Legal

Privacy Policy

Last Updated

1. Scope and Data Controller

This policy explains how Tạp Chí Phố Wall ("Tạp Chí Phố Wall," "we," "our," or "us") collects, uses, discloses, retains, and protects personal information when you visit tapchiphowall.com, en.tapchiphowall.com, or use related services (collectively, the "Service").

Tạp Chí Phố Wall is the data controller or business handling personal information for the activities described in this policy. This policy is designed to provide the notices and privacy rights required, where applicable, by US federal law, the California Consumer Privacy Act as amended by the California Privacy Rights Act (CCPA/CPRA), the Texas Data Privacy and Security Act (TDPSA), Canada's Personal Information Protection and Electronic Documents Act (PIPEDA) or substantially similar provincial law, Singapore's Personal Data Protection Act 2012 (PDPA), Australia's Privacy Act 1988 and the Australian Privacy Principles (APPs), the European Union General Data Protection Regulation (GDPR), and Japan's Act on the Protection of Personal Information (APPI). Whether a law applies depends on your location, the processing activity, and statutory exemptions.

All user data retained by Tạp Chí Phố Wall is stored exclusively in data centers located in the United States. We comply with privacy and data-security laws and regulations enacted or enforced by US federal and state governments to the extent applicable to the Service.

Using the Service does not mean that you consent to every processing activity. Where the law requires consent, we will request it separately and you may withdraw it.

2. Information We Collect and Its Sources

Depending on how you use the Service, we may process:

  • Account and authentication data: email address, display name, profile image, user identifiers, Google profile data you authorize, session status, and passkey information. When you use a passkey, biometric information such as your face or fingerprint is processed by your device, and we do not receive a copy of that biometric information.
  • Transaction and subscription data: plan, subscription status, invoices, transaction identifiers, VietQR payment information, and payment evidence you submit. Stripe processes card data, and we do not store full payment card numbers.
  • Portfolio and financial preferences: watchlists, ticker symbols, quantities, cost basis, position sizes, alert preferences, and broker-import data that you confirm.
  • Content and communications: comments, likes, votes, support requests, correspondence, attachments, and survey or promotional responses. Content you post publicly may be visible to others.
  • Service usage: content and ticker symbols viewed or searched, course enrollment and progress, feature interactions, AI analysis requests, usage history, and feature limits.
  • Device and network data: IP address, browser type and version, operating system, device, screen resolution, time zone, language, URLs, referral source, access time, error logs, and diagnostic data.
  • Notification data: web-push endpoint, encryption keys, browser or device type, and notification preferences.
  • Cookie and advertising data: cookie or device identifiers, page views, interactions, measurement data, and inferred interests as described in Section 5.

We receive data directly from you, automatically from your browser or device, from service providers such as Google and Stripe, and from public sources or data providers when needed to provide financial content. Do not submit account numbers, identity documents, health data, or other sensitive information unless necessary. Redact that information before uploading an image or document.

3. Purposes and Legal Bases

We process information to:

  • provide accounts, content, courses, portfolios, alerts, AI analysis, and requested features;
  • authenticate users, process payments, manage subscriptions, provide support, and perform our contract with you;
  • secure the Service and prevent fraud, abuse, account sharing, attacks, and payment disputes;
  • personalize content, measure performance, fix errors, conduct research, and improve the Service;
  • send transactional notices, alerts you request, and permitted marketing;
  • deliver, measure, and manage advertising; and
  • comply with law and valid government requests, and protect our rights or the rights of others.

Where the GDPR applies, our legal bases are: performance of a contract; compliance with legal obligations; our legitimate interests in operating, securing, improving, and protecting the Service after balancing your rights; and consent for marketing, non-essential cookies, or other activities where required. We do not use personal information to make solely automated decisions that produce legal or similarly significant effects concerning you.

4. When We Disclose Information

We do not disclose personal information except for the purposes described below. Categories of recipients may include:

  • Infrastructure, database, and security providers: hosting, content delivery, authentication, database, caching, and monitoring providers, including Supabase, Cloudflare, Upstash, and Sentry.
  • Payment providers: Stripe, banks, card networks, and VietQR providers for payment processing, reconciliation, refunds, and disputes.
  • Analytics and advertising providers: Google Analytics, Google AdSense or Funding Choices, and Microsoft Clarity for measurement, analytics, and advertising.
  • AI and automation providers: model providers or gateways that may include Google Gemini, DeepSeek, xAI, OpenRouter, Meta, Merge.dev, and Modal when needed to process an AI request or image you submit.
  • Email, notifications, and media providers: Resend, web-push providers, Bunny.net, YouTube, and content-delivery providers.
  • Advisers and authorities: auditors, advisers, law enforcement, regulators, or other parties where permitted or required by law.
  • Corporate transactions: a buyer, investor, or adviser in a merger, asset sale, restructuring, or similar transaction, subject to appropriate safeguards.

Providers receive data appropriate to their functions and are subject to applicable contractual terms or legal duties. Providers may change as the Service develops.

5. Cookies, Analytics, and Advertising

We use:

  • Essential technologies to maintain sessions, secure the Service, remember theme and language choices, balance traffic, and provide features you request.
  • Analytics and performance technologies from Google Analytics, Microsoft Clarity, and Sentry to understand use, identify errors, and improve performance.
  • Advertising technologies from Google and advertising partners to deliver, limit the frequency of, and measure ads. Depending on your choices and region, partners may use online activity to select contextual or personalized ads.
  • Third-party media such as YouTube or Bunny.net players, which may receive IP address, device data, and interaction data when content loads.

Cookies and similar technologies have different durations, from the browser session to periods set by us or the provider. You may delete or block cookies in your browser and use privacy choices made available by Google, Microsoft, or your device. Blocking essential technologies may prevent features from working. Where required by law, non-essential cookies or technologies may only be used based on your valid consent choice, and withdrawing consent must be as easy as giving it.

6. Notice About Sale and Targeted Advertising

NOTICE ABOUT TARGETED ADVERTISING: We may disclose online identifiers and Internet activity data to analytics or advertising providers. Under broad definitions in some US state laws such as the CCPA/CPRA and TDPSA, this activity may be considered a "sale," "sharing" for cross-context behavioral advertising, or processing for targeted advertising even when no money is exchanged. Section 13 details the opt-out rights available specifically to California residents.

We do not sell personal information for money, and we do not knowingly sell sensitive personal data or biometric data. We also do not process personal data for profiling in furtherance of decisions that produce legal or similarly significant effects concerning you.

You may opt out of covered sales or targeted advertising by emailing support@tapchiphowall.com with the subject "Privacy Opt-Out Request." An authorized agent may submit a request for you. We may need to verify your identity, residence, and the agent's authority.

7. AI and Uploaded Data

When you use an AI feature, your prompt, relevant portfolio data, or uploaded image may be sent to an AI provider to produce the result. Portfolio-import screenshots are processed to return extracted positions and are not intentionally stored by us as files after the request completes, but a provider may retain logs or data under its terms, service configuration, and legal obligations. Position data is saved to your portfolio only after you review and confirm it.

Do not upload brokerage account numbers, identity documents, passwords, access codes, or unnecessary sensitive data. AI output may be inaccurate and is not used to make legal or similarly significant decisions about you.

8. Retention and Deletion

We retain personal information for as long as necessary for the purposes in this policy. The period depends on the data type, account status, subscription term, operational and security needs, dispute periods, tax, accounting, or legal obligations, and backup schedules.

When data is no longer needed, we delete, anonymize, or isolate it until secure deletion is possible. Some transaction, anti-fraud, privacy-request, or backup records may be kept longer where permitted or required. Account deletion may not immediately delete data controlled by others, anonymized data, or public content copied by other users.

9. Data Security

We maintain administrative, technical, and organizational safeguards appropriate to the nature and volume of data, including HTTPS in transit, access controls, authentication, rate limiting, logging, and separation of server secrets. We review provider access and respond to incidents under applicable procedures. No system is completely secure. If a breach requires notice, we will notify affected individuals and authorities within the time required by applicable law.

10. US Data Storage and International Processing

We store all user data retained by us exclusively in data centers located in the United States. Some service providers may operate or access, transfer, or process information from other countries only as necessary to provide services to us. This limited processing does not change our commitment that user data retained by Tạp Chí Phố Wall is stored in the United States.

Where the GDPR applies, we use a legally recognized transfer mechanism, such as an adequacy decision, European Union Standard Contractual Clauses, or another mechanism under GDPR Chapter V, with supplementary measures where appropriate. Where the APPI applies, we provide information about foreign transfers, obtain consent, or use another APPI-permitted mechanism as required. Where Singapore's PDPA applies, we take reasonable steps to ensure that any transfer of personal data outside Singapore, including storage in the US data centers described above, meets a standard of protection comparable to the PDPA, consistent with the PDPA's Transfer Limitation Obligation. Where Canada's PIPEDA applies, we remain accountable for personal information transferred to service providers, including in the United States, and require contractual safeguards comparable to our own obligations. Where Australia's Privacy Act applies, disclosure of personal information overseas to our US-based infrastructure is made consistent with Australian Privacy Principle 8 (APP 8), and we take reasonable steps to ensure overseas recipients handle information consistently with the APPs. You may request information about applicable safeguards using the contact in Section 19.

11. Privacy Rights and How to Submit a Request

Depending on applicable law, you may have the right to:

  • know or confirm whether we process your data and access it;
  • correct inaccurate data;
  • request deletion;
  • receive a portable copy;
  • object to or restrict certain processing;
  • withdraw consent without affecting earlier lawful processing;
  • opt out of marketing, sale, targeted advertising, or certain profiling; and
  • receive equal service without discrimination for exercising a privacy right.

Email support@tapchiphowall.com and state the right you wish to exercise and your place of residence. You may also request account deletion through the support page linked from your profile. We may request information reasonably necessary to verify identity and will use it only to process the request. You do not need to create a new account to exercise a right. Valid requests are generally free, although applicable law may permit us to decline or charge a reasonable fee for manifestly unfounded, excessive, or repetitive requests.

You can unsubscribe from marketing email using the link in the message. This does not stop necessary transactional or security messages.

12. US and Texas Notice

In the United States, we comply with the federal and state privacy and data-security laws and regulations applicable to the Service. These include the Federal Trade Commission Act, the Children's Online Privacy Protection Act (COPPA) where applicable, data-breach notification laws, and the TDPSA for covered Texas residents. We honor the commitments in this policy and maintain reasonable security appropriate to the data we process. Additional state-specific rights may apply.

Texas residents covered by the TDPSA may confirm and access, correct, delete, obtain a portable copy, and opt out of targeted advertising, sale, or profiling that produces legal or similarly significant effects. We will respond without undue delay and ordinarily within 45 days. When reasonably necessary, we may extend once by 45 days and will explain the extension during the initial period.

If we deny a request, we will explain why and how to appeal. Email support@tapchiphowall.com with the subject "Privacy Appeal." We will answer an appeal in writing within 60 days. If an appeal is denied, you may submit a complaint to the Texas Attorney General. An authorized agent may submit an opt-out request as permitted by law. We will not discriminate against you for exercising these rights.

13. California Notice (CCPA/CPRA)

If you are a California resident and the California Consumer Privacy Act, as amended by the California Privacy Rights Act (CCPA/CPRA), applies to our processing of your personal information, this section supplements the disclosures above.

Categories collected: In the ordinary course of operating the Service, we collect the categories of personal information described in Section 2, which may include identifiers, account and commercial information, internet or other electronic network activity, geolocation inferred from IP address, and, if you use a passkey, biometric information processed solely on your device (we do not receive or retain it). We do not collect Social Security numbers, driver's license numbers, precise geolocation, or other sensitive personal information except where you voluntarily submit it, and we do not use sensitive personal information beyond what is necessary to provide the Service.

Sources, purposes, and disclosures: The sources, business and commercial purposes, and categories of third parties who receive personal information are described in Sections 2, 3, and 4.

Sale and sharing: As explained in Section 6, we do not sell personal information for money. Depending on how you configure analytics and advertising cookies, certain disclosures to advertising or analytics partners may meet the CCPA's broad definitions of "sale" or "sharing" for cross-context behavioral advertising. You may opt out at any time by emailing support@tapchiphowall.com with the subject "California Opt-Out Request," or, where supported, by sending an opt-out preference signal (e.g., Global Privacy Control) from your browser, which we will honor for the browser or device that sent it.

Your CCPA/CPRA rights: Subject to verification and applicable exceptions, California residents may:

  • know and access the specific pieces and categories of personal information we have collected, used, disclosed, or sold/shared, and the sources, purposes, and recipients;
  • delete personal information we collected from you;
  • correct inaccurate personal information;
  • opt out of the sale or sharing of personal information and limit the use or disclosure of sensitive personal information;
  • receive a portable copy of personal information in a readily usable format; and
  • not receive discriminatory treatment for exercising any of these rights.

How to submit a request: Email support@tapchiphowall.com with the subject "California Privacy Request" and describe the right you wish to exercise. We will verify your identity using information reasonably matched to what we already hold and will respond within 45 days, with one 45-day extension where reasonably necessary and explained to you. An authorized agent may submit a request on your behalf with proof of authorization; we may still ask you to verify your identity directly.

We have not sold or shared personal information for money in exchange for cross-context behavioral advertising in the preceding 12 months, and we have not sold or shared the personal information of individuals we know to be under 16.

If you believe we have not adequately addressed your request, you may contact the California Privacy Protection Agency (CPPA) or the California Attorney General's office.

14. Canada Notice (PIPEDA)

If you are in Canada, we handle your personal information consistent with the Personal Information Protection and Electronic Documents Act (PIPEDA) or substantially similar provincial legislation that applies instead of PIPEDA (for example, Quebec's Act Respecting the Protection of Personal Information in the Private Sector as amended by Law 25, or Alberta's or British Columbia's private-sector privacy legislation), to the extent that law applies to our activities.

Access and correction: Under PIPEDA's Individual Access principle, you may submit a written request to support@tapchiphowall.com to be informed of the existence, use, and disclosure of your personal information, to access that information, and to request correction or amendment of information that is inaccurate or incomplete. We will respond with due diligence and in any case no later than 30 days after receiving the request; if an extension is needed, we will send written notice within 30 days of the request stating the new time limit, the reasons for the extension, and your right to complain. If we refuse a request, we will state our reasons in writing and explain your available recourse.

Consent: We collect, use, and disclose personal information only with your meaningful consent or under an exception permitted by PIPEDA, and you may withdraw consent at any time, subject to legal or contractual restrictions, by contacting us using Section 19.

Data breach notification: If a security breach involving your personal information creates a real risk of significant harm, we will notify the Office of the Privacy Commissioner of Canada (OPC) and affected individuals as soon as feasible, and keep a record of the breach as required by PIPEDA.

You may lodge a complaint with the Office of the Privacy Commissioner of Canada (OPC).

15. Singapore Notice (PDPA)

If you access the Service from Singapore, we handle your personal data consistent with the obligations of the Personal Data Protection Act 2012 (PDPA) to the extent it applies to our processing.

Consent and purpose limitation: We collect, use, and disclose personal data only for the purposes described in Section 3, and, where the PDPA requires consent rather than a permitted exception (such as a legitimate-interest or business-improvement exception under the PDPA), we obtain it before processing and allow you to withdraw it by contacting us using Section 19, subject to legal or contractual restrictions.

Access and correction: You may request access to the personal data we hold about you and information about how it has been or may have been used or disclosed in the past year, and you may request correction of an error or omission. We will respond as soon as reasonably possible, generally within 30 days; if we cannot meet that timeframe, we will inform you of the expected response time.

Data Protection Officer: Our Data Protection Officer can be reached at support@tapchiphowall.com to handle PDPA queries, complaints, access requests, and correction requests.

Retention and transfer: We retain personal data only as long as necessary for the purposes in Section 8. Because all user data we retain is stored in the United States (Section 10), transferring the personal data of Singapore users outside Singapore uses the same infrastructure and safeguards described there; we take steps to ensure a standard of protection comparable to the PDPA before doing so.

Data breach notification: If a data breach involving your personal data is likely to result in significant harm to you, or is of a significant scale, we will assess and, where required, notify the Personal Data Protection Commission (PDPC) and affected individuals within the timeframes required by the PDPA.

You may also lodge a complaint with the Personal Data Protection Commission of Singapore (PDPC).

16. Australia Notice (Privacy Act and APPs)

If you are in Australia, we comply with the Privacy Act 1988 (Cth) and the Australian Privacy Principles ("APPs") to the extent that law applies to us.

Collection, storage, and purpose: The kinds of personal information we collect and hold, how we collect and store it, and why we collect it are described in Sections 2 and 3. We do not collect sensitive information (as defined by the Privacy Act) unless you voluntarily provide it or the law permits it.

Overseas disclosure (APP 8): As explained in Section 10, all user data we retain is stored in data centers located in the United States, and some service providers described in Section 4 may access or process data from other countries. Your personal information may therefore be disclosed to recipients in the United States and other countries where our providers operate. We take reasonable steps to ensure overseas recipients handle personal information consistently with the APPs.

Access and correction (APP 12, APP 13): You may request access to the personal information we hold about you and request correction of information that is inaccurate, out of date, incomplete, irrelevant, or misleading. Send requests to support@tapchiphowall.com; we will respond within a reasonable time, generally within 30 days.

Complaints: If you believe we have breached an APP, please contact us first at support@tapchiphowall.com so we can address the issue. If you are not satisfied with our response, you may complain to the Office of the Australian Information Commissioner (OAIC).

Notifiable data breaches: If an eligible data breach occurs that is likely to result in serious harm to affected individuals, we will notify the OAIC and affected individuals as required by Part IIIC of the Privacy Act.

Automated decision-making: As stated in Section 3, we do not use personal information to make solely automated decisions that produce legal or similarly significant effects concerning you. If this changes in a way covered by APPs 1.7 to 1.9 (effective 10 December 2026), we will update this section to describe the kinds of personal information and decisions involved.

17. GDPR Notice for the EEA

If the GDPR applies, you have the rights in Section 11, including the right to object to direct marketing at any time and to object to processing based on legitimate interests. We ordinarily respond within one month and may extend by two months for complex or numerous requests after notifying you.

You may complain to a data protection authority in the EEA country of your habitual residence, place of work, or the alleged infringement. The European Data Protection Board's member list identifies the appropriate authority. Please contact us first if you would like us to address the concern directly.

18. APPI Notice for Japan and Children's Privacy

If the APPI applies, the purposes for using personal information are stated in Section 3. You may request notice of purpose, disclosure of retained personal data or third-party provision records, correction, addition, deletion, cessation of use, or cessation of third-party provision in circumstances provided by the APPI. We will address complaints and qualifying requests appropriately and promptly and explain when we cannot act. The address and representative of the business handling personal information, together with details of security-control measures, will be provided without delay upon a request to the contact in Section 19.

The Service is intended for people aged 18 or older and is not directed to children under 13. We do not knowingly collect online personal information from a child under 13. If we learn that we have done so, we will delete it or take other action required by the US Children's Online Privacy Protection Act (COPPA) and applicable law. A parent or guardian may contact us using Section 19.

19. Changes and Contact

We may update this policy to reflect changes to the Service or law. We will post the revised version, update the "Last Updated" date, and provide additional notice when required by law or when a change materially affects your rights.

For questions, complaints, privacy-rights requests, or requests for transfer-safeguard information, contact:

Tạp Chí Phố Wall

Email: support@tapchiphowall.com

Website: https://tapchiphowall.com