Privacy Policy

AloChat ("AloChat", the "Service") is an omni-channel conversation management platform that helps businesses connect with and automatically reply to customers using AI across Facebook Messenger, WhatsApp, Zalo, TikTok, websites, and other channels. The Service is operated by KVGPAY GLOBAL COMPANY LIMITED ("we", "us").

This Privacy Policy (the "Policy") explains how we collect, use, share, retain, and protect your information when you use the AloChat mobile app, website, and services.

By creating an account or using the Service, you confirm you have read and agree to this Policy. If you do not agree, please stop using the Service.

Our role regarding data

AloChat serves two groups of users: (a) businesses/staff who register accounts to manage conversations ("Business Customers"), and (b) end users who message businesses through connected channels ("Messaging Users").

For Business Customer account data, we act as a data controller. For conversation content between a business and Messaging Users, the business is the data controller and AloChat processes the data on its behalf (as a processor) to provide the Service.

Information we collect

Most of the information below is your own data and the data of the shop you manage. We store it so we can show it back to you and so the Service can function — not to exploit it. Each group below states what it is stored for.

Account information: name, email address, password (hashed/encrypted), avatar, preferred language, and the shop information you create.

Social login information: when you choose to sign in with Google or Facebook, we receive your name, email, and public profile picture from that provider to create or sign in to your account.

Platform connection data: when you connect a Facebook Page, WhatsApp Business account, Zalo OA/personal account, TikTok Business account, or web widget, we store access tokens (encrypted), page/account IDs, and page name and picture to send and receive messages on your behalf.

Conversation content: messages, images, attachments, tags, notes, and the public profile details of Messaging Users (display name, avatar, platform ID). This is your shop’s data — we store it so that you and the staff you authorise can review the conversation history, and so bots can reply in context. Data is isolated per shop: an account in one shop cannot access another shop’s conversations. See "What we do NOT do with conversation content" below.

Knowledge base data: documents and text you upload for the AI to reference when replying.

Payment information: subscription plan, transaction history, amounts, and payment status. Transactions are processed by third-party payment gateways (VNPay, MoMo, ZaloPay); we do NOT store your card numbers or sensitive financial details.

Device & push data: device tokens (FCM/APNs), device type, operating system, and app version — used to deliver notifications and provide technical support.

Technical & usage data: IP address, access logs, interaction events, and crash reports for operating, securing, and improving the Service.

What we do NOT do with conversation content

Because this is our customers’ biggest concern, we state the limits we hold ourselves to:

• We do NOT sell, rent or share conversation content with data brokers or advertisers.
• We do NOT use your conversation content to train or fine-tune AI models — neither our own nor those of third-party providers.
• We do NOT use conversation content for targeted advertising.
• We do NOT mix data between shops. Each shop is isolated, including the bot answer cache (reused only within the same bot of the same shop).
• There is NO feature in the system that lets AloChat staff open and read your shop’s message content. Internal administration tools show only aggregate figures (conversation counts, message counts, last activity time), never content.

The only circumstances in which our engineers may reach data at the infrastructure level are when you actively request support to resolve an incident, or when a competent State authority requires it under the law. Such access is controlled and logged.

Cookies and similar technologies

On our website and app, we use cookies, local/secure storage, and similar identifiers to keep you signed in, remember your preferences (language, theme), and measure and improve the experience.

You can manage or delete cookies in your browser settings; however, some features may not work properly if essential cookies are disabled.

How we use information

• Provide, operate, and maintain the Service (send/receive messages, AI auto-reply, conversation management).
• Authenticate users, secure accounts, and detect fraud or abuse.
• Process subscriptions, payments, and invoicing.
• Send operational notices, push notifications, and respond to support requests.
• Analyse, measure and improve the quality of the Service using aggregate operational metrics (volumes, frequency, error rates) — we do NOT use your conversation content to train AI models.
• Comply with legal obligations and enforce our terms.

Legal bases for processing

Depending on applicable law, we process personal data on one or more bases: performance of a contract (providing the Service you request); legitimate interests (security, fraud prevention, improving the Service); your consent (e.g., marketing communications); and compliance with legal obligations.

Where processing is based on consent, you may withdraw it at any time without affecting the lawfulness of prior processing.

Data from Facebook/Meta, WhatsApp, Zalo and TikTok

When you connect a platform, we access and use platform data (such as page messages, public profiles of messaging users, and the list of pages you manage) only for the purpose of providing the conversation management features you request.

We do NOT sell platform data, do NOT use it for targeted advertising, and do NOT share it with data brokers. Our use of Facebook data complies with Meta Platform Terms; our use of Zalo data complies with Zalo terms.

You can disconnect any page/account at any time in the Platform Connections section; we will then stop accessing new data and delete the related access tokens.

WhatsApp Business Platform: AloChat acts as a Tech Provider on Meta’s WhatsApp Business Platform. The WhatsApp Business Account (WABA), the phone number and the billing belong to the business customer; AloChat is only authorised by the business to send and receive messages on its behalf.

Through the WhatsApp Business Platform (Cloud API) we access: the WhatsApp Business Account ID (WABA ID), the phone number ID, the display number and display name, the number’s quality rating and messaging limit; the content of messages in both directions and their attachments (images, video, audio, documents, stickers, location, contact cards); the customer’s phone number (wa_id) and the WhatsApp profile name the customer set themselves; and delivery statuses (sent, delivered, read, failed).

We use WhatsApp data only to provide the conversation management features the business asks for: showing messages to staff, automated replies, tagging and statistics. We do NOT sell WhatsApp data, do NOT use it for targeted advertising, do NOT share it with data brokers, and do NOT use customer content to train AI models. Our use of WhatsApp data complies with the Meta Platform Terms, the WhatsApp Business Messaging Policy and the Meta Developer Policies.

Images and files sent over WhatsApp can only be downloaded from Meta for 7 days, so AloChat keeps a copy in its own storage so that the business’s conversation history is not lost. That copy is deleted under the same data deletion mechanism that applies to the other channels.

The business can disconnect WhatsApp at any time in the Platform Connections section; we then stop accessing new data, delete the access token, and unsubscribe from webhooks for that account.

TikTok: when you connect a TikTok Business account, we access the following through the TikTok Business Messaging API: the business account identifier (open ID / business ID), the account display name and profile picture; the content of direct messages (DMs) in both directions together with images and file attachments; the display name, profile picture and TikTok identifier of the person messaging you; and message send and receive status.

We use TikTok data only to provide the features you ask for: showing messages to you and the staff you authorise, automated replies via scripts or AI, tagging and statistics. We do NOT sell TikTok data, do NOT use it for targeted advertising, do NOT share it with data brokers, and do NOT use TikTok message content to train or fine-tune AI models. Our use of TikTok data complies with the TikTok Developer Terms of Service, the TikTok Community Guidelines and the related TikTok platform policies.

AloChat does NOT access your videos, published content, account analytics, follower lists or comments, and does NOT access your TikTok Shop data (products, orders). The permissions we request are limited to reading and sending direct messages.

You can revoke access at any time: disconnect the channel in the Platform Connections section of AloChat, or remove the permission directly in the TikTok app under Settings and privacy → Security and permissions → Manage app permissions. We then stop accessing new data and delete the access token for that TikTok account.

Artificial intelligence (AI) processing

To generate automated replies, we send third-party AI model providers (OpenAI, Anthropic) only the content needed for that particular reply — the recent messages in the conversation and the relevant knowledge base excerpts. We do NOT send your entire conversation archive or shop data.

These providers process data under their service agreements and security commitments with us, and are NOT permitted to use your content to train their models.

AI-generated responses may not be perfectly accurate; businesses are responsible for reviewing content before relying on it for important purposes. We do not use AI to make automated decisions producing significant legal effects on individuals.

How we share information

We do NOT sell your personal information and we do NOT hand conversation content to anyone for them to exploit.

In this section, "share" means only this: data passes through the technical parties that must exist for the Service to work, within the scope and for the purpose stated on each line below.

• Messaging platforms (Facebook/Meta, WhatsApp, Zalo, Telegram, TikTok and the other channels you connect): the messages between you and your customers ALREADY originate and reside on those platforms — that is where the conversation happens. AloChat uses their official APIs to receive messages for display to you and to send your replies out. We do NOT give them any further data: no customer lists, no shop data, no conversations from other channels.
• Technical infrastructure: servers, storage, email delivery, push notifications (Google Firebase). This is where data is stored and relayed under our configuration; by contract these providers may not use the data for their own purposes.
• AI model providers (OpenAI, Anthropic): they receive only the content needed for that particular reply and may not use it to train models — see "Artificial intelligence (AI) processing" for details.
• Payment gateways (VNPay, MoMo, ZaloPay): they receive order and transaction details only, in order to collect payment. They do NOT receive conversation content.
• Legal requirements: where required by law or to protect the rights, property, and safety of us, our users, and the public. We disclose only what is within the scope requested.
• Business transfers: in a merger, acquisition, or asset transfer, data may be transferred under equivalent confidentiality commitments.

Apart from the cases above, no third party has access to your conversation content. See also "What we do NOT do with conversation content".

Notifications and marketing

We may send necessary operational notices related to your account and the Service (you cannot opt out of these while using the Service).

For marketing communications (if any), you may opt out at any time via the unsubscribe link in the email or notification settings in the app.

Retention periods

We retain information for as long as your account is active or as needed to provide the Service, comply with the law, and resolve disputes.

Account and shop data are kept for the duration of use; after account deletion, data is retained for up to 30 days (recovery window) and then permanently deleted. Technical logs and transaction records may be retained longer to meet legal or accounting obligations.

Disconnecting a channel, deleting your account and removing data

When you disconnect a channel, we delete that channel’s access token and stop receiving new data immediately. What happens to the conversation history already synced differs by channel, and the interface always states what will happen BEFORE you confirm:

• Facebook: all conversations and messages for that page are permanently deleted the moment you confirm, and cannot be recovered.
• Zalo Personal and WhatsApp: you choose whether to delete the conversation history as well, via a checkbox in the confirmation dialog. If you choose to delete, all conversations, messages and stored images/files for that channel are permanently removed and cannot be recovered. For WhatsApp we also unsubscribe from webhooks so that Meta stops sending your customers’ messages to our systems.
• Other channels (Zalo OA, Telegram, TikTok and others): the conversation history is KEPT so you can look it up and reuse it if you reconnect the channel. If you want it removed, delete the conversations in the app or send a request to [email protected].

You can delete your account directly in the app (Profile → Delete account) or by contacting [email protected]. On deletion, your account and the shops you own stop working IMMEDIATELY: you and your staff lose access, the channels stop receiving messages, and no one can view your data.

The underlying data is then kept for a further 30 days before permanent deletion. That window exists for your benefit: if you change your mind or deleted by accident, signing up again with the same email restores everything. After 30 days the system permanently deletes the data with no way to recover it, except data we must retain to meet legal obligations (for example accounting records).

If you do NOT want to wait 30 days and prefer immediate permanent deletion, send a request to [email protected]. We verify that you are the account holder and then delete permanently, with no recovery window.

To request deletion of Facebook- or WhatsApp-related data, you may remove the app from your Facebook settings, disconnect the channel in the Platform Connections section, or send a request to [email protected]; we will process deletion of the corresponding platform data.

To request deletion of TikTok-related data, you may remove AloChat in the TikTok app (Settings and privacy → Security and permissions → Manage app permissions), disconnect the channel in the Platform Connections section, or send a request to [email protected]; we will delete the access token and the corresponding TikTok data.

See the step-by-step guide (on the iOS/Android mobile app and on the web) at the Account deletion instructions page.

Security and breach notification

We apply reasonable technical and organizational measures to protect information: encryption in transit (HTTPS/TLS), password hashing, encryption of platform access tokens, access controls, and per-shop data isolation (multi-tenant).

No method is completely secure; we cannot guarantee absolute security but commit to responding promptly and notifying you and the competent authorities (where required by law) in the event of an incident affecting personal data.

Your rights

Depending on applicable law, you may have the right to access, correct, export, restrict, or delete your personal data, object to processing, and withdraw consent.

You can edit your profile, change your password, manage platform connections, and delete your account directly in the app, or send a request to [email protected]. We will respond within a reasonable time as required by law (typically within 30 days).

Children's privacy

The Service is intended for businesses and users aged 16 or older. We do not knowingly collect data from children under this age. If you believe a child has provided us with data, please contact us so we can delete it.

International data transfers

Data may be processed or stored on servers located in countries other than where you reside (for example, AI providers or cloud infrastructure). In such cases, we apply appropriate safeguards as required by law.

Third-party links and services

The Service may contain links to third-party websites or services (messaging platforms, payment gateways). This Policy does not apply to them; please review each party’s own policy.

Complaints

If you believe our processing of your data is not appropriate, please contact us first at [email protected] so we can resolve it under the Complaint, Request and Feedback Handling Procedure. You also have the right to lodge a complaint with the competent data protection/regulatory authority under applicable law.

Changes to this policy

We may update this Policy from time to time. When there are material changes, we will notify you via the app or email. The "Last updated" date at the top reflects the current version.

Contact us

If you have questions or requests regarding privacy, please contact:

• Operator: KVGPAY GLOBAL COMPANY LIMITED
• Tax code (MST): 0110843806
• Address: 5th Floor, No. 23, Alley 16, Van Phu Street, Kien Hung Ward, Hanoi City, Vietnam
• Email: [email protected]
• Website: https://alochat.vn