ZappBot is run by [OPERATOR NAME, ADDRESS AND E-MAIL: to be filled in before launch]. In this policy 'we' means that operator.
Business customers sign up for ZappBot and give us their business details, staff names and contact details, and payment records. For that account data, we decide why and how it is used.
Visitors talk to the chat assistant on a customer's website. In general the business decides why a visitor's data is collected, and we handle it for that business as its processor. A visitor's questions about their own data should go first to the business whose website they used; we help the business answer them.
From visitors: what they type in the chat, the contact details they choose to give (for example a name, phone number or e-mail address) when they leave a lead or book an appointment, and the technical data a chat needs to work (a random chat id, the language, the page it ran on). We do not ask the chat for more than the business set it up to ask.
From business customers: the sign-up details (business name, contact name, e-mail, phone or Zalo), the settings, FAQ and wording they give the assistant, staff names and sign-in links, and records of plan payments.
From affiliate partners: name, contact, payout details (PayPal or bank account) and the sign-ups credited to them.
To run the service: answer visitors, record leads and appointments, send alerts, show the owner dashboard, bill plans, keep the service secure and fix faults. We use account data to run the contract with the customer, and visitor data on the instructions of the business that runs the chat, which is responsible for telling its visitors and for having their consent where the law asks for it.
We do not sell personal data, do not use it for advertising, and do not use chat content to train models.
Only the outside services on the sub-processors page, and only the data shown there. We may also disclose data when a law or a valid order of a public authority requires it.
The data-location page lists, from the code, where each kind of data is stored, how long it is kept and which outside services receive data. Deletion runs automatically on those schedules, and the business owner can change some of them. That page is the current statement; this policy does not repeat the numbers.
Some outside services process data in other countries, including outside Vietnam. Where Vietnamese law asks for steps before data goes abroad, the business that runs the chat and we each take the steps that belong to our role.
You can ask to know what is held about you, to see or get a copy of it, to correct it, to delete it, to limit or object to its use, and to withdraw consent you gave. A business owner can export and delete the data held about one person from the dashboard (the data-location page lists what the owner can do today). A visitor should ask the business that runs the chat, or write to us and we will pass it on or answer it. We reply within 30 days, sooner where the law sets a shorter time. You can also complain to the data protection authority that is competent where you live.
Customer data is separated by client: every read and write is limited to one client. Pages and the API use HTTPS, sign-in uses links and codes with expiry, secrets are kept outside the code, and changes made by staff and the operator are written to an audit log. No system is perfectly secure; if a breach affects personal data we notify the affected customers and, where the law requires, the authority, without undue delay.
ZappBot is for businesses and is not aimed at children. A business should not set the chat up to collect data from children without the consent the law requires.
The chat widget, the pages and the owner dashboard keep some data in the browser. The cookie and storage page lists what is kept.
If we change this policy in a way that matters, we say so on this page and tell customers by e-mail. Last updated: 5 November 2026. Questions, requests and complaints: use the contact link at the top of this page.