Privacy Policy & Terms of Service

8.1. General privacy provisions

Our website takes information security seriously and applies industry-standard measures to protect customer information and payments. Customer payment information is encrypted in transit. After the order process is completed, the secure session ends.

• You may not use any program, tool or other means to interfere with the system or alter the structure of its data. Distributing, propagating or encouraging any activity that interferes with, damages or intrudes into the system's data is also strictly prohibited. Violators will lose all related rights and may be prosecuted to the extent permitted by law.
• All transaction information is kept confidential except where disclosure is required by law-enforcement authorities.

8.2. Purpose and scope of data collection

- ORA does not sell, share or trade customer personal information with any third party.

- When you make a purchase at ORA, the personal information ORA collects includes:

• Full name
• Delivery address
• Mobile phone number
• Email (if available)
• Date of birth (optional)
• Gender (optional)

- The above mandatory information is required when purchasing on the website to protect consumer rights. Customers are responsible for the security and integrity of all activity carried out under their inbox. Customers must also notify us promptly of any unauthorised use, abuse or security breach concerning their account credentials so that appropriate measures can be taken.

8.3. Scope of information use

- The above information will be used for one or more of the following purposes:

• Delivering goods to the customer.
• Notifying about delivery and providing customer support.
• Providing product-related information.
• Processing orders and providing services and information requested by the customer.
• Contacting and assisting customers in special cases.
• Preventing destructive or fraudulent activities targeting customer accounts.

- ORA does not sell or trade customer information to third parties except in the specific cases below:

• We may share the customer's name and address with our courier or supplier in order to deliver goods.
• Where required by law or by a competent state authority, ensuring that the disclosure is consistent with applicable law.
• If disclosure to another third party is required, we will give specific notice to the customer and information will only be provided with the customer's express consent.

8.4. Data retention period

Customer personal data is retained until a deletion request is made. In all cases, customer personal information is kept secure on the website's server. Information suspected of being falsified or in breach of these terms will be deleted.

8.5. Persons or organisations permitted to access the data

Information requested during consultation and purchase will be used only within the scope set out in section 8.3 of this Policy.

• ora-candle.com for customer support.
• State authorities upon lawful request for member information in connection with an investigation.
• Partners providing part of the services we offer, such as payment-gateway and shipping providers. These partners receive only the information stipulated under contract (in part or in whole, depending on the contract terms) for the purpose of supporting users of our services.

8.6. Address of the entity collecting & managing personal information

8.7. Means and tools for users to access and correct their personal data

Customers may update personal information by sending a request via Zalo or email so that we can review, update, correct or delete their data.

Customers have the right to file a complaint with the website administrators regarding any disclosure of personal information to a third party. Upon receiving such feedback we will verify the data, respond with the reason and guide the user in restoring and re-securing their information.

Phone / Zalo: +84 334 676 943

Email: ora.candle.shop@gmail.com

8.8. Mechanism for receiving and resolving complaints relating to personal data

Please contact us 24/7 for product consultation and support.

If a customer reports use of their information contrary to the stated purpose, we will follow these steps:

Step 1: The customer submits feedback regarding the alleged misuse of personal information.

• Hotline: +84 334 676 943
• Website: www.ora-candle.com
• Official Fanpage: www.facebook.com/ora.candle
• Store address: 39 N11 Street, Binh Thanh quarter, Tran Bien Ward, Dong Nai Province, Vietnam

Step 2: Customer Care receives the request and works with relevant parties to resolve it. ora-candle.com will apply technical and operational measures to verify the reported issue. Complaints relating to customer personal information will be processed within a maximum of 15 working days from the date of receipt.

Step 3: If the situation cannot be resolved internally, we will engage the competent authorities. We always welcome feedback, contact and comments from customers regarding our “Privacy Policy”.

9.1. Data we collect from Facebook and how we use it

We collect only the minimum data fields listed below from a user's Facebook account, after that user has explicitly granted consent, in order to operate the core functionality of the tool:

• public_profile (id, name, picture): displayed in the dashboard so the user can confirm the correct Facebook account is connected.
• email (optional): used to send service notifications such as publish status alerts and renewal reminders.
• pages_show_list: lists the Pages the user administers so they can pick which Page to connect. Without this permission, users would have to copy/paste a Page ID and Page Access Token manually, which is error prone and insecure.
• pages_read_engagement: reads basic information of the chosen Page (id, name, category, picture) and obtains the Page Access Token required to publish on the user's behalf.
• pages_manage_posts: core feature — publishes posts (text, image, link) to the user's own Page on the schedule they configured. This is the single primary feature the tool provides.
• pages_read_user_content: reads posts that our tool itself has published so the History tab can show the permalink, status and timestamp, allowing the Page Admin to verify each post went live.
• pages_manage_engagement: lets the Page Admin delete posts our tool has published (e.g. typo corrections, retracted promotions) directly from our interface, without leaving for Facebook.
• read_insights: reads basic post metrics (impressions, reach, engagement) shown in the Calendar tab so the Page Admin can evaluate content performance and adjust their schedule. Insights are visible only to the Page Admin who connected the Page.

We do not collect friend lists, messages, contacts, location, or any other personal data of the user or of their Page's followers.

9.2. Permitted use of Platform Data

• Platform Data is used only to provide and operate the ORA Auto Post tool for the very Page Admin who granted consent.
• We do not sell, rent, or share Platform Data with third parties under any circumstances.
• Platform Data is not used for advertising targeting, data brokerage, machine-learning model training, or decisions about credit, insurance, employment, housing or education.
• Platform Data is not combined with data from other sources to build user profiles.

9.3. Storage, security and retention

• Page Access Tokens and User Access Tokens are stored encrypted in private Vercel Blob Storage, accessible only by our application server. Tokens are auto-refreshed before expiry and deleted immediately when the user disconnects.
• All connections to the Facebook Graph API use HTTPS / TLS 1.2 or higher.
• Page metadata (id, name, profile picture) is retained until the user disconnects the Page or deletes their account.
• Publish history is capped at the 500 most recent entries per account; older entries are auto-pruned.
• Insights (impressions / reach) are fetched on-demand when the Page Admin opens the Calendar tab; results are cached server-side for at most 5 minutes and never persisted long-term.

9.4. User rights over Platform Data

Users may at any time:

• Disconnect their Facebook account from the tool via the Settings tab — all stored tokens and Page metadata are erased from our server.
• Revoke permissions directly at facebook.com/settings/business_tools. Once revoked, the tool ceases all activity for the affected Page.
• Request full data deletion by following the instructions at ora-candle.com/data-deletion (also configured as the Data Deletion Callback URL in our Facebook App).
• Contact ora.candle.shop@gmail.com for assistance — we respond within 15 business days.

9.5. Compliance commitments

ORA Candle commits to compliance with:

• Meta Platform Terms — including Section 4.1 (Privacy Policy), Section 5 (Data Use Restrictions) and Section 6 (Data Security).
• Meta Developer Policies — including Section 1.6 (Build Trustworthy Products) and Section 3 (Use of Data).
• In the event of a data incident, we will notify Meta and the affected users within 24 hours of discovery.

9.6. Contact regarding Platform Data