Privacy Policy

Data we collect

Account information: name, email address, and avatar if you sign in with Google. Passwords are stored hashed — we cannot read them.

API keys: only a hash of each key is stored; the full key is shown once at creation.

Usage records: which service, which action, and when — to show you your usage and operate limits.

Business client data (app.erpfit.com, cloud.erpfit.com, console.erpfit.com): company details, contact persons (name, role, phone, email), services in use, invoices and payments — to provide the services, invoice and support you.

The erpfit.com contact form: your name, email and message — to reply to you.

Content you submit for processing: for example images uploaded to Vectorize, RemoveBG, Upscale, Stylize, Restore or Colorize, text sent to Summarize, or web addresses submitted to AiSEO.

Photos of people

Photos sent to Restore, Colorize, RemoveBG, Upscale or Stylize often show faces. A photo is processed only to return your result and is deleted straight after; we do not keep it, do not train models on it, and do not identify the people in it.

Upload only photos you have the right to use; if a photo shows other people, you need their consent.

Purposes and legal basis

To provide and operate the services you request or contract for; secure accounts; show usage; invoice and keep records as accounting and tax law requires; and reply to you.

We do not sell your data and we do not use it for advertising.

Where data is stored and transfers abroad

erpfit.com, the ERPFit account (auth.erpfit.com) and the Craft tools run on ERPFit servers in Vietnam.

The client portals app.erpfit.com, cloud.erpfit.com and console.erpfit.com run on servers rented from OVH in Singapore; backups are encrypted before they are sent to Hetzner storage in Germany, which holds only encrypted data. This is a transfer of personal data abroad; ERPFit prepares the transfer impact assessment the law requires.

The default summariser of Summarize sends the text you submit through our AI gateway to a third-party AI model provider, which may process it outside Vietnam. Vectorize and the other processing modes do not send images beyond our servers. Do not submit personal data to Summarize if you do not want it to leave Vietnam.

The Summarize default summariser uses the DeepSeek model through OpenCode Zen (servers in the US and EU), whose provider states it keeps nothing and does not train models on the text. When that service does not answer, the request may be routed through OpenRouter. Vectorize AI mode is not currently offered.

Cookies

We use one sign-in session cookie, valid across erpfit.com subdomains so a single sign-in works for every service. No advertising or third-party tracking cookies.

Third parties

Cloudflare: content delivery and anti-automation verification (Turnstile).

Google: only if you choose to sign in with Google; we receive your basic name, email and avatar.

Resend: transactional email about your account and invoices.

OVH (Singapore) and Hetzner (Germany): server and backup infrastructure as described above.

AI model providers: only for the AI modes described above.

Retention

Account and usage data: while your account is active.

Contact-form messages: 12 months, then deleted automatically.

Images and text submitted for processing: deleted as soon as the result is returned.

Invoices and accounting records: for the period accounting and tax law requires, including after an account is deleted.

Your rights

You have the right to be informed about processing; to give or withdraw consent; to access, correct and receive a copy of your data; to ask for deletion, restriction of processing, or to object to processing; and to complain, denounce, sue and claim compensation as the law provides.

Send requests to [email protected]. Once we have verified that you are the data subject, we carry out a deletion or data-copy request within 72 hours, except for data the law requires us to keep.

Withdrawing consent does not affect processing carried out before it.

Security and incidents

Connections are TLS-encrypted; passwords and API keys are hashed; backups are encrypted; each business client’s data is kept separate; system access is restricted.

If personal data is leaked or lost, we notify the Department of Cybersecurity and High-Tech Crime Prevention (A05, Ministry of Public Security) within 72 hours, and notify the people affected when the incident may harm them.

Children

The services are for businesses and adults and are not directed at children under 16.

Changes and contact

When this policy changes we update this page together with the effective date.

Questions: [email protected] — ERPFIT COMPANY LIMITED, tax code 0317567782.