Privacy Policy

Effective 4 November 2026

This policy explains what data BlueKey collects, what it is used for, who receives it, where it is stored and what rights you have. BlueKey is provided by Công ty TNHH BlueKey Solutions (tax ID 0319085086, address Số 1B, đường số 30, Khu phố 27, Phường An Khánh, Thành phố Hồ Chí Minh). In this policy, "we" means Công ty TNHH BlueKey Solutions.

It applies to the BlueKey web and mobile apps, the pages and forms BlueKey serves on behalf of businesses, and this website.

1. What BlueKey is

BlueKey is software for businesses. A business uses BlueKey to receive and answer messages from Facebook Messenger, Instagram, Zalo OA and comments on its Facebook Page in one Inbox; manage customers, leads, deals and bookings; publish posts to Facebook, Zalo OA, TikTok and YouTube; keep documents in a knowledge base; view reports; and assign work to AI employees for marketing, sales and customer care.

2. Who is responsible for which data

There are two kinds of data, and our role differs for each.

A business's data and its customers' data. Messages customers send to the business's Page or OA, customer records, orders, bookings, job applicants, knowledge base documents and anything else the business puts into BlueKey. For this data, the business is the personal data controller: it decides what is collected and why. We are the personal data processor and process it only on the business's instructions, to provide the service.

If you are a customer of a business that uses BlueKey and want to see, correct or delete your data, please contact that business first. We will help the business handle your request.

Account data of BlueKey users. Information about people who sign up and sign in to BlueKey (business owners, managers, staff). For this data, we are the controller.

We process personal data under the Law on Personal Data Protection No. 91/2025/QH15, Decree 356/2025/NĐ-CP and related Vietnamese law.

3. Data we collect

When you have a BlueKey account

• Name, email and password (stored as a hash, never in plain form).
• If you sign in with Google, Facebook, Microsoft or Zalo: your account ID, name, email (Zalo does not provide one) and profile picture if the provider sends it.
• Sessions: IP address and browser or device information.
• Your role in the business (Owner, Manager, Staff) and the actions you take. Data changes are recorded in a change log so the business can see who changed what.
• If you use the mobile app: a device token for push notifications.
• If you link the Telegram bot: your Telegram account ID, to send notifications.

When a business connects channels and services

When a business connects an account, BlueKey receives data from it within the permissions the business granted:

• Facebook and Instagram: messages customers send to the Page or Instagram account, the sender's public name, Page posts and comments, post metrics, leads from Facebook Lead Ads forms, ad metrics (when Meta Ads is connected).
• Zalo OA: messages customers send to the OA, OA information, OA articles.
• TikTok: account information, video lists and metrics; ad metrics when TikTok Ads is connected.
• YouTube: channel information, video lists, video metrics and comments.
• Google Drive: only files the user picks (see section 6).
• KiotViet, Sapo: products, stock, orders.

Access tokens for these connections are encrypted before storage and never sent to the browser.

Data the business enters

Customer records, notes, orders, bookings, documents, images, videos, post content, job applications and CVs, network member information, and data imported from files, through the integration API or by webhook.

Data from forms, landing pages and booking pages

A business can publish lead forms, landing pages, job application pages, booking pages and a Zalo Mini App through BlueKey. What people submit (usually name, phone number, email, their request, and a CV when applying) belongs to that business. Forms can include a consent checkbox written by the business.

Landing pages set no cookies and load no third-party tracking. To count views, the server derives a keyed hash from the IP address and browser that changes every day. The IP address is not stored.

When you request a demo on this site

For what you send through the demo request form on the BlueKey website, we are the controller.

• Data: what you fill in (usually name, phone number, email, business name, industry, message), when you sent it, the wording of the consent box you ticked, and the link you arrived by (the ad source, if any).
• Purpose: to contact you to arrange and run the demo, and to answer your questions about BlueKey.
• Basis: your consent, given with the consent box in the form. The box is never pre-ticked. If the form also offers a box for product news, that is a separate, optional consent, and you can request a demo without ticking it.
• Who sees it: the BlueKey team that handles demos. It is stored in the BlueKey app itself (servers in Vietnam).
• How long: at most 12 months from the last contact if you do not become a customer, or until you ask for deletion or withdraw consent, whichever comes first.
• Withdrawing consent or deleting: email tech@ceoagent.io. We stop contacting you and delete your details within the time limits in section 13.

This website sets no cookies, uses no analytics or ad tracking code, and serves its own fonts. It is hosted on Cloudflare, so Cloudflare receives your browser's IP address to deliver the pages and to block attacks.

4. What we use data for, and on what basis

We do not sell personal data. We do not use a business's data for advertising, and we do not use it to train AI models.

5. AI and AI providers

When data is sent to an AI provider

AI employees, the Assistant, written answers from documents, reply suggestions, content writing, CV reading and the in-app help assistant call third-party AI models. These features run only when the business turns on "Allow external AI". An Owner or Manager can turn it on or off in Settings, and every change is recorded.

When it is off, BlueKey does not send the business's messages or documents to an AI model provider. The knowledge base still works and returns verbatim passages from documents.

When it is on, the data each task needs is sent, for example: the customer's messages in the conversation being handled, relevant document passages, that customer's own details, a content brief, the text of a CV.

Masking personal data

Before text is sent to an AI model, BlueKey replaces phone numbers, emails, ID card or passport numbers, bank account numbers, card numbers, and addresses that have a recognisable marker (such as a house number), with placeholders, and restores them when a person views the result. This masking is pattern-based and does not catch every case. Personal names are not masked at present. Images (such as a photographed CV) are sent as they are.

AI providers

• Anthropic (Claude models) and OpenAI: writing and chat, answer checking, reading image CVs; image, voice and subtitle generation (OpenAI).
• fal.ai: image and video generation, when the AI Media feature is used.
• Google Cloud Text-to-Speech: voice-over, when the AI Media feature is used.
• Brave Search: when configured, the AI Research feature sends search queries about the market and competitors (no customer data).

Under Anthropic's and OpenAI's current commercial terms, data sent through their APIs is not used to train their models unless the customer opts in. This is those providers' commitment under their own terms, not a promise we make on their behalf. See Anthropic's commercial terms and OpenAI's API data policy.

Knowledge base documents

Documents are converted to text, split into passages and indexed for search on our own servers, using a model we run ourselves. If a knowledge base is set up to use OpenAI's indexing service, its passages are sent to OpenAI.

Automated processing

AI employees read customer messages, find relevant document passages, then draft replies, suggestions or proposed actions (such as updating a customer's details or creating a booking). The models work from the documents and instructions the business provides, and do not decide on prices, contracts or customers' entitlements on their own. The business can turn off all use of external AI in Settings, and choose which actions need a person's approval first.

The business is the controller of its customers' data, so it is responsible for telling its customers that their messages may be processed by AI.

AI can be wrong

AI output can be wrong or incomplete. Messages, posts and data changes proposed by AI go through Approvals so someone at the business reviews them first, unless the business has allowed a given action to run without approval.

6. Data from Google

BlueKey's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Sign in with Google. BlueKey asks only for openid, email and profile, to know who you are and sign you in.

Google Drive. BlueKey uses the drive.file scope with Google Picker. This scope lets BlueKey see only the files you pick in Google's file picker, not the other files in your Drive. BlueKey downloads the picked files into your own business's knowledge base or sales data, and keeps them in sync when a file is edited, deleted or moved out of the folder.

YouTube. When a business connects a YouTube channel, BlueKey uses the YouTube API Services with youtube.readonly (channel information, videos, metrics and comments) and youtube.upload (uploading a video once the business approves it). By using this feature you agree to the YouTube Terms of Service. Google processes data under the Google Privacy Policy.

For data received from Google, we commit to the following:

• We use it only to provide or improve the user-facing features described above, which the user requested.
• We do not sell it, use it for advertising, or use it to determine creditworthiness or for lending.
• We do not use it to develop, improve or train generalized AI or machine learning models.
• No person reads it, unless you agree for a specific case, it is needed for security (such as investigating abuse), the law requires it, or the data is aggregated and anonymised for internal operations.
• We transfer it to others only when needed to provide those features (for example sending document passages to an AI provider in section 5 when the business has turned on external AI), when the law requires it, or in a merger or acquisition with prior notice.

You can revoke BlueKey's access at any time on your Google Account permissions page, or disconnect in BlueKey under Settings → Connections.

7. Facebook data deletion

If you gave BlueKey access to Facebook (to connect a Page or to sign in) and want that data deleted:

1. Go to Facebook → Settings & privacy → Settings → Apps and websites.
2. Select BlueKey and click Remove.
3. Choose to send a data deletion request.

Facebook sends the request to BlueKey. You get a confirmation code and a link to a status page to track it. Once processed:

• The Facebook access you granted to Pages is deleted, and those connections stop.
• Your Facebook sign-in link is deleted.

The following is kept because it belongs to the business that owns the Page: messages sent to the Page, customer records, orders, notes. Facebook issues a different ID per app and per Page, so we cannot match your deletion request to messages you sent to a Page. To have those messages deleted, contact the Page owner. You can also write to tech@ceoagent.io.

If you only remove BlueKey from Facebook without requesting deletion, the connections you granted stop and need to be reconnected.

TikTok also tells BlueKey when you revoke access; your TikTok connection then stops and its token is deleted.

8. Who we share data with

We share data only with parties needed for the service:

• Platforms the business connected (Meta, Zalo, TikTok, Google, KiotViet, Sapo): when the business replies to messages, publishes posts, sends ZNS messages, or syncs ad audiences. For ad audiences, phone numbers and emails are hashed with SHA-256 before sending, and only customers who consented are included.
• AI providers in section 5, when the business has turned on external AI.
• Infrastructure: our server provider in Vietnam; DigitalOcean (servers in Singapore); an email delivery (SMTP) provider; Cloudflare (domain DNS, and traffic proxying if enabled); an off-server backup storage provider, if configured (it receives encrypted backups only).
• Notifications: Apple and Google (Firebase) to deliver push notifications to phones; Telegram if you link the bot. A push about an urgent conversation may include an excerpt of the message with personal data masked. Telegram messages contain only counts, statuses and task descriptions, never message text or customer details.
• Google Fonts: the web app loads fonts from Google, so Google receives your browser's IP address.
• Systems the business connects itself: AI apps the business authorises through MCP, integration API keys, and webhooks sent to addresses the business sets.
• Authorities, when the law requires it.

9. Where data is stored

• The database and the app run on servers located in Vietnam.
• A server in Singapore processes documents for the knowledge base (text extraction, splitting, indexing) and runs our internal operator site. The two locations are linked over an encrypted channel.
• AI providers and some platforms in section 8 process data abroad, mostly in the United States.

Data may therefore be transferred outside Vietnam, mainly to the United States (Anthropic, OpenAI, Meta, Google, fal.ai, Brave) and Singapore (DigitalOcean). Only the data each task needs is transferred. It travels over encrypted connections, personal details are masked before text is sent to AI models as described in section 5, and nothing is sent to AI providers unless the business has turned on external AI.

10. Retention and deletion

• A business's data is kept while the business uses the service, unless the business deletes it or sets a retention period.
• The business owner can set retention periods for conversations, unconverted leads, job applicants and logs. The system deletes expired data daily.
• Backups are made daily, encrypted before they are written to disk, and deleted after a limited period (14 days under the current configuration). Deleted data may remain in a backup until that backup expires.
• Demo requests made on this site: as in section 3, When you request a demo.
• When a business stops using the service, its data is returned or deleted according to the contract and on request to tech@ceoagent.io.

11. How we protect data

Some of the measures we use:

• Each business's data is kept separate at the database level.
• Connections to BlueKey use HTTPS.
• Passwords are hashed. Channel connection tokens and a business's own AI keys are encrypted.
• Backups are encrypted.
• Personal data is masked before it reaches an AI model and in system logs.
• Role-based access (Owner, Manager, Staff); our operators sign in to the operator site with two-factor authentication.

No system is perfectly secure. If a personal data breach occurs, we notify the affected businesses without delay, and the specialised personal data protection authority within 72 hours of discovering it, as the law requires.

12. Cookies

The BlueKey app uses cookies that are needed to keep you signed in. It uses no advertising cookies and no third-party analytics. The BlueKey website sets no cookies at all.

13. Your rights

Under the Law on Personal Data Protection you have the right to be informed about the processing of your data, to consent or refuse, to withdraw consent, to access, correct and delete your data, to restrict or object to processing, and to complain, denounce, sue and claim damages as provided by law.

Withdrawing consent does not affect processing that took place before. For data needed to run an account under the contract, a deletion request may mean the service has to end.

• BlueKey users: edit your name and account details in Settings. Delete your account yourself on the app's Tài khoản (Account) page, under Xoá tài khoản (Delete account). To get a copy of your data, email tech@ceoagent.io from your account's email address.
• Customers of a business: contact the business. The business can export its customer list, mark a customer as opted out of marketing messages, and ask us for help with deletion.
• Revoking connections: disconnect in Settings → Connections, or revoke access in your Facebook, Google, TikTok or Zalo settings.

Time limits: we answer requests to withdraw consent, restrict or object to processing within 2 working days and carry them out within 15 days (20 days if other processors must also stop). Deletion requests are carried out within 20 days (30 days if other processors are involved). Other requests are answered within the time limits set by law. We may need to verify your identity before acting on a request.

Personal data protection contact: send any request or question about personal data to tech@ceoagent.io, stating what you ask for and how we can reach you.

14. Children

BlueKey is meant for businesses. We do not knowingly collect data from children under 16 as BlueKey users.

15. Changes to this policy

When this policy changes, we update the effective date at the top. For material changes, we notify business owners by email or in the app before the change applies. If a change adds a purpose that needs consent, we ask for your consent again and do not treat continued use as consent.

16. Contact

• Công ty TNHH BlueKey Solutions
• Address: Số 1B, đường số 30, Khu phố 27, Phường An Khánh, Thành phố Hồ Chí Minh
• Tax ID: 0319085086
• Email: tech@ceoagent.io
• Phone: 0938 005 382