Privacy policy

1. Scope and roles

Heedium serves two groups of people, in different roles:

• Businesses that use Heedium (shop owners, admins, staff): Heedium is the controller of your account data.
• Customers of a business, meaning people who chat with the AI assistant on the business's website, Zalo OA or Facebook Messenger: the business is the data controller, and Heedium processes the data on behalf of the business and under its instructions.

If you are a customer who has chatted with a business that uses Heedium, please contact that business first about your data. We help businesses look up, download and delete data at your request.

2. Data we process

• Account: name, email, password (stored as a hash, which we cannot read), business name, business phone number and website, role in the team, and the time and wording of what you agreed to when signing up.
• Content the business adds: document files, website links, Google Sheets and hand-written answers.
• Conversations: messages and images customers send, and messages between customers and the AI assistant or staff on the website, Zalo OA and Facebook Messenger, together with summaries, tags, internal notes and customer ratings. Location and device information attached to images (EXIF) is removed when they are stored.
• Information customers choose to leave: name, phone number and email; if the business turns on the consent checkbox, also the time and the wording the customer agreed to.
• Data from Zalo OA: the Zalo user ID and the content of messages customers send to the OA. Raw event data from Zalo is kept for 30 days and then deleted.
• Data from Facebook Messenger: the Page-scoped user ID (PSID) and the content of messages customers send to the Page. Raw event data from Meta is kept for 30 days and then deleted.
• Technical data: IP address (to limit request rates and prevent abuse; when you have not chosen a language, the IP address is also used to pick the display language, only while the request is being processed and without being stored, based on IP location data from DB-IP, db-ip.com), a random visitor ID stored in the browser to keep the conversation, a cookie recording the language you chose, and a log of actions taken in the dashboard.

3. What we use data for

• Verifying a business when it signs up (calling its phone number, looking at its website) before opening the trial.
• Providing the service: finding relevant document passages and generating answers for customers, handing conversations over to staff, and sending notifications and reports.
• Keeping the service safe: limiting the number of messages, detecting abuse and logging important actions.
• Supporting you when you contact us, and sending necessary information about your account.

Heedium does not sell personal data and does not use a business's documents or conversations for advertising.

4. Third parties that process data

To operate the service, some data is transferred to the following providers, only to the extent necessary:

• AI model provider, for the following tasks: generating answers (the customer's question, the recent conversation history, relevant document passages); drafting a suggested answer when staff press “AI suggestion” (the same data as above, never sent to the customer automatically); summarizing a conversation when it is handed over to staff; filling in lead profiles with the fields the business sets (the recent conversation of a customer who has left a phone number or email); writing suggestions in the weekly report (questions customers asked that the bot could not answer); reading images customers send, only when the business turns on “Let AI read images from customers” (up to 3 images per turn); scoring the bot's drafts against staff answers in shadow mode on Zalo OA; rating how relevant each website page is when scanning a website (the page address, title and the opening part of the page content).
• Server hosting and file storage: GreenNode (VNG Corporation), located in Vietnam, which stores the database, documents and backups.
• Email delivery service: sending verification emails, password resets, notifications and weekly reports.
• Zalo: when a business connects a Zalo OA, messages are received and sent through Zalo's API.
• Meta (Facebook Messenger): when a business connects a Facebook Page, messages are received and sent through Meta's API.

The AI model provider is Anthropic, PBC, which processes requests in the United States, so the data listed above is transferred abroad for processing. Anthropic does not use this data to train its models and deletes it within 30 days, except for content flagged as violating its usage policy (kept for up to 2 years) or where the law requires otherwise. We prepare an impact assessment dossier for transferring personal data abroad as required by law, and send only the data needed for each task. Phone numbers, email addresses and citizen ID numbers that appear in messages, chat history or documents are replaced with temporary codes before being sent to the AI provider, and are restored only on Heedium's servers in Vietnam; the AI provider does not receive this information in readable form. People's names and other information customers type into messages are still sent. Images customers send (when the business turns on image reading) are sent with their full visual content: text, numbers or documents photographed in an image are not masked.

Heedium's servers, database, document files and backups are located in Vietnam. Finding the relevant document passages for each question runs on these servers and is not sent to the AI provider.

Current list of providers: Anthropic, PBC (United States): Claude AI models; GreenNode, part of VNG Corporation (Vietnam): servers, databases, file storage and backups; VNG Corporation: Zalo, when a business connects a Zalo OA; Meta Platforms, Inc. (United States): Facebook Messenger, when a business connects a Facebook Page. We may also provide data when a competent state authority requests it in accordance with the law.

5. Data retention and deletion

Data is kept for as long as the account is active. A business can delete documents, leads and all the data of a specific customer itself at any time in the dashboard.

When a business account is terminated, or when the account owner sends a deletion request to the address in section 10, all of the account's data (members, bots, documents and uploaded files, conversations, leads, logs) is permanently deleted within 30 days, except for data the law requires us to keep longer. Deleted data cannot be recovered.

6. How we protect data

• Each business's data is kept separate: every query in the application is tied to the business's ID.
• Passwords are hashed; Zalo OA and Facebook Page access tokens are encrypted when stored.
• Connections to the website and the dashboard use HTTPS.
• Role-based permissions (owner, admin, on-duty staff, viewer) and activity logs.
• Heedium staff look at a business's data only when needed to support it or run the service, read-only; each time they open the business's dashboard, a conversation or a bot's settings, it is recorded in an activity log the business owner can see.

No system is completely secure. If an incident affects personal data, we will notify the businesses concerned and the competent authorities as required by law.

7. Your rights

Under Vietnamese law on personal data protection, you have the right to be informed about, access, correct and delete your data, to withdraw consent, to object to or request restriction of processing, and to make a complaint.

For account data, you can change your name and password yourself on the Account page, or send us a request at the address in section 10. For data in a conversation with a business, please send your request to that business.

8. Cookies and browser storage

• The dashboard uses a session cookie to keep you signed in.
• The chat widget on a business's website stores the visitor ID and the most recent conversation in browser storage, so customers do not lose the conversation when they move between pages.
• When you open the Heedium website from a partner's referral link (a link containing “?ref=”), your browser stores the partner code in the hd_ref cookie for 30 days, only to record which partner referred you when you sign up. This cookie contains no personal information and is not used to track you on other websites.
• Heedium does not use advertising cookies.

9. Changes to this policy

When this policy changes, we update the date at the top of the page. Significant changes will be announced by email or in the dashboard before they take effect.

10. Contact

Heedium. Email: info@heedium.com.