This Privacy Policy applies to the zepo.io website, the console.zepo.io dashboard and the AI Agent provided by Zepo AI ("Zepo", "we"). We process personal data in accordance with Vietnamese law, including Decree 13/2023/ND-CP on personal data protection.
1. Scope
This policy covers three groups of people:
- Visitors: people who browse zepo.io, read our news or request a consultation.
- Business customers: account owners and members invited to a Zepo account.
- End customers: people who message the website, Facebook page or Zalo account of a business that uses Zepo.
2. Data we collect
2.1. Data you provide
- Account information: name, email, phone number, business name and your password, stored hashed.
- Business data: products, price lists, training documents, FAQs and workflows you add for the AI Agent to use.
- Contact details: information you send when booking a demo, contacting support or giving product feedback.
2.2. Data generated when you use the service
- Conversation data: messages, attachments, public profile information of end customers and orders created in conversations.
- Usage data: features used, messages processed, AI Agent settings and system logs.
- Payment data: your plan, invoices and transaction history. Card details are handled by our payment partners; we do not store full card numbers.
2.3. Data collected automatically
- Device and access data: IP address, device type, browser, language, pages viewed and time of visit.
- Cookies: see section 8.
2.4. Data from third-party platforms
When you connect a Facebook page or a Zalo Official Account, we receive the page name, identifiers and the permissions you grant so we can send and receive messages on your behalf.
3. How we use data
- Providing the service: running the AI Agent to reply, advise and create orders as you configure it; this is necessary to perform our contract with you.
- Support and communication: verifying your account, sending service notices and invoices, and answering support requests.
- Improving the product: analysing how the service is used, relying on aggregated or anonymised data where possible.
- Marketing: sending news and offers when you have agreed; you can unsubscribe at any time.
- Safety and compliance: detecting fraud, protecting our systems and meeting legal obligations.
We do not process personal data for purposes other than those we have told you about without your consent, unless the law permits it.
4. End-customer data and the AI Agent
For end-customer data, your business is the data controller and Zepo is the data processor acting on your behalf. This means:
- We process this data only according to your settings and instructions, to provide the service.
- Zepo staff access conversations only when needed for support, troubleshooting or at your request.
- You are responsible for telling end customers that an AI Agent is used and for having a legal basis to collect their data.
- AI Agent replies are based on the data you provide; review sensitive information such as prices, promotions or professional advice carefully.
5. Sharing data
We do not sell or rent personal data. We share data only as needed with:
- Service providers: cloud infrastructure, storage, AI models, email delivery and analytics, under contracts with confidentiality terms.
- Messaging platforms: Meta, Zalo and the other channels you connect, to send and receive messages.
- Payment partners: to process transactions and issue invoices.
- Competent authorities: when required by law.
- Business transfers: in a merger, acquisition or asset transfer; we will notify you in advance.
International transfers
Some providers may store or process data outside Vietnam. In that case we apply appropriate safeguards and complete the cross-border transfer procedures required by law.
6. Data retention
- Account data: kept while you use the service and deleted or anonymised within a reasonable period after your account ends.
- Conversation and business data: kept according to your settings; you can delete it in the dashboard or ask us to delete it.
- Payment records: kept for the period required by accounting and tax law.
- System logs: kept for a limited period for security and incident investigation.
7. Data security
We apply appropriate technical and organisational measures to protect data:
- Encryption in transit with HTTPS/TLS, and hashing of passwords before storage.
- Role-based access control, granting access only to staff who need the data for their work.
- System monitoring and access logging to detect unusual activity.
- Notifying you and the competent authorities within the legal time limit if an incident affects personal data.
No system is completely secure. Keep your password and API keys secret, and tell us immediately if you notice unauthorised access.
8. Cookies and similar technologies
- Essential cookies: remember your language, keep you signed in and protect forms. The website does not work properly without them.
- Analytics cookies: measure traffic and content performance so we can improve the website.
You can block or delete cookies in your browser settings; some features may then not work fully.
9. Your rights
Under Decree 13/2023/ND-CP, you have the following rights over your personal data:
- Right to be informed: about how your data is processed.
- Right to consent and withdraw consent: withdrawing does not affect processing carried out before.
- Right of access and correction: to view and update your data.
- Right to deletion: to ask us to delete data that is no longer needed for the stated purposes.
- Right to restrict and object to processing: including objecting to the use of data for advertising.
- Right to obtain your data: to receive a copy of your personal data.
- Right to complain, report, sue and claim compensation: as provided by law.
To exercise these rights, email support@zepo.io. We may need to verify your identity first and will respond within the legal time limit. If you are an end customer of a business that uses Zepo, please contact that business directly; we will help them handle your request.
10. Children
Zepo is a service for businesses and is not directed at children. We do not knowingly collect data from children under 16. If we learn that we have collected such data without valid consent, we will delete it.
11. Changes to this policy
We may update this policy when our service or the law changes. The date of the latest update is shown at the top of this page. For significant changes, we will notify you by email or on the website before they take effect.
12. Contact
If you have questions about this policy or how we handle data, contact us:
- Email: support@zepo.io
- Phone: +84 8888 301 36
Please also read our Terms of Use to fully understand your rights and obligations when using Zepo AI.