Effective 2026-10-04
Publisher
Phạm Quang Huy publishes this portal under CILO while the studio is being formed. CILO is not an incorporated legal entity.
Information and purpose
Invited members and authorized administrators provide names, member codes, access levels and language preferences. The service stores passkey credential identifiers, public keys and device/security metadata, account locks, invitation and session records, hashed recovery codes and security events to provide member access and protect accounts. When you connect, the publisher's server also records your IP address, the time, the requested URL and browser information in connection logs.
Passkeys and access
Fingerprint, face and device PIN verification stay with your authenticator; this portal does not receive them. Raw session tokens stay in HttpOnly cookies. Recovery codes appear once and only their hashes are stored. Administrators can access internal information according to their access level.
Browser storage
First-party Secure, SameSite=Strict cookies provide the session, CSRF protection, a two-minute passkey ceremony binding and a one-year language choice. The session cookie ends with your browser session. Server access expires after 15 minutes idle or eight hours total; recovery access lasts at most 15 minutes. The CSRF cookie lasts up to eight hours or the issued session expiry. Your light or dark appearance choice stays in your browser's local storage and is not sent to the server. No visitor analytics, advertising trackers or external fonts are used.
Hosting and recipients
The website, member portal, API and database run on one virtual server that the publisher configures and operates. The server is rented from ViettelIDC and is located in Vietnam; ViettelIDC supplies the machine and the network and does not run the application. Mat Bao (Vietnam) registers the domain name and answers DNS lookups. Google Workspace (Google, which may process messages outside Vietnam) receives messages sent to the privacy contact. Apart from ViettelIDC, these providers do not receive application data, connection logs or database copies. Current provider information is linked below.
ViettelIDC: virtual server hosting in VietnamMat Bao privacy policy: domain name and DNSGoogle Workspace data processing addendum: privacy contact mailbox
Retention
Authentication and security records currently have no automatic deletion schedule. Invitation, challenge and session expiry limits their use; it does not automatically delete stored records. Connection logs (web server and system logs) are kept for up to 15 days. Nightly copies of the database are kept for 14 days on the server, so a deleted record can remain in a copy until it expires.
Requests
Contact the publisher to request information, access, correction, a copy or deletion of your data, or to raise a privacy concern. The publisher replies within two working days and completes requests within 10 days (access, correction), 15 days (withdrawal of consent, restriction, objection) or 20 days (deletion); longer only where the law allows. Requests and replies are kept for 12 months after they are closed. Identity may need to be verified before an account request is handled.