Privacy Policy

This Privacy Policy explains how Blogger Manager (Giao Diện Blog, domain giaodienblog.vn) collects, uses, stores, shares and protects data when you use our services — in particular the data we receive from Google APIs when you sign in with your Google Account. Please read it together with our Terms of Service.

1. Scope

This policy applies to:

The website giaodienblog.vn: landing pages, theme store, checkout and payment, contact.
The web app at giaodienblog.vn/app: management of Blogspot blogs (posts, products, pages, labels, orders, forms).
The "Blogger Manager" Chrome extension: a browser extension for managing Blogspot blogs.
Blogspot themes we provide, when blog visitors submit order or contact forms.

Together, the "Service". "We" means the operator of Blogger Manager; "you" means a user of the Service.

2. Who is responsible and how to contact us

Blogger Manager (Giao Diện Blog) is responsible for the personal data processing described in this policy. For any question, access or deletion request, please contact us by email at [email protected] or via our Contact page.

3. Data we collect

3.1. Google Account information

When you sign in with Google, we receive from Google your Google account ID, name, email address and profile picture. We also receive the access token and refresh token issued by Google so that we can call the Blogger API on your behalf. Both tokens are encrypted before being stored in our database.

3.2. Blogger data accessed through Google APIs

Once you grant Blogger access, the Service reads and writes your Blogger data only when you take an action, including: the list of blogs you manage (ID, title, URL); posts, pages, labels, drafts, scheduled posts and trash; blog-wide pageview statistics; images you upload to insert into posts.

Post, page and product content is fetched directly from Google each time you open it and is not stored as a copy on our servers. We only keep the minimum needed to operate: the ID, title and URL of the blogs you have used with the Service.

3.3. Data you create in the Service

Label SEO settings (title, description and thumbnail of label pages).
Custom forms you build and their display settings.
Notification settings: notification email, your own SMTP details (password encrypted), Telegram bot token (encrypted) and chat ID.
Interface preferences (language, items per page, etc.).
Images uploaded through the web app's fallback uploader (stored on our server so they can be embedded in posts).

3.4. Data your blog visitors submit through forms

When your blog uses our themes or forms, information your visitors enter into order / contact forms (e.g. name, phone number, address, message, ordered items), together with their IP address and submission time, is stored on our servers so that you can manage it under Orders. For this data, you are the data controller and we process it on your behalf.

3.5. Purchase and payment data

When you buy a theme on giaodienblog.vn: your name and email (from your Google Account), the phone / Zalo number you enter, the product, amount, order code, order status, IP address and download count. When the money arrives, our bank reconciliation gateway sends us the incoming transfer details (amount, transfer description, transaction reference, time) so the order can be confirmed automatically. We never collect or store card numbers, bank passwords or banking login credentials.

3.6. Technical and usage data

Standard server logs (IP address, browser, access time) for security and troubleshooting.
Feature usage counts (e.g. "publish product", "upload image") linked to your account. Blogs appear in these statistics only as a one-way hash of the blog ID — never the blog URL or content.

4. Google access and how we use Google user data

4.1. Scopes we request

openid, email, profile (userinfo.email, userinfo.profile): to identify you, create and sign in to your account, show your name/avatar, and send order confirmations to your email.
https://www.googleapis.com/auth/blogger: to manage your Blogger blogs at your request — list your blogs; create, edit, publish, schedule, delete and restore posts, pages and products; assign labels; view pageview statistics.

The web app requests offline access (a refresh token) so you do not have to sign in again repeatedly while managing your blog.

4.2. How we use it

Data received from Google APIs is used only to provide and improve the user-facing features that you see and actively use in the Service. In particular, we do not:

sell Google user data, or transfer it to third parties except as described in section 7;
use or transfer it for advertising, including targeted, personalized or interest-based advertising;
use it to determine creditworthiness or for lending purposes;
use it to train generalized artificial intelligence or machine learning models;
allow humans to read it, unless: you give explicit consent for specific data (e.g. when you ask for support on a particular post); it is necessary for security purposes (investigating abuse); it is required to comply with applicable law; or the data is aggregated and anonymized for internal operations.

4.3. Compliance with the Google API Services User Data Policy

Blogger Manager's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

5. The Blogger Manager Chrome extension

The extension signs in through Chrome's chrome.identity and calls the Blogger API directly from your browser to Google.
Some features the Blogger API does not support (post permalink, search description, blog settings, image upload, theme import) are performed by calling blogger.com with the Google session that already exists in your browser. These requests go directly between your browser and Google; your Google session cookies are never sent to our servers.
The extension sends our server: your Google access token (only to verify your identity with Google at that moment — not stored), the ID/title/URL of the blog you are using (for account management and abuse prevention), product data you compose (to render product HTML — not stored) and the usage counts described in section 3.6.
The extension stores preferences such as your default blog locally in your browser (chrome.storage); that data stays on your device.

6. Purposes of processing

To provide, operate and maintain the features of the Service you request.
To process theme purchases, confirm payments, deliver files and provide after-sales support.
To send notifications about new orders / form submissions to the channels you configure (email, Telegram).
Security: detecting and preventing abuse, fraud and unauthorized access.
Customer support when you contact us.
Improving the Service based on aggregated, anonymized usage statistics.
Complying with legal obligations.

We do not sell personal data. Data is shared only:

With Google: actions on your blog are sent to Google (Blogger API, blogger.com) at your request.
With infrastructure providers: the server (VPS) hosting the Service and Cloudflare (content delivery and attack protection) — processing data only to run the Service.
For payments: the VietQR image service (img.vietqr.io) receives the amount and order code to generate the QR code; the bank reconciliation gateway sends us incoming transaction details.
With notification channels you configure: your own email (SMTP) server and Telegram bot receive order / form content to notify you.
For legal reasons: when lawfully requested by competent authorities, or to protect the rights, property and safety of us and our users.
Business transfers: if the Service is merged or transferred, the recipient must continue to honor this policy; you will be notified in advance.

8. Storage and security

All connections use HTTPS (TLS encryption).
Google access/refresh tokens, SMTP passwords, Telegram bot tokens and webhook tokens are encrypted in the database.
Access to servers and databases is limited to the operators who need it.
Theme orders can only be viewed through a link containing a random 40-character key or from within your own account.

No system is perfectly secure; if an incident affects your data, we will notify you promptly as required by law.

9. Retention

Account data and Google tokens: kept while your account is active; deleted when you request account deletion.
Form / order data from your blog: kept until you delete it under Orders or delete your account.
Theme orders and payment transactions: kept for as long as accounting and tax laws require, then deleted or anonymized.
Server logs: kept for a short period for security and troubleshooting.

10. Your rights

You have the right to: be informed about and access your data; request correction; request deletion; withdraw consent; object to or restrict processing; and obtain a copy of your data — under Vietnam's Decree 13/2023/ND-CP on personal data protection and other applicable laws.

10.1. Revoking Google access

You can revoke Blogger Manager's access at any time at myaccount.google.com/permissions. After revocation, stored tokens stop working and the Service can no longer access your blog. For the extension, you can also remove it from Chrome.

10.2. Requesting deletion

Send a request by email at [email protected] or via our Contact page from the email linked to your Google Account. We will delete your account together with your Google tokens, settings, forms and related order data within 30 days, except data we are legally required to keep (e.g. payment records). Deleting data from our servers does not delete content on your Blogger blog.

11. Cookies

The website uses only essential cookies: the session cookie, the anti-forgery (CSRF) cookie and the lang cookie that remembers your language. We do not use third-party advertising or tracking cookies.

12. Children

The Service is not intended for anyone under 16 and we do not knowingly collect children's data. If we become aware of such data, we will delete it.

13. Changes to this policy

We may update this policy. The "Last updated" date at the top always reflects the latest version. If a material change affects how we use your Google data, we will notify you in the Service or by email and ask for your consent again where required.

14. Contact

For any question about this policy or your data, please contact us by email at [email protected] or via our Contact page.