Privacy policy
This policy is available in English, Korean, Japanese and Chinese. Where the versions differ, the Vietnamese version prevails.
English version: Privacy policy (English)
1. Scope
This policy applies to the GUDJOB website and to every product, application and service operated by GUDJOB CO.,LTD, including but not limited to GUDJOB Mate, GUDHOST, GUD CONTEST, GUD Visibility and any other product that refers to this policy (together, the “Services”).
This policy consists of:
- a general part (sections 1–13): applies to all of the Services;
- product appendices (section 14): set out the data specific to each product.
Where an appendix differs from the general part, the appendix prevails for that product.
2. Who we are
- Legal entity: GUDJOB CO.,LTD
- Tax identification number: 0315539317
- Address: 1st Floor, 456 Xo Viet Nghe Tinh Street, Thanh My Tay Ward, Ho Chi Minh City, Vietnam
- Personal data protection contact: the Data Protection department, email contact@gudjob.net (subject “Personal data”)
3. Legal basis
We process personal data in accordance with the following legal instruments:
- Law on Personal Data Protection No. 91/2025/QH15;
- Decree No. 356/2025/ND-CP detailing the Law on Personal Data Protection;
- Law on Cybersecurity and other relevant laws and regulations of Vietnam.
We process data only where one of the following grounds applies:
- your consent;
- the performance of a contract with you or the fulfilment of your request;
- compliance with a legal obligation;
- other cases permitted by law.
4. GUDJOB's role
- Data controller. GUDJOB is the controller for:
- data collected on the GUDJOB website;
- customer accounts of GUDJOB products;
- administrator and judge accounts.
- Data processor. When GUDJOB operates the Services on behalf of another organisation, that organisation is the controller and GUDJOB is the processor, processing data only on that organisation's instructions. For example:
- a contest organiser on GUD CONTEST;
- a customer hosting their website on GUDHOST.
We forward data rights requests concerning this type of data to that organisation and assist it in handling them.
5. Data we collect
Data you provide:
- your full name, email, phone number, organisation, province/city and the content you submit through contact, consultation or newsletter sign-up forms;
- application documents (CV, contact details, experience) when you apply for a position at GUDJOB;
- account information when you use a GUDJOB product;
- data specific to each product (see section 14).
Data collected automatically:
- IP address, browser and device type, time zone, language;
- pages viewed and the referring page;
- cookie data (see section 10);
- activity logs on products that require sign-in.
Data from third parties, when you choose to connect an account (for example TikTok, Facebook or other social networks): see the appendix for the relevant product.
Data we do not collect:
- sensitive personal data, unless a product explicitly states so and you consent;
6. Purposes of processing
- Responding to enquiries, consultation and quotation requests; sending newsletters when you subscribe.
- Providing, operating and securing the Services: account creation, sign-in, fraud and spam prevention.
- Performing contracts with customers and partners.
- Measuring and improving the website.
- Measuring the effectiveness of GUDJOB's own advertising (see section 10).
- Recruitment.
- Complying with legal obligations and resolving complaints.
We do not sell personal data.
7. Data sharing and sub-processors
We share data only where necessary for the purposes set out in section 6, with the following parties:
- Infrastructure providers. These include servers and databases, a content delivery network (CDN), file storage and spam protection (Cloudflare), email delivery (Resend) and website hosting.
- Platforms you choose to connect. For example TikTok, Meta (Facebook, Instagram) and other social networks. Data is exchanged only within the scope of the permissions you grant.
- Measurement and advertising tools on the GUDJOB website: Google (Tag Manager, Analytics, Ads), Meta (Pixel and Conversions API), OpenAI (ChatGPT ad measurement). When you submit the contact form, your name, email address and phone number are hashed one-way (SHA-256) before being sent to Meta, solely to measure the effectiveness of GUDJOB's advertising. Meta does not receive the original data.
- Form tools, used for the contact and job application forms.
- GUDJOB Social and our AI provider (Anthropic). Used for GUDJOB Mate, within the scope set out in section 14.1 e).
- Providers of the software platforms on which some GUDJOB products are built. These parties process data only on GUDJOB's instructions and under contracts containing data protection clauses.
- Competent state authorities, where required by law.
8. Transfers of data outside Vietnam
The servers of GUDJOB products and of some providers listed in section 7 may be located in different countries. Their location may change over time, depending on the infrastructure used.
Your data may therefore be stored and processed outside Vietnam. By using the Services, you are informed of and consent to this transfer.
We carry out cross-border data transfers in accordance with the Law on Personal Data Protection and Decree 356/2025/ND-CP, including:
- preparing a cross-border personal data transfer impact assessment dossier as required by law;
- transferring data only to parties that have contractually committed to protecting it;
- applying technical measures such as encryption in transit and at rest.
9. Retention periods
| Data type | Retention period |
|---|---|
| Enquiries and consultations | 12 months from the last contact. |
| Newsletter | Until you unsubscribe. |
| Job applications | 12 months after the end of the recruitment round. |
| Accounts and product data | For as long as you use the product and 12 months after you stop using it, unless the product's appendix states otherwise. |
| Data from social media platforms (GUDJOB Mate) | See section 14.1 d). |
| Invoices and accounting records | For the period required by accounting and tax laws. |
At the end of the retention period, data is deleted or anonymised.
10. Cookies and measurement tools
Cookies are small files stored in your browser. We use:
- Essential cookies: sign-in, security, remembering your language, spam prevention. Without them, the Services do not work properly.
- Analytics cookies: Google Analytics, to compile aggregate visitor statistics.
- Advertising cookies: Google Ads, Meta Pixel (_fbp and _fbc cookies), ChatGPT ad measurement. Used to measure the effectiveness of GUDJOB's advertising and for retargeting.
You can refuse or delete cookies in your browser settings. You can also use the opt-out tools provided by Google and Meta. Blocking essential cookies may cause some features to stop working.
11. Your rights
All users, in any country, have the following rights over their data:
- to be informed about the processing of their data;
- to give or withdraw consent;
- to access, view and obtain a copy of their data;
- to request correction;
- to request deletion;
- to request restriction of processing;
- to object to processing, including for marketing purposes;
- to lodge complaints, report violations and bring legal action as provided by law.
How to submit a request: email contact@gudjob.net with the subject “Personal data”.
Processing times (under Decree 356/2025/ND-CP): we respond within 2 working days of receiving a request, and then complete it within the following periods.
| Request type | Completion period | Where a processor or third party must be involved |
|---|---|---|
| Viewing, obtaining a copy of or correcting data | 10 days | 15 days |
| Withdrawing consent, restricting processing, objecting | 15 days | 20 days |
| Deleting data | 20 days | 30 days |
In complex cases, the period may be extended once as permitted by law. We will then inform you of the reason and the new deadline.
To protect you, we may ask you to verify your identity before processing a request.
Detailed instructions: Data deletion instructions
12. Minors
The Services are not intended for children under 16, unless a product states otherwise.
For persons under 18, we process data only with the consent of a parent or guardian. For children aged 7 or over, the child's own consent is also required. Parents and guardians may request to view the child's data, withdraw consent or have the child's data deleted.
13. Security, external links and policy changes
Security.
- Data is transmitted over encrypted connections (HTTPS).
- Access tokens for connected platforms are encrypted at rest.
- Internal access is restricted on a need-to-know basis.
No system is completely secure. If a personal data breach occurs, we will give notice as required by law.
External links. The Services may contain links to third-party websites. We are not responsible for how those websites process data.
Changes to this policy. When this policy changes, we update the date at the top of the page. Significant changes will be announced on the website or by email to users who have an account.
14. Product appendices
14.1 GUDJOB Mate: data from social media and advertising platforms
GUDJOB Mate (mate.gudjob.net) is GUDJOB's internal work system. GUDJOB staff use it to publish and schedule posts that a client has approved to that client's social media accounts, to track the results of those accounts and campaigns, and to run advertising for the client.
This appendix explains what GUDJOB Mate receives from each platform when you connect an account (as a client, a person who manages a client's page, or GUDJOB staff), why, where it is stored, for how long, and how to have it deleted. It adds to sections 1–13 above. Where they differ, this appendix prevails for platform data.
Besides platform data, GUDJOB Mate keeps user accounts (name, email), post content and approval comments, for the periods in section 9.
a) Principles
- GUDJOB Mate receives only what you grant on the platform's consent screen, and uses it only for the work you or the client asked GUDJOB to do.
- We do not sell platform data, use it to advertise for anyone else, or use it to train AI models, and we share it with no one but the processors in e).
- Each social media account belongs to one client. One client's data is never shown to another client.
- Access tokens and refresh tokens are encrypted (AES-256-GCM) and bound to the client. They are never shown in a browser or written to logs, and they are destroyed as soon as the account is disconnected.
- GUDJOB Mate publishes only posts the client approved, to the accounts and at the time set. GUDJOB Mate never deletes a post on its own.
- GUDJOB Mate removes a post from a platform only when the client, or a GUDJOB staff member who works on that client, asks for it, and only on platforms whose API allows removal. TikTok's API does not: there GUDJOB Mate only opens the post in TikTok for the account holder to remove.
- GUDJOB Mate never asks for or stores your social media passwords. You sign in on the platform's own page. Bluesky uses an “app password”, which you create and can revoke at any time; it is not your account password.
b) Data by platform
| Platform | What GUDJOB Mate reads or writes (permissions granted) | Why |
|---|---|---|
| Facebook (Pages) | The Pages you manage, their names and IDs; publishing posts, photos and videos to a Page; reading the Page's published posts to avoid posting twice; Page insights; commenting as the Page when the client asks (pages_show_list, pages_read_engagement, pages_manage_posts, pages_manage_engagement, publish_video, read_insights) | Publishing client-approved posts; reporting results to the client |
| Instagram (professional accounts) | The account's name, ID, profile picture and recent media; publishing photos, carousels and videos; account and media insights (instagram_basic, instagram_content_publish, instagram_manage_insights) | Publishing client-approved posts; reporting results to the client |
| Meta: Business Suite and ads | Pages, Instagram accounts and ad accounts the client shares with GUDJOB's business portfolio; creating and managing campaigns and reading ad results (business_management, ads_management, ads_read) | Running the client's advertising and reporting spend and results |
| Threads | The profile's username, name, ID and recent posts; publishing; removing a post on request (threads_basic, threads_content_publish, threads_delete) | Publishing client-approved posts, avoiding duplicates, removing a post on request |
| TikTok | open_id, display name and avatar (user.info.basic); uploading a video to the account's TikTok inbox as a draft (video.upload); where the client turns on direct posting, publishing the video (video.publish); the status of videos sent | Sending client-approved videos: the account holder posts the draft, or GUDJOB Mate posts directly with the client's consent |
| The member's ID, name and picture (openid, profile); posting to that member's own profile (w_member_social); for Company Pages, the Pages you administer and your role, posting as the Page and reading its recent posts (rw_organization_admin, w_organization_social, r_organization_social). GUDJOB Mate does not read your email address | Publishing client-approved posts | |
| YouTube | The channels you may post to, and their names and IDs; uploading videos to a channel; deleting a video when the client asks GUDJOB to remove it (youtube.force-ssl) | Publishing client-approved videos, and removing a video at the client's request |
| Google Business Profile | Business locations whose owner invites GUDJOB's Google account (social@gudjob.net) as a Manager; location names and IDs; publishing update posts and reading their status (business.manage) | Publishing client-approved updates to the business profile |
| X, Bluesky, Pinterest, Mastodon | Account name and ID, Pinterest boards; publishing posts and reading their status, through our processor GUDJOB Social (e) | Publishing client-approved posts |
c) Where it is stored
Data is stored in GUDJOB Mate's own database, with our infrastructure provider in Singapore. Encrypted backups, the latest 30 days, are kept in Cloudflare R2, in the Asia-Pacific region. Files (images, videos) are kept in private storage. A platform receives only a short-lived link when a post is published.
d) Retention and deletion
- Tokens: destroyed as soon as the account is disconnected, when you remove GUDJOB's access on the platform, or when a token expires and cannot be refreshed.
- Account names, IDs and published posts: kept while GUDJOB serves the client, and at most 12 months after the service ends. Post content is work GUDJOB made for the client, so it is kept as the contract and accounting law require.
- Insights and ad results: kept as above, for the client's reports.
- Platform notifications (webhooks): deleted after 30 days.
You can ask for deletion at any time, in the following ways.
- Disconnect in GUDJOB Mate: the GUDJOB staff member on the client, or the client's admin, disconnects the account. Its tokens are destroyed and its scheduled posts are cancelled.
- Remove access on the platform (menu names may differ slightly between app versions):
- Facebook: Settings → Business integrations;
- Instagram: Settings → Apps and websites;
- Threads: Settings → App and website permissions;
- TikTok: Profile → ☰ → Settings and privacy → Security & permissions → Apps and services permissions → Remove access;
- LinkedIn: Settings → Data privacy → Permitted services;
- Google and YouTube: Google's security settings page (see g);
- Google Business Profile: remove GUDJOB from the profile's managers.
When Meta, Threads or TikTok tell us you removed access, GUDJOB Mate destroys your tokens automatically.
- A data deletion request through Facebook or Threads: when you remove the app and ask for your data to be deleted, Meta sends us the request. GUDJOB Mate destroys your tokens, erases your Facebook or Threads account ID and name, and gives you a confirmation code and a page to check its status.
- Email contact@gudjob.net with the subject “Personal data”. Response times are as in section 11. Data received from YouTube and Google is deleted within 30 days of your revoking access.
Detailed instructions: Data deletion instructions
e) Who it is shared with
- Our infrastructure provider in Singapore: servers and database.
- Cloudflare: network protection, file storage and backups.
- Resend: notification emails.
- GUDJOB Social: GUDJOB's publishing tool, operated by a provider in the United States. It is used only for X, Bluesky, Pinterest and Mastodon, as a processor under a data processing agreement.
- Our AI provider (Anthropic, United States): only when GUDJOB staff ask the Mate assistant, and only with data that staff member may already see. Under the provider's current terms, this data is not used to train models.
- The platforms themselves (Meta, TikTok, LinkedIn, Google): when GUDJOB Mate publishes or reads results with the permissions you granted.
- Competent public authorities: where the law requires it.
f) Cross-border transfer
Some of the data in b) is stored or processed outside Vietnam: in Singapore and the Asia-Pacific region (servers, backups), in the United States (GUDJOB Social, our AI provider) and on the platforms' own servers. These transfers are made as described in section 8.
g) Platform-specific commitments
- Google: GUDJOB Mate's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
Google API Services User Data Policy: Google API Services User Data Policy
- YouTube: GUDJOB Mate uses YouTube API Services. By connecting a YouTube channel, you agree to be bound by the YouTube Terms of Service. Google processes data under the Google Privacy Policy. In addition to the deletion routes in d), you can revoke GUDJOB Mate's access to your data on Google's security settings page. Send questions or complaints about our privacy practices to contact@gudjob.net.
YouTube Terms of Service: YouTube Terms of Service
Google Privacy Policy: Google Privacy Policy
Google's security settings page: security.google.com/settings/security/permissions
- Meta (Facebook, Instagram, Threads): GUDJOB Mate uses Meta data only to publish, manage advertising and report for the client who owns the account. GUDJOB Mate never sells it or passes it to data brokers, and deletes it on request as in d).
- TikTok: GUDJOB Mate uses TikTok data only to send or publish videos the client approved and to follow their status. GUDJOB Mate does not read private videos or messages, and never sells the data.
- LinkedIn: GUDJOB Mate uses LinkedIn data only to publish client-approved posts, and deletes a member's content and tokens when they ask.
14.2 GUDHOST
GUDHOST is a website hosting service.
Data processed:
- customer account information: GUDJOB is the controller;
- data within the customer's website: the customer is the controller and GUDJOB is the processor. GUDJOB accesses this data only when necessary for operation, backup or restoration, or when the customer requests support.
Backups and retention period: backups are kept according to the service plan. After the service ends, website data and backups are deleted within 12 months at the latest.
14.3 GUD CONTEST
GUD CONTEST is a platform for running contests. For the contestant data of each contest, the organiser is the controller and GUDJOB is the processor.
a) Contestant data and purposes
| Data | Purpose |
|---|---|
| Full name, email, phone number, province/city, date of birth, team name | Registration, communication, verification of eligibility and age, prize awarding |
| Photos, videos, entry descriptions | Displaying and judging entries |
| AI tool disclosure, copyright undertaking | Checking the validity of entries |
| One-time passcode (OTP) sent by email, activity logs | Sign-in, security, fraud prevention |
Organiser, administrator and judge accounts (full name, email, activity logs) are controlled by GUDJOB.
b) Data from TikTok
When you sign in with TikTok, GUD CONTEST uses TikTok Login Kit and Display API, with only two scopes:
- user.info.basic: identifier (open_id), display name, avatar;
- video.list: the list of your public videos and their numbers of views, likes, comments and shares.
Purpose:
- verifying that the contest video is yours;
- calculating the reach score under the contest rules. The metrics are read periodically until the contest's cut-off date.
Commitments:
- we do not post on your behalf;
- we do not read your private videos or messages;
- we do not sell data;
- access tokens are encrypted at rest and used only for the purposes above.
Retention period:
- access tokens: deleted when the contest ends;
- video metrics: retained as set out in item d).
Revoking access: you can revoke access at any time in the TikTok app: Profile → ☰ → Settings and privacy → Security & permissions → Apps and services permissions, select the app, then tap Remove access (menu names may differ slightly between app versions).
c) Data from Meta (Facebook, Instagram)
Entries may be published to the contest's Facebook Page through the Meta Graph API, directly or through GUDJOB Mate. Publishing uses the contest Page's permissions, not the contestant's personal account.
GUD CONTEST reads the reach, reactions, comments and shares of those posts to calculate scores under the contest rules.
Data stored:
- post ID;
- engagement metrics;
- the time the metrics were read.
Retention period as set out in item d).
d) Retention period
Contestant data and metrics from TikTok and Meta are retained for the duration of the contest and for 6 months after the results are announced. The data is then deleted or anonymised, unless the law requires longer retention (for example, prize award records).
e) Contestants under 18
- Contestants under 18 must confirm upon registration that they have the consent of a parent or guardian. Contestants aged 7 or over must also give their own consent.
- The organiser is responsible for verifying this consent.
- A parent or guardian may request deletion of the contestant's data.
f) Contestants' rights
Send requests to the contest organiser or to contact@gudjob.net. GUDJOB will forward the request to the organiser and assist in carrying it out.
14.4 GUD Visibility
GUD Visibility measures the extent to which customers' brands appear in the answers of AI platforms.
Data processed:
- user accounts: full name, email;
- business information provided by the customer: brand, competitors, set of tracked questions;
- measurement results.
GUD Visibility does not collect personal data of AI platform users.
Retention period: for as long as you use the product and 12 months after you stop using it.
Contact us
GUDJOB CO.,LTD · contact@gudjob.net · 1st Floor, 456 Xo Viet Nghe Tinh Street, Thanh My Tay Ward, Ho Chi Minh City