1. Who is responsible
MonsterCDN is operated by Monster Design Co., Ltd., Vietnam, company number 0312031388, DUNS 555820121. For privacy enquiries, contact contact@monsterdesign.vn. This policy covers our storefront, account services, support and CDN administration.
For customer account, payment administration and security records, Monster Design determines the purposes of processing. For personal data in assets a customer submits for delivery, our role depends on the service and applicable law; the customer remains responsible for deciding what is published and for giving its own visitors an appropriate notice. This policy does not replace a customer's privacy policy or any required data-processing agreement.
2. Information we handle
Account and order information includes your email address, website hostname, organization and membership records, order identifiers, verification state, CDN hostname, service settings and correspondence you send us. We also process hashed authentication tokens, session records and security events needed to operate your account.
Billing records include the selected plan, currency, recurring amount, subscription and transaction references, payment status, renewal dates and verified payment notifications. PayPal handles payment credentials on its own systems; our checkout does not ask you to enter a card number into MonsterCDN.
Technical data may include IP addresses, request timestamps, requested paths, response codes, device/browser information available in server logs, rate-limit counters and aggregated bandwidth. Bunny.net may process visitor request information and cached copies of public assets to deliver CDN traffic. Public assets can themselves contain personal information; do not submit private documents, authenticated pages, payment data or sensitive personal data for public caching.
3. Why we use information
We use information to prepare orders, confirm payments with the provider, issue secure access links, verify website ownership, provision and maintain CDN services, manage renewals, investigate failures, answer support requests and enforce service limits. We also use necessary records to prevent fraud and abuse, protect systems, handle disputes and satisfy accounting or other legal obligations.
We rely on the applicable legal ground for each activity, including valid consent where required, steps to enter or perform an agreement where permitted, and statutory duties or other processing specifically allowed by law. A purchase or acceptance of our Terms is not blanket consent to unrelated marketing or to every possible use of personal data. Where consent is required, you may refuse or withdraw it; this may prevent us from providing a feature that requires that processing.
4. Service providers and disclosures
Relevant information is shared with providers needed to deliver the service: Bunny.net for CDN delivery and zone operations, PayPal for payments and payment verification, Brevo for transactional email when configured, and our hosting, database and infrastructure operators. Provider processing varies by feature and configuration. PayPal also processes information for its own payment, fraud-prevention and legal purposes under its privacy notice.
Access is limited to people and providers who need information for their work. We do not sell or rent personal data or provide it for third-party targeted advertising. We may disclose information where legally required, to respond to a lawful authority request, or to establish or defend legal rights. A business transfer may involve necessary records subject to applicable safeguards and notification obligations.
5. International processing
A CDN is distributed infrastructure. Depending on provider routing, hosting and support arrangements, requests, cached assets and operational information may be processed outside Vietnam and outside your country. Do not assume a particular storage location or data-residency commitment unless agreed in writing.
Cross-border processing is subject to applicable requirements, including any required notices, consent, contractual safeguards, assessments or regulatory procedures. Contact us before using MonsterCDN for a workload requiring a specific residency arrangement or regulated-data processing. This notice does not certify that a particular deployment or transfer assessment has been completed.
7. Retention and deletion
We retain records according to their purpose, service activity, security needs, dispute periods and mandatory accounting or legal requirements. Cancelling renewal does not automatically delete account, billing, verification, backup or provider records. Where a legal hold or retention duty applies, the affected information may need to be retained after a deletion request.
Authentication links expire and session access can be revoked. Expiry of access does not itself mean that the underlying record has already been erased. CDN cache expiry, log retention and backup deletion follow their relevant operational schedules. Contact us for the retention details applicable to your records and to request deletion; we will explain any lawful restriction rather than promise immediate deletion from every system.
8. Security and incident handling
Our controls include server-side authorization, scoped access, hashed access tokens and encrypted transport over HTTPS. No internet service can guarantee absolute security. Protect your email account and access links, use accurate contact details and report suspected unauthorized activity promptly.
We investigate suspected incidents and take protective action appropriate to the circumstances. Where an incident triggers a legal notification obligation, we will notify the relevant authorities and affected parties as required. Never send support your provider API key, password or complete payment credentials.
9. Your rights and requests
Depending on applicable law, you may request information about processing, access or a copy, correction, deletion, restriction, objection or withdrawal of consent, and may complain to a competent authority or pursue other legal remedies. Rights and exceptions depend on the circumstances; withdrawing consent does not retrospectively invalidate lawful processing.
Send requests to contact@monsterdesign.vn from the account email where possible. We may request proportionate proof of identity and clarify the scope to protect other people's information. We will handle requests within applicable legal time limits and explain any permitted restriction. If you are a visitor to a customer's website, contact that website first about the content it publishes; we will assist with requests relevant to processing under our control.
10. Eligibility and policy changes
MonsterCDN is intended for people authorized to purchase and administer website infrastructure. It is not directed at children. If you believe a child has supplied personal information without the legally required authorization, contact us so we can investigate.
We may update this policy as services and legal requirements change. The update date identifies this version. Material changes will be communicated as required, and we will seek fresh consent where the law requires it; merely publishing a new policy does not override existing statutory rights.