Privacy Policy — Tingo Chatpay
Last updated: October 26, 2026
Effective date: October 26, 2026
1. Introduction
This Privacy Policy explains how Tingo Chatpay (the "Extension"), a Google Chrome browser extension, accesses, uses, transmits, stores, and protects information when you install and use it. It also explains what information we do not collect.
It is written to match exactly what the Extension does in its current released version. If a capability is described below, it exists in the Extension; if it is not described, the Extension does not perform it.
By installing and using the Extension, you agree to the practices described in this policy. If you do not agree, please uninstall the Extension.
2. Who We Are
The Extension is published by BLUECOM VIETNAM JOINT STOCK COMPANY ("we", "us", "our").
- Publisher / data controller: BLUECOM VIETNAM JOINT STOCK COMPANY
- Registered address: Lot 47, HDI Homes Villa Area, Mac Thai Tong Street, Trung Hoa Ward, Cau Giay District, Hanoi City, Vietnam
- Contact email: [email protected], [email protected]
- Website: https://vietqr.vn
3. What the Extension Does
Tingo Chatpay is a sales-support extension for online sellers. It runs inside supported chat and e-commerce websites and helps the seller:
- Insert quick messages, product information, and order information directly into a chat conversation.
- Detect an order or a payment in the conversation you are working on, so you do not have to type it again.
- Generate a VietQR payment QR code for an order and check its payment status.
- Receive a notification when an order has been paid, including an optional voice notification.
Single purpose: The Extension has one single purpose — to help sellers create and send order messages and payment requests inside supported chat platforms, and to confirm payment.
4. Supported Websites
The Extension only runs on websites that are declared in its permissions and that the user grants access to:
Messenger, Zalo, WhatsApp, WeChat, Instagram, Telegram, and Shopee Seller Center.
The Extension does not use <all_urls> and does not run on any other website.
The Extension also connects to our own payment service (see Section 8) and, optionally, to a companion desktop application running on your own computer (see Section 8.3).
5. Information We Handle
5.1 Information stored on your device
The Extension stores the following information locally on your own device, in the browser's extension storage. It is not uploaded to our servers unless stated in Section 8:
- Sign-in session: your Tingo Chatpay user ID, your phone number, authentication tokens (V1 and V2), a refresh token, and a randomly generated device ID. We do not store your password.
- Shop configuration: shop name, contact details you enter, and bank account details (bank code, account number, account holder name, and settlement account used to generate VietQR payment codes).
- Catalog and templates: your product/service catalog, your quick-message templates, and images you attach to those templates.
- Order and transaction records: the orders, sales drafts, and payment records you create or confirm while using the Extension.
- Settings: enabled platforms, panel position, language, notification and voice preferences.
5.2 Website content the Extension reads and processes on the page
To perform its single purpose, the Extension reads the content of the chat conversation open in your browser on the supported websites listed in Section 4. Specifically, it reads the visible text of the conversation, the name or label of the conversation you have open, and the message input field. It uses this content only to:
- detect whether a conversation contains an order or a payment request (for example an amount in VND and a product name), and propose it to you;
- avoid sending a duplicate payment confirmation when a confirmation already exists in the conversation;
- place the message, product information, or QR image you have selected into the message input field.
This content is processed only on your device. The Extension does not upload, transmit, or store your chat messages or conversation content on our servers or on any third-party server. It does not read conversations on websites other than the supported websites listed in Section 4.
5.3 Payment and account information sent to our payment service
To create a payment QR code, verify a payment, and sign you in, the information described in Section 8.1 is sent to the VietQR payment service.
5.4 Optional desktop companion application
You may choose to install a companion desktop application on your own computer. If it is running, the Extension synchronizes your shop configuration, settings, order records, and transaction records with it over a local connection to your own computer (see Section 8.3). If the companion application is not installed or not running, no such synchronization occurs.
6. Information We Do NOT Collect
- We do not store or transmit your chat messages or conversation content to our servers or to any third party.
- We do not collect your browsing history or your activity on websites other than the supported websites listed in Section 4.
- We do not use analytics, tracking, or advertising SDKs.
- We do not build advertising profiles and we do not serve advertising.
- We do not sell or rent your personal information.
- We do not access your camera, microphone, screen, or precise location.
- We do not store your password on your device or on our servers.
- The current version of the Extension does not use any third-party artificial-intelligence or large-language-model service.
7. How We Use Information
| Purpose | Information used |
|---|---|
| Sign you in to Tingo Chatpay | Phone number, device ID, authentication tokens |
| Detect an order or payment in the conversation you are working on | Conversation content, read on your device only |
| Insert quick messages, product and order information into chat | Your templates, catalog, and the order details you enter or confirm |
| Generate a VietQR payment code and check payment status | Bank account details, order amount, transfer content, order reference |
| Notify you when an order is paid | Order reference and payment status received from the payment service |
| Remember your settings and your catalog | Your Extension preferences, products, and templates |
| Optional: keep the desktop companion application in sync | Shop configuration, settings, orders, transactions |
We do not use your information for any purpose unrelated to these functions.
8. When Information Is Sent Off Your Device
Most data stays on your device. Information leaves your device only in the cases below. This section lists all recipients of data handled by the Extension.
8.1 VietQR payment service (our own service)
To sign you in, create the payment QR code, and verify whether a payment has been made, the Extension sends data over HTTPS to:
api.vietqr.org— sign-in (phone number, encrypted password, device ID), sign-out, and QR generation (bank code, settlement account, amount, transfer content, user ID, order reference, terminal code).dev-v2.vietqr.vn— sign-in and token refresh (phone number, encrypted password).
8.2 Real-time payment notification channel
The Extension opens a secure WebSocket connection to wss://api.vietqr.org/vqr/socket, identified by your user ID, to receive balance-change and payment notifications. The notification data received from the server includes the bank account number, amount, transfer content, and reference number of the transaction, which the Extension uses to match a payment to your order and notify you.
8.3 Companion desktop application (your own computer)
If you install and run the optional companion desktop application, the Extension sends your shop configuration, settings, order records, and transaction records to it over a connection that stays on your own computer (http://127.0.0.1:17890). This data does not leave your computer through us. The desktop application's own data handling is governed by its own terms and privacy notice.
8.4 The chat platform you are using
When you send a message, product, or QR code, the content you send is delivered through the chat platform you are using (for example Messenger, Zalo, WhatsApp, WeChat, Instagram, or Telegram), under that platform's own terms and privacy policy.
8.5 No other sharing
We do not sell your information. We only send data to:
- our own VietQR / Tingo Chatpay services described in Sections 8.1 and 8.2;
- the chat platform you choose to use to deliver a message; and
- the optional companion desktop application running on your own computer.
9. Services and Data Recipients
9.1 Our own services
| Service | Purpose | Data sent |
|---|---|---|
VietQR API (api.vietqr.org) | Sign-in, sign-out, generate payment QR codes and check payment status | Phone number, encrypted password, device ID, bank code, settlement account, amount, transfer content, user ID, order reference, terminal code |
VietQR V2 API (dev-v2.vietqr.vn) | Sign-in and token refresh | Phone number, encrypted password |
VietQR real-time channel (wss://api.vietqr.org) | Receive balance-change and payment notifications | User ID (to open the channel); receives transaction data from the server |
9.2 Local recipient on your own computer
| Recipient | Purpose | Data sent |
|---|---|---|
| Companion desktop application (your own computer) | Optional local synchronization | Shop configuration, settings, orders, transactions |
9.3 Other platforms you choose to use
| Recipient | Purpose | Data sent |
|---|---|---|
| Chat platforms listed in Section 4 | Delivery of the messages you choose to send | The message content you send |
We do not sell your information. Other than the recipients listed above, we do not share your information with any other external party.
10. Permissions and Why They Are Needed
| Permission | Why it is needed |
|---|---|
storage, unlimitedStorage | Store your settings, templates, product catalog, order records, and attached template images locally on your device. |
tabs | Identify which supported chat website you are currently on, and route messages between the Extension's background service and that page. |
scripting | Inject the Extension's panel into supported chat pages and write into the chat input field. |
windows | Open the Extension's own application window (the seller panel) as a separate popup window. |
clipboardWrite | Copy order details and payment links so you can paste them into a chat. |
alarms | Schedule periodic checks of order payment status and clean up temporary files. |
downloads | Download a generated payment QR image as a temporary file on your device so it can be attached to the chat input. Temporary files are deleted automatically after use. |
tts | Optional voice notification when a new order or payment confirmation arrives. Uses the built-in browser text-to-speech engine; no text is sent to an external speech service. |
debugger | Dispatch trusted keyboard and mouse events required to reliably send a composed message and attach QR images on chat platforms that reject synthetic events. It is used only for this purpose; no page content, network traffic, or user data is read, captured, or transmitted through it. |
| Host permissions | Access only the supported chat/seller websites you use, our payment services, and your own computer for the optional companion application. |
11. Data Retention
- Local data remains on your device until you delete it by removing the Extension or clearing its data.
- We do not retain your chat content on our servers.
- Account and order data associated with your Tingo Chatpay account is retained for as long as your account is active, and is deleted or anonymized upon a valid deletion request.
12. Security
We apply appropriate technical and organizational measures to protect information. All data sent to our services is transmitted over encrypted connections (HTTPS/WSS), and authentication is token-based; we do not store your password. No method of transmission or storage is 100% secure, but we limit the data we access to what is necessary for the Extension to function.
13. Your Rights and Choices
- You can disable the Extension, or any individual platform, at any time in its settings.
- You can delete all locally stored data by removing the Extension.
- You can choose not to install the optional companion desktop application.
- You may request access to, correction of, or deletion of your account data by contacting us at [email protected] or [email protected].
14. Children's Privacy
The Extension is a business tool intended for sellers. It is not directed to children under 13 (or the minimum age required in your jurisdiction), and we do not knowingly collect information from children.
15. International Data Transfers
Our service providers may process data outside your country. Where required, we rely on appropriate safeguards for such transfers.
16. Changes to This Privacy Policy
We may update this policy from time to time. Changes will be posted on this page with an updated "Last updated" date. Continued use of the Extension after a change means you accept the updated policy.
17. Contact Us
For questions about this Privacy Policy or how your data is handled:
BLUECOM VIETNAM JOINT STOCK COMPANY
Lot 47, HDI Homes Villa Area, Mac Thai Tong Street, Trung Hoa Ward, Cau Giay District, Hanoi City, Vietnam
Email: [email protected], [email protected]
Website: https://vietqr.vn