Legal
Privacy Policy
How Sota Labs collects, uses and protects personal data when you use hatang.dev, and what we do with the data your customers entrust to you.
Last updated 14 September 2026
1. Controller
Sota Labs Technology JSC (Công ty Cổ phần Công nghệ Sota Labs), business registration no. 0109975847, CIC Tower, 2 Nguyễn Thị Duệ, Cầu Giấy, Hà Nội, Việt Nam is the controller of personal data about account holders and website visitors. For data you process through the Service about your own customers, you are the controller and we are the processor (see the Data Processing Agreement).
2. Data we collect about you
Account data: name, email, password hash, team membership, billing details and tax code. Usage data: API requests, IP addresses, browser information, dashboard activity and support conversations. Website data: pages visited and, if you use the chat bubble, the messages you send us.
3. Why we use it
To provide and secure the Service, to bill you and issue e-invoices, to prevent abuse, to answer support requests, to send service notices, and, with your consent, product news. Legal bases under Decree 13/2023/NĐ-CP are contract performance, legal obligation, legitimate interest and consent.
4. Data you process through the Service
Email addresses, message content, chat transcripts, customer profiles, invoices and payment records belong to you. We process them only on your instructions, store them encrypted at rest, and never use them to train models or for advertising. AI features send the relevant conversation and knowledge-base excerpts to our model provider under a contract that prohibits training on the data.
5. Where data is stored
Production data is hosted in Singapore with encrypted backups. Email is relayed through Amazon Web Services in the same region. Enterprise plans can request storage in Việt Nam. Cross-border transfers are documented as required by Vietnamese law.
6. Sub-processors
We use a small number of infrastructure providers to run the Service: cloud hosting and email relay (Amazon Web Services), AI model inference (Anthropic), and channel providers you connect yourself (Zalo, Meta). The current list is available on request and changes are announced 30 days in advance.
7. Retention
Account data is kept while your account is active and for 30 days after closure. Email events are kept for 30 days by default and message bodies for the period you configure. Chat transcripts follow your retention settings. Invoices and billing records are kept for 10 years as required by Vietnamese accounting law.
8. Your rights
You may access, correct, export or delete your personal data, withdraw consent, and object to processing, subject to legal retention duties. Write to [email protected]; we respond within 72 hours as required by Decree 13/2023/NĐ-CP. Complaints may also be lodged with the Ministry of Public Security's Department of Cybersecurity and High-Tech Crime Prevention (A05).
9. Security
Encryption in transit and at rest, scoped API keys, signed webhooks, audit logging, least-privilege access for staff, and regular reviews. Sota Labs operates under SOC 2 Type II, ISO 9001 and CMMI DEV ML 3 controls. Report vulnerabilities to [email protected].
10. Cookies
The dashboard uses strictly necessary session cookies. The marketing site sets no tracking cookies. The chat widget stores a visitor token in local storage on the sites where it is installed.
11. Changes
We will notify you by email of material changes at least 14 days before they take effect.