Last updated: October 2026
Unikorn (unikorn.vn) processes personal data under the Law on Personal Data Protection No. 91/2025/QH15 and its implementing regulations.
1. Data we collect
Data you provide
- Account: your name, email and profile picture, plus your password (stored as a one-way hash) if your account was created with an email and password. When you sign in with Google or GitHub, we receive your name, email and profile picture from that account.
- Profile: username, bio, website, social media links and, if you fill them in, your phone number, Telegram, Zalo and year of birth. Your year of birth is not shown publicly.
- Content: products, comments, reviews, Talks, collections, changelogs, feedback and messages sent through the contact form.
- Support: when you support a maker, we store the amount, payment method, transaction status and your message if there is one. Payment is a transfer through SePay, and Unikorn does not store the payer's bank account details.
- Event tickets: when you buy a ticket, we store the email you used to register on Luma, the amount, the order ID and the payment status.
- Withdrawal details: if you are a maker who receives support, we store your bank name, account number and account holder name to send money when you withdraw from your Unikorn wallet.
- Metrics connections: when a maker connects Google Analytics, GitHub, Stripe or Polar to a product, we store an encrypted access token and the metrics read from those services.
- Connected apps: you can connect an AI agent over MCP once you're a maker of an approved product. When you connect an AI agent such as Claude, ChatGPT or Cursor to your account, we store the app's name, the permissions you granted, when you granted them and when the app was last used.
- Onboarding answers: how you heard about Unikorn and what you want to use it for, if you answer them in the welcome steps after signing up.
Data collected automatically
- Sign-in log: IP address, browser (user agent), country, referring page and the time of sign-ups and sign-ins, including failed sign-ins and the email entered, used to detect unusual sign-ins and spam accounts.
- Views: a random visitor ID stored in a cookie, used to count views and viewers.
- Referral source: the UTM parameters, the referring page and the first page you landed on from the link that brought you to Unikorn, saved to your account when you sign up.
- Email clicks: links in newsletters and notification emails are tied to the receiving account, so we know which links you clicked, which tells us which content is useful.
- Activity: claps, points, levels, badges and activity streaks.
- Viewing history: the products and Talks you view while signed in, and the interest by category and tag worked out from them, used to recommend products, personalise the newsletter and count daily tasks.
- MCP log: when you use a connected AI agent, each call is recorded with the tool name, its arguments (up to 1,024 characters), the result, the calling app and the IP address, used to prevent abuse and to help when something goes wrong.
- Cookies: details in the Cookie Policy.
2. How we use data
- Running your account, signing you in and showing your profile and the content you post publicly.
- Calculating points, levels, vote weight and the rankings.
- Processing support payments and event tickets, and sending withdrawals to makers' bank accounts.
- Sending verification emails, notifications and newsletters. You can turn off optional emails in your notification settings.
- Fighting spam, vote manipulation and abuse.
- Generating content with AI: Uni's suggestions, product reviews, translations and email summaries.
- Measuring traffic to improve Unikorn and measure ad performance.
- Meeting our legal obligations.
3. Services that process data with us
The application servers and database are run by Unikorn. The external services below receive only the data they need for their specific job:
| Service | Purpose | Data involved |
|---|---|---|
| Anthropic (Claude) | Generating AI content for Uni, product reviews, translations and summary emails. For Uni's suggestions, translations and summary emails, Unikorn may switch to OpenAI or Google. | Product information, post content and the context needed to generate a response |
| Resend | Sending email and managing newsletter lists | Email, name, email content |
| Cloudflare R2 (S3-compatible storage) | Storing profile pictures, product images and files you upload | Files you upload |
| Cloudflare Turnstile | Blocking bots at sign-up, sign-in and on forms such as product submission, contact, reviews and Talk | IP address, browser signals |
| SePay | Payments for support and event tickets by bank transfer or NAPAS | Amount, order ID, transaction details |
| Google, GitHub | Signing in with an existing account | Name, email, profile picture |
| Google Analytics, Microsoft Clarity, Meta Pixel | Measuring traffic and ad performance, only if you agree | Cookies, pages viewed, browser information |
| Scout QA | Quality-checking a product when the maker agrees to use this feature | The maker's email, and the product's name, link, logo and tagline |
| Google Analytics, GitHub, Stripe, Polar | Reading product metrics when the maker connects them | Encrypted access token, product metrics |
| Webhooks a maker sets up (Slack, Discord or another address) | Telling the maker when the product gets a comment, a clap or a status change | The commenter's name and comment, the name of whoever clapped, product details |
| AI agents you connect over MCP (Claude, ChatGPT, Cursor...) | Reading your account data and, when you allow it, posting Talks and changelogs, and submitting and editing your products | Profile, products, Talks and the content you request |
Some of these services have servers outside Vietnam, so data may be transferred abroad for processing.
Data sent to an AI agent you connect is processed by that agent's provider under its own policy. Content the AI agent posts this way is your content. You can revoke access at any time in Connected apps, on the Advanced tab of Account settings.
4. Public data and sharing
- Profiles, products, comments, Talks and claps are public. If you want to hide your profile or hide your name from the leaderboards, email [email protected].
- A message sent with your support is shown publicly unless you choose to show it to the maker only.
- When you register for an event, its organiser can see your name, username, email, phone number, contact channels and the registration form answers you filled in, so they can contact you about the event.
- Unikorn does not sell personal data.
- We provide data to competent state authorities when the law requires it.
5. Security
- Connections are encrypted with HTTPS.
- Passwords and connected-app tokens are hashed. Tokens for metric connections (Google Analytics, GitHub, Stripe, Polar) are encrypted.
- Data is backed up regularly.
- Some members of the Unikorn team can access data when needed to help you, handle violations and run the system. When helping you, they may see Unikorn as your account sees it.
6. Retention
We keep your data while your account is active. When you email us to delete your account, we delete or anonymise your personal data, except transaction and withdrawal data that must be kept under accounting and tax rules. Some logs are deleted sooner: sign-in logs, security logs and email clicks after 12 months, viewing history after 24 months, and the MCP log after 30 days.
7. Your rights
Under the Law on Personal Data Protection, you have the following rights over your personal data:
- To be informed that your data is being processed.
- To consent or refuse consent to processing.
- To access, view and correct your data.
- To withdraw consent you have given.
- To delete your data.
- To restrict processing.
- To request a copy of your data.
- To object to processing, including for advertising.
- To complain, denounce or sue as provided by law.
- To claim compensation for damage caused by a data protection violation.
You can edit your profile and notification settings yourself in Account settings. To delete your account, get a copy of your data or exercise your other rights, email [email protected] from the address tied to your account. We verify that you own the account before handling the request. Withdrawing consent or deleting data may stop some features from working for your account.
Google Analytics, Microsoft Clarity and Meta Pixel run only if you agree in the cookie notice. You can change your choice at any time under Cookie settings at the bottom of the page.
8. Minors
If you are under the age of majority under Vietnamese law, you need the consent of a parent or guardian before creating an account.
9. Changes to this policy
When the policy changes, we update the date at the top. For important changes, we let you know by email or with a notice on Unikorn.
10. Contact
If you have questions about personal data, email [email protected].
