Privacy policy
GeoHub is a multi-organisation remote sensing and GIS platform: find and view satellite imagery, store data, label with AI, build maps. This policy explains how we process data when you visit the www.geohub.vn introduction site and when you use GeoHub modules (Account, Admin, EOM, VMRS, LabelHub, Drive, and further modules as they launch).
It is prepared under Vietnam’s Law on Personal Data Protection No. 91/2025/QH15 (in force from 1 January 2026), Decree 356/2025/ND-CP and related Vietnamese regulations. If you use GeoHub through an organisation (agency or company), also read section 4.
1. Scope and who is responsible
“GeoHub”, “we” means the operator of the GeoHub platform. This policy covers the introduction site and the platform modules; a module may carry its own additional notice if it processes a special kind of data.
Send any personal-data request to contact@geohub.vn (see section 14).
2. Data we collect
We collect only what is needed to provide the service:
- Account data: email address (used to sign in), first and last name; optional details you add on the Account page such as date of birth, gender, extra emails, phone numbers, address, profile picture.
- Organisation data: the organisations you belong to, your role and groups, and your organisation’s email domain if it enables automatic membership by domain.
- Third-party sign-in (Google, GitHub, or an OIDC provider your organisation configures, when enabled): we receive the email address verified by the provider, your name, and your identifier at that provider. We do not receive your password at the provider.
- Security data: your password (stored only as a hash) and two-factor settings (TOTP, security key/passkey, recovery codes) if you enable them.
- Content you create or upload: files in Drive, images, labels and labeling projects, map layers, analysis results, OAuth application settings.
- Activity and audit logs: sign-ins, password changes, two-factor changes, profile and permission changes, administrative actions, with time, IP address and browser information (user agent). System logs support operations and incident investigation.
- Information stored in your browser (see section 6).
The www.geohub.vn introduction site is static: it has no data-collection forms and sets no tracking cookies.
3. Purposes and legal bases
We process data to:
- create and manage accounts, verify identity, and apply permissions by organisation and role;
- provide the features you ask for (imagery search and viewing, storage, labeling, maps, processing jobs);
- send service notifications (job results, security alerts, permission changes, organisation invitations) by email and in-app;
- secure the platform, prevent unauthorised access, investigate incidents, and respond to lawful requests from competent authorities;
- operate, maintain and improve the platform.
The bases are your consent (when you create an account and use the service), the agreement between you or your organisation and GeoHub, and legal obligations. You may withdraw consent (section 9); withdrawal does not affect processing already carried out and may make some features unavailable.
We do not sell personal data and do not use your data for advertising.
4. Organisation data: who is the controller
GeoHub serves many organisations on one platform. Each organisation’s data is kept separate; one organisation cannot see another’s.
- For your account and security data, GeoHub decides the purposes and means, so GeoHub is the data controller.
- For content you and your organisation put in (files, images, labels, maps, member data managed by the organisation), your organisation is usually the controller and GeoHub processes it under the agreement and the organisation’s instructions. Send requests about this data to your organisation’s administrator; we help the administrator carry them out.
Organisation administrators can view and manage data within their organisation (members, roles, content, organisation logs). Platform operations staff access data only as needed to operate, secure and support the service, under assigned roles and with logging.
7. Storage and security
Data is stored on infrastructure operated by GeoHub. Our measures include:
- encrypted connections (TLS) in transit;
- passwords stored only as hashes; keys and sensitive connection secrets encrypted at rest;
- separation of data by organisation at the database and access layers, with role- and group-based permission checks;
- two-factor authentication: mandatory for administrator accounts, optional for other users;
- audit logging of sensitive actions, restricted internal network access between services, and regular database backups.
No system is perfectly secure and we cannot guarantee absolute security. Use a strong password, enable two-factor authentication and do not share credentials. If you suspect your account is compromised, change your password and tell us.
8. Retention and deletion
We keep data while your account or organisation is active and as long as needed for the purposes above or required by law.
- When a member leaves an organisation, content that member created in the organisation belongs to the organisation and is handled by it (handover, archive or deletion).
- When an organisation is deleted there is a waiting period before permanent deletion; afterwards the organisation’s data (file storage, module content, member identities belonging to the organisation) is removed from the system.
- Audit and technical logs are kept for a limited period for security and investigation, then deleted or anonymised.
- Backups may still contain deleted data until they expire under the backup cycle.
Self-service account deletion on the Account page is currently not enabled. To delete an account or data, contact your organisation administrator or send us a request (section 14).
9. Your rights
Under personal data protection law you have the right to be informed about how your data is processed, to consent or refuse, to access, correct, request deletion, restrict or object to processing, withdraw consent, and to complain, report or bring a claim as provided by law.
- On the Account page you can view and edit your profile, download a copy of your profile data (JSON: profile, contacts, organisations, settings, sign-in methods and recent activity; not passwords or secret keys), and revoke connected applications.
- For other requests, write to contact@geohub.vn. We verify identity first and respond within the period the law sets. A request may be refused or limited where the law allows (for example to protect others’ rights or meet a legal obligation).
Requests about data your organisation controls are passed to your organisation’s administrator.
10. Children
GeoHub is for organisations and professional users, not children. We do not knowingly collect personal data of people under 16; if we find such data we will delete it or seek a guardian’s consent as the law requires.
11. Transfers outside Vietnam
We do not intend to store your data on servers abroad. Some services you choose may process data outside Vietnam (signing in with Google or GitHub, international imagery sources). Data is then sent at your request and is subject to that provider’s policy. Where transferring personal data abroad is necessary, we will follow the conditions and procedures required by law.
Deployments for state agencies may run fully isolated (no outside connection); then the external services in section 5 are not used.
12. Security incidents
If an incident affects personal data, we will investigate, remediate, and notify the competent authority and affected people within the time and in the manner the law requires.
13. Changes to this policy
We may update this policy. The latest update date is at the top of the page. For material changes we will notify you in the app or by email before they apply, where the law requires.
14. Contact
Questions, personal-data requests or security reports: contact@geohub.vn.
You may also complain to the competent state authority for personal data protection.