Privacy Policy
Last updated: 20 October 2026
Intaky is a client intake and document collection service, operated by Ha Van Luong, an individual sole trader based in Vietnam, who is responsible for the personal data described here ("Intaky", "we", "us"). This policy explains what we do with personal data — both the data we hold about the people who run workspaces on it, and the data those workspaces collect from their own applicants. Those are two different relationships, and section 1 sets out which one applies to you.
If your organisation is subject to a particular data protection regime and needs terms that address it, write to [email protected] before you start and we will work it out with you.
1. Two different relationships
If you run a workspace — you signed up, you administer it, or you review submissions in it — this policy describes what we do with your personal data.
If you submitted an application to an organisation using Intaky, we only hold that information on their behalf. The organisation that asked you for it decides what to collect, why, and how long to keep it; we act on their instructions. Ask them first — they are the ones who can answer, correct or delete. If you cannot reach them, write to us and we will help you work out who to contact.
2. What we collect about workspace users
- Account information: your name, email address, the organisation name, and your role in the workspace. Staff passwords are stored only as salted hashes; applicants can access their portal through an email link without setting a password.
- Usage and device information: IP address, browser and operating system, and the pages and actions performed, kept in server logs to run the service and to investigate faults and abuse.
- Review activity: which reviewer accepted, rejected or commented on what, and when. This is deliberate — it is the audit trail the product exists to keep.
- How you found us: if the link you followed to sign up carried campaign
tags (the
utm_labels an ad or an email adds to its link, such as the source and search term), we record them once on the new workspace, so we know which of our campaigns work. They are passed along on the link itself; nothing is stored on your device for it. - Enquiries: whatever you send us through the contact form or by email.
- Billing information: for a paid plan, which plan the workspace is on, its status, its billing dates, and the reference Paddle gives the subscription. We do not receive or store card numbers. The billing page may show your card's brand and last four digits, which it asks Paddle for when it needs them.
3. What we process for our customers
Workspaces collect forms and documents from their own applicants. Depending on what the organisation asks for, that can include identity documents and financial records. We do not choose what is asked for, and we do not use any of it for our own purposes: no profiling, no analytics across customers, and no training of machine-learning models.
4. Who else is involved
We do not sell personal data and we do not share it for advertising. We use a small number of service providers who process data on our behalf, under contract:
- Our server hosting provider — the data centre that runs the application and its database.
- Cloudflare — object storage for uploaded documents, the network connection in front of the application, hosting for this marketing site, and the privacy-friendly page statistics described in section 7.
- Resend — sending transactional email such as verification codes, invitations and status notifications.
- Sentry — error monitoring, which can incidentally capture technical details of a request that failed.
These providers operate outside Vietnam, so using Intaky means your data is stored and processed abroad. We will update this list before adding anyone to it.
Paddle sells our paid plans as our reseller and merchant of record. When you pay, Paddle collects your payment details, billing address and any tax number itself, and handles them under its own privacy notice as a separate controller. Paddle tells us the outcome, such as which plan was bought and whether a payment succeeded, and nothing more about your card.
5. How long we keep it
- Applicant forms and documents: for as long as the workspace holding them exists, or until the organisation deletes them. When a workspace closes, its content is deleted within 30 days.
- Account records: for the life of the account and 12 months after it closes.
- Database backups: kept on a rolling 14-day window and then destroyed. Deleted data can survive in a backup until that window passes.
- Server logs: 14 days.
- Billing records: the plan and subscription details above are kept for the life of the workspace. Paddle keeps invoices and payment records for as long as tax and accounting law requires.
- Enquiries: 24 months from our last exchange.
6. How we protect it
Traffic is encrypted in transit with TLS. Each workspace's data is separated by tenant-scoped queries and role-based authorisation, and uploaded documents sit in private object storage that is never publicly addressable — every download passes through an endpoint that checks who is asking. Passwords are stored only as salted hashes. Access to production systems is limited to the operator.
No system is perfectly secure, and we would rather say so than imply otherwise. If you believe you have found a vulnerability, please write to [email protected].
7. Cookies
The application sets only the cookies it needs in order to work. They cover signing in, protection against cross-site request forgery, and keeping a registration in progress together while you verify your email. Applicant sign-in sessions last 90 days and can renew while in use. A separate essential cookie remembers the email address used on this device for up to a year, so you can request a new sign-in link without retyping it. Signing out clears that remembered address.
When you pay for a plan, the payment window is Paddle's, and Paddle may set cookies it needs for the payment. Its privacy notice explains them.
This marketing site counts page views with Cloudflare Web Analytics. It sets no cookies, stores nothing on your device, and does not identify or follow you across sites. There is no advertising or cross-site tracking on the site or in the application. If that ever changes, we will ask first.
8. Your choices
You can ask us for a copy of your personal data, to correct it, or to delete it. Write to [email protected] and we will respond within 30 days. Depending on where you live you may have further rights under local law, and we will honour them where they apply.
If you submitted an application to an organisation using Intaky, please see section 1 — those requests belong with that organisation, and we will pass them on.
9. Changes to this policy
We will post any new version on this page and change the date at the top. Where a change materially affects how we handle your data, we will tell workspace administrators by email rather than relying on you to check.