1. Who collects your data, and how to reach us

TRAKO's website and Facebook Page are operated by TRAKO, a technology consulting and software development firm based in Vietnam. TRAKO is the controller of the personal data described in this policy.

• Support email: trakotech@gmail.com
• Phone / Zalo: +84 398 635 898 (Mr. Khoi) — +84 905 038 127 (Ms. Trang)

2. Personal data we collect

We only collect data you actively provide when you contact TRAKO:

• Website contact form: your name, email address, phone number (with country code), subject, and the message you write.
• AI assistant (chatbot) on the website: the messages you send, the files you attach (images or PDFs), your interface language, and a random session ID generated by your browser for each conversation.
• Facebook Messenger messages: the Page-Scoped ID issued by Meta, the content of the messages you send to our Page, and their timestamps.
• Stored in your browser: the name, email, phone number, and country code you entered in the contact form are saved in localStorage (key TRAKO:contact-info) so you don't have to type them again. This data stays on your device and you can remove it at any time by clearing your browsing data.

We do not collect profile pictures, friend lists, location, payment data, or sensitive personal data. The website uses no advertising cookies and no third-party behavioral tracking.

3. How we use your data

We use your data to:

• Answer your questions, advise you on our services, and follow up as you requested.
• Operate the AI assistant that replies automatically on the website and on Facebook Messenger.
• Run internal quality assurance (QA) and improve the AI assistant's answers.
• Detect and prevent abuse, spam, or attacks on our systems.
• Produce internal statistics about customer needs so we can improve our services.

We do not sell or rent your data, and we do not use it for targeted advertising.

4. Legal basis and consent

We process your data on the basis of your consent, given when you submit the contact form, message the AI assistant, or message our Facebook Page; and on the basis of our legitimate interest in protecting our systems from abuse.

You may withdraw your consent at any time by following section 9. This policy is written in line with Vietnam's Decree 13/2023/ND-CP on personal data protection.

5. How we process and store data

We do not run our own physical servers. Your data is processed and stored as follows:

• The website runs on Vercel's infrastructure. All connections to the website and to our APIs are encrypted over HTTPS/TLS.
• Contact form submissions are written to a private Google Sheet in TRAKO's Google account.
• Conversations with the AI assistant (both on the website and on Messenger) are written to private Google Docs in TRAKO's Google Drive, used solely for quality assurance and abuse detection. Files you attach in a conversation are stored alongside these logs (images are embedded directly in the document, PDFs are saved as separate files in the same Drive folder). These logs are never readable by users.
• Message content and attachments are sent to OpenAI to generate the AI assistant's replies.
• Data is encrypted at rest by Google's and Vercel's default mechanisms. Only TRAKO staff with a work-related need can access it.

Retention: we keep your data for as long as it is needed for the purposes in section 3. Deletion is currently performed manually upon request — once you send a deletion request, we complete it within 30 days of verifying your identity, unless the law requires us to keep it longer.

6. Sharing data with third parties

We do not sell, trade, or rent your personal data. We share it only to the minimum extent necessary with the service providers we rely on to operate:

• OpenAI (United States) — processes message content and attachments to generate the AI assistant's replies.
• Google LLC — stores contact form submissions and conversation logs in Google Sheets, Google Docs, and Google Drive.
• Vercel Inc. (United States) — hosting and infrastructure for the website.
• Meta Platforms, Inc. — the Facebook Messenger platform, when you message our Page.

Because we use these services, your data may be transferred to and stored outside Vietnam. Apart from these providers, we disclose data only when lawfully required to by a competent state authority.

7. Data obtained from Meta platforms (Facebook Messenger)

When you message TRAKO's Facebook Page, we receive data from Meta through the Messenger Platform (Graph API and Webhooks): your Page-Scoped ID, the content of your messages, and their timestamps.

We use this data strictly within the scope of the permissions granted to us by Meta, and only to reply to you and provide customer support. We do not use data obtained from Meta platforms for advertising, we do not sell it or pass it to third parties other than the service providers listed in section 6, and we do not combine it with data from other sources for purposes beyond those stated here.

TRAKO commits to complying with the Meta Platform Terms and Developer Policies. To request deletion of the data we received via Messenger, see section 9.

8. Your rights over your personal data

Under Decree 13/2023/ND-CP, you have the following rights:

• The right to know how your data is being processed.
• The right to give or withhold consent, and to withdraw it at any time.
• The right to access, review, and request a copy of the data we hold about you.
• The right to have inaccurate data corrected.
• The right to request deletion of your data.
• The right to restrict or object to the processing of your data.
• The right to complain, denounce, litigate, and claim damages as provided by law.

9. How to request access, correction, or deletion

Email trakotech@gmail.com with the subject "Personal data request", stating whether you want to access, correct, or delete your data, and include enough information for us to identify it:

• If you submitted the contact form or chatted with the AI assistant: the email address or phone number you used.
• If you messaged us on Facebook Messenger: the Facebook account name that messaged our Page.
• You can also call +84 398 635 898 (Mr. Khoi) or +84 905 038 127 (Ms. Trang).

We will verify your request and respond within 72 hours, and complete any deletion within 30 days of verifying your identity, unless the law requires us to retain the data longer.

10. Security

We apply reasonable technical safeguards: HTTPS/TLS encryption in transit, HMAC signature verification on the Messenger webhook, rate limiting to prevent abuse, and access restricted to staff with a work-related need.

That said, no method of transmission or storage is completely secure. We recommend you do not send highly sensitive information (bank account numbers, passwords, identity documents) through the contact form or the AI assistant.

11. Children's data

Our services are aimed at businesses and adults. We do not knowingly collect data from children under 16. If we discover we have done so, we will delete it as soon as we are notified.

12. Changes to this policy

We may update this policy over time. The latest version is always published on this page, with the update date shown at the top. Significant changes will be clearly announced on the website.

13. Contact

For any question or complaint about this policy, please contact:

• Email: trakotech@gmail.com
• Phone / Zalo: +84 398 635 898 (Mr. Khoi) — +84 905 038 127 (Ms. Trang)