Legal

Privacy Policy

Version 2.0

Version: 2.0

Last Updated: May 25, 2026

Rafetus is committed to protecting user privacy and personal data as a personal knowledge management application that strictly says "no" to copyright infringement. This document transparently outlines the rights and obligations of all parties regarding data processing and uploaded file management, strictly complying with the current legal framework of the Socialist Republic of Vietnam, with a focus on:

PART IGENERAL PRINCIPLES AND MANAGING ENTITIES

Article 1. Scope of Application and Legal Validity

  1. This policy applies to all activities involving access, account registration, and the use of features across the entire Rafetus ecosystem, including:
    1. The official website at rafetus.vn (marketing, profile, payments, community surveys).
    2. The authentication portal at auth.rafetus.vn.
    3. The personal knowledge management application at app.rafetus.vn and linked browser or mobile clients sharing the same account.
  2. Your act of clicking to confirm agreement, registering an account, or continuing to use the service is considered the establishment of a lawful electronic transaction, demonstrating your voluntary acceptance of the terms in this document, except where separate consent is required by law (for example, the AI assistant or research survey programs).

Article 2. Information of the Data Controller and Processor

  1. System Operator: Rafetus, legally represented by Mr. Le Tri Nhan, acts as the Data Controller and directly performs the processing of users' personal data.
  2. Data Protection contact: All requests regarding the enforcement of privacy rights, data deletion, withdrawal of consent, or notifications of copyright infringement complaints should be directed to the official email address: support@rafetus.vn.

PART IIDATA CATEGORIES AND STORAGE INFRASTRUCTURE

Rafetus utilizes a fragmented cloud technology architecture to protect data. Your data is structurally divided and stored across independent zones (Supabase for accounts and application data; Cloudflare Workers and R2 for web operations, files, and edge protection).

Article 3. Account, Financial Transaction, and Service Preference Data

  1. Basic Identity Information: Email address, chosen display name, UserID (unique public identifier), and a one-way hashed access password managed by Supabase Auth. Login sessions are maintained via cookies and secure session tokens on your device after you authenticate at auth.rafetus.vn.
  2. Subscription and quota information: Plan tier (free or paid), subscription period, Rafai token quotas, and pay-as-you-go billing settings where applicable.
  3. Flexible billing settings (Rafai): If you enable them, the system may store your monthly token soft cap and pay-as-you-go preference — operational account settings only, not bank card data.
  4. Transaction Reconciliation Information: When a user upgrades a service package through our affiliated payment partners (SePay or VNPAY), the system only receives and stores the instant payment response payload, which includes the invoice code, transfer amount, transaction status, timestamp, and (for SePay) technical IPN records for reconciliation. Rafetus commits to neither collecting nor storing your bank card information, credit card numbers, or financial app passwords in any form.

Article 4. Resources and Uploaded Files

  1. Independent Storage Zone: All files uploaded by users to the system, such as research documents, personal resources, images, or raw formatted notes, are completely isolated and stored in the Cloudflare R2 object storage system.
  2. Access Control Mechanism: The system automatically generates time-bound, cryptographically signed access links (Presigned URLs). Only your account, after a valid login, has the right to request the system to generate a link and download the file from the repository.

Article 5. Automatically Generated Data and Technical Logs

  1. Usage data: Logs of interactions with resources and personal notes (when you use the corresponding features in the application).
  2. System Logs: Network addresses (IP), device types (User-Agent), and access timestamps are automatically recorded through Cloudflare Workers and edge operations. This information solely serves the purpose of preventing distributed denial-of-service (DDoS) attacks, combating automated unauthorized data scraping, operational troubleshooting, and fulfilling technical logging obligations under the Cybersecurity Law.
  3. Rafetus does not deploy advertising behavior trackers (remarketing). The official website uses Google Analytics 4 (Google tag) to measure traffic, referral sources, and content performance in order to improve the product and communications; Rafetus does not sell personal data from this tool.

Article 6. Local Data Stored on Your Device

  1. Personal Security Keys: The decryption key and the 24-word recovery phrase for advanced end-to-end encryption are generated and stored exclusively and locally on your personal device. Rafetus's servers do not store and cannot intervene with these security keys.
  2. Browser Support Tools: Supabase session identifiers, display language preferences (rafetus-locale), and light/dark theme choices (rafetus-theme) are stored in cookies and/or local browser storage. Authentication session data is cleared when you log out.

Article 7. Cookies and Similar Technologies

  1. Strictly necessary cookies: Maintain login sessions, secure transport, and abuse prevention (for example Cloudflare Turnstile when enabled on the login portal).
  2. Functional cookies: Store your language and interface theme preferences.
  3. Analytics cookies and identifiers (Google Analytics): When the page loads the Google tag, Google may set cookies or use technical identifiers to record page views, referral sources, and basic interactions on rafetus.vn.
  4. External resources: The website may load fonts, icons, or measurement scripts from third-party hosts (for example Google Fonts, Google tag) — your browser may send standard technical requests to those servers.
  5. You may delete cookies via browser settings or block tracking with browser extensions; some features (login, language) may not work correctly if strictly necessary cookies are disabled.

Article 8. Research Surveys and Community Contribution Programs

  1. Knowledge-labeling survey (may not require login): When you join a community survey on the website, you may provide an email address as the session identifier, self-declared demographic fields (cognitive role, information density, thinking tools, age group), relation choices between propositions, rationale for choices, completion time, and keyboard interaction counts. This data is processed only when you actively submit the form and agree to the research purpose stated at participation.
  2. Authenticated research contribution: When logged in, you may label knowledge relations between fixed propositions; the system stores your account identifier, relation labels, and optional text you enter.
  3. Purpose: Improve Rafetus knowledge-relation models and product quality; survey emails are not used for unrelated advertising unless you separately opt in.
  4. You may request deletion of survey data linked to your email by contacting support@rafetus.vn.

Article 9. Resource Metadata from Third-Party Sources

  1. When you search for or add resources, Rafetus may display metadata (title, author, cover, short description) from public libraries or lawful partners (for example Open Library). Rafetus does not claim copyright over third-party content; you remain responsible for the legality of resources you upload yourself.

PART IIICOPYRIGHT PROTECTION AND PIRATED MATERIAL HANDLING POLICY

Article 10. Application of the Legal Exemption Principle (Safe Harbor)

  1. Rafetus operates as an online intermediary storage service provider, creating a personal knowledge management and storage space for users. The user directly uploads and utilizes personal documents; therefore, the user must bear full legal responsibility for the legality of all files they upload to the system. Rafetus is fully exempt from joint liability for copyright infringement acts committed by users, provided we strictly adhere to the content removal process upon receiving a valid notification.

Article 11. Strictly Prohibited Acts

  1. The Rafetus system adamantly refuses to support and strictly prohibits users from uploading, storing, or sharing:
    1. E-books, study materials, or syllabi that infringe upon copyrights, lack authorization from the copyright owner, or have illegal origins (pirated materials).
    2. Documents containing obscene content, defaming the honor of others, or violating national security.
    3. Files containing malware, computer viruses, or cybersecurity sabotage tools.

Article 12. Process for Reporting and Removing Infringing Documents

  1. To maximize the protection of authors' and publishers' interests, Rafetus has established a rapid copyright infringement removal process as follows:
    1. Reporting Method: When a copyright owner discovers their work has been unlawfully posted on our system, please send a written takedown request to the email address support@rafetus.vn, accompanied by proof of lawful ownership and precise instructions to the location of the infringing file.
    2. Processing Timeframe: Rafetus is committed to verifying the information and implementing measures to suspend access, hide, or permanently delete the infringing file from the system within a maximum of 24 to 48 working hours upon receiving a valid request.
    3. Handling of Repeat Infringers: For accounts that intentionally upload copyright-infringing documents or store pirated books two or more times, the system will permanently lock the account, refuse to provide services, and will not refund any fees previously paid.

PART IVSECURITY TECHNOLOGY, THIRD PARTIES, AND ARTIFICIAL INTELLIGENCE

Article 13. Transmission Security and Database Isolation Standards

  1. Transmission Protection: All data traveling between the user's personal device and Rafetus's servers must pass through Cloudflare's highest-tier transmission encryption security layer (TLS).
  2. Encryption at Rest: All document files stored in the Cloudflare R2 object storage system and information in the Supabase database system are automatically physically encrypted using an advanced symmetric encryption algorithm with a 256-bit security key (AES-256).
  3. Row-Level Security Feature: The system applies strict control rules to every user query. Each account only has the right to read or write data belonging to itself via a secure session identifier token (JWT), completely eliminating the possibility of cross-user data leakage.

Article 14. Advanced End-to-End Encryption (E2EE) Feature

  1. For personal notes or other sensitive content where the user actively enables End-to-End Encryption:
    1. The original text content is converted into a cryptographic string on your personal browser or device (AES-256-GCM algorithm) before being transferred to the cloud storage server.
    2. Rafetus's servers only record the encrypted characters and have no capability to read the original content. Users must note that if they lose the security recovery phrase, the data will be permanently lost, and the artificial intelligence assistant will be unable to analyze such content.

Article 15. Data Commitments Regarding the Artificial Intelligence Assistant (Rafai)

  1. Rafetus processes your content through Rafai only when you actively enable or invoke the relevant feature; each use must have a clearly stated purpose.
  2. Rafetus pledges not to use your private notes or other Private Content as training material for any large language models of the system or of third parties.
  3. When you use the Rafai assistant, data within the scope of the working session may be transmitted to technology partners' servers via an enterprise-grade API connection. Rafetus enforces that partner servers do not retain your private content for model training: data is processed temporarily to return results and is not used as training data derived from your private content.
  4. You may withdraw consent or disable Rafai in product settings; disabling Rafai does not affect core features that do not depend on AI.

Article 16. Data Processors and Cross-Border Transfers

  1. Rafetus may share data with the following processors only as necessary to operate the service:
    1. Supabase (authentication and application database).
    2. Cloudflare (CDN, Workers, R2, protection, and bot mitigation).
    3. SePay and VNPAY (payments and reconciliation).
    4. AI model providers (only when you enable and use Rafai).
  2. Rafetus does not sell email lists or personal profiles to advertisers. Partner servers may be located outside Vietnam; Rafetus requires them to maintain confidentiality and process data only on Rafetus's instructions.

PART VDATA SUBJECT RIGHTS AND ENFORCEMENT PROVISIONS

Article 17. Lawful Rights of the User

  1. Pursuant to the Personal Data Protection Law, users possess full legal rights, including: The right to be informed about processing activities; the right to request access to collected personal data; the right to access and self-correct information; the right to request deletion, restriction, or objection where the law allows; the right to withdraw consent for artificial intelligence features and research surveys; the right to change private/public status of content where the product supports it; and the right to file complaints regarding unlawful data processing. All requests to exercise these rights should be directed to support@rafetus.vn; we will process and respond within a period not exceeding 72 working hours, unless the law permits an extension with stated reasons.

Article 18. Children and Persons Lacking Full Civil Capacity

  1. The service is not directed at children under 13. Users aged 13 to 16 require parental or legal guardian consent or supervision as stated in the Rafetus Terms of Use.

Article 19. Regulations on Providing Data to State Management Agencies

  1. Rafetus profoundly respects individual freedom and commits not to sell your data to any advertising agencies. We will only extract and hand over user data to competent State Authorities upon receiving an official written request or a lawful investigation warrant from a criminal proceeding agency, strictly complying with the Cybersecurity Law and specialized legal documents.
  2. You may lodge a complaint with the Authority of Information Security (Ministry of Information and Communications) or other competent bodies under the Personal Data Protection Law if you believe your rights have been infringed.

Article 20. Account Deletion Process and Financial Storage Exceptions

  1. Processing Account Deletion Commands: When you execute account deletion on the system, all personal files stored on Cloudflare R2 and information stored on Supabase will be switched to permanent hidden mode and automatically entirely deleted from physical storage partitions after 30 days to prevent arising disputes, except data that must be retained by law.
  2. Financial Document Storage Obligations: Specifically, invoice information and transaction logs related to payments via the SePay or VNPAY systems must be retained for a minimum of 5 to 10 years, in mandatory compliance with the Vietnamese Accounting Law and Tax Administration Law, to serve direct financial inspections from the State.

Article 21. Content Amendments and Applicability

  1. This document officially takes effect from May 25, 2026 upon publication on the service homepage. Rafetus reserves the sole right to edit or supplement the content of this policy to ensure its alignment with technical advancements or changes in the legal system of Vietnam. Any significant changes will be specifically notified to users prior to implementation.
  2. This Policy is established in the Vietnamese language and is maximally protected under the laws of the Socialist Republic of Vietnam. Should multilingual translations exist, the Vietnamese version remains the original text with the highest legal validity for reference in the event of a dispute.