← Home

Privacy Policy

In force from 22 August 2026. Written to follow Vietnam's Decree 13/2023/ND-CP on personal data protection. Data controller: MoExtension, Ho Chi Minh City.

This English text is provided for your convenience. The Vietnamese version at moextension.com/privacy is the governing text; where the two differ, the Vietnamese wording prevails.

1. Principles

We collect exactly what is needed to issue licences, prevent key sharing, and fix the problems you report. Nothing is collected for advertising, no data is sold, and we build no behavioural profiles.

This policy describes what the system actually does as of the date at the top of the page. When we change how data is handled, we update this document first.

2. What we collect

When you buy

The email address you enter, so we can send your licence key and support your order.
Order details: order code, chosen plan, amount, timestamp, and the transaction reference the bank generates during reconciliation.

We do not receive and do not store card numbers, account numbers or any payment credentials: the money goes straight from your banking app to the receiving account, and we see only the transfer note and the amount.

When you activate or start a trial

A hashed machine identifier. The panel reads the machine identifier issued by your operating system (MachineGuid on Windows, IOPlatformUUID on macOS), hashes it with SHA-256 on your own machine, and only the hash ever leaves. We never receive the original value and cannot work backwards from the hash.
The operating system name in general form, for example "Windows 11" or "macOS 14".
First and most recent activation time for each machine.

The panel does not read and does not send: local IP address, MAC address, computer name, Windows account name, drive list, or the list of installed software.

When you send a problem report

This is where the most data is collected, so here it is in full. When you actively press send, the report carries:

The description you typed, and your email if you filled it in so we can reply.
The last four characters of your licence key, to find your order. Never the full key.
Technical context: panel version, the host application in use (After Effects or Premiere Pro) and its version, the operating system, plus the machine hash so we can tell that several reports came from the same machine.
Roughly the last 50 lines of the panel's technical log - error and warning messages the panel itself produced while running. File paths are replaced before anything leaves your machine: a path pointing into your project becomes %DUONG% plus the file extension - a fault in an .aep, an .mp4 or an .ffx file are three different things, so we need the extension but not the name. Paths pointing inside MoLib's own folders are kept for diagnosis, but the account name inside them is replaced too. Your project names and file names do not travel with the report.
Up to 3 screenshots that you attach yourself. We never capture the screen on our own and never capture in the background; images travel only when you choose the files.

What we cannot filter is the text you type and the images you attach. If the report concerns a sensitive project, please do not paste full paths into the description, and look over the screenshots before sending.

When you visit the website

The site sets no tracking cookies, embeds no advertising code and uses no third-party analytics. The payment page keeps the order code and a random string in your browser's storage so the licence key can be shown again after a reload; that string never leaves your machine in its original form, the server holds only its hash.

For the problem report and key lookup forms, we store a hash of your IP address to stop bulk flooding. The original IP address is not stored.

3. What it is used for

Issuing, verifying, renewing and revoking licences.
Limiting the number of machines per key, and detecting key sharing.
Granting one trial per machine.
Reconciling payments and handling mismatched transfers.
Sending licence keys, order notifications, and notices about changes to the terms.
Reproducing and fixing the problems you report.

We do not use your data for advertising, do not share it with third parties for marketing, and do not sell it under any circumstances.

We do not collect your project content, the files you edit, or statistics on which presets you use and how often.

4. Processors and transfers abroad

We use the providers below. Their servers sit outside Vietnam, so using the service means personal data is transferred abroad within the meaning of Decree 13.

Cloudflare - runs the website, the licence server, the database and the asset store. Processes everything listed in section 2.
Resend - sends transactional email. Receives the email address and the contents of the message (licence key, order notifications).
SePay - reconciles bank transactions. Receives the transfer note, the amount and the transaction reference; it receives neither your email nor your licence details.
VietQR - renders the bank transfer QR image. Receives the amount and the order code. Since 22 August 2026 our own server fetches that image, so your browser no longer connects to VietQR directly.

We transfer data to no one else, except on a lawful written request from a competent state authority.

5. How long we keep it

Orders and licences - kept while the licence is valid and for the record-retention period required by accounting and tax rules.
Machine activation records - kept until you remove the machine from the key or the licence ends.
The trial ledger - kept long term. It is the only record that guarantees one trial per machine; it contains only the machine hash, timestamps, and your email if you entered one.
Screenshots attached to problem reports - deleted automatically after 90 days.
Hashed IP addresses used for flood protection - deleted automatically after 24 hours.
Licence keys in readable form, held briefly so the payment page can collect them - deleted automatically after 24 hours. Outside that window the database holds only the hash of the key.

6. Security

Licence keys are stored as SHA-256 hashes. Even a database leak does not reveal a key.
Machine identifiers and IP addresses are stored hashed only, never in original form.
All connections to our servers use HTTPS.
Asset download links are signed and expire after 15 minutes, so a link shared elsewhere cannot be reused.
The admin console requires a password plus two-factor authentication.

No system is perfectly secure. If a data breach affects you, we will notify you at your registered email and report it to the competent authority as required.

7. Your rights

Under Decree 13/2023/ND-CP you have the right to:

Be informed that your data is being processed.
Access and request a copy of the data we hold about you.
Have inaccurate data corrected.
Withdraw consent, and object to processing.
Request deletion of your data.
Request restriction of processing.
Complain, denounce, litigate and claim compensation as provided by law.

Send requests to the support email below. We respond within 72 hours and complete the request within 30 days.

One straightforward note: if you ask us to delete all your data while your licence is still valid, we no longer have any way to verify your right to use the software, and the licence will stop working. The trial ledger alone is retained as a technical anti-abuse record - it holds nothing that identifies you apart from an email address, and the email in that ledger can be deleted.

8. Children

The product is aimed at professional users and is not directed at children under 16. We do not knowingly collect children's data. If we find that we have, we delete it as soon as we are told.

9. Changes to this policy

When we amend this policy we update the date at the top of the page. For changes that widen what we collect or what it is used for, we give at least 30 days notice by email to your registered address.

10. Contact

Anything relating to personal data: [email protected].