Privacy Policy

01Who we are

Xipat is a Vietnam-based technology company that builds e-commerce software (under the OmegaTheme brand) and casual and board games (under the GameZoka brand). For the purposes of data protection law, Xipat is the controller of personal data collected through our corporate website, careers pages, and marketing channels.

Where Xipat processes data on behalf of Shopify merchants who install our applications, we act as a processor or service provider for that merchant. See Section 6 for details.

Registered address: No. 18, Lane 11 Thai Ha, Hanoi, Vietnam.

02Information we collect

We collect information in three ways: information you provide to us, information collected automatically when you use the Services, and information we receive from third parties.

Information you provide

• Contact details when you reach out via our forms, email, or hotline — name, email address, phone number, company name, and the content of your message.
• Account information when you install one of our applications or create an account — store URL, account identifiers, billing details, and authentication tokens issued by the underlying platform (e.g., Shopify).
• Recruitment data when you apply for a role — résumé, cover letter, professional history, and any information you choose to share during the hiring process.
• Game profile data when you register for or play GameZoka titles — username, avatar, in-game progress, and purchase history.
• Support communications — anything you tell us when you contact customer support.

Information collected automatically

• Device and log data — IP address, browser type, operating system, device identifiers, referring URLs, pages viewed, and time stamps.
• Usage data — feature interactions, clicks, sessions, crashes, and performance metrics, used to maintain and improve the Services.
• Cookies and similar technologies — see Section 7.

Information from third parties

• From Shopify and other platforms — when you install one of our apps, we receive store and customer data necessary to operate the application, in accordance with the permissions you grant.
• From payment processors — limited transaction confirmations. We do not store full card numbers.
• From analytics and advertising partners — aggregated audience data to help us understand how the Services perform.

03How we use your information

We use personal information to:

• Provide, maintain, and improve the Services, including our Shopify apps and games;
• Authenticate users, prevent fraud, and protect the security of our Services;
• Process transactions and send transactional notices (receipts, renewal reminders, service alerts);
• Respond to enquiries, support requests, and feedback;
• Send product updates and marketing messages where permitted, with the ability to unsubscribe at any time;
• Evaluate job applications and manage our recruitment process;
• Conduct research, analytics, and aggregated reporting; and
• Comply with legal obligations and enforce our Terms.

04Legal bases for processing

Where the GDPR or similar laws apply, we rely on the following legal bases: performance of a contract with you; our legitimate interests in operating and improving the Services; your consent (which you may withdraw at any time); and compliance with legal obligations.

05How we share information

We do not sell your personal information. We share data only as described below:

• Service providers — cloud hosting, analytics, customer support, email delivery, and payment processing partners that help us operate the Services under written confidentiality and data-protection terms.
• Platform partners — for example, Shopify, app stores, and game distribution platforms, to the extent required for the Services to function.
• Professional advisers — lawyers, accountants, and auditors, when reasonably necessary.
• Legal and safety — when required by law, court order, or to protect the rights, property, or safety of Xipat, our users, or the public.
• Business transfers — in connection with a merger, acquisition, financing, or sale of assets, subject to appropriate confidentiality protections.

06Shopify merchants and their customers

OmegaTheme apps are installed by Shopify merchants. When a merchant installs one of our apps:

• The merchant is the data controller of their store and customer data; Xipat acts as a processor on their behalf.
• We access only the data the merchant authorizes through Shopify's permission scopes, and we use that data solely to operate, support, and improve the app.
• We do not use merchant or end-customer data for our own marketing purposes without separate consent.
• If a merchant uninstalls the app, we delete or anonymize the associated data within the timeframes specified in Section 8, unless retention is required by law.
• End customers of merchants should consult the privacy policy of the merchant whose store they are using.

07Cookies and similar technologies

We use cookies, pixels, local storage, and similar technologies to operate the Services, remember preferences, measure performance, and (where permitted) deliver relevant marketing.

You can control cookies through your browser settings or, where available, through our cookie banner.

08Data retention

We retain personal information only for as long as necessary to provide the Services and for legitimate, legal, or accounting purposes. Typical retention periods:

• Active account and merchant data — for the duration of the relationship plus a reasonable period afterwards.
• Uninstalled app data — generally deleted or anonymized within 30 to 90 days, unless retention is required by law.
• Recruitment data — typically up to 12 months from the last interaction, unless you ask us to delete it sooner.
• Marketing contacts — until you unsubscribe or are inactive for an extended period.
• Records required for tax, accounting, or legal compliance — for the period required by applicable law.

09Security

We apply administrative, technical, and physical safeguards designed to protect personal information, including encryption in transit, access controls, and regular review of our practices. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

10International transfers

Xipat operates from Vietnam and may use service providers in other countries. Where personal information is transferred internationally, we take steps to ensure that an appropriate level of protection is maintained, including through contractual safeguards.

11Your rights and choices

Depending on your location, you may have the right to:

• Access the personal information we hold about you;
• Request correction of inaccurate or incomplete data;
• Request deletion of your data, subject to legal exceptions;
• Object to or restrict certain processing;
• Request data portability;
• Withdraw consent at any time, where processing is based on consent; and
• Lodge a complaint with a data protection authority.

To exercise these rights, contact us using the details in Section 14. We may need to verify your identity before responding.

12Children's privacy

Our Services are not directed to children under 13 (or the equivalent minimum age in your jurisdiction). We do not knowingly collect personal information from children. If you believe a child has provided us with information, please contact us so we can take appropriate action.

13Changes to this Policy

We may update this Policy from time to time. When we make material changes, we will update the "Last updated" date and, where appropriate, provide additional notice through the Services. Continued use of the Services after changes take effect constitutes acceptance of the updated Policy.

14How to contact us

If you have questions, requests, or complaints about this Policy or our handling of your personal information, please contact us:

• Email: [email protected]
• Hotline: 0987 290 998
• Address: No. 18, Lane 11 Thai Ha, Hanoi, Vietnam