Privacy Policy

1. Data we collect

Account information (name, email, phone number, business name); data you provide to train the AI (price lists, products, documents); conversation content between the AI and your end customers; and technical data (logs, IP address, cookies).

2. How we use data

To provide and operate the Service; train and improve the AI assistant for you; support customers; issue invoices and process payments; and ensure security and legal compliance.

3. Legal basis

We process data based on your consent, to perform the service contract, and to comply with legal obligations.

4. Sharing with third parties

We may share data with: infrastructure/hosting providers; AI model providers (if you choose to use cloud AI); payment gateways; messaging platforms (Zalo, Facebook, TikTok) to send/receive messages; and advertising and selling platforms (Facebook, TikTok, Shopee) for the features a business connects and turns on, as described in sections 9 to 11. We do not sell personal data.

5. Storage and security

Data is stored on infrastructure with access control, encryption in transit, role-based permissions and audit logging. On the Enterprise plan, data can be kept on your own server.

6. Retention

We retain data for as long as you use the Service and for a reasonable period afterward as required by law, then delete or anonymize it.

7. Your rights

You have the right to access, correct, delete, restrict or object to the processing of your personal data, and to withdraw consent. Please contact us to exercise these rights.

8. Your end-customer data

For end-user data you collect through the Service, you are the data controller and Aegis Flow is the data processor acting on your instructions. You are responsible for ensuring a lawful basis and appropriate notice to end users.

9. Data from Facebook, Instagram, WhatsApp, Zalo and TikTok

When a business connects a Facebook Page, Instagram account, WhatsApp number, Zalo OA or TikTok account to Aegis Flow, we receive the access token the platform issues and the messages and comments customers send to those accounts. We use this data only so the AI assistant and the business's staff can reply, so the business can review its conversations and leads, and to publish posts when the business's staff choose to publish. Tokens are encrypted at rest. We do not use message or comment content to advertise Aegis Flow or anyone else, and we do not sell it to anyone.

For a business's TikTok account, Aegis Flow works only with accounts whose owner has authorized it, does not download TikTok videos to repost them elsewhere, and does not aggregate creators' data to rank them.

A business can disconnect at any time by deleting the channel under Channels. Aegis Flow then stops receiving messages from that account and deletes its stored token.

10. Advertising on Facebook and TikTok

When a business connects a Facebook or TikTok ad account, Aegis Flow receives an access token and reads the ad account, campaigns, spend figures and leads from ad forms, for reporting and so the business can turn ads on or off and change budgets from Aegis Flow.

Only when the business's owner or an admin turns it on, separately for each platform, Aegis Flow sends customer lists from the CRM (phone numbers, emails) to Facebook or TikTok as advertising audiences. Phone numbers and emails are one-way hashed (SHA-256) before they leave; the platform uses them only to match its own users. Aegis Flow does not send customers who unsubscribed from emails, asked not to be contacted or have an open complaint. Lists are updated about once a day until the business turns this off.

When the business turns it on, Aegis Flow also sends hashed conversion events (a customer left their details, an order was confirmed) to Facebook to measure ad results.

For this data the business is the data controller and is responsible for informing its customers. On disconnect, Aegis Flow deletes the access token, the list of ad accounts and the audiences it made from Aegis Flow; synced campaign figures stay in the business's reports until the business asks for them to be deleted. Audiences already sent to Facebook or TikTok stay on the platform until the business deletes them (in Aegis Flow before disconnecting, or in the platform's ads manager).

11. Livestreams to Facebook, Shopee and TikTok

When a business streams a live through Aegis Flow, we store the platform's stream server address and stream key (the key encrypted at rest) only to send the video to the right live session, and we record the hours on air for reporting. On Facebook Live, viewers' comments are read so the AI assistant can reply and the business can review them.

12. Data deletion requests

To ask us to delete the data Aegis Flow holds about you, including data received through Facebook or TikTok login, or messages and comments sent to a Page, Zalo OA, WhatsApp number or TikTok account that uses Aegis Flow, email [email protected] with the subject "Data deletion request" and include your account email or the related Page name or phone number. We will confirm receipt and complete the deletion within the period required by Vietnamese Decree 13/2023/ND-CP.

You can also remove Aegis Flow's access on Facebook under Settings & privacy → Settings → Apps and websites, on Zalo in your OA's app management, or on TikTok in TikTok For Business's authorized apps.

13. Cookies and analytics

The website uses cookies necessary for sign-in and may use analytics tools (such as Google Analytics) to understand traffic. You can manage cookies through your browser.

14. Changes to this policy

We may update this Policy and will post the new version with its effective date.

15. Contact

For any personal-data requests, please contact: Email: [email protected] · Hotline: +84 904 129 159.