Chính sách bảo mật

1. Introduction

This Privacy Policy explains how Spwig Pte. Ltd. (“Spwig”, “we”, “us”) handles personal data in connection with:

• Spwig.com and myspwig.com;
• self-hosted licence purchase, activation, maintenance, update, and support services;
• hosted Spwig subscriptions;
• the developer portal;
• the community/forum and related public resources;
• the component marketplace and update infrastructure; and
• associated business communications.

This Privacy Policy does not replace the merchant’s own privacy obligations to its customers, users, staff, or site visitors.

2. Role Allocation

2.1 When Spwig acts as controller

Spwig acts as controller for personal data relating to:

• prospective customers and business contacts;
• purchasers and account holders;
• billing contacts;
• developer portal users;
• community/forum users;
• support correspondents;
• website visitors to Spwig-operated sites and portals;
• licence registration, activation, update, hotfix, and maintenance interactions; and
• any merchant personnel data needed to administer the customer relationship.

2.2 When merchants act as controller

Merchants are the controller of the personal data they collect and manage through their own Spwig stores, including customer, order, account, product review, marketing, and operational data.

2.3 Hosted Spwig

For hosted Spwig, Spwig provides the hosted infrastructure and application environment and may process merchant-controlled store data only to the limited extent necessary to provision, host, store, transmit, secure, maintain, and back up the hosted environment. Spwig does not have ordinary access to the contents of merchant-controlled store data within merchant containers. Spwig personnel can access such data only if the merchant separately provisions access for Spwig, such as by creating an account for support or troubleshooting purposes.

2.4 Self-hosted Spwig

For self-hosted deployments, Spwig generally does not process a merchant’s full store database or customer records in the ordinary course. However, certain Spwig-operated services used by self-hosted installations can receive limited technical or end-user data, as described below.

3. Categories of Personal Data We Process

3.1 Purchaser, account, and business relationship data

We may process:

• name;
• company name;
• business email address;
• billing address;
• browser details;
• IP address;
• licence activation and installation data;
• account identifiers;
• billing records and transaction history;
• support correspondence; and
• similar customer relationship and operational records.

3.2 Self-hosted service interaction data

Based on the current platform audit, self-hosted installations may send the following data to Spwig-operated services:

• registration/authentication data to updates.spwig.com, including domain and admin email on first authentication;
• licence refresh data, including aggregate counts only such as products, orders, and customers;
• platform update check and update reporting data;
• telemetry data about component versions;
• error reports, which are intended to be stripped of sensitive information but may in some cases contain personal data in stack traces or file paths;
• bug reports, where the merchant manually includes data;
• GeoIP lookup requests, which process end-customer IP addresses;
• address autocomplete requests, which process address data entered during checkout;
• push notification service interactions, where enabled, which may process device identifiers and push tokens;
• SSO broker service interactions, where enabled, which may process authentication metadata;
• Docker registry access data, including server IP on image pull;
• hotfix checks; and
• component marketplace browse activity.

3.3 Hosted merchant-controlled store data

For hosted deployments, merchant-controlled store data may include, depending on how the merchant uses the store:

• merchant staff account data;
• customer account data;
• names, email addresses, phone numbers, and addresses;
• order, cart, fulfilment, and payment-status data;
• uploaded files and store content;
• logs and operational metadata; and
• other information entered by the merchant or its users into the hosted environment.

Spwig does not use this merchant-controlled store data for its own marketing or model-training purposes.

3.4 Community and developer portal data

We may process:

• usernames and profile details;
• account credentials or authentication metadata;
• forum posts, developer submissions, reviews, and related content;
• moderation and abuse-prevention data; and
• audit or compliance records relating to marketplace or portal activity.

3.5 Payment and billing data

We use tokenized payment flows. Spwig does not store full card numbers, CVV/CVC, PINs, or magnetic stripe data. We may process:

• card brand;
• last four digits;
• expiry month/year;
• billing address;
• payment provider token or reference IDs; and
• transaction and billing history.

4. Sources of Personal Data

We obtain personal data:

• directly from you when you sign up, buy, activate, subscribe, correspond with us, or use our portals;
• from your browser, device, or network when you access Spwig-operated sites or services;
• from your self-hosted installation when it contacts Spwig-operated services;
• from hosted environments that we provision for merchants;
• from payment providers in connection with billing events and tokenized payment records; and
• from community/forum or developer portal activity.

5. Purposes and Legal Bases

Where GDPR or similar law applies, we rely on one or more of the following legal bases.

5.1 Contract

We process personal data as necessary to:

• create and administer accounts;
• deliver self-hosted licences, hosted subscriptions, updates, hotfixes, and related services;
• provide billing, payment administration, and subscription management;
• provide support and respond to requests;
• host, back up, and secure hosted environments;
• operate developer portal, marketplace, and community services; and
• enforce our contracts and plan terms.

5.2 Legitimate interests

We process personal data where necessary for legitimate interests such as:

• service security, abuse prevention, and fraud detection;
• audit logging and operational monitoring;
• debugging, reliability, and product maintenance;
• licence compliance and infrastructure protection;
• business administration and recordkeeping;
• improving our websites and services; and
• defending legal claims and exercising legal rights.

Where we rely on legitimate interests, we consider the impact on individuals and apply safeguards appropriate to the context.

5.3 Legal obligation

We process personal data where necessary to comply with applicable legal, regulatory, accounting, tax, sanctions, disclosure, or law-enforcement obligations.

5.4 Consent

Where required by law, we rely on consent for certain cookies or similar tracking technologies, certain marketing communications, and other optional processing activities.

6. Cookies and Similar Technologies

6.1 Cookies we currently use

Spwig deployments and/or Spwig-operated pages may use cookies such as:

• sessionid for session management;
• csrftoken for CSRF protection;
• spwig_cookie_consent for consent preferences;
• lang for language preference;
• geo_country for GeoIP override;
• ref_token for referral attribution; and
• admin_theme for admin theme preference.

Spwig deployments may also use browser local storage and session storage for non-personal UI state preferences such as dismissed announcements, layout selections, and panel collapse states.

6.2 Analytics and tracking

Spwig currently uses internal analytics rather than Google Analytics, Meta Pixel, or similar third-party ad trackers. These internal analytics may track session information, page views, device types, UTM parameters, and referrer URLs.

6.3 Important current implementation note

The current platform audit indicates that analytics tracking is presently implemented regardless of cookie consent state, and consent gating is not yet fully enforced in code. Spwig intends to improve this, but until then this policy discloses the current state rather than implying stricter behavior than is presently implemented.

6.4 Referral tracking

Referral tracking may involve hashed IP-based attribution and device fingerprint hashes derived from user agent and IP-related data.

7. Marketing Communications

Spwig may send service-related and business communications including:

• onboarding emails for hosted merchants;
• billing and payment status messages;
• suspension, cancellation, reactivation, and lifecycle notices;
• product or account administration notices; and
• marketing communications where permitted by law.

You can opt out of marketing communications, but you cannot opt out of transactional or service-critical notices.

Merchant-controlled customer marketing preferences inside a merchant’s own Spwig store are controlled by the merchant, not by Spwig acting for its own purposes.

8. Payments

Merchant billing for hosted subscriptions is processed using third-party payment provider infrastructure. Spwig follows a tokenization-first approach and does not locally store full payment card data.

Merchants remain responsible for their own end-customer payment arrangements, payment gateway choices, and compliance obligations for their stores.

9. Security Measures

Spwig uses measures designed to protect personal data appropriate to the context, including measures such as:

• HTTPS enforcement in production;
• HSTS and security header controls;
• credential encryption for supported secrets;
• role-based access controls;
• rate limiting;
• session protection measures;
• audit logging; and
• encryption at rest and container-level backup protections for hosted environments where implemented.

No method of transmission, storage, or processing is completely secure.

9.1 Data breach notification

Where Spwig becomes aware of a qualifying personal data breach affecting data for which it acts as controller, Spwig will notify affected individuals and supervisory authorities as required by applicable law. For hosted environments, where Spwig becomes aware of a breach that may affect merchant-controlled store data, Spwig will notify the merchant promptly so the merchant can fulfil its own notification obligations as controller.

10. International Transfers and Data Location

10.1 Purchaser and account data

Spwig stores purchaser and account relationship data in Singapore.

10.2 Hosted merchant environments

Hosted merchant store environments may be provisioned in regions such as:

• Frankfurt for Europe;
• Singapore for Oceania / Asia; and
• Newark for the Americas.

Available regions may change over time. The region applicable to your hosted environment is determined at provisioning.

10.3 International transfers

Because Spwig is based in Singapore and support, administration, or billing functions may be managed from Singapore, personal data may be accessed or processed outside the EEA/UK. Where required, Spwig will rely on contractual and operational safeguards appropriate to the transfer context.

11. Data Sharing

We may share personal data with:

• payment providers for billing and subscription administration;
• hosting and infrastructure providers as necessary to run the service;
• merchant-selected external translation providers where the merchant enables those integrations;
• professional advisers, auditors, insurers, and corporate transaction counterparties where appropriate;
• law enforcement, regulators, courts, and authorities where required; and
• service providers acting on our instructions for hosting, operations, security, communications, or support.

We do not sell personal data.

12. Retention

We retain personal data only for as long as necessary for the relevant purpose, unless a longer period is required by law or justified by legitimate operational need.

Current known retention settings or states include:

• Django sessions: 30 days;
• GeoLocation IP cache: 7 to 30 days depending on confidence;
• admin audit logs: 90 days;
• mobile auth tokens: 30 days post-expiry;
• referral events: 90 days, configurable;
• consent/preference change logs: 90 days;
• hosted post-termination backup archive: up to 90 days on request;
• analytics records such as visitor sessions and page views: retained for the duration of the merchant's account relationship and a reasonable period thereafter for operational, legal, and dispute resolution purposes;
• payment transactions, orders, and webhook payloads: retained for the duration of the account relationship and a reasonable period thereafter for legal, tax, accounting, and dispute resolution purposes.

Spwig expects to refine retention controls over time and will update this section accordingly.

13. Your Rights

Where applicable law grants rights, you may request:

• access to personal data;
• correction of inaccurate data;
• deletion of personal data;
• restriction of processing;
• objection to certain processing;
• data portability; and
• withdrawal of consent where processing is based on consent.

These rights are not absolute and may be subject to legal or contractual limitations.

For merchant-controlled store data, the merchant is normally the first party responsible for handling end-customer rights requests.

14. Error Reports and Bug Reports

Error reports are intended to exclude sensitive information and are rate-limited, but the current audit indicates that personal data may still occasionally appear in stack traces or file paths. Bug reports may also contain personal data if the submitting merchant includes it manually.

If you submit logs, screenshots, exports, or other materials to Spwig, do not include personal data unless necessary. If you do, you are responsible for ensuring you have authority to share it.

15. GeoIP and Geocoder Services

Spwig-operated GeoIP and address autocomplete services are a material privacy point for self-hosted deployments:

• GeoIP lookups may process end-customer IP addresses;
• address autocomplete may process end-customer address data entered during checkout; and
• these services are part of Spwig-operated service infrastructure tied to maintenance eligibility.

Merchants using these services should disclose them appropriately in their own customer-facing privacy notices where required by law.

16. Children

Spwig services are intended for business use, not for children. The community/forum currently states a minimum age of 13. Spwig does not knowingly collect personal data from children in contexts where doing so would be prohibited by law.

17. AI and Model Training

Spwig’s primary AI-related feature in scope is translation tooling. By default, translation may run locally or through external providers selected or configured by the merchant.

Spwig does not use merchant or customer data from Spwig installations to train its own models.

External providers used by the merchant for translation or related features may apply their own terms and retention practices, which the merchant should review.

18. Community, Public Content, and Reviews

If you post in Spwig community areas, submit marketplace content, or leave public reviews, the information you submit may be visible to others. Do not include confidential or sensitive personal data in public content.

19. Changes to this Policy

We may update this Privacy Policy from time to time. The updated version becomes effective when posted, unless a later date is stated.

20. Contact and Complaints

For privacy-related requests or questions, contact:

Spwig Pte. Ltd. 3 South Buona Vista Road, #B1-08 Viva Vista, Singapore 118136 [email protected]

For general support enquiries, contact [email protected].

If applicable law gives you the right to complain to a supervisory authority, you may do so. For merchant-controlled customer data, the merchant is usually the first point of contact.