Last updated: 05/10/2026
VNExchange respects your privacy. This document explains what information we collect, what we use it for, who we share it with, how long we keep it, and what rights you have regarding your data.
1. Scope of application
This policy applies to the VNExchange website and all services on it: buying and selling digital accounts, buying and selling foreign currency balances, financial services, community and charitable activities. The policy does not apply to third‑party websites or services that you access through links from VNExchange.
2. Information we collect
2.1. Information you provide yourself
- When registering: username, nickname, email address, password.
- In profile: phone number, date of birth, avatar — all optional.
- When depositing funds: transaction code and receipt photos you upload.
- When withdrawing funds: recipient account information (bank account number, wallet address, e‑wallet phone number).
- When transacting with a partner: payment information you provide for the partner to send money to you or vice versa.
- When using the service: contact information you fill in the order (Facebook, Telegram, Zalo, notes).
- When needing support or filing a complaint: description content, images and evidence files you attach.
- In the community: post content, comments and attached files you voluntarily make public.
2.2. System‑generated information
- IP address and timestamp of the most recent login — used to detect abnormal access.
- Number of failed login attempts, used for temporary lockout to prevent password guessing.
- Product view counts, used for internal statistics. This number is associated with the product, not with the viewer’s identity.
- Your order history, deposits, withdrawals, transactions and balances.
2.3. Cookies and storage in the browser
VNExchange only uses the cookies necessary for the website to function:
vnex_token — login session. HttpOnly cookies cannot be read by JavaScript in the browser, set SameSite=Strict to prevent request forgery, and automatically expire after 7 days.vnex_currency — the currency you choose to display prices.vnex_oauth, vnex_oauth_pending — exists only while you log in with Google, Telegram, or Facebook, to prevent login request forgery; automatically expires after a maximum of 15 minutes.vnex_session_hint — a small hint stored in the browser so the interface knows you are logged in without querying the server.
We do not use any advertising tracking tools — no Google Analytics, no Facebook Pixel, no third‑party advertising cookies. We do not sell or share your data with advertisers.
2.4. Login with Google, Telegram, or Facebook
You can log in or sign up using a Google, Telegram, or Facebook account instead of a username and password. When you choose this method and consent on the provider’s page, we only receive:
- Google: the Google account identifier, the email address verified by Google, and the display name.
- Telegram: the Telegram account identifier, name and username. Telegram does not provide an email, so you must enter your email yourself and verify it with an OTP code.
- Facebook: the Facebook account identifier for VNExchange, name and email address (if the Facebook account has an email).
We use this information only to log in and create a VNExchange account for you. We do not receive your passwords on those services, do not post or send messages on your behalf, and do not read your contacts, friends, or messages. You can cancel the link at any time in Account Information → Linked Accounts.
3. What we use the information for
- Create and operate your account, authenticate during login.
- Process orders, deposits, withdrawals, and balance transactions.
- Send necessary emails: OTP codes, password resets, password change alerts, order confirmations, deposit/withdrawal approval results.
- Handle support requests and resolve disputes between parties.
- Detect and prevent fraud, abuse, as well as using the platform to circulate illegal funds.
- Improve the product based on aggregated statistics.
- Meet lawful requests from competent authorities.
4. Share information with third parties
We do not sell personal data. Information is shared only in the following cases:
- Infrastructure provider: server and database services where the website operates. They store data on our behalf and are not used for personal purposes.
- Email sending service: to deliver system emails to your mailbox.
- Automatic translation service: the website supports multiple languages, and the text is machine-translated only includes content prepared by administrators — product descriptions, news, announcements, specifically these legal pages. We do not send your personal data, complaint content, messages or posts to the translation service.
- Google, Telegram, Facebook: only when you choose to log in with their account. You are redirected to the provider's page to log in; this follows their own privacy policy. We do not send any additional of your data to these parties.
- The other party in the transaction: when you transact a balance with a partner, both parties see the payment information declared by the other — this is a condition for transferring money to each other. Only disclose what is necessary for receiving funds.
- According to legal requirements: when there is a valid request from competent authorities, or when it is necessary to protect the legal rights of VNExchange and other users.
Cross-border data processing. VNExchange operates online, and our infrastructure together with the aforementioned service providers may host servers in various countries. Therefore, your data may be stored and processed outside your place of residence. Wherever it is, we apply the same level of protection described in Section 5, in accordance with widely recognized personal data protection principles worldwide.
5. How we protect data
- Passwords are hashed with bcrypt before storage. We do not store passwords in readable form, and no one — including administrators — can see your password.
- Recipient account information in withdrawal requests is encrypted before being written to the database.
- The two-factor authentication secret key is encrypted when stored.
- Login sessions use HttpOnly + SameSite=Strict cookies.
- Failed login 5 times will be temporarily locked for 30 minutes. OTP codes expire after 10 minutes, password reset links expire after 1 hour.
- Requests to the server are rate-limited to prevent scanning and abuse.
- All administrator actions on user data are logged and cannot be deleted.
No system is absolutely secure. Use strong, unique passwords, enable two-factor authentication, and do not share OTP codes with anyone — even those claiming to be VNExchange staff. We never ask for your password or OTP code.
6. Retention period
- Account data: retained for the entire duration the account remains active.
- Transaction, deposit, and withdrawal history: retained long‑term, even after you stop using the service, to support reconciliation, resolve post‑incident disputes, and meet legal retention obligations.
- OTP codes and password reset codes: deleted or invalidated immediately after use or expiration.
- Administrative activity logs: retained long‑term and immutable.
7. Your rights
- View and edit profile information directly on the Account Information page.
- Change email (with OTP verification), change password, enable or disable two-factor authentication.
- Request a copy of the personal data we hold.
- Request account deletion. Note: we must retain transaction records that have occurred for reconciliation and legal reasons; this part cannot be deleted upon request.
- File a complaint about how we process your data.
To exercise the above rights, contact us using the information in the website footer or submit a request via the Support page.
7.1. Delete data received from Google, Telegram, or Facebook
- Delete yourself now: log in to VNExchange, go to Account Information → Linked Accounts and click Unlink. The identifier, name, and email received from that provider are removed from the system immediately.
- Delete the entire account: submit a request via the Support page from that account. We process it within 30 days; the transaction records that have occurred are still retained as stated in Section 6.
- You can also revoke VNExchange's permissions directly in the app/device settings of the logged-in Google, Telegram, or Facebook account.
8. Persons under 18 years old
VNExchange is for persons who are at least 18 years old. We do not intentionally collect data from individuals under 18. If discovered, we will lock the account and delete the related data.
9. Policy changes
The policy may be updated when the service changes or when legal regulations change. The update date is always listed at the top of the page. For major changes affecting your rights, we will announce them on the website. Continuing to use the service after the policy is updated constitutes your acceptance of the new version.
10. Contact
For any privacy questions, please contact using the information posted in the website footer, or submit a request on the Support page. We will respond as soon as possible.