you provide them, the parents' names (with Numerology numbers calculated from the parents' dates of birth), the grandparents' names and your preferences for traits and name length; and the Numerology numbers calculated from this data. We do not send email addresses, passwords, login credentials or payment card details. These providers may process data outside Vietnam and outside your own region, for example in the United States, so this is a cross-border transfer and is covered by the safeguards described at the end of this section. How long these providers keep the data is governed by each provider's own policy. You may request the list of AI service providers we currently use through the contact channel described in section 8.
• Infrastructure and operations providers: Cloudflare for content delivery (CDN) and PDF report storage (Cloudflare R2); ZeptoMail (Zoho) to send transactional email such as account verification, password resets and report-ready notices; plus server/hosting services, databases, caching, error monitoring and system security.
• Online support channel: Chatwoot, self-hosted by MiKiTech at chat.mikitech.io, to receive and store conversation content when you use the support chat widget; it sets a chat-session cookie prefixed cw_.
• Measurement providers: Google Analytics, plus the conversion tags of Google Ads and the Meta (Facebook) Pixel, so we can tell which advertising campaign brought you here. Where the law requires asking first, these tools only run after you consent; elsewhere they are switched on by default and you can turn them off at any time, as described in section 6. MiKiName does not display advertising on the site.
• State agencies and competent authorities: upon lawful request, to enforce our terms, resolve disputes, or protect the rights, property and safety of users and systems.

Some of the providers above may store or process data on servers located outside Vietnam. When making cross-border transfers, we transfer only the minimum data needed; that data is protected under the data protection terms each provider publishes for its service, and the transfer is carried out in accordance with applicable law on transferring personal data overseas.

Retention period: We retain data for as long as necessary to provide the service, maintain your account and the reports you have purchased, fulfil accounting and legal obligations, resolve disputes and prevent fraud. The specific period depends on the type of data and purpose of processing - for example, transaction records may be retained longer to meet accounting and tax regulations. When there is no longer a lawful need, data will be deleted, anonymised or isolated through an appropriate process; any remaining technical backups will be removed according to the system's limited cycle.

Security measures: We implement reasonable technical and organisational measures to protect data, including: transmission encryption via HTTPS/TLS; one-way password hashing; access control on a least-privilege basis; separation of development and production environments; logging and anomaly monitoring; regular backups; and frequent security updates. However, no method of transmission or storage is 100% absolutely secure. If an incident significantly affecting personal data occurs, we will remediate it and notify you as well as the competent authorities in accordance with the requirements of the law.

Your responsibilities: You are responsible for keeping your login details confidential, using a strong and unique password, not sharing your account, and notifying us immediately if you suspect unauthorised access to your account.

Under applicable law on personal data protection, you have the following rights over your personal data:

• Right to be informed and to access: request to know what data we are processing about you and receive a copy of that data.
• Right to rectification: request correction or completion of inaccurate or incomplete data. You can edit most of your information yourself in the account page.
• Right to withdraw consent: withdraw consent for processing activities based on consent, or object to or restrict certain processing activities.
• Account and data deletion: request deletion of your account and related data, except for the portion we are required or permitted to retain due to legal obligations, transaction records, security or ongoing dispute resolution.
• Right to data portability: request a copy of your data in a commonly used format or its transfer to another party where the law provides.
• Right to manage cookies: change your non-essential cookie choices at any time, as described in section 6.
• Right to complain: request an explanation, object to or complain about how your data is processed, including complaints to the competent state authority.

To protect you, before processing a request we may need to verify your identity and clarify the scope of the request. Please send requests to [email protected]; we will receive and respond within a reasonable time as required by law.

MiKiName uses cookies and similar technologies (local storage, pixels) divided into three clear categories:

• Essential cookies: required for login authentication, security, request forgery protection, language routing, remembering your consent choices and core functions. This category is always active and cannot be disabled via the banner, because without it the service will not operate correctly.
• Analytics cookies: Google Analytics 4 helps us measure visits, traffic sources, page performance and how users use features, so we can improve the product.
• Advertising cookies: the conversion tags of Google Ads and the Meta (Facebook) Pixel tell us which advertising campaign brought you to MiKiName and whether you completed a purchase. MiKiName does not display advertising on the site, so this cookie group is used for measurement only.

When analytics and advertising cookies are switched on: We determine your region from your IP address. Where the law requires asking for consent first, including the European Union, the European Economic Area, the United Kingdom, Switzerland, Vietnam and certain other countries, or when we cannot determine your region, these two groups only run after you consent through the cookie banner shown on your first visit. In other regions, they are switched on by default. Wherever you are, you can switch each group on or off at any time through the Cookie settings link in the footer, and your choice takes effect straight away.

Global Privacy Control (GPC): If your browser sends a GPC signal, we treat it as a request to opt out and always switch off advertising cookies, in every region.

Children's data: MiKiName is designed to be used by parents, guardians and adults to choose names or perform analysis - typically analysis for children. Children themselves should not create accounts, make payments or submit personal data without the appropriate consent and supervision of a parent or legal guardian. When you enter information about your child, another child or a family member, you confirm that you have the authority to do so and are responsible for the validity of the data. If you believe a child has provided personal data to us without appropriate consent, please contact us so we can review, remove or handle it in accordance with regulations.

Policy changes: We may update this Privacy Policy when the service, providers, technology or legal requirements change. The latest version is always posted on this page together with the update date. For significant changes affecting your rights, we may provide additional notice via the website, in-account notification or email where appropriate. Your continued use of the service after the effective date is deemed acceptance of the updated policy.

For personal data of children under 16, MiKiName relies on the consent of a parent or legal guardian, in accordance with applicable law. You may withdraw this consent at any time by contacting [email protected]; we will then stop processing and delete the related data except where retention is legally required.

The entity responsible for controlling data, operating the service and receiving all requests relating to personal data is:

• Operating entity: MIKITECH ONE MEMBER COMPANY LIMITED (CÔNG TY TNHH MỘT THÀNH VIÊN MIKITECH)
• Product: MiKiName - a Numerology-based naming platform
• Support and data protection email: [email protected]

When contacting us, to help us assist you quickly and accurately, please clearly describe your request, state the email address associated with the relevant account and provide the information needed for us to verify your identity. For safety reasons, never send passwords, OTP codes, security codes or full payment card details via email or any contact channel. We are committed to receiving and responding to your requests within a reasonable time as required by law.