Cookie Policy

The short answer

This site carries one analytics tag, Google Analytics 4, and it does not run until you allow it. It sets one cookie of its own accord, and only to remember the cookie choice you make yourself.

There is no advertising tag, no tracking pixel, and no session recorder. Nothing at all is written to your browser's local storage or session storage. The analytics tag is delivered switched off: it ships in the page as inert text that no browser will execute, and it is only turned into a running script after you allow the Analytics category. Until then, nothing measures your visit.

There is exactly one piece of content on this site that comes from another company: the Google map of our Hanoi office on the Contact page. It does not load on its own. Until you allow it, that page shows a plain address panel we drew ourselves, and Google is told nothing about your visit.

Most cookie policies exist to explain a long list of trackers. This one exists to tell you there is exactly one, to name it and the cookies it sets, to name the single cookie that is there before you decide anything, to name the single embed and how it is held back, and to explain the control we built before we had anything that needed it.

What cookies are

A cookie is a small text file a website asks your browser to store and send back on later requests. Cookies are how a site remembers that you are logged in, and also how advertising networks follow you between sites. Similar technologies, including local storage, session storage, pixels, and browser fingerprinting, do comparable jobs without using a cookie file, and the law generally treats them the same way.

What decides whether permission is needed is not the technology but the purpose. Storage that is strictly necessary to deliver something you asked for needs no permission. Everything else does, and it has to be asked for before the storing happens rather than after.

The cookies this site can set

One is set to record your own choice. Two more are set by Google Analytics, and only if you allow it. Nothing here is written before you answer the prompt.

That is the complete list. The cookie holds no name, no email address and no identifier for you. It holds your answer. It is written only once you have answered, it is readable by us and by nobody else, it is marked SameSite=Lax so other sites cannot cause it to be sent, and on our live site it is marked Secure so it travels only over an encrypted connection.

What the site does instead of tracking is worth stating positively, because these are the choices that kept the list at one.

• Self-hosted fonts. Our two typefaces are served from our own servers. We do not use a font network, so loading a page does not disclose your visit to a font provider.
• One embed, and it cannot load itself. There are no embedded videos and no social widgets anywhere on this site. There is one map, on the Contact page, and it is not served as a frame at all: the page ships the map's address in an inert attribute and a panel we drew ourselves, and a frame is only created after you allow External content in Privacy choices or press Load map on that page. Pressing the button loads it for that visit and stores nothing.
• First-party forms only. The contact form and the newsletter form both post to our own server, and they send only what you typed. Apart from Google Analytics, which does not run unless you allow it, they are the only places the site sends data anywhere.
• No tag manager. Google Analytics is written directly into this site's source rather than loaded through a tag container. A container can be changed in a web console without a commit, a build or a review, which would put what runs in your browser outside the checks described on this page.
• No web storage. Nothing is written to local storage or session storage anywhere on this site.
• Server logs. Our hosting records ordinary technical request data to keep the site running and to detect abuse. This is not a cookie, it does not persist on your device, and it is not used to profile you.
• Counting without cookies. Our own server counts page views in aggregate: a date, a page address, and a number, held on our side. Nothing is stored on your device for this, no identifier is created, and nothing is sent to any third party, which is why it does not appear in the cookie table above and needs no switch in the prompt. It exists so that we can know our true readership without asking Google to watch you, and it is described in full in the Privacy Policy.

The categories, and what is in them

The table below is built from the same definitions the prompt itself renders, so the two cannot drift apart.

Two of the four optional categories are still empty, and we would rather show you an empty category than invent something to put in it. Defining them before anything sat behind them is what makes the rest of this page checkable: because the Analytics category existed and defaulted to off before Google Analytics was added, the tag arrived switched off rather than switched on, and no visitor was measured in the gap between the two.

How we ask, and how your answer is recorded

On your first visit a bar appears at the bottom of the page offering Manage preferences, Reject all, and Accept all. It is not a wall. It does not cover the page and it does not trap your keyboard, because a prompt that blocks reading until you decide is pressuring the decision, and a pressured decision is not freely given.

The rules we held ourselves to are the ones the earlier version of this page promised, in the same words:

• Nothing runs before you allow it. Every optional category starts off. This is enforced in code rather than by policy: a script belonging to a category is served inert and is activated only once your record allows it.
• No pre-ticked boxes. The switches in Manage preferences are unticked in the HTML we send you. A box we ticked on your behalf records our preference, not yours, and it is not consent.
• Refusing is exactly as easy as accepting. Reject all sits beside Accept all at the same size, weight and color. One click either way.
• Closing the prompt is not consent. Dismissing it without answering leaves everything off, and we ask again next time.
• The site works either way. Nothing here is withheld, delayed or degraded because you said no.

Your answer is recorded so that we can act on it and so that we can show what you chose: the categories you allowed, the time you answered, the version the answer was given against, and whether you used Accept all, Reject all, or the preference dialog. That record lives in the at_consent cookie on your own device and nowhere else.

After 180 days we ask again rather than treating an old answer as permanent, and we ask again if we ever change what a category means. An answer given to one question is not stretched to cover a different one.

Changing or withdrawing your choice

Every page has a Privacy choices button in its footer. It opens the same dialog you saw the first time, shows what you currently allow, and lets you change any of it. Withdrawing everything is one click on Reject all.

That is a legal requirement as well as a courtesy: consent has to be as easy to withdraw as it was to give. Same dialog, same number of clicks, on every page, with no email to send and nobody to ask.

You can also delete the cookie yourself in your browser settings. Nothing on this site depends on it except our knowledge of what you decided.

Wherever in the world you are reading this

We are based in Vietnam and our clients are spread across Europe, the United Kingdom, Singapore, the United States and elsewhere. Those rules differ. Rather than detect where you are and apply the weakest rule that fits, we apply the strictest one to everybody.

That is a deliberate decision rather than a shortcut, and it is worth explaining why, because it would be easy to assume a site does this to save effort. Deciding what a visitor is entitled to from the country their connection appears to come from is unreliable in both directions. A location lookup is accurate most of the time and never guaranteed: a VPN, a corporate network, a mobile carrier, a satellite link, Apple's Private Relay or a newly allocated address range can all place somebody in the wrong country, and someone near a border can be placed on either side of it. In the other direction, some rights do not follow location at all. Data protection law in the EU can apply to anyone who is physically in the EU, whatever passport they hold, while California's law protects California residents even while they are abroad. A site that gave people rights based on the country their IP address suggested would get both of those wrong.

• Vietnam. Law No. 91/2025/QH15 and Decree No. 356/2025/ND-CP have applied since 1 January 2026. Consent must be clear, specific, informed and demonstrable, and silence is not consent. This is the law of the country we operate from, so it applies to everything we do here regardless of where you are.
• European Union, EEA, United Kingdom and Switzerland. The ePrivacy Directive and its national implementations, and PECR in the UK, require consent before non-essential storage. The GDPR and UK GDPR require that consent to be freely given, specific, informed and unambiguous, and as easy to withdraw as to give. Google's own consent policy covers this same group. That is the standard the prompt is built to.
• Singapore. The Personal Data Protection Act works on notification of purpose plus consent, with a right to withdraw on reasonable notice. The purpose of each category is stated in the prompt itself rather than buried here, and withdrawal takes effect immediately rather than on notice.
• United States. California and the newer state acts use an opt-out model for sale, sharing and targeted advertising. We do none of those, so there is nothing to opt out of. We honor the opt-out preference signal regardless: if your browser sends Global Privacy Control, the optional categories are recorded as refused without our asking, and the prompt tells you that is what happened. The Privacy choices control is in the footer of every page for every visitor, not only for visitors we think are American, because a Californian reading this in Hanoi keeps their rights and no location lookup would show it.

One thing the country of your connection does affect. Our network tells us which country it associates with your connection, and we use it to decide which consent policy to apply to the page. Today every country receives the same strict policy, so it changes nothing about what you see. If your country cannot be determined, or you are connecting over Tor, you get the strict policy as well: an unknown location always resolves to the more protective setting, never the weaker one. We do not use it to work out your address, we do not put it in a cookie, and your IP address is never sent to the page.

Third parties and outbound links

This site links out to a small number of places, including our profiles on Clutch, GoodFirms, DesignRush, and TechBehemoths, and our Facebook and LinkedIn pages. These are ordinary links. Nothing is loaded from those sites while you are on ours, so they receive nothing until you actually click through.

Once you click, you are on their site and their cookie and privacy practices apply, not ours. We have no control over what they set. If you would rather not be tracked by them, review the settings on those platforms directly.

What happened when this changed

This page used to promise what would happen if analytics were ever added. In August 2026 it was added, so here is what actually happened, against that promise:

• The cookie was named before it shipped, not after. Google Analytics 4, provider Google, cookies _ga and a second property-specific cookie, lifetime two years: all of it is in the table above, and the wording of this page was corrected in the same change that added the tag rather than in a later one. An inaccurate privacy notice is itself a breach, so a corrected policy is not tidying up after the work, it is part of the work.
• It belongs to a category and does not run until you allow it. Analytics was one of the categories defined in 2025, when there was nothing behind it. Because the category and its off-by-default switch already existed, the tag arrived switched off. It is delivered as inert text your browser will not execute, and only becomes a running script after you allow Analytics.
• Everyone was asked again. The recorded version was changed, so every answer given before this arrived was retired. An answer given when Analytics was empty was not permission for Google Analytics, because there was nothing to permit at the time it was given.
• Refusing stayed exactly as easy as accepting, with no pre-ticked boxes, and the site is fully usable if you refuse.

To keep that honest, our build fails if a tracking script is added to the site while this page still says there is none, and it fails if a cookie is written anywhere other than the single place that writes your consent record. A separate check drives the shipped pages and verifies that the prompt appears on a first visit, that no switch arrives pre-ticked, and that Reject all is as prominent as Accept all. The commitment is enforced by code rather than by memory.

Controlling cookies yourself

Beyond the controls on this site, every major browser lets you block or delete cookies, and most offer a strict tracking-protection mode. Look under Settings, then Privacy. Several browsers and extensions can also send the Global Privacy Control signal described above, which we honor.

Blocking cookies site-wide will not break anything here. The only thing you lose is our memory of what you chose, so you will see the prompt again.

Questions

If you have a question about this policy, or you believe you have found something on this site that sets a cookie we have not named here, please tell us at hello@agiletech.vn. We would want to know.

See also our Privacy Policy for what we do with the personal data you send us.