Effective Date: September 30, 2025 (Last Updated)
Welcome to EXOTRAILS COMPANY LIMITED ("ExoTrails", "we", "our", or "us").
This Privacy Policy explains how we collect, use, disclose, store, and protect personal data of individuals who use exotrails.com or our mobile apps or our social media platforms (collectively, the "Service").
We comply with:
We use your data to provide and improve Service. By using Service, you agree to the collection and use of information in accordance with this policy. Unless otherwise defined in this Privacy Policy, the terms used in this Privacy Policy have the same meanings as in our Terms and Conditions.
Our Terms and Conditions ("Terms") govern all use of our Service and together with the Privacy Policy constitutes your agreement with us ("agreement").
Key terms used in this Policy:
We process Personal Data based on:
Name, email, phone, password, profile photo, language preference.
Activity & Sensor Data: route GPS traces, distance, pace, elevation, device IDs, if you choose to connect sensors - power, cadence, similar fitness metrics.
Location: processed only with your permission. We collect your location when you are recording an activity and enable Live Location in TrackMate.
When you enable Live Location in TrackMate (Track or Challenge mode), we collect your device's location at regular intervals to show your real-time position. You can control whether to share it with your groups in Track Mode. Location sharing stops when you end the session. Therefore, you are responsible for choosing who can view your real-time position and for sharing it only with trusted contacts or participants.
We retain live location records solely to support user safety and troubleshoot technical issues. These records are either deleted or anonymized when no longer needed, unless legal obligations require otherwise.
Sensitive Data: processed only with your explicit consent and for purposes you select.
Technical & Log Data. When you access the Service, we automatically collect technical data (browser, OS, referrer, URL visited, request timestamp, IP address, device identifiers, app/network latency). We use this to operate the Service, prevent abuse, and diagnose incidents. IP addresses and security logs are kept up to 90 days, then deleted or anonymized unless the law requires longer.
If you opt in, we hash and compare your device contacts solely to help you discover friends; you can revoke this permission at any time.
We use (i) essential cookies/SDKs to run the Service, (ii) analytics (with consent where required) to improve performance, and (iii) profiling/marketing (only with your opt-in consent). You can manage non-essential cookies via our cookie banner and in-app controls, and adjust OS ad preferences (iOS/Android) or withdraw consent anytime in app/browser privacy settings.
If you buy a subscription plan we collect:
We use third-party payment processors to handle payments. They receive only the data needed to process your transaction and store card details on their systems. We receive confirmation of payment status and basic billing metadata. See our payment processor's privacy notice for details.
If you sign up or log in with Apple/Google or connect social accounts, we receive the info you authorize (e.g., name, email, profile image). You can disconnect anytime in settings or the third-party account.
We use machine learning/AI to power features such as route recommendations, anomaly detection on leaderboards, and training insights. We prefer aggregated/de-identified data where possible; where features rely on health or precise location data, we only process them with your settings and explicit consent (where required).
While using our Service, we may also collect the following information: sex, age, date of birth, place of birth, passport details, citizenship, registration at place of residence and actual address, telephone number (work, mobile), details of documents on education, qualification, professional training, employment agreements, NDA agreements, information on bonuses and compensation, information on marital status, family members, social security (or other taxpayer identification) number, office location and other data.
We use your data to:
You can control your preferences anytime in settings.
Visibility Controls: you choose per-activity and per-profile visibility: Everyone / Followers / Only You.
Safer Defaults: for new accounts and all minors, default visibility is Followers and start/end of routes are blurred by default.
Export & Deletion: you may download your data (including GPX) and delete your account at any time; we delete Personal Data unless retention is required by law.
Subscription & billing records are retained for the period required by Vietnamese accounting/tax law (normally 10 years).
Activity & health data is retained until you delete it or your account, unless longer retention is required by law.
Other data will be retained throughout your use of the Service and will be deleted upon your request (except where such data is minimally required to maintain the use of the Service), or when you stop using the Service, or as required by law and competent government authorities, whichever comes first, unless longer retention is required by law.
We will delete or anonymize data no longer needed for stated purposes.
If your data is transferred outside Vietnam (e.g., to cloud servers in Singapore or the EU), we will:
EU/EEA Transfers. Where applicable, we use Standard Contractual Clauses (and complementary safeguards) for transfers from the EU/EEA/UK.
We comply with the regulations on preparing, storing, and submitting Data Protection Impact Assessment (DPIA) records within the prescribed time frame to the competent authorities in Vietnam when processing and/or transferring data outside Vietnam.
We may disclose Personal Data:
We do not sell or rent your Personal Data for money.
We apply appropriate technical and organizational measures to safeguard your data.
No online system is 100% secure; we will notify affected users and authorities of breaches as required by law.
Depending on the country/region in which the user is located, we will comply with the data collection regulations of that country for the User.
You have the right to:
Object to direct marketing at any time in email/push settings or via unsubscribe links.
Where we rely on consent (e.g., health or precise location for certain features), you may withdraw it at any time in settings; we may continue limited processing if another legal basis applies (e.g., legal compliance).
These rights will remain under Decree 13/2023 until Law 91/2025/QH15 takes effect on Jan 1 2026; we will then align fully with the updated rights framework.
If you are a resident of the European Union (EU) and European Economic Area (EEA), you have certain data protection rights, covered by GDPR.
We aim to take reasonable steps to allow you to correct, amend, delete, or limit the use of your Personal Data.
If you wish to be informed what Personal Data we hold about you and if you want it to be removed from our systems, please email us at support@exotrails.com.
In certain circumstances, you have the following data protection rights to:
Please note, we may not be able to provide Service without some necessary data.
You have the right to complain to a Data Protection Authority about our collection and use of your Personal Data. For more information, please contact your local data protection authority in the European Economic Area (EEA).
If you are a California resident, ExoTrails complies with the California Online Privacy Protection Act (CalOPPA) and the California Consumer Privacy Act (CCPA) and the California Privacy Rights Act (CPRA).
Under these laws, you have the right to:
How we comply:
"Do Not Track" Signals:
We honor browser-based "Do Not Track" settings. When enabled, we do not track, place cookies, or deliver personalized advertising.
To adjust your Do Not Track settings, visit your browser's Preferences or Privacy Settings page.
To protect your privacy and comply with applicable laws (PDPD, GDPR, CCPA), we verify your identity before processing any personal data request.
How to submit a request:
Email support@exotrails.com with:
We may request additional information to confirm your identity or authorized representation. Unverified requests may be declined.
What you can request:
Limitations:
We may refuse or limit requests that:
Response time:
We will acknowledge your request within 10 working days and respond within 45 calendar days, unless extended for legitimate reasons.
For all privacy-related requests, contact: support@exotrails.com
We use analytics to improve the Service and, with your consent, cookies/SDKs for personalized offers/ads. Manage non-essential cookies via our banner and in-app controls; adjust advertising preferences in your device OS. You may opt out of marketing emails anytime and manage push notifications in app/OS settings.
If you connect third-party apps, devices, or integrations (e.g., wearables, training platforms), we share only the minimum data needed for an integration and prohibit unrelated use. Partners and developers may not use ExoTrails data to train AI models or for purposes outside the user-authorized feature. We may limit or revoke access for violations.
When you interact with our official pages on third-party platforms, those platforms may process your data under their terms. We may receive aggregated analytics about page visits and engagement.
We respond only to valid and lawful requests from competent authorities, consistent with Vietnamese law and applicable international obligations.
We require appropriate legal process (e.g., warrant, court order, or lawful written request) and where permitted, we will notify affected users.
We may publish periodic transparency information.
Where legally permitted, we aim to notify affected users before producing data in response to a government request and may publish aggregated transparency information.
The Service is not intended for anyone under 18, and we do not knowingly collect data from minors. For any permitted teen accounts in specific regions, stricter defaults apply (e.g., Followers-only visibility, stronger map privacy, messaging limits). Uploading heart-rate/health data generally requires being 16+ with explicit consent (where allowed by law). If you believe we collected data from a minor, contact support@exotrails.com.
We may update this Policy to reflect changes in laws, technologies, or practices.
We will update the "Effective Date" above and, where appropriate, notify you by email or prominent notice in-app or on the website.
For any privacy-related questions, concerns, or rights requests:
Privacy Contact - ExoTrails
Email: support@exotrails.com