Terms of Service

Ecbot is a customer-conversation automation platform built for Southeast Asia. It connects to messaging and commerce channels — including Facebook Messenger, Instagram, Zalo Official Account, TikTok Shop, and Shopee — and lets Customer build AI agents and automations that read, triage, and reply to conversations, manage orders, and perform actions across connected accounts.

The Product has different pricing plans, which are available at Provider’s pricing page. Customer will pay Provider the applicable Fees based on the Product tier and Customer’s usage. Provider may update Product pricing with reasonable notice to Customer (including by email or notification within the Product), and the change will apply in the next billing cycle.

Provider will use commercially reasonable efforts to provide and maintain the Cloud Service without excessive errors and interruptions. If Provider does not meet the SLA in two consecutive months or over three months in any 12-month period, then Customer may, as its only remedy, terminate the subscription upon notice and receive a prorated refund of prepaid fees for the remainder of the billing period.

By Provider:

• Security Measures. Provider warrants it will implement, maintain, and comply with any technical and/or organizational measures required to ensure the security and confidentiality of the Customer’s information, as outlined in the Security Policy below.
• Deliverables free of malicious code. Provider warrants that Deliverables do not contain, and Provider will not insert into any Deliverable, any lock, dongle, clock, timer, counter, hardware key, copy protection feature, replication device, virus, or worm that may (a) lock, disable, or erase any Deliverable or data, (b) limit or prevent full use or copying of Deliverables, (c) harm or interfere with Company’s servers or hardware, or (d) require action by Provider to allow use of the Deliverables.

For Provider: Ecbot, registered in Ho Chi Minh City, Socialist Republic of Vietnam. Registered address to be confirmed on the Effective Date. Notices may be sent to legal@ecbot.dev pending confirmation.

For Customer: The main email address on Customer’s account.

Provider offers free trials so that prospective Customers can evaluate the Product. The standard trial period is 7 days, which Customer may extend once for an additional 7 days (up to 14 days total), subject to usage limits that Provider communicates at signup and may update from time to time.

The Product depends on third-party messaging and commerce platforms (“Connected Platforms”). Customer is responsible for:

• Maintaining its own account and good standing on each Connected Platform (Facebook Page, Instagram Business Account, Zalo Official Account, TikTok Shop, Shopee Shop, etc.) and for granting Provider only the OAuth scopes needed to deliver the Service.
• Complying with each Connected Platform’s developer, commerce, advertising, and messaging policies — including messaging windows (for example Meta’s 24-hour standard messaging window and message tag rules, Zalo OA messaging quotas), opt-in requirements, and content restrictions.
• Honoring end-user opt-outs and unsubscribe requests within the timeframes required by applicable law (including Vietnam’s Decree 91/2020/ND-CP on spam advertising messages, Singapore’s PDPA Do Not Call rules, and Thailand’s PDPA marketing consent rules).

Customer acknowledges that Connected Platforms may change their APIs, policies, fees, or availability at any time, and that such changes are outside Provider’s control. Provider is not liable for loss of functionality caused by Connected Platform changes, suspensions, or rate limits.

Provider makes no guarantees that the Product will always be safe, secure, or error-free, or that it will function without disruptions, delays, or imperfections. The warranties in this Agreement do not apply to any misuse or unauthorized modification of the Product, nor to any product or service provided by anyone other than Provider, including Connected Platforms and AI model providers.

Except for the express warranties stated in this Agreement, Provider and Customer each disclaim all other warranties, whether express or implied, including the implied warranties of merchantability, fitness for a particular purpose, title, and non-infringement. These disclaimers apply to the maximum extent permitted by applicable law.

Provider will use commercially reasonable efforts to secure the Cloud Service from unauthorized access, alteration, or use and other unlawful tampering.

• Information Security Management System. Ecbot maintains an ISMS with controls including policies, processes, software, and hardware functions that are monitored, reviewed, and improved to meet security and business objectives.
• Human Resource Security. Pre-employment screening per Vietnamese law, confidentiality clauses in employee and vendor contracts, disciplinary processes for non-compliance, and prompt access revocation upon termination of employment.
• Asset Management & Data Security. Information assets are identified and inventoried, classified per an Information Classification & Data Management Policy, and stored in reputable cloud data centers. Customer data is segregated using unique identifiers with proper data isolation in multi-tenant environments. Data retention policies align with Vietnam Decree 13/2023, Decree 53/2022, and other applicable Southeast Asian data protection laws.
• Access Control. Role-Based Access Control (RBAC) on a need-to-know basis, separation of duties, least privilege principles, periodic access rights reviews, strong password policies, multifactor authentication (MFA) on administrative accounts, and SSO support where available.
• Cryptography. AES 256-bit encryption or higher for data at rest, TLS 1.2+ for data in transit, authentication on all public API endpoints, and encrypted backups.
• Operations Security. Controlled and documented production changes, malware detection on endpoints and servers, patch management with regular updates, and a vulnerability management program including periodic dependency and infrastructure scans.
• Logging, Monitoring & Incident Management. Event logging of user activities, exceptions, and audit trails retained for at least 1 year and protected from tampering. Security incident response with root cause analysis, and breach notification within 72 hours as required by Vietnam Decree 13/2023.
• Communication & Network Security. Network segmentation, firewalls, access management, logging and monitoring, environment segregation (Prod, Dev, Staging), and DDoS protections on production environments.
• Software Development. Secure Software Development Lifecycle (S-SDLC) following OWASP and similar best practices, with code review and automated dependency scanning.
• Supplier Relationships. Due diligence on direct suppliers covering Information Security, Data Protection, and Business Continuity. Suppliers are subject to confidentiality and security obligations.
• Business Continuity & Disaster Recovery. Documented BC/DR plans, independent backups, target RTO of 4 hours and RPO of 24 hours, with periodic backup testing.
• Information Security Risk. A security risk management program covering identification, assessment, treatment, and acceptance of risks.

Provider’s compliance roadmap (ISO 27001 and/or SOC 2 Type II) is published in its Trust Center as it matures.

Provider intends to maintain commercial general liability, professional liability (errors and omissions), and cyber liability insurance coverage appropriate to its stage of operation. Details are available upon request for Enterprise customers.

The following Data Processing Agreement is incorporated into this Agreement. The DPA is based on the Common Paper DPA Standard Terms Version 1.0 and covers the processing of Customer Personal Data in accordance with applicable data protection laws, including Vietnam Decree 13/2023 (PDPD), Decree 53/2022 (local storage), Singapore PDPA, Indonesia UU PDP (Law No. 27 of 2022), Thailand PDPA, Philippines DPA 2012, Malaysia PDPA, GDPR, and CCPA where applicable.

For Vietnam-based Customers, Provider will support Customer’s obligation to file a Data Processing Impact Assessment (DPIA) and, where applicable, a cross-border data transfer dossier with the Ministry of Public Security’s Department of Cybersecurity and Hi-Tech Crime Prevention (A05), by providing the required technical and processing information on request.

To the extent the CCPA applies, Provider is a service provider receiving Personal Data from Customer to provide the Service for a limited and specified business purpose. Provider will not sell or share any Personal Data provided by Customer.

For additional details on data collection, international transfers, and data subject rights, see our Privacy Policy.

The following sub-processors are authorized to process Customer Personal Data.

Provider supports regional data residency. By default, AWS Singapore (ap-southeast-1) is used for low-latency access from Vietnam and the rest of Southeast Asia; Vietnam-resident storage is available to support Customer’s obligations under Decree 53/2022/ND-CP. Contact support@ecbot.dev for details.