The outside services that can receive data when ZappBot runs, taken from what the code does today. It is the same list as on the data-location page, which stays the current statement. The data processing terms that apply to them are at the end of this page.
Hosting and the database: all tenant data (leads, chats, settings, staff links).
Always.
The visitor's message (first 300 characters) and the owner's business facts, to write an answer.
Optional: AI fallback and staff copilot, only when the facts do not answer.
Chat messages and staff or owner alerts sent through the tenant's own Zalo account.
Optional: only if Zalo is connected.
Replies to Messenger chats (channel is frozen).
Optional: only if Messenger is connected.
E-mail: sign-in links and codes, e-mail replies.
Optional: only when e-mail is used.
Sign-in exchange for staff (SSO).
Optional: only if the tenant sets up SSO.
The visitor's browser loads a QR image; the address holds bank, account number, amount and transfer note.
Optional: only for deposits and plan payments.
The visitor's browser loads the Turnstile check on the sign-up and sign-in pages; the server sends the check token and the visitor's IP address to Cloudflare to verify it.
Optional: only when the operator turns Turnstile on.
When a business customer uses ZappBot for its own visitors, the business decides why that data is collected and ZappBot handles it on the business's instructions as its processor. ZappBot uses the services listed above only to run the service, only for the data shown against each one, and only to the extent each one is switched on for that customer.
Each service is bound by its own terms with ZappBot, which must protect the data at least as well as these terms do. ZappBot stays responsible to its customers for the services it chooses.
Where the data sits: tenant data is in one Cloudflare D1 database; the data-location page states the region and the backups. Some services (Anthropic, Zalo, Meta, Resend, Cloudflare's global network) may process data outside the customer's own country, including outside Vietnam, so the customer should say so in its own privacy notice.
Changes: a new service, or a change in what a service receives, is added to this page before it is used. Customers who need advance notice can ask us to e-mail them about changes to this list.
When a customer leaves, its data is deleted on the schedule on the data-location page, and the customer can export it first. ZappBot does not sell the data and does not use it to train its own or anyone else's models.
This page is a plain statement of how ZappBot works today. A signed data processing agreement for a specific customer is available on request, and its terms prevail over this page for that customer.