Terms and Policies
Effective date: 16 October 2026
Bluecoral develops the Sora family of applications and services. This Privacy Policy and Terms of Use explain how Bluecoral handles personal data on bluecoral.vn and in the Sora products below.
Contents
- Sora Scanner
- Sora Ops
- Sora Photo
- Sora Hub
- Sora Go
- Sora POS
- Sora Auth
- Website
- Terms of Use / EULA
- Liên hệ
Privacy at a glance
We use data only to provide, secure, support, and improve the relevant service; meet legal obligations; and respond to your requests. We do not sell personal data or use Sora data for behavioural advertising.
We collect data when you enter it, sign in, allow a device permission, take or choose a photo, upload a file, use a service, or contact us. We do not use camera, photo, document, or receipt content to train public AI models.
Permissions
You can deny or change device permissions in device settings. A feature that needs a permission may not work without it.
- Camera: captures documents, operational evidence, photos, or video as described for the relevant app.
- Photo library: Sora Photo reads, edits, and saves your photos. Sora Scanner lets you choose import items through Apple’s photo picker.
- Microphone and motion: Sora Photo uses these for video audio and camera levelling/composition guidance.
- Local network: Sora Scanner uses this to connect to your document server on a local network.
- Notifications: Sora Ops may use notifications for operational updates. You can turn them off in device settings.
- Location, contacts, calendar, Bluetooth, health, and advertising tracking: Sora mobile apps do not request these permissions.
Sharing, security, and international transfers
We share data only when necessary to provide a service, when you direct us to do so, or when law requires it. Service providers may include your document server, your employer or partner company, Google, Cloudflare, Zalo, email providers, payment providers, shipping carriers, invoice providers, Apple, and Google Play.
We require providers that process data for us to use it only for the instructed purpose and to apply safeguards no less protective than those in this policy. A service you use directly, such as your document server, app store, identity provider, or payment provider, also has its own terms and privacy policy.
We use appropriate safeguards, including encrypted connections, access controls, secure credential storage, session expiry, and anti-abuse controls. No system is completely secure; please protect your device and credentials and tell us promptly about suspected unauthorized access.
Data may be processed in Vietnam and in other countries where our service providers operate. We use appropriate contractual, organizational, and technical safeguards for international transfers.
Retention, your choices, and children
We retain data for the period stated in the relevant product section, while your account, workspace, or employment relationship is active, and afterward only as needed for lawful operational, legal, accounting, dispute-resolution, backup, or security purposes. We then delete or anonymise it within a reasonable period unless law requires longer retention.
You may ask to access, correct, restrict, object to, withdraw consent for, or delete personal data that we control. Email hello@bluecoral.vn or nguyen@bluecoral.vn with the product, account/workspace/company, your identifier, and your request. We may ask for proportionate identity verification and respond within the time required by applicable law.
If an account-deletion option is available in an app, you may start deletion there. You may also request deletion by email. For employer-managed Sora Ops accounts, ask your company administrator to disable or delete the account; you may contact us for help.
Sora products are not directed to children. We do not knowingly collect personal data from children in violation of applicable law. A parent or guardian may contact us to make a request.
Sora Scanner
Sora Scanner is an iPhone document-scanning app. It processes scans on your device and sends them only when you choose to sync with your own document server (for example paperless-ngx). It has no Bluecoral account and does not include advertising, analytics, or crash-diagnostic SDKs.
| Data | Purpose | Storage and sharing | Retention |
|---|---|---|---|
| Document images, PDFs, titles, and tags | Scan and manage documents | On your device; sent to your document server when you sync | Until you delete it or remove the app; server data follows your server policy |
| Document-server address and settings | Connect the app | On your device; used only to contact your document server | Until changed, cleared, or the app is removed |
| Document-server API token | Authenticate sync | Secure device storage; sent only to your document server | Until replaced, removed, or the app is removed |
| Camera and local-network access | Capture documents and reach your document server | Used while the feature is active | Not retained separately |
Sora Ops
Sora Ops supports operational workflows for partner-company staff, including production/QC, delivery, overtime, attendance, timeclock, and leave. Accounts are issued and managed by the partner company; the app does not provide self-registration.
| Data | Purpose | Storage and sharing | Retention |
|---|---|---|---|
| Login, password, device name, app version, and session tokens | Sign in and secure the session | Secure device storage and the partner company’s service | Local tokens until logout; account data under company policy |
| QC photos, checklist values, failure reason, notes, and capture time | Product-quality checks | Temporary device queue, then partner-company service | Local copy until sent; service data under company policy |
| Delivery photos, order details, and capture time | Delivery evidence | Temporary device queue, then partner-company service | Local copy until sent; a replacement photo may replace the earlier service photo |
| Overtime evidence photo, work time, duration, and note | Overtime requests and records | Partner-company service | Under company policy |
| Attendance, absence, timeclock, leave, production, delivery, and expense records | Operational workflows | Partner-company service | Under company policy |
| Notification token and notification content | Send operational notifications when enabled | Notification provider and partner-company service | Until disabled, replaced, or removed under service policy |
Sora Ops uses camera access for QC, delivery, and overtime evidence. It does not use advertising, analytics, or crash-diagnostic SDKs.
Sora Photo
Sora Photo is a camera and photo-editing app. It does not use an account, advertising, analytics, crash-diagnostic SDKs, or a Bluecoral cloud upload service.
| Data | Purpose | Storage and sharing | Retention |
|---|---|---|---|
| Photos, videos, edits, thumbnails, and photo identifiers | Capture, edit, review, and save photos | Your photo library or app-local files | Until you delete the item or remove the app |
| Video audio | Record video | Local video storage | Until you delete the video |
| Motion data | Camera levelling and composition guidance | Used on your device | Not retained as a separate record |
| App settings and local editing state | Remember preferences and editing state | On your device | Until cleared or the app is removed |
Sora Hub
Sora Hub provides accounts, guides and workspaces, intake and workflow steps, participant details, invitations, collaboration, and comments.
| Data | Purpose | Storage and sharing | Retention |
|---|---|---|---|
| Name, email, and password | Account registration and sign-in | Sora Hub service; authorized workspace users and administrators where relevant | While the account is active, then deleted or anonymised within a reasonable period |
| Workspace, guide, intake, participant, comment, invitation, collaboration, and workflow data | Provide the workspace and collaboration service | Sora Hub service; authorized workspace users and administrators | While the workspace or content is active, then deleted or anonymised within a reasonable period |
| Session information | Keep the service secure and signed in | Sora Hub service | For the active session and a reasonable security period |
Sora Go
Sora Go helps people plan trips and collaborate on destinations and expenses. It uses an identity provider for sign-in, Cloudflare for hosting and storage, and anti-abuse checks. It does not use advertising, product analytics, crash-diagnostic, push-notification, or payment-processing SDKs.
| Data | Purpose | Storage and sharing | Retention |
|---|---|---|---|
| Sign-in identity and profile data | Authenticate account owners and contributors | Sora Go service; identity provider, Cloudflare, and authorized workspace users | While the account or workspace is active, then deleted or anonymised within a reasonable period |
| Session and security data | Sign-in, session management, and abuse prevention | Sora Go service and essential browser storage; Cloudflare | For the active session and security needs |
| Trips, destinations, dates, traveller details, notes, tasks, coordinates, expenses, settlements, and member roles | Plan and collaborate on trips | Sora Go service and browser offline storage; authorized members and Cloudflare | While the workspace is active; browser data until you clear it |
| Receipts and receipt details | Record trip expenses | Sora Go service; authorized members and Cloudflare | While needed for the workspace, then deleted or anonymised within a reasonable period |
| Place submissions, issue notices, photos, author name, and licence consent | Moderate and publish destination content | Sora Go service; Cloudflare, moderators, and the public for approved contributions | Approved public contributions may remain available under their stated licence |
Sora POS
Sora POS is a merchant commerce and point-of-sale service. It uses Sora Auth for sign-in. It may use payment, shipping, invoice, and storage providers selected for the merchant. It does not directly collect or store raw payment-card numbers or CVV/CVC data.
| Data | Purpose | Storage and sharing | Retention |
|---|---|---|---|
| Account identity, session, organization membership, and role | Authenticate staff and control access | Sora Auth and Sora POS services; authorized organization users | Under account and organization policy |
| Merchant, staff, location, catalogue, inventory, supplier, and customer data | Run commerce operations | Sora POS service; authorized merchant staff and configured providers | Business and legal retention needs |
| Orders, reservations, invoices, fulfilment, payment records, summaries, and audit records | Process and administer commerce | Sora POS service; authorized merchant staff and relevant providers | Business and legal retention needs |
| Payment, shipping, and invoice integration data | Complete configured merchant workflows | Sora POS and relevant providers | Under merchant, provider, and legal policy |
| Export and migration files | Data export and migration | Sora POS storage service; authorized users and storage provider | For the export/migration purpose, then deleted within a reasonable period |
Sora Auth
Sora Auth is Bluecoral’s central identity and single-sign-on service. It supports email/password, email link, phone verification where enabled, and selected social sign-in methods. It also provides secure sign-in for approved Sora services.
| Data | Purpose | Storage and sharing | Retention |
|---|---|---|---|
| Name, email, profile image, phone, optional social-profile data, role, and account status | Create and manage identity profiles | Sora Auth service; approved Sora services and selected sign-in provider | While the account is active, then deleted or anonymised within a reasonable period |
| Password credential, linked sign-in details, verification, and password-reset records | Sign-in and account recovery | Sora Auth service; selected sign-in and email provider | Reset records are short-lived; account records follow the account lifecycle |
| Phone verification data | Phone sign-in where enabled | Sora Auth service and phone-verification provider | OTPs expire after 5 minutes |
| Two-factor authentication data | Secure sign-in | Sora Auth service | While two-factor authentication or the account is active |
| Session, device, IP, user-agent, and security records | Authentication, security, and audit | Sora Auth service; approved Sora services where needed for sign-in | Standard session inactivity is 30 days; security data is retained as needed |
| Organisation memberships, invitations, and consent records | Access management and single sign-on | Sora Auth service; approved Sora services and authorized administrators | While active, then deleted or anonymised within a reasonable period |
| Transactional-email data | Send verification and recovery messages | Sora Auth and email provider | For delivery and operational needs, then deleted within a reasonable period |
Website: bluecoral.vn
When you use bluecoral.vn, we and our hosting or tag-management providers may process IP address, browser/device information, requested pages, timestamps, and essential cookies/logs to provide and protect the site. We use site tag management for service operation and do not use it for advertising.
If you send information through a website form, comment, account feature, or embedded third-party service, we use it for that feature and disclose the relevant recipient before the feature is enabled.
Changes and governing law
We may update this policy when products, law, or data practices change. We will post the updated version on this page and change the effective date. This policy is governed by the laws of Vietnam, including Decree No. 13/2023/NĐ-CP on Personal Data Protection, unless mandatory law provides otherwise.
Terms of Use / EULA
Licence and acceptable use
Bluecoral grants you a limited, personal, non-exclusive, non-transferable, revocable licence to use a Sora service for its intended purpose. You must follow applicable law, your employer/customer/workspace rules, and these Terms.
- Do not use a Sora service unlawfully or infringe another person’s rights.
- Do not upload content you lack permission to use, send malware or deceptive content, or collect personal data without required authority and consent.
- Do not interfere with or bypass service security or share credentials without authorization.
- You are responsible for necessary notice, authority, and consent for submitted content.
- You must comply with applicable export-control, sanctions, and trade laws.
Apple terms
For an iOS app obtained through Apple, Apple’s Standard EULA applies and these Terms supplement it: Apple Standard EULA.
These Terms are between you and Bluecoral, not Apple. Apple has no obligation to provide maintenance, support, warranty, or product claims for a Sora app. Bluecoral, not Apple, handles product claims and intellectual-property claims relating to a Sora app. Apple and its subsidiaries are third-party beneficiaries of these Terms and may enforce them against you.
Third parties, suspension, warranty, and liability
Some functions depend on your document server, employer, workspace administrator, app store, identity provider, payment provider, carrier, invoice provider, or another third party. Bluecoral is not responsible for a third party’s independent service, availability, content, terms, or privacy practices.
We may suspend or end access when reasonably necessary to protect people, data, systems, legal compliance, or service integrity, or when you materially breach these Terms.
To the maximum extent permitted by law, Sora services are provided as is và as available. We do not guarantee uninterrupted, error-free, secure, or loss-free operation. Keep appropriate copies of important data.
To the maximum extent permitted by law, Bluecoral is not liable for indirect, incidental, special, consequential, exemplary, or punitive damages, or lost profits, revenue, data, goodwill, or business interruption. Bluecoral’s total liability will not exceed the amount you paid Bluecoral for the relevant service in the 12 months before the event giving rise to the claim. These limits do not exclude liability that cannot lawfully be excluded.
Liên hệ
For privacy requests, account deletion, questions, or complaints, contact:
- Email: hello@bluecoral.vn
- Alternative email: nguyen@bluecoral.vn
- Organization: Bluecoral, Ho Chi Minh City, Vietnam