Privacy Policy

Effective Date: November 5, 2026 | Version: 2.0

This Privacy Policy describes how ScapBot Technology Joint Stock Company ("ScapBot", "we", "Platform") collects, uses, stores, shares, and protects your personal data when you use our services at https://scapbot.ai. It applies to Users and End Customers wherever they are located.

ScapBot is a company incorporated in Vietnam, and Vietnamese law is the home legal framework for our processing of personal data, including the Law on Personal Data Protection 2025 (No. 91/2025/QH15) and its implementing Decree 356/2025/ND-CP, and the Cybersecurity Law 2025 (No. 116/2025/QH15) and its implementing Decree 333/2026/ND-CP. Because our Users and their End Customers are located in many countries, we also comply with the data protection laws that apply to our processing in the jurisdictions where they are located. Region-specific information is set out in Section 13 (Regional Provisions).

1. Data Controller

ScapBot Technology Joint Stock Company is the Data Controller with respect to the personal data of Users (business owners who register to use ScapBot).

• Legal entity: ScapBot Technology Joint Stock Company, a company incorporated in Vietnam
• Enterprise Registration No.: 0110646734, issued by the Hanoi Department of Planning and Investment on 12 March 2024
• Registered office: Villa 1B10, My Dinh 1 Urban Area, Tu Liem Ward, Hanoi, Vietnam
• Privacy email: privacy@scapbot.ai
• Support email: support@scapbot.ai
• Website: https://scapbot.ai

For End Customer data (consumers who send messages to businesses through ScapBot), ScapBot acts as the Data Processor — see details in Section 3.

In this Policy, "Data Controller" and "Data Processor" have the meanings given to them under Vietnamese law and correspond to the equivalent roles under other applicable laws (for example, "controller" and "processor" under the GDPR, "business" and "service provider" under U.S. state privacy laws, and "personal information handler" and "entrusted party" under the PIPL of the People's Republic of China).

2. Personal Data We Collect

2.1. Data You Provide Directly

2.2. Automatically Collected Data

2.3. Payment Data

Note: ScapBot does not store credit/debit card information. International payments are processed through PayPal and Polar (polar.sh) — card data is handled by these payment providers under PCI-DSS standards. When you pay by card through Polar, Polar's terms and privacy policy may also apply to the card transaction. The top-up methods available to you are those shown on the Wallet top-up page at the time of top-up.

2.4. Business Data

When using the Service, you may upload or create:

• Product information (name, description, price, images)
• Business documents (FAQs, policies, sales scripts)
• AI Assistant configuration (name, industry, response style)
• Staff information (email, access permissions)

This is data you fully control. We process this data solely for the purpose of providing the Service.

2.5. Data from Google

a) Google Sign-In

If you log in via Google, we collect:

• Google account ID (identifier, not password)
• Email linked to the Google account
• Display name and profile picture (if available)

This data is used solely to create and authenticate your ScapBot account.

b) Google Drive Sync (optional)

If you choose to connect Google Drive to sync documents into your AI Assistant's Documents page, we collect:

Google Drive commitments:

• We only access your Drive in read-only mode — we do not modify, move, or delete any files on your Google Drive.
• We only access the files and folders you actively select to sync — we do not scan your entire Drive.
• File content is downloaded, encrypted (AES-256-GCM), and stored on ScapBot servers (Cloudflare R2).
• You can disconnect Google Drive at any time — all synced data will be deleted from ScapBot's system.
• You can also revoke access at myaccount.google.com/permissions.

We do not access your contacts, calendar, Gmail, or any other Google data beyond the scope you authorize.

c) Limited Use of Google User Data

ScapBot's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. In particular, data received through Google Sign-In and the Google Drive API:

• is used only to provide the features described in this Section 2.5 — signing in to your ScapBot account and syncing the files you select into your AI Assistant's Knowledge Base;
• is transferred to third parties only where necessary to provide those features (for example, to the AI provider listed in Section 5.1 when your AI Assistant processes your synced documents), to comply with applicable law, or as part of a merger, acquisition or sale of assets;
• is never used or transferred for serving advertisements, is never sold, and is never used to determine creditworthiness or for lending purposes;
• is not read by humans unless you give your affirmative agreement for specific files, it is necessary for security purposes (such as investigating abuse) or to comply with applicable law, or the data has been aggregated and anonymized for internal operations;
• is not used to develop, improve or train generalized artificial intelligence or machine-learning models.

3. End Customer Data

3.1. ScapBot as Data Processor

When End Customers (consumers) send messages to your business through connected messaging platforms, ScapBot collects and processes:

3.2. AI Analysis of End Customers

ScapBot uses AI to analyze End Customer messages to:

• Identify intent (price inquiry, complaint, order placement, etc.)
• Assess psychological state (interest level, satisfaction level)
• Classify customer stage (lead, prospect, customer, repeat, etc.)
• Recommend relevant products/services

This analytical data is under the control of the User (business). Users are responsible for informing End Customers about AI usage as required by law.

3.3. User Responsibilities

As the Data Controller for End Customer data, you are obligated to:

• Have your own privacy policy informing End Customers about the use of ScapBot.
• Have a lawful legal basis for collecting and processing End Customer data.
• Cooperate with ScapBot when End Customers exercise their data rights.

3.4. Facebook Messenger Profile Data (Business Asset User Profile Access)

When End Customers send messages to a Facebook Page connected to ScapBot, we read the following profile fields through Meta's "Business Asset User Profile Access" feature, strictly within the scope of the connected business asset:

Storage and retention specific to Facebook profile data:

• The avatar image is downloaded once and re-hosted on Cloudflare R2 for instant loading. The cache is signed with a presigned URL valid for 7 days, matching the original Facebook CDN TTL, and is automatically refreshed on the next inbound message from the same customer or after 24 hours, whichever comes first.
• The name, id, and ids_for_business fields are stored in the connected business's database partition only — never aggregated across businesses, never indexed for cross-business search.
• When the business disconnects or removes the Facebook Page in ScapBot Dashboard → Performance → Connect → Sales Skill → Messaging Platforms → Facebook, ScapBot stops all access to that Page immediately. Facebook profile data already received stays in the business's database partition so its history is kept if it reconnects, and is deleted when the business deletes its ScapBot account (Section 15.2) or at any time on request (Section 15.1).
• Facebook profile data is never used for advertising, never sold, never licensed, never shared with any third party, and is visible only to the staff of the specific business that connected the Page.
• Facebook profile data is excluded from any AI model training pipeline — names and avatars are display-only and are not part of the data used to improve AI quality.

Compliance reference: This usage falls within the "in-app business experience" scope defined by Meta for the Business Asset User Profile Access feature (Meta Developer Documentation).

3.5. TikTok Account Data (TikTok API for Business)

When a business connects its TikTok Business Account to ScapBot (Dashboard → Performance → Connect → Sales Skill → Messaging Platforms → TikTok), it authorizes ScapBot on TikTok's authorization screen. Within the permissions the business grants, we access:

Storage and retention specific to TikTok data:

• TikTok data is stored in the connected business's partition only, is visible only to that business's staff, and is never sold, licensed or used for advertising.
• When the business disconnects its TikTok account, ScapBot stops all access to TikTok immediately. Data already received stays in the business's workspace so its history is kept if it reconnects.
• TikTok data is deleted when the business deletes its ScapBot account (Section 15.2), or at any time on request (Section 15).

4. Purposes of Data Processing

We process your personal data for the following purposes:

4.1. Legal Bases for Processing

Where the law applicable to you requires a legal basis for processing personal data, we rely on the following bases, as indicated for each purpose in the table above:

• Performance of contract — processing necessary to provide the Service under our Terms of Service, or to take steps at your request before entering into them: providing and operating the Service, account authentication and session security, payment processing and reconciliation, and sending service notifications (OTP, security, maintenance).
• Consent — sending product information and promotions, and advertising effectiveness measurement through the Meta Pixel and advertising cookies (Sections 5.4 and 10). You may withdraw your consent at any time (Section 9.4).
• Legitimate interests — account and session security; fraud, spam and abuse detection and system protection; improving Service quality; improving AI models using aggregated, anonymized data; and website traffic analysis (Google Analytics). Our interests are keeping the Service secure and reliable, preventing abuse, and improving our products. We do not rely on these interests where your interests or fundamental rights override them, and you may object to this processing (Section 9.8).
• Legal obligation — payment processing and reconciliation records required by accounting and tax law, and complying with requests from competent government authorities (Section 5.3).

Some laws — for example, those of Vietnam and the People's Republic of China — do not recognize legitimate interests as a general legal basis. Where such a law applies to you, we rely on another basis that it provides, such as the performance of a contract with you, compliance with a legal obligation, or your consent, and we obtain your consent where that law requires it (see Section 13).

For End Customer data (Section 3), the business that uses ScapBot is the Data Controller and is responsible for having a lawful legal basis (Section 3.3); ScapBot processes that data on the business's instructions.

5. Sharing Data with Third Parties

5.1. Service Providers

We share data with the following third parties to operate the Service:

5.2. Cross-Border Data Transfer

Where your data is stored. ScapBot is established in Vietnam. Personal data processed through the Service is stored on servers located in Vietnam (see also Section 6.3), and files such as documents and images are stored with Cloudflare R2 (Section 5.1). If you are located outside Vietnam, your personal data is therefore transferred to Vietnam.

Where service providers process data. Some service providers have servers located outside Vietnam. The service providers listed in Section 5.1 may process personal data in other countries, as shown in the "Country" column of that table:

• United States: Google (Gemini AI, Drive API, Google Analytics), Facebook/Meta (Messenger Platform, Meta Pixel), WhatsApp (Meta) and PayPal;
• Japan: Line;
• Luxembourg: Viber (Rakuten);
• United Arab Emirates and the other countries where Telegram operates: Telegram;
• Vietnam: Zalo (VNG);
• The countries where that provider operates: Cloudflare (R2) and TikTok, which are listed as "Global", and Polar (polar.sh);

These countries may not provide the same level of data protection as the country where you live.

Safeguards. Data transferred abroad is limited to the scope necessary for operating the Service. Where the law applicable to you requires safeguards for these transfers, we will rely on appropriate safeguards — such as contractual safeguards with the recipient, including standard contractual clauses adopted or approved by the competent authority — or on another transfer basis permitted by that law (for example, your consent, or the necessity of the transfer to perform our contract with you). You may request information about the safeguards that apply to your data at privacy@scapbot.ai. Region-specific information is set out in Section 13.

Vietnam. In accordance with the Law on Personal Data Protection 2025, the Cybersecurity Law 2025 and Decree 333/2026/ND-CP:

• We maintain a copy of Vietnamese users' personal data on servers in Vietnam.
• Data transferred abroad is limited to the scope necessary for operating the Service.
• We have prepared a Cross-Border Data Transfer Impact Assessment as required by regulation.

5.3. Government Authorities

We may provide data to competent government authorities upon written request in accordance with applicable law.

5.4. Scope of Meta Pixel and Other Advertising Cookies

Meta Pixel and equivalent advertising cookies are loaded only on our public marketing pages (the homepage, blog, pricing pages on https://scapbot.ai) to measure the effectiveness of our own marketing campaigns. They are strictly excluded from:

• The authenticated application area (any page under /{lang}/assistants/..., /{lang}/dashboard, etc.)
• Any data flow involving End Customer profile information (Facebook Messenger names, avatars, PSIDs, conversations, CRM records)
• Any data exchange with the messaging platforms (Facebook, TikTok, Zalo, Telegram, WhatsApp, Viber, Line)

End Customer data is therefore never used to power advertising, regardless of whether the Meta Pixel is enabled on our marketing pages.

5.5. Commitment

We do not sell, rent, or trade your personal data — whether yours as a User or that of any End Customer who messages your business — to any third party for commercial purposes.

6. AI Data Processing

6.1. Data Sent to AI Models

When AI processes messages, the following data is sent to the AI provider (Google Gemini):

• End Customer message content (including TikTok comments and direct messages received through a connected TikTok account)
• Conversation context (recent messages)
• Related product/document information
• AI Assistant response configuration

6.2. AI Commitments

• Data sent to AI is processed according to the AI provider's privacy policy.
• ScapBot does not use personally identifiable data to train AI models.
• Data used to improve AI is in aggregated, anonymized form (conversation patterns containing no personal information).
• You have the right to turn off AI mode at any time — when disabled, no data is sent to AI models.

6.3. Vector Embedding

ScapBot converts documents and images into vector representations (embeddings) for semantic search purposes. Vector embeddings:

• Cannot be reverse-converted back to original content.
• Are stored alongside original data on servers in Vietnam.
• Are deleted when you delete the corresponding document or product.

7. Security Measures

7.1. Technical Security

7.2. Organizational Security

• Data access follows the principle of least privilege.
• All system access is logged (audit log).
• Data isolation between Users (multi-tenant isolation — all queries scoped via assistant_id).

7.3. Data Breach Response

In the event of a personal data breach:

1. Within 72 hours of discovery: Notify the specialized personal data protection authority — the Department of Cybersecurity and High-Tech Crime Prevention (A05), Ministry of Public Security — as required by the Law on Personal Data Protection 2025 and Decree 356/2025/ND-CP.
2. As soon as possible: Notify affected Users via email, clearly stating: scope of breach, data affected, remediation measures, and contact point.
3. Remediation: Implement containment and remediation measures immediately.

Where the data protection laws of other jurisdictions apply to a breach (Section 13), we will also notify the competent supervisory authorities and affected individuals within the time limits and in the manner those laws require.

8. Data Retention Periods

After service termination, you have 30 days to export your data. After this period, personal data will be permanently deleted, unless legally required to retain longer.

9. Your Data Rights

Under the Law on Personal Data Protection 2025 and Decree 356/2025/ND-CP, which govern our processing as a company established in Vietnam, you have the following rights, subject to the exceptions provided by law. If you are located outside Vietnam, you also have the rights granted by the data protection law of your country, as described in Section 13 (Regional Provisions).

9.1. Right to Be Informed

You have the right to be informed about the processing of your personal data, including the types of data, purposes, and processing methods.

9.2. Right to Consent

You have the right to consent or not consent to the processing of your personal data, except where otherwise provided by law.

9.3. Right of Access

You have the right to request a copy of your personal data that we hold.

9.4. Right to Withdraw Consent

You have the right to withdraw consent previously given. Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal.

9.5. Right to Erasure

You have the right to request the deletion of your personal data, unless we have a legal obligation to retain it.

9.6. Right to Restrict Processing

You have the right to request restriction of processing of your personal data in certain circumstances.

9.7. Right to Data Portability

You have the right to receive your personal data in a structured, commonly used, and machine-readable format.

9.8. Right to Object

You have the right to object to the processing of your personal data for direct marketing purposes or processing based on legitimate interests.

9.9. Right to Complain

You have the right to file a complaint with ScapBot or the competent government authority (the Department of Cybersecurity and High-Tech Crime Prevention (A05), Ministry of Public Security) if you believe your personal data has been processed unlawfully. If you are located outside Vietnam, you may also lodge a complaint with the data protection authority of your country (Section 13).

9.10. Right to Compensation

You have the right to seek compensation for damages when your personal data has been processed in violation of the law.

How to exercise your rights: Send a request to privacy@scapbot.ai with identity verification information. We will respond within 15 business days. Where the law applicable to you sets a shorter time limit, we respond within that time limit.

9.11. Rights of End Customers (Facebook Messenger and TikTok Users)

If you are a Facebook user who messaged a Facebook Page connected to ScapBot and want to access, correct, or delete the profile data we hold about you, you may exercise your rights through any of the following channels:

Channel A — Email request to ScapBot directly:

1. Email privacy@scapbot.ai with subject line "Data Deletion Request — Facebook Messenger".
2. Include either (a) your Facebook Page-Scoped User ID (PSID), or (b) the name of the Facebook Page you messaged, plus the approximate date range.
3. We process the request within 30 days and email you a confirmation.

Channel B — Ask the business that operates the Page: The business is the Data Controller for your conversation. You may ask the business to submit a deletion request for your data to ScapBot (privacy@scapbot.ai). Note: if the business only disconnects the Page, ScapBot stops accessing it but does not automatically delete data already received.

Channel C — Step-by-step guide: A complete walkthrough — including the exact email template, how to ask the business to submit a deletion request, identity verification, and appeals — is in Section 15 below.

TikTok users: If you commented on or messaged a business's TikTok account connected to ScapBot, email privacy@scapbot.ai with the subject "Data Deletion Request — TikTok", including your TikTok username, the business's TikTok username and the approximate dates. We process the request within 30 days and email you a confirmation. You may also ask the business to delete your conversation. Full steps are in Section 15.1b.

10. Cookies

10.1. Cookies We Use

10.2. Managing Cookies

• Essential cookies are required for the Service to function — they cannot be disabled.
• Functional cookies can be managed through your browser settings.
• Analytics cookies (Google Analytics) collect anonymized data to improve your experience. You may opt out via Google Analytics Opt-out.
• Advertising cookies (Meta Pixel) are only activated with your consent via the cookie consent banner. You may withdraw consent at any time through the cookie settings on our website or via Facebook Ad Preferences.

11. Minors

ScapBot is not intended for individuals under 18 years of age. We do not knowingly collect personal data from minors. If you discover that we have inadvertently collected data from a person under 18, please contact us immediately at privacy@scapbot.ai so that we can delete such data.

12. Changes to This Policy

• We may update this Privacy Policy. Material changes will be communicated via email at least 30 days in advance.
• The latest version is always available at https://scapbot.ai/en/privacy.
• Change history is recorded at the bottom of this page.

13. Regional Provisions

This Section supplements the rest of this Policy for individuals located in the regions below. If it conflicts with another part of this Policy, this Section prevails for individuals in that region to the extent required by local law. To exercise any right described here, email privacy@scapbot.ai; we verify your identity as described in Section 15.4.

If you are an End Customer, the business you contacted is the Data Controller of your data (Section 3). You may contact that business directly, or contact us as described in Sections 9.11 and 15, and we will handle your request or assist the business in handling it.

13.1. European Economic Area, United Kingdom and Switzerland

If you are located in the European Economic Area (EEA), the United Kingdom or Switzerland, the General Data Protection Regulation (EU) 2016/679 (GDPR), the UK GDPR and the Data Protection Act 2018, or the Swiss Federal Act on Data Protection (FADP), as applicable, apply in addition to this Policy:

• Controller and processor. ScapBot is the controller of User account data (Section 1) and a processor of End Customer data, which it processes on behalf of, and on the instructions of, the business that is the controller (Section 3).
• Legal bases. We rely on the legal bases described in Section 4.1: performance of a contract (Art. 6(1)(b) GDPR), consent (Art. 6(1)(a)), legitimate interests (Art. 6(1)(f)) and legal obligation (Art. 6(1)(c)). Where we comply with obligations under laws other than EU, EEA Member State, UK or Swiss law (for example, Vietnamese accounting law or requests from Vietnamese authorities), we rely on our legitimate interest in complying with those obligations.
• Your rights. You have the rights of access, rectification, erasure, restriction of processing, data portability and objection (including an absolute right to object to direct marketing), the right to withdraw consent at any time, and rights in relation to decisions based solely on automated processing that produce legal or similarly significant effects concerning you.
• Complaints. You have the right to lodge a complaint with a supervisory authority — in particular in the EEA Member State of your habitual residence, place of work or place of the alleged infringement; in the United Kingdom, with the Information Commissioner's Office (ICO); and in Switzerland, with the Federal Data Protection and Information Commissioner (FDPIC).
• International transfers. Your personal data is transferred to Vietnam and to the other countries listed in Section 5.2. Where a transfer is made to a country that the European Commission, the UK Government or the Swiss Federal Council, as applicable, has not recognized as providing an adequate level of protection, we will rely on the European Commission's Standard Contractual Clauses (with the UK International Data Transfer Addendum or the Swiss adaptations, as applicable) or on another transfer mechanism permitted by law. You may request a copy of the relevant safeguards at privacy@scapbot.ai.
• Representative. Where Article 27 of the GDPR or of the UK GDPR, or the FADP, requires us to designate a representative, we will do so and publish the representative's contact details in this Policy.
• Response time. We respond within 15 business days (Section 9) and in any event within the time limits set by the GDPR, the UK GDPR or the FADP.

13.2. United States

If you are a resident of a U.S. state with a comprehensive consumer privacy law — such as the California Consumer Privacy Act as amended by the California Privacy Rights Act (CCPA/CPRA) — the following applies to you:

• Categories collected. We collect, and in the preceding 12 months have collected, the following categories of personal information, from the sources and for the purposes described in Sections 2 to 4: identifiers (name, email address, account ID, IP address, cookie and device identifiers); customer records (name, email address and, where provided, phone number); commercial information (top-up codes and transaction history); internet or other electronic network activity (activity logs and, on our marketing pages, browsing data collected through Google Analytics and the Meta Pixel); approximate geolocation derived from IP address; audio or visual information (avatar images and images you upload); professional or business information (business data and staff information); and account log-in credentials (email and password), which are sensitive personal information that we use only to authenticate you and secure your account. We retain each category as set out in Section 8 and disclose personal information for business purposes to the service providers listed in Section 5.1.
• Sale and sharing. We do not sell personal information for money, and we never sell or share End Customer data or data from the authenticated application area (Section 5.4). The only disclosure that may be considered a "sale" or "sharing" of personal information for cross-context behavioral advertising, or "targeted advertising", under some state laws is the Meta Pixel and related advertising cookies (_fbp, _fbc) on our public marketing pages, which are activated only with your consent (Sections 5.4 and 10). You may opt out at any time by declining or withdrawing consent in the cookie settings on our website; where required by law, we will also treat a legally recognized opt-out preference signal (such as Global Privacy Control) as a request to opt out. We do not knowingly sell or share the personal information of consumers under 16 years of age.
• Your rights. Subject to verification and the exceptions provided by law, you have the right to know what personal information we have collected about you (including the categories and specific pieces), to delete it, to correct inaccurate personal information, to opt out of the sale or sharing of personal information and of targeted advertising, and to limit the use of sensitive personal information (which we use only for purposes that the law does not allow you to limit).
• How to exercise and appeal. Email privacy@scapbot.ai. We verify your identity as described in Sections 9 and 15.4 and respond within the time limits required by law. If we decline your request, you may appeal by replying to our response; if your appeal is denied, you may contact the Attorney General of your state.
• Authorized agents. You may use an authorized agent to submit a request on your behalf. We may require the agent to provide your signed written permission and may ask you to verify your identity directly with us, unless the agent holds a valid power of attorney.
• Non-discrimination. We will not discriminate against you for exercising any of these rights, for example by denying you the Service, charging you different prices or providing a different level of quality.
• End Customer data. When we process End Customer data on behalf of a business (Section 3), we act as that business's service provider or processor. Requests should be directed to the business, and we will assist it as required by law; you may also contact us as described in Sections 9.11 and 15.

13.3. Japan

If you are located in Japan, the Act on the Protection of Personal Information (APPI) applies in addition to this Policy:

• Purposes of use. We use personal information only for the purposes set out in Section 4 (as described further in Sections 2, 3 and 6), and we will not handle it beyond the scope necessary to achieve those purposes without your consent, except as permitted by the APPI.
• Provision to third parties. We do not provide personal data to third parties without your prior consent, except as permitted by the APPI — for example, where we entrust the handling of personal data to the service providers listed in Section 5.1 within the scope necessary to achieve the purposes of use, or where provision is required by law (Section 5.3).
• Provision to third parties in foreign countries. Your personal data is provided to and stored in Vietnam, where ScapBot is established, and may be provided to service providers in the United States, Luxembourg and the United Arab Emirates, and in the other countries where Cloudflare, TikTok, Telegram and Polar operate (Section 5.2). Where the APPI requires your consent to such provision, we will obtain it after providing the information the APPI requires; on request, we will provide information about the personal information protection system of the recipient's country and the measures the recipient takes to protect personal data.
• Security control measures. We take the technical and organizational security control measures described in Section 7, including access control under the principle of least privilege, audit logging, encryption in transit and document encryption, and isolation of each business's data. Because personal data is stored in Vietnam, we implement these measures with an understanding of Vietnam's personal data protection system (Section 13.10).
• Your requests. You may request notification of the purposes of use, disclosure of your retained personal data (including records of provision to third parties), its correction, addition or deletion, suspension of its use or its erasure, and suspension of its provision to third parties, by emailing privacy@scapbot.ai.
• Business operator. ScapBot Technology Joint Stock Company, Villa 1B10, My Dinh 1 Urban Area, Tu Liem Ward, Hanoi, Vietnam. The name of our representative is available on request at privacy@scapbot.ai.
• Inquiries and complaints. Please contact privacy@scapbot.ai. You may also contact the Personal Information Protection Commission of Japan.

13.4. Republic of Korea

If you are located in the Republic of Korea, the Personal Information Protection Act (PIPA) applies in addition to this Policy:

• Items collected, purposes and retention. The items of personal information we collect are listed in Sections 2 and 3, the purposes of processing in Section 4, and the retention periods in Section 8. When a retention period expires or the purpose of processing has been achieved, we destroy the personal information without delay by permanently deleting it, unless retention is required by law (Sections 8 and 15.2).
• Entrustment and provision to third parties. We entrust processing to the service providers listed in Section 5.1, for the tasks described there. We provide personal information to third parties only with your consent or as permitted by law (Section 5.3).
• Overseas transfer. When you use the Service, personal information is transferred over encrypted connections (HTTPS/TLS): (i) to Vietnam, where it is stored by ScapBot Technology Joint Stock Company (privacy@scapbot.ai) for the purposes in Section 4 and for the periods in Section 8; and (ii) to the service providers listed in Section 5.1, in the countries, for the items and for the purposes stated in that table and in Section 5.2, for the period necessary for each provider to perform its service. These transfers are necessary to provide the Service under our contract with you. You may refuse a transfer by not connecting the relevant channel or feature, or by deleting your account (Section 15.2); if you refuse a transfer that is necessary for the Service, you may be unable to use all or part of the Service.
• Your rights. You, or your legal representative or an authorized agent, may request access to, correction or deletion of, or suspension of the processing of your personal information, and may withdraw consent, by emailing privacy@scapbot.ai.
• Cookies. We use cookies as described in Section 10. You may refuse non-essential cookies through your browser settings or our cookie settings; essential cookies are required for the Service to function.
• Security measures. Our technical and organizational measures are described in Section 7.
• Privacy officer. The person responsible for personal information protection can be contacted at privacy@scapbot.ai. Where PIPA requires us to designate a domestic representative in Korea, we will do so and publish the representative's contact details in this Policy.
• Remedies. You may apply for dispute mediation to the Personal Information Dispute Mediation Committee, or report an infringement to the Personal Information Infringement Report Center operated by the Korea Internet & Security Agency (KISA).

13.5. People's Republic of China

If you are located in mainland China, the Personal Information Protection Law (PIPL) applies in addition to this Policy:

• Roles and legal bases. ScapBot is the personal information handler for User account data, and processes End Customer data as an entrusted party of the business that uses ScapBot (Section 3). We process personal information on the bases permitted by the PIPL, including your consent and the necessity of processing to conclude or perform a contract with you or to fulfill legal obligations; we do not rely on legitimate interests (Section 4.1).
• Separate consent. Where the PIPL requires your separate consent — for example, for providing your personal information outside the PRC, for processing sensitive personal information, or for providing your personal information to another personal information handler — we will obtain it before that processing.
• Cross-border provision. Because personal data is stored on servers in Vietnam, using the Service involves providing your personal information outside the PRC. Overseas recipients: ScapBot Technology Joint Stock Company (Vietnam; privacy@scapbot.ai) and the service providers listed in Section 5.1, in the countries indicated in Section 5.2. Purposes and methods of processing: Sections 4, 5.1 and 6. Categories of personal information: Sections 2, 3 and 5.1. You may exercise your rights under the PIPL against any overseas recipient by contacting privacy@scapbot.ai. Where required, we will comply with the PIPL's conditions for outbound transfers of personal information (such as the standard contract for the outbound transfer of personal information).
• Sensitive personal information. Some information described in this Policy may be sensitive personal information under the PIPL (for example, financial account or transaction information, or information that End Customers choose to include in messages). We process it only for the specific purposes described in this Policy where strictly necessary, with the protective measures described in Section 7, and with your separate consent where the PIPL requires it. The Service is not intended for persons under 18 (Section 11), and we do not knowingly process the personal information of minors under 14.
• Your rights. You have the right to know about and decide on the processing of your personal information; to restrict or refuse its processing; to access and copy it; to request its transfer to another personal information handler where the conditions set by the competent authority are met; to correct, supplement and delete it; to withdraw consent; and to request an explanation of our personal information processing rules. Exercise these rights at privacy@scapbot.ai.
• Representative. Where the PIPL requires us to establish a dedicated entity or designate a representative within the PRC, we will do so and report their details to the competent authority as required.
• Complaints. You may lodge a complaint with the competent personal information protection authority.

13.6. Thailand

If you are located in Thailand, the Personal Data Protection Act B.E. 2562 (2019) (PDPA) applies in addition to this Policy:

• Legal bases. We process personal data on the bases described in Section 4.1 — contract, consent, legitimate interests and legal obligation — which correspond to bases recognized by the PDPA. We obtain explicit consent where the PDPA requires it, including for sensitive personal data.
• Your rights. You have the right to withdraw consent; to access and obtain a copy of your personal data and to request disclosure of how it was obtained where you did not consent; to data portability; to object to processing; to request the erasure, destruction or anonymization of your personal data; to restrict processing; and to have your personal data corrected and kept accurate, up to date and complete.
• Cross-border transfers. Your personal data is transferred to Vietnam and to the countries listed in Section 5.2. Where the destination country does not have adequate data protection standards, we will transfer personal data only on a basis permitted by the PDPA, such as appropriate safeguards, the necessity of the transfer to perform our contract with you, or your consent.
• Representative and data protection officer. Where the PDPA requires us to designate a representative in Thailand or to appoint a data protection officer, we will do so and publish their contact details in this Policy.
• Breach notification. We notify the Office of the Personal Data Protection Committee, and notify you where required, within the time limits set by the PDPA (Section 7.3).
• How to exercise and complain. Email privacy@scapbot.ai. You may also lodge a complaint with the Personal Data Protection Committee.

13.7. Indonesia

If you are located in Indonesia, Law No. 27 of 2022 on Personal Data Protection (the "PDP Law") applies in addition to this Policy:

• Legal bases. We process personal data on the bases provided by the PDP Law, including your explicit consent, the performance of a contract with you, compliance with legal obligations, and legitimate interests, as mapped in Section 4.1.
• Your rights. You have the right to obtain information about the identity of the controller, the legal basis and the purposes of processing; to complete, update and correct your personal data; to access and obtain a copy of it; to end its processing and to have it deleted or destroyed; to withdraw consent; to object to decisions based solely on automated processing, including profiling, that have legal effects or significantly affect you; to delay or restrict processing; to obtain your personal data in a commonly used, machine-readable format and transmit it to another controller; and to sue and receive compensation for violations.
• Cross-border transfers. Your personal data is transferred to Vietnam and to the countries listed in Section 5.2. We will make such transfers only as permitted by the PDP Law — to a country with an equal or higher level of personal data protection, subject to adequate and binding safeguards, or with your consent.
• Time limits. Where the PDP Law and its implementing regulations set shorter time limits than those stated in Sections 7.3 and 9 for responding to your requests or for notifying a personal data breach, we comply with those shorter time limits.
• How to exercise and complain. Email privacy@scapbot.ai. You may also lodge a complaint with the authority designated to supervise personal data protection under the PDP Law.

13.8. Cambodia

• As of the Effective Date of this Policy, Cambodia does not have a comprehensive personal data protection statute in force.
• We apply the protections of this Policy, including the rights described in Section 9, to individuals in Cambodia.
• We comply with the applicable laws of Cambodia, such as the Law on Electronic Commerce (2019) and the Law on Consumer Protection (2019).
• Your personal data is transferred to Vietnam and to the countries listed in Section 5.2, with the safeguards described there.
• If Cambodia adopts a personal data protection law, we will update this Policy as that law requires.
• To exercise your rights or ask a question, email privacy@scapbot.ai.

13.9. Lao PDR

If you are located in the Lao People's Democratic Republic, the Law on Electronic Data Protection (2017) applies in addition to this Policy:

• We collect, use and disclose your electronic data only for the purposes described in Section 4 and, where the Law requires it, with your consent.
• Where the Law requires your consent before your electronic data is disclosed or transferred to a third party, including a recipient outside the Lao PDR (Sections 5.1 and 5.2), we will obtain it.
• You may request access to, correction of, or deletion of your electronic data, and may withdraw your consent, by emailing privacy@scapbot.ai.
• We protect your electronic data with the technical and organizational measures described in Section 7.
• Where the Law requires notification of a data breach, we will notify the competent authority and affected individuals as required (Section 7.3).

13.10. Vietnam

ScapBot is incorporated in Vietnam, and Vietnamese law is the home legal framework for our processing of personal data:

• Applicable law. The Law on Personal Data Protection 2025 (No. 91/2025/QH15) and Decree 356/2025/ND-CP detailing it, and the Cybersecurity Law 2025 (No. 116/2025/QH15) and Decree 333/2026/ND-CP detailing it.
• Your rights. You have the rights described in Sections 9.1 to 9.10: the rights to be informed, to consent, of access, to withdraw consent, to erasure, to restrict processing, to data portability, to object, to complain and to compensation. We respond to requests sent to privacy@scapbot.ai within 15 business days (Section 9).
• Data stored in Vietnam. We maintain a copy of Vietnamese users' personal data on servers in Vietnam (Section 5.2).
• Impact assessment. We have prepared a Cross-Border Data Transfer Impact Assessment as required by regulation (Section 5.2).
• Data breaches. We notify the Department of Cybersecurity and High-Tech Crime Prevention (A05), Ministry of Public Security no later than 72 hours after discovering a breach, as required by the Law on Personal Data Protection 2025 (Section 7.3).
• Retention. Account data (such as account name, period of use, email, phone number and the most recent login and logout IP addresses) is stored in Vietnam as required by the Cybersecurity Law 2025 and Decree 333/2026/ND-CP; where a competent authority requests retention, the data concerned is kept for at least 24 months. Transaction history is kept as required by accounting and tax law (Sections 8 and 15.2).
• Complaints. You may file a complaint with ScapBot or with the Department of Cybersecurity and High-Tech Crime Prevention (A05), Ministry of Public Security (Sections 9.9 and 15.5).

14. Contact

If you have questions about this Privacy Policy or wish to exercise your data rights:

• Data Controller: ScapBot Technology Joint Stock Company
• Registered office: Villa 1B10, My Dinh 1 Urban Area, Tu Liem Ward, Hanoi, Vietnam
• Privacy email: privacy@scapbot.ai
• Support email: support@scapbot.ai
• Website: https://scapbot.ai

15. Data Deletion Instructions

This section is the public Data Deletion instructions referenced in our Meta Developer App settings. The instructions are organized by who you are: an end customer who messaged a Facebook Page connected to ScapBot, a TikTok user who commented on or messaged a TikTok account connected to ScapBot (Section 15.1b), or a business user with a ScapBot account.

15.1. For End Customers (Facebook Messenger Users)

You sent a message to a Facebook Page that is connected to ScapBot. The business operating that Page is the Data Controller; ScapBot acts as the Data Processor on the business's behalf. You have two channels to request deletion (A, B) and one way to revoke access (C).

Channel A — Email request to ScapBot directly

This is the recommended path if you cannot reach the business or want a paper trail.

1. Send an email to privacy@scapbot.ai with the exact subject line: Data Deletion Request — Facebook Messenger
2. Include in the body either of the following identifiers (either one is sufficient):
   • Your Facebook Page-Scoped User ID (PSID) — a numeric identifier visible in your conversation with the Page (advanced users), or
   • The name of the Facebook Page you messaged, plus the approximate date range when you messaged it
3. We acknowledge receipt within 3 business days and complete the deletion within 30 calendar days. You receive a confirmation email when the deletion is complete.

Email template (copy-paste):

To: privacy@scapbot.ai
Subject: Data Deletion Request — Facebook Messenger

Hello,

I am a Facebook user who messaged the Page "[NAME OF THE PAGE]"
between approximately [START DATE] and [END DATE].

I request that ScapBot delete all personal data it holds about
me, including my name, profile picture, Page-Scoped User ID,
and any conversation history collected on behalf of that
business.

[Optional: PSID = ...]

Thank you.

[Your Facebook display name]

Channel B — Ask the business operating the Page

The business is the Data Controller. If you trust the business, you can ask them to submit a deletion request for your data to ScapBot at privacy@scapbot.ai (using the email template in Channel A, with the Page name and the approximate date range). ScapBot handles it like Channel A: acknowledgement within 3 business days, deletion completed within 30 calendar days.

Note: when the business disconnects or removes the Page (Dashboard → Performance → Connect → Sales Skill → Messaging Platforms → Facebook), ScapBot stops all access to that Page immediately, but data already received is kept so the business does not lose its history if it reconnects. The data is deleted only on a deletion request, or when the business deletes its ScapBot account.

Channel C — Revoke ScapBot's access via Facebook

You may also revoke any permissions ScapBot has been granted on your Facebook account:

1. Visit https://www.facebook.com/settings?tab=apps
2. Find any business app that uses ScapBot
3. Click Remove
4. After removal, ScapBot can no longer fetch new profile data about you from Facebook. Data received earlier stays stored until you request deletion through Channel A.

15.1b. For End Customers (TikTok Users)

You commented on a video of, or sent a direct message to, a business's TikTok account that is connected to ScapBot. The business is the Data Controller; ScapBot acts as the Data Processor on the business's behalf. You have two channels to request deletion of your data.

Channel A — Email request to ScapBot directly

Send an email to privacy@scapbot.ai with the exact subject line: Data Deletion Request — TikTok

Include your TikTok username, the TikTok username of the business, and the approximate date range.

We acknowledge receipt within 3 business days and complete the deletion within 30 calendar days. You receive a confirmation email when the deletion is complete.

Email template (copy-paste):

To: privacy@scapbot.ai
Subject: Data Deletion Request — TikTok

Hello,

I am a TikTok user (@[YOUR USERNAME]) who commented on
or messaged the TikTok account "@[BUSINESS USERNAME]"
between approximately [START DATE] and [END DATE].

I request that ScapBot delete all personal data it holds
about me, including my username, display name, profile
picture, comments and messages collected on behalf of
that business.

Thank you.

Channel B — Ask the business

The business is the Data Controller. You can ask the business to delete your conversation in ScapBot.

15.2. For Business Users (ScapBot Account Holders)

You registered an account at https://scapbot.ai for your business.

Account deletion by email request

Email privacy@scapbot.ai from the address registered on your account, with the subject Data Deletion Request — ScapBot Account. We acknowledge receipt within 3 business days and complete the deletion within 30 calendar days.

Account deletion covers:

• Your account, password, and login sessions
• All connected Facebook Pages, TikTok Business Accounts, Zalo OAs, Telegram bots, WhatsApp Business numbers, Viber bots, Line accounts
• All conversations, messages, and customer profiles received through your connected channels
• All AI Assistants you created, along with their configurations and knowledge bases
• All uploaded documents and product images on Cloudflare R2
• All Google Drive sync state

Records we are required to retain

By Vietnamese tax and accounting law, we retain the following even after account deletion:

• Transaction history (for accounting purposes — at least 5 years)
• Aggregated, anonymized usage statistics (with no personally identifying information)

These records do not contain your full name, email, or any other identifier that could be linked back to you.

15.3. Response Timelines

15.4. Identity Verification

To prevent fraudulent deletion requests, we may ask you to verify your identity:

• End Customers: confirmation message sent through Facebook Messenger from your account, or a screenshot of the conversation with the Page
• TikTok Users: confirmation message sent from your TikTok account, or a screenshot of your comment or conversation
• Business Users: OTP sent to the email address on your ScapBot account

We never ask for your password.

15.5. Appeals

If you are not satisfied with our response, you may:

• Reply to our confirmation email with your concerns
• File a complaint with the Department of Cybersecurity and High-Tech Crime Prevention (A05), Ministry of Public Security of Vietnam
• If you are located outside Vietnam, lodge a complaint with the data protection authority of your country (Section 13)
• For Facebook-specific issues, you may also contact Meta directly through https://www.facebook.com/help/contact

16. Version History