This policy explains how Lê Mai collects, uses, and protects your personal data when using the library at library.lemai.com.vn.
Principle: transparent, minimal collection, no sale of data to third parties. You have the right to view, export, and delete your data at any time.
Account information: email, display name, hashed password, registration date, last sign-in date.
Activity data: pages viewed, search queries, filters used, access timestamps.
Technical information: IP address, user agent (browser and OS), referer (source link).
When you contact us by email, we retain the correspondence to handle your request.
We do NOT collect phone numbers, addresses, date of birth, or financial information.
Provide library access and maintain login sessions.
Send email for signup confirmation, password recovery, and important notices (terms updates, security incidents).
Improve the library: aggregated anonymized statistics help identify the most useful pages and guide content expansion.
Marketing only when you actively subscribe to a newsletter. You may unsubscribe at any time.
We do NOT sell or rent your personal data to third parties.
Supabase (Singapore): provides authentication and database services. Email and hashed password are stored in Supabase infrastructure. Supabase complies with SOC 2 and GDPR.
Vercel (global): provides hosting services. Vercel may log technical access at edge servers.
Google Analytics 4: the library uses Google Analytics to count page views and traffic sources as aggregated statistics. Google Analytics sets cookies in your browser (such as _ga), and Google may process your IP address. You can block it with a tracker blocker or Google's opt-out add-on (tools.google.com/dlpage/gaoptout).
Google Fonts: the library loads typefaces from Google Fonts CDN. Google may log your IP address when fonts are fetched.
Google OAuth (if you choose Google sign-in): Google shares your email and display name with Lê Mai. Lê Mai does not receive your Google password.
CDN jsDelivr / unpkg: provide some public JavaScript libraries (such as Fuse.js for search).
Account data (email, name, hashed password) is retained until you request deletion.
Activity logs (pageviews, searches) are kept in detail for 12 months. After that, data is aggregated anonymously and cannot be traced back to individuals.
Support email correspondence is retained for 24 months from the last reply.
When you delete your account, all personal data is removed from the live database within 30 days. Backup copies may remain for up to 90 days before they are also deleted.
Right to access: you can view all personal data we hold about you in the Account page.
Right to delete: you may self-delete your account at any time. Upon deletion, data is handled per the Retention section.
Right to portability: email lemai@lemaivietnam.com.vn to request export of your personal data as a JSON or CSV file. We will respond within 14 days.
Right to object: you may unsubscribe from marketing emails at any time via the 'unsubscribe' link in any such email.
Right to complain: if you believe your data is being mishandled, you may file a complaint with Vietnam's data protection authority or the EU's (if you are an EU resident).
The library uses localStorage to store the session token. This is necessary to keep you signed in across tab close/reopen.
Supabase uses a technical cookie to maintain authentication sessions.
The library does not use Facebook Pixel or advertising cookies. It does use Google Analytics 4 cookies for page view statistics (see section 03). The library no longer offers accounts; any existing account data is kept only to be deleted on request.
The library is not directed at users under 16 and we do not knowingly collect personal data from children.
If we discover an account belongs to a user under 16 without guardian consent, we will delete the account and all related data.
Guardians who discover a child has registered may contact lemai@lemaivietnam.com.vn for deletion assistance.
All connections to the library are encrypted via HTTPS (TLS 1.3).
Passwords are hashed with bcrypt managed by Supabase. Lê Mai never sees raw passwords.
Session tokens are signed JWTs (JSON Web Tokens). They expire and refresh automatically.
The database is encrypted at rest.
Internal admin access is restricted by the principle of least privilege and is logged for audit.
This privacy policy may be updated as our service or legal requirements change.
Material changes (such as adding third parties or expanding collection scope) will be notified via email and an on-site banner at least 14 days before they take effect.
The latest revision date is always shown at the bottom of the page. Continued use after an update means acceptance of the new version.
Data is stored on Supabase infrastructure in Singapore (ap-southeast-1). When you access the library, data may be processed at Vercel data centers globally (CDN edge).
Lê Mai commits to working only with service partners who meet international data protection standards equivalent to GDPR or better.
All questions, requests, or complaints regarding privacy may be sent to: lemai@lemaivietnam.com.vn
Hotline: +84 938 137 468
Facebook: facebook.com/lemaivietnam
We commit to responding within 14 business days.
Current policy revision: 2026-05-12.