Privacy Policy

Last Updated: April 26, 2026

Customer privacy is our priority. Repio Joint Stock Company ("Repio", "we") has created this Privacy Policy to clearly explain how we collect, use, share, and protect personal data when customers use our platform, including integrations with Facebook Messenger, Zalo, and WhatsApp. By using Repio's services, you acknowledge that you have read and agreed to the contents of this Policy.

This policy is built in accordance with the Personal Data Protection Law 2025 (Law No. 91/2025/QH15), Decree 356/2025/ND-CP, Artificial Intelligence Law 2025 (Law No. 134/2025/QH15) and relevant Vietnamese legal regulations.

1. Data We Collect

To operate the platform and better serve our customers, we collect the following types of data:

• Account Data: When registering to use the platform, we collect information such as name, email, phone number of system users, along with login, administrative, and billing information (if any).
• Conversation Data: During operation, the system stores message content between end-users and the system, full conversation history, information related to service requests (e.g., appointment booking, service consultation), and accompanying conversation information including time, channel, and status.
• End-user Data: Through messaging channels, we may receive full names, phone numbers, conversation content, and public profile information from the messaging platform (display name, avatar, subject to platform permissions). This data is collected by enterprise customers and sent to the Repio system. Enterprise customers are responsible for obtaining valid consent from end-users before the data is processed through the platform.
• Sensitive Health-Related Data: Because Repio serves businesses in various sectors including health-related services, the system may process data related to basic health conditions, treatment needs, or allergy information provided by end-users during conversations. Repio does not actively collect this type of data but recognizes that health data may appear in conversation content. Health data is classified as sensitive personal data according to Article 4 of Decree 356/2025/ND-CP and is subject to additional protection measures (see Section 4). Enterprise customers are responsible for obtaining explicit consent from end-users before health data is inputted or processed through the system, and must conduct a personal data processing impact assessment as required by law.
• Technical Data: When customers access the platform, we automatically collect certain technical information including IP address, device and browser information, system and access logs, along with cookies and analytics data (see Section 10).
• Third-party Platform Data: When integrating with Facebook Messenger, Zalo, and WhatsApp, we receive data within the scope permitted by these platforms, including public profile information and message content.

2. How We Use Data

The collected data is used to provide and operate the platform, automatically generate responses, manage and store conversations, improve system performance and accuracy, detect and prevent abuse, provide technical support for enterprise customers, and comply with legal obligations.

Repio does not use customer data to train generalized AI models, advertise or market to end-users, or sell and rent to third parties.

3. Legal Basis for Data Processing

According to the Personal Data Protection Law 2025 and Decree 356/2025/ND-CP, we process personal data based on the following grounds:

• Contract: Processing necessary data to perform service contracts with enterprise customers.
• Consent: Consent of the data subject, collected by the enterprise customer from the end-user.
• Legal Obligation: When the law requires us to process or retain data.
• Legitimate Interest: To maintain system security and prevent abuse.

4. Data Security and Storage

4.1 Security Commitment

Protecting customer data is a continuous responsibility throughout Repio's service provision. All data is stored on servers meeting security standards, applying encryption during transmission and at rest, role-based access control, continuous system monitoring, and periodic backups.

Data is only accessed and processed to the extent necessary to operate the service, or upon legal request from a competent authority.

4.2 Additional Measures for Sensitive Data

For health-related data, we apply additional safeguards including limiting internal access only to necessary personnel, detailed access logging, and not using health data for aggregate analysis or system improvement purposes.

4.3 Data Retention

Repio only retains personal data for the time necessary to fulfill the purposes outlined in this Policy and comply with applicable laws. Customer consent for processing purposes remains valid after the termination of the service relationship. When data is no longer necessary for defined purposes, we will securely delete or anonymize it, unless the law requires longer retention.

5. Data Sharing

Repio does not sell, rent, or exchange customer personal data. Data is only shared in the following cases:

• Enterprise Customers: Conversation and end-user data within their management scope.
• Service Providers: Certain technical partners receive data to support platform operations, including cloud infrastructure and artificial intelligence model providers. These partners must comply with security standards and Vietnamese legal regulations on information safety. Details are specified in service contracts.
• Competent Authorities: Repio may provide data upon receiving lawful requests from state agencies according to legal regulations.

6. Data Isolation

Repio is designed on a multi-tenant architecture with strict data isolation mechanisms. Each enterprise customer's data is logically separated. There is no cross-access or data sharing between customers, and response content is generated specifically for each customer based on their own data.

7. Data Subject Rights

Depending on applicable laws, data subjects have the following rights under the Personal Data Protection Law 2025 (Article 4):

• Right to be informed: To be informed about the processing of their personal data.
• Right to consent: To consent or not consent to data processing.
• Right of access: To request a copy of the personal data we store.
• Right to rectification: To request correction of inaccurate or incomplete data.
• Right to erasure: To request deletion of personal data in certain circumstances.
• Right to restriction of processing: To request stopping or limiting data processing.
• Right to withdraw consent: To withdraw previously given consent.
• Right to complain: To lodge a complaint with the competent authority.

For end-users, since data is collected by the enterprise customer, data rights requests should be directed to the relevant enterprise customer first. Repio will support enterprise customers in fulfilling these requests. For system users, please contact us directly via email: hello@repio.io.

8. Data Deletion

Customers can request data deletion by emailing hello@repio.io or through the administration interface on the platform (when available).

Deletion requests will be confirmed within 3 business days and completed within 30 days from the confirmation date. Data sent to third-party providers will be deleted according to their retention policies (usually 30 days or less).

Please note that data may be retained after deletion if required by legal obligations (e.g., accounting records) or if the data has been anonymized and is no longer identifiable.

9. Data Breach Notification

In the event of a data security breach, Repio will notify affected enterprise customers within 72 hours of discovering the breach. The notification will include a description of the incident, the types of data affected, measures taken and planned, and a point of contact. Repio will report to the competent authority in accordance with the Personal Data Protection Law 2025 and Decree 356/2025/ND-CP. Enterprise customers are responsible for notifying affected end-users according to their legal obligations.

10. Cookies and Tracking Technologies

Like most web platforms, Repio uses cookies to support authentication, remember settings, and analyze traffic. Customers can manage cookies through browser settings.

Repio's marketing website may use essential cookies for operations (no consent required) and analytical cookies to understand how users interact with the website (consent required). The Repio platform uses session cookies essential for authentication and operation. These are strictly necessary technical cookies and are not used for advertising purposes.

Disabling essential cookies may affect the ability to use the service.

11. International Data Transfers

Some data may be processed on servers located outside the territory of Vietnam. In all cases, we apply appropriate safeguards in accordance with the law.

Data may be processed by cloud infrastructure and artificial intelligence model providers with servers located abroad, including the United States and other regions.

When transferring data outside of Vietnam, Repio conducts cross-border data transfer impact assessments in accordance with the Personal Data Protection Law 2025 and Decree 356/2025/ND-CP when necessary, only transfers data to providers with adequate security commitments, and applies encryption to protect data during transit.

12. Data by Integrated Platform

Repio integrates with multiple messaging platforms to support conversation management and customer care. Here is how we handle data from each platform:

Facebook Messenger

• Data Collection via API: Repio collects message data, user public profile information (display name, avatar), and interaction history via the Facebook Graph API, within the permissions granted by the enterprise customer when connecting their Facebook Page.
• Real-time Updates: Repio receives notifications from Facebook's webhook upon new messages or interaction events, allowing the system to respond immediately.
• Data Processing: Data is processed to manage conversations, generate automated responses, and support customer care. Only platform-permitted data is collected.
• Storage: Data from Facebook Messenger is stored securely on Repio's servers with encryption in transit and at rest.

The use of data from Facebook complies with Meta's Data Policy. Enterprise customers are responsible for complying with Meta's terms when using this integration.

Zalo

• Data Collection via API: Repio collects message data and interaction information via the Zalo OA API to manage communications with customers on the Zalo platform.
• Data Processing: Data is processed to respond to end-user requests, manage conversations, and generate automated responses.
• Storage: Data from Zalo is securely stored and encrypted on Repio's servers.

The use of data from Zalo complies with Zalo/VNG's data policy.

WhatsApp

• Data Collection via API: Repio collects message data, interaction logs, and user information via the WhatsApp Business API to manage messaging flows.
• Data Processing: Messages are processed to manage conversations, generate automated responses, and integrate with customer care systems.
• Storage: Data from WhatsApp is encrypted and stored securely on Repio's servers.

The use of data from WhatsApp complies with Meta/WhatsApp's data policy.

13. Links to External Websites

Our services may contain links to external websites or services not owned or controlled by Repio. We are not responsible for the content, privacy policies, or data practices of third-party websites. Customers should review the privacy policies of each website before providing personal information.

14. Children's Data Protection

The Repio platform is designed for businesses and is not intended for individuals under 16 years of age. We do not knowingly collect personal data from children. If an enterprise customer processes data relating to children via the platform, they must ensure they have consent from a parent or legal guardian. If you discover that a child's data has been submitted to the system without appropriate consent, please contact us immediately.

15. Policy Changes

This policy may be adjusted when there are changes in services, infrastructure partners, or legal regulations. For significant updates, we will send an email notification or display a notice on the platform at least 15 days before the effective date. The current version is always available at repio.io/chinh-sach-bao-mat.

This Privacy Policy may be provided in both Vietnamese and English. In the event of any inconsistency or conflict between the two versions, the Vietnamese version shall prevail.

16. Contact

If you have questions about this Privacy Policy or how we handle data, please contact:

• Email: hello@repio.io
• Address: No. 26, Alley 203 Chua Boc, Kim Lien Ward, Hanoi, Vietnam
• Response Time: Within 3 business days

For requests or questions regarding data protection, please contact us via email: hello@repio.io.