ComicStation Privacy Policy

DRAFT – PENDING LEGAL REVIEW. Items marked [CẦN XÁC NHẬN – TO CONFIRM] are not yet confirmed.

1. Controller and contact

ComicStation (comicstation.store) is operated by [CẦN XÁC NHẬN – TO CONFIRM: legal entity name, registration number], [CẦN XÁC NHẬN – TO CONFIRM: registered address] ("we").

• Personal data contact: privacy@comicstation.store
• General support: support@comicstation.store
• Data protection officer / responsible unit: [CẦN XÁC NHẬN – TO CONFIRM]

This policy is written for Vietnam's Decree 13/2023/ND-CP, the Personal Data Protection Law No. 91/2025/QH15 ([CẦN XÁC NHẬN – TO CONFIRM: effective date and applicable provisions]), the EU GDPR for users in the EU, and consumer laws where you live where they apply.

2. Data we collect

• Account: email, Google name and picture when you sign in with Google, account ID.
• Profile: display name, @handle, bio, avatar and cover you enter.
• Content you create: comics, chapters, posts, comments, reactions, lists, reports.
• Social graph: follows, connections, blocks, mutes, restrictions, snoozes.
• Messages: message text, attachments, reactions, edit history, read state, last-active time (unless you turn off "show activity status").
• Wallet and payments: Xu top-up records (amount, provider, status), the Xu ledger, sponsorships, royalties. We do not store card numbers.
• Creator payouts: legal name, address, date of birth, payout email, bank/PayPal/Payoneer details when you set up withdrawals.
• Contract evidence: version, SHA-256 of the text, time, IP and browser when you accept the Creator Agreement or Sponsor Terms.
• Security: sessions, IP address, browser/device, sign-in history, two-factor authentication.
• Devices: push subscriptions (your browser's endpoint and keys).
• Settings: language, time zone, currency, 18+ content, warning filters, privacy and notification settings.
• Usage: reading history, profile views, daily activity rollups and interest segments used for recommendations.

We do not use advertising cookies or third-party analytics, and we do not knowingly collect sensitive data. Please do not send sensitive data (health, religion, ID documents…) in messages or posts.

3. Purposes and legal bases

• Providing the service (account, reading, publishing, messaging, notifications, Xu wallet): performance of a contract (GDPR Art. 6(1)(b)); your consent under Decree 13.
• Payments, revenue sharing, payouts, accounting, tax: contract and legal obligation.
• Security, fraud and spam prevention, attachment malware checks: legitimate interests and legal obligation.
• Moderation, reports and copyright claims: legitimate interests and legal obligation.
• Personalized recommendations: consent (turn it off any time in Account › Privacy).
• AI translation of comics: contract with creators and sponsors.

We do not send marketing email today. If we ever do, we will ask for separate consent with an opt-out.

4. Processors and providers

• Supabase: database, authentication, storage, server functions. Region: [CẦN XÁC NHẬN – TO CONFIRM].
• Cloudflare: website hosting (Workers), file storage (R2), CDN, bot protection (Turnstile), AI (Workers AI).
• Google: Google Sign-In, API servers and virus scanning (Cloud Run), AI translation and processing (Vertex AI/Gemini). Region: [CẦN XÁC NHẬN – TO CONFIRM].
• Bunny.net: video delivery.
• Resend: system email.
• RunPod, Modal: GPU compute that processes comic pages for translation (comic content only).
• Browser push services (Google, Apple, Mozilla, Microsoft): deliver notifications to your device.
• Vietnamese banks, PayPal, Payoneer: creator payouts.
• Xu top-up payment gateway: [CẦN XÁC NHẬN – TO CONFIRM provider].

They process data only on our instructions. We do not sell personal data.

5. International transfers

Most providers above host data outside Vietnam and may host it outside the EU. We transfer data abroad based on your consent and a cross-border transfer impact assessment under Decree 13 ([CẦN XÁC NHẬN – TO CONFIRM: prepared and filed with the Ministry of Public Security (A05)]). For EU users we rely on the providers' Standard Contractual Clauses ([CẦN XÁC NHẬN – TO CONFIRM]).

6. Direct messages

• Messages are not end-to-end encrypted. They are encrypted in transit (HTTPS) and stored on our providers' infrastructure.
• Staff open messages only to handle reports, safety incidents or legal requests. Every access is logged (who, when, which conversation).
• Attachments are checked: executables, macro files, PDFs with active content and archives containing executables are blocked, and files are virus-scanned.
• Turn on Hide message previews so push notifications show only the sender, never the text.
• Messages from strangers land in Message requests. You can block, restrict, mute or report.
• When you unsend a message, its text, edit history and reactions are removed in the daily cleanup.

7. Retention

• Account and content: until you delete your account.
• Account deletion: 30 days to cancel. The daily job then anonymizes the account: email, name, @handle, post and comment text, follows, push subscriptions, sessions, Google link, your messages (others see "unsent"), and payout address/date of birth/payout email are removed.
• Financial records (Xu ledger, top-ups, royalties, payouts, contract evidence): kept under a pseudonymous ID for the period accounting and tax law require ([CẦN XÁC NHẬN – TO CONFIRM years]).
• Notifications: read ones deleted after 30 days, all after 90 days; push log 3 days.
• Daily reading activity: 180 days.
• Message last-active time: 30 days.
• Unsent attachments: 1 day. Files of unsent messages are removed from storage within hours.
• Sessions, sign-in history, audit logs: while the account exists ([CẦN XÁC NHẬN – TO CONFIRM maximum]).

8. Your rights and how to use them

• Access and portability: Account › Data & account › Download your data (JSON, including messages and attachment download links; up to 3 times per 24 hours).
• Rectification: Account › Profile, Security & sign-in.
• Erasure: Account › Data & account › Delete account.
• Withdraw consent / object: turn off personalization, hide from search, turn off push in Account; or delete the account.
• Restriction: deactivate the account in Account › Data & account, or email privacy@comicstation.store.
• Complaints: contact us first; you may also complain to Vietnam's A05 (Ministry of Public Security) or your local data protection authority.

Response times: we answer email requests within the time the applicable law requires and no later than 30 days; for requests under Vietnamese law we aim for 72 hours ([CẦN XÁC NHẬN – TO CONFIRM with counsel]). We may need to verify your identity first.

9. Security and breach notification

We use enforced HTTPS (HSTS), row-level security, optional two-factor authentication, admin access logging and rate limits. If a personal data breach happens, we will notify the competent authority within 72 hours of becoming aware as applicable law requires, and tell you without undue delay where the breach is likely to put you at risk ([CẦN XÁC NHẬN – TO CONFIRM internal procedure]).

10. Children and minimum age

• You must be at least 13 to create an account.
• If you are under 16 (or under the age your local law sets), a parent or guardian must consent to the processing of your data ([CẦN XÁC NHẬN – TO CONFIRM: Decree 13 rules for children aged 7 and over]).
• 18+ content shows only after you confirm you are 18 or older.
• If we learn an account belongs to a child under 13, we delete it. Parents can write to privacy@comicstation.store.

11. California users (CCPA)

We do not sell or share personal information for cross-context behavioral advertising. You have the right to know, delete and correct your data and not to be discriminated against for using these rights. Use the Account tools or privacy@comicstation.store.

12. Cookies

See the Cookie notice.

13. Changes

We will announce material changes on the site before they apply. Version: 2026-10-15.