Privacy Policy

This policy applies to the website at heycapy.store (the “Website”), operated by HỘ KINH DOANH KOMBUCHA CAPY, a household business registered in Vietnam (“Capy”, “we”, “us”).

We are a small kombucha business in Vietnam. We only collect the information we need to answer enquiries, fulfil orders and run our shop.

You can browse our product pages without giving us any personal information. We do not require an account to view the Website.

We collect two kinds of information:

• Information you give us directly, for example when you contact us to order or submit a collaboration form.
• A limited amount of technical information collected automatically by our hosting provider when your browser loads the Website.

We do not collect sensitive personal information, and we do not buy personal data from third parties.

When you place an order. Orders are arranged by phone or messaging rather than through an automated checkout on the Website. To prepare and deliver an order, we record the details you give us, which typically include your name, phone number, delivery address and area, the items you ordered, and any notes or delivery instructions. We also record the payment status of the order, such as the deposit and the balance due.

When you submit a collaboration form. Our collaboration page includes a form for content creators who would like to work with us. That form asks for a name and a phone number and/or a TikTok channel, and optionally other channel links, an approximate follower count, your area and a message.

This information is typed in by you. We do not retrieve it from TikTok or any other platform — see section 10.

Please only submit your own information, and do not include other people’s personal details.

Like most websites, our hosting provider automatically processes basic technical data when a page is requested. This typically includes the IP address making the request, the browser and device type, the page requested, and the date and time.

This data is used to serve the Website, keep it secure and diagnose faults. We do not use it to build profiles of individual visitors.

We use personal information to:

• reply to your enquiries and confirm the details of an order;
• prepare, deliver and track orders, including sharing delivery details with a courier;
• handle payments, deposits and balances for orders;
• deal with order problems, replacements and refunds;
• respond to collaboration enquiries from content creators;
• keep basic business records, such as sales and stock records;
• protect the Website and our customers against misuse, fraud and security incidents;
• comply with our legal and tax obligations in Vietnam.

We do not sell your personal information. We do not send marketing messages to customers who have not asked to hear from us.

Order records are kept in our internal shop system, which is protected by a login and used only by Capy staff.

For some orders we may send you a private link so you can view your order and its delivery status. Anyone holding that link can see the order details it refers to, so please do not share it publicly. These links are excluded from search engine indexing.

The public pages of the Website do not use advertising or tracking cookies, and we do not run third-party advertising pixels on them.

Our internal administration area, which is only accessible to Capy staff after logging in, uses a session cookie that is strictly necessary to keep the user signed in. It is not used to track visitors to our public pages.

Your browser also stores ordinary technical data such as cached files and images so pages load faster on a repeat visit. You can clear this at any time in your browser settings.

We do not currently run a third-party analytics service, such as an audience-measurement or behavioural analytics tool, on the public pages of the Website.

If we add one in future, we will update this policy before or at the time it starts operating, and will describe what it collects.

We use a small number of service providers to operate the Website and our shop:

• a website hosting provider, which serves the Website and processes the technical data described in section 4;
• a managed database provider, where order records and collaboration submissions are stored;
• third-party delivery providers, who receive the recipient name, phone number and address needed to complete a delivery;
• messaging and phone services, which you use to contact us and which operate under their own terms and privacy policies.

These providers process information on our behalf, or as independent operators in the case of messaging platforms and couriers. We share only what is needed for them to perform their role.

We maintain a presence on social media and work with content creators, and our collaboration form asks creators to tell us their TikTok channel so we can find and contact them.

The Website does not currently connect to the TikTok API, and there is no TikTok login or authorisation flow on it. Any TikTok channel name or link we hold was typed into our form by the creator. We do not retrieve follower numbers, videos, messages, account details or any other data from TikTok accounts.

If we introduce a TikTok integration in future — for example to manage a shop listing or to support creator collaborations — then:

• any access would be limited to the specific permissions requested and shown to you at the time you authorise it;
• we would process only the information covered by those permissions, for the purpose described when the permission is requested;
• you would be able to withdraw the authorisation through your TikTok account settings or by contacting us;
• this policy would be updated to describe the integration before it starts operating.

Where you interact with TikTok itself — for example by watching our content, messaging us on TikTok, or authorising an application — TikTok processes your information as an independent controller under its own terms and privacy policy. We recommend reviewing TikTok’s privacy documentation, available within the TikTok app and on TikTok’s official website, to understand how it handles your data. We have no control over TikTok’s own data practices.

We share personal information only in these situations:

• with the service providers listed in section 9, so they can host the Website, store our records or deliver an order;
• when you ask us to, for example by asking us to coordinate with someone else about your delivery;
• where required by law, or in response to a lawful request from a competent Vietnamese authority;
• to establish, exercise or defend a legal claim, or to investigate fraud or a security incident.

We do not sell, rent or trade personal information.

We keep personal information only as long as we need it for the purpose it was collected for.

• Order records are kept while we run the business, because we need them for accounting, tax and warranty or complaint handling.
• Collaboration form submissions are kept while we are considering or working on the collaboration, and are removed when they are no longer relevant.
• Technical server data is kept for a short period by our hosting provider for security and troubleshooting purposes.

Where a legal or accounting obligation requires us to retain a record for a set period, we keep it for that period. Otherwise, we delete or anonymise information when it is no longer needed. You can ask us about the information we hold about you at any time.

We take reasonable measures to protect personal information:

• the Website is served over an encrypted HTTPS connection;
• our internal shop system requires a login, and access is limited to Capy staff who need it;
• order records are stored with a managed database provider rather than on personal devices;
• private order links are excluded from search engine indexing.

No website or system can be completely secure. If a security incident occurs that materially affects your personal information, we will act promptly and inform you and the relevant authority where required by law.

We are based in Vietnam and serve customers in Vietnam. Some of our service providers — such as our website hosting and database providers — operate infrastructure outside Vietnam, so your information may be stored or processed abroad.

When this happens, we seek to use established providers that apply recognised security and data protection practices, and we share only the information necessary for the service.

You can ask us about the personal information we hold about you. In particular, you may:

• ask for access to the personal information we hold about you;
• ask us to correct information that is inaccurate or out of date;
• ask us to delete information, where we do not have a legal or legitimate business reason to keep it — for example, we may need to retain order and accounting records;
• withdraw your consent where we relied on consent, such as for a collaboration submission (this does not affect processing that already took place);
• object to a particular use of your information, or ask us to restrict it, and we will consider your request;
• raise a question or complaint about how we handle your personal data.

To make a request, contact us using the details in section 18. Please give us enough information to find your record — for example the phone number used for the order. We may need to verify your identity before acting, so that we do not disclose someone else’s information.

We aim to respond to requests within a reasonable time. If we cannot do what you ask, we will explain why. You may also contact the competent Vietnamese authority responsible for personal data protection if you are not satisfied with our response.

The Website is intended for a general adult audience and is not directed at children. We do not knowingly collect personal information from children.

If you believe a child has sent us personal information, please contact us and we will delete it unless we are legally required to keep it.

We may update this policy when our website, ordering process or service providers change. The current version is always published on this page, with the “Last updated” date at the top.

If we make a significant change — such as introducing analytics or a TikTok integration that processes personal data — we will update this page before or at the time that change takes effect.

For any question or request about privacy and your personal information, please contact us:

See also our Terms of Service.