Privacy Policy

Last Updated: August 25, 2026

1. Introduction and Scope

LetsMes ("LetsMes", "we", "us", or "our") is a software studio operated by LetsMes Co., Ltd, based in Ho Chi Minh City, Vietnam.

This Privacy Policy explains how we collect, use, disclose, retain, and protect personal data when you:

  • visit letsmes.com;
  • contact us through our website;
  • communicate with us about our consulting or software development services; or
  • otherwise interact with LetsMes in connection with our studio business.

This Privacy Policy does not apply to our individual software products. Each product may have its own privacy policy that governs its use.

We process personal data in accordance with applicable privacy and data-protection laws, including Vietnam's Personal Data Protection Law No. 91/2025/QH15 and applicable implementing regulations, and, where applicable, the EU General Data Protection Regulation ("GDPR").

2. Information We Collect

We only collect and process Basic Personal Data (such as names and emails) via our website. We do not collect Sensitive Personal Data (such as health, financial, or political information) through letsmes.com.

Information you provide

  • Name
  • Email address
  • Company or organization name
  • Messages and other information you submit through our contact forms or communications
  • Information provided in connection with a business or consulting engagement

Automatically collected information

When you visit our website, certain technical information may be processed, such as:

  • IP address
  • Browser and device information
  • Approximate location derived from technical information
  • Pages visited and basic usage information
  • Security and performance information

Our website does not use advertising or cross-site tracking cookies.

3. How We Use Personal Data

We use personal data only for legitimate business purposes, including to:

  • respond to inquiries;
  • communicate with prospective or existing customers;
  • provide consulting and software development services;
  • negotiate, perform, and manage contracts;
  • operate, secure, and maintain our website and systems;
  • prevent fraud, abuse, and security incidents;
  • comply with legal and regulatory obligations; and
  • improve our website and services.

We do not sell personal data.

We do not use customer confidential information or customer-provided personal data to train our own AI models or for unrelated product development unless expressly authorized by the customer.

Where a third-party AI or other technology provider is used to provide a requested service, the relevant processing will be subject to the applicable product terms, privacy policy, and contractual arrangements.

4. Legal Basis

Where GDPR or another law requiring a legal basis applies, we may process personal data based on:

  • your consent;
  • performance of a contract or steps taken at your request before entering into a contract;
  • our legitimate interests, where permitted by law; or
  • compliance with a legal obligation.

Where consent is used, you may withdraw it subject to applicable law.

5. Service Providers and Data Sharing

We may use trusted third-party service providers to operate our website and business, such as providers of:

  • hosting and cloud infrastructure;
  • content delivery and security;
  • contact forms and communications;
  • analytics;
  • authentication or other business services.

Examples may include Amazon Web Services, Cloudflare, Formspree, and other providers we may use from time to time.

We share personal data with service providers only as reasonably necessary for them to provide services to us.

We may also disclose personal data:

  • where required by applicable law;
  • in response to valid legal process;
  • to protect our rights, users, systems, or property; or
  • in connection with a merger, acquisition, financing, restructuring, or sale of assets, subject to applicable law.

We do not sell personal data to third parties.

6. International Data Processing

Some service providers may process or store personal data outside Vietnam or outside the country where you are located.

Where required by applicable law, we will take appropriate measures for such transfers and processing, including appropriate contractual, organizational, or other safeguards, including the execution of Standard Contractual Clauses (SCCs) for EU users and relevant cross-border transfer registrations required by Vietnamese authorities.

7. Consulting and Client Data

During a consulting or software-development engagement, a client may provide LetsMes with personal data or other information relating to the client's customers, employees, users, or business operations.

In those circumstances, LetsMes may process such data on behalf of the client rather than for its own purposes.

The applicable MSA, SOW, NDA, and/or Data Processing Agreement ("DPA"), where applicable, will govern the parties' obligations regarding such data.

Unless otherwise agreed in writing, LetsMes will process client-provided personal data only as necessary to provide the agreed services and to comply with applicable law.

8. Data Retention

We retain personal data only for as long as reasonably necessary for the purposes described in this Privacy Policy, including to:

  • provide requested services;
  • maintain business and contractual records;
  • resolve disputes;
  • enforce agreements; and
  • comply with legal, tax, accounting, or regulatory requirements.

For website inquiries, we generally retain information only as long as reasonably necessary to handle the inquiry and related business communications.

For client engagements, retention and deletion requirements may be governed by the applicable MSA, SOW, or DPA.

9. Data Security

We use reasonable technical and organizational measures designed to protect personal data against unauthorized access, disclosure, alteration, loss, or destruction.

These measures may include:

  • encryption in transit;
  • access controls;
  • authentication and authorization controls;
  • secure cloud infrastructure;
  • logging and monitoring; and
  • reasonable operational security practices.

No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

10. Data Incidents

If we become aware of a personal-data incident that is subject to mandatory notification or reporting under applicable law, we will take the required steps within the applicable statutory timeframes.

Where required by applicable law, we will notify affected individuals and/or relevant authorities.

11. Your Rights

Depending on applicable law and your circumstances, you may have rights relating to your personal data, including rights to:

  • obtain information about processing;
  • access or request a copy of personal data;
  • request correction of inaccurate data;
  • request deletion where legally available;
  • object to or request restriction of certain processing;
  • withdraw consent where processing is based on consent; and
  • exercise other rights provided by applicable law.

We may need to verify your identity before responding to a request.

12. How to Contact Us

For privacy questions or requests concerning your personal data, contact us at:

We acknowledge all data rights requests within 72 hours and will provide a full resolution or response within 30 days, unless a shorter timeline is mandated by local laws.

13. Changes to This Privacy Policy

We may update this Privacy Policy from time to time.

When we make changes, we will update the "Last Updated" date above. Where required by applicable law, we will provide additional notice or obtain consent.

14. Product-Specific Privacy Policies

Our software products may have separate privacy policies that contain additional information about their data processing activities.

Where a product-specific privacy policy applies, it will govern the processing carried out through that product to the extent stated in that policy.