Privacy Policy

We use the information we collect to:

• Provide and maintain the Service, including ingesting conversations, generating AI responses, routing messages, and delivering replies through your connected platforms.
• Process payments and manage your subscription.
• Improve and develop the Service, including using aggregated, de-identified data to enhance our product features. We do not use Customer Content to train general-purpose foundation models.
• Communicate with you about updates, security alerts, and support inquiries.
• Send marketing communications about new features and offerings, where permitted by applicable law (you can opt out at any time).
• Prevent fraud, spam, and platform-policy violations, and ensure the security and integrity of the Service.
• Comply with legal obligations and enforce our terms.

We do not sell your personal information. We may share your information with:

• Service providers: cloud hosting (AWS), payment processing (VNPay, Momo, Sepay, Payos), email delivery, and analytics. These providers are bound by contractual obligations to protect your data.
• AI model providers: Customer Content (including conversation snippets) may be sent to AI model providers such as OpenAI, Anthropic, and Google. These providers process data solely to generate responses and do not use Customer Content to train their general models, in accordance with their data processing terms.
• Connected Platforms: data flows between Ecbot and the platforms you connect (Meta, Zalo, TikTok Shop, Shopee, etc.) as necessary to provide the Service.
• Professional advisors: lawyers, accountants, and auditors as needed for business operations.
• Legal requirements: when required by law — including lawful requests from Vietnam’s Ministry of Public Security (A05), Singapore’s PDPC, or comparable authorities in Indonesia, Thailand, the Philippines, and Malaysia.
• Business transfers: in connection with a merger, acquisition, or sale of assets, your information may be transferred to the acquiring entity.

We retain your personal information for as long as your account is active or as needed to provide the Service. Upon termination of your agreement, we will delete Customer Content within 60 days of your request, except where retention is required by law (for example, accounting and tax records, which Vietnamese law generally requires to be retained for at least 10 years).

End-user conversation data ingested from Connected Platforms is retained according to your account’s retention settings (default: 24 months), subject to platform-specific retention restrictions (for example, Meta requires certain data to be deleted within 30 days of disconnection).

Your information may be transferred to, stored, and processed in Singapore, Vietnam, the United States, or other countries where our service providers operate.

• Vietnam: For Customers and end users in Vietnam, certain cross-border transfers are subject to Decree 13/2023/ND-CP. Ecbot will support Customer in preparing and submitting a Cross-Border Transfer Impact Assessment (TIA) dossier to the Department of Cybersecurity and Hi-Tech Crime Prevention (A05) under the Ministry of Public Security.
• Indonesia: Transfers are subject to UU PDP Art. 56, requiring adequacy or appropriate safeguards.
• EEA / UK: For Personal Data transferred from the EEA or the United Kingdom, we rely on Standard Contractual Clauses (SCCs) approved by the European Commission and the UK International Data Transfer Addendum.
• Other ASEAN jurisdictions: We rely on the data subject’s consent, contract necessity, or comparable legal mechanisms under Singapore PDPA, Thailand PDPA, Philippines DPA 2012, and Malaysia PDPA.

When you use Ecbot to handle conversations with your end customers, you are the data controller (under Vietnam Decree 13/2023, the Data Controller or Data Controller-Processor) for the end-user personal data, and Ecbot acts as the data processor. As the controller, you are responsible for:

• Providing a privacy notice to your end customers.
• Establishing a valid lawful basis (typically consent) for processing under the applicable law in their country.
• Honoring data subject requests, including requests originating through the Connected Platform.
• Complying with anti-spam and marketing-consent rules (including Vietnam Decree 91/2020/ND-CP, Singapore PDPA Do Not Call, Thailand PDPA marketing rules, and equivalent rules in other ASEAN markets).
• Complying with the messaging and content policies of each Connected Platform.

For customers subject to data protection laws that require a data processing agreement, our DPA is incorporated into our Terms of Service. The DPA is based on the Common Paper DPA Standard Terms Version 1.0 and covers:

• Our role as a data processor (or sub-processor) of Customer Personal Data.
• Processing instructions and permitted purposes.
• Sub-processor management, including advance notice of changes.
• Data subject rights and breach notification obligations.
• International transfer mechanisms (Standard Contractual Clauses, Vietnam Decree 13/2023 TIA support, and similar).

For Enterprise customers, we offer a comprehensive Cloud Service Agreement with a full DPA, liability caps, indemnification terms, security exhibits, and custom terms. Contact privacy@ecbot.dev to get started.

The Service is not intended for individuals under the age of 18 (or the age of majority in your jurisdiction). Under Vietnam Decree 13/2023, processing the personal data of children (under 16) requires verifiable consent from a parent or legal guardian; we do not knowingly process such data through the Service. If we learn that we have collected personal information from a child without proper consent, we will take steps to delete that information promptly.

The Service contains links to and integrations with third-party websites and services, including the Connected Platforms (Meta, Zalo, TikTok, Shopee, etc.). We are not responsible for the privacy practices of these third parties. We encourage you to review the privacy policies of any third-party services you connect to Ecbot.

We may update this Privacy Policy from time to time. We will notify you of material changes by posting the updated policy on this page and updating the “Last updated” date above. Where required by applicable law (for example, Vietnam Decree 13/2023 requires re-consent for material changes to purpose of processing), we will obtain renewed consent before applying such changes. Your continued use of the Service after any changes constitutes acceptance of the updated policy.

For privacy questions or to exercise your rights, contact us at privacy@ecbot.dev.