Privacy Policy

1. Operator

The party responsible for handling personal information in the Service is SBC TRADING CO., LTD (the "Company"). The Company complies with Vietnam's Law on Personal Data Protection and other applicable laws and regulations.

2. Information We Collect

(1) Account information

• Email address, name, or display name
• Password (stored hashed; the Company never retains the original password)
• Email verification status, last sign-in date and time

When you register through LINE Login, the Company does not collect a password. An email address is collected only when you allow it to be shared on LINE's consent screen, in which case the email address registered to your LINE account is collected. Any email address collected is used only for email verification and for sending important notices from the Service (for example, a re-linking notice if your WhatsApp link is removed). The Service remains usable even if you do not allow sharing on that consent screen.

(2) Linked account information

• LINE: the user identifier issued by LINE and the display name on your profile
• WhatsApp: your account identifier on WhatsApp, the link status, and the date and time you consented to the link
• Credentials needed for the link are stored encrypted, or held only on the linking gateway side

(3) Target group information

• The group identifier assigned by the platform, and the group name where it can be obtained
• Translation settings (target languages, enabled/disabled state), and which customer created the link

(4) Message content

• The body of a message posted in a target group, and the sender's display name
• Processed temporarily for use as translation context, and the body is not stored in the database (see Section 4 for details)

(5) Delivery records (metadata)

• Send date and time, platform, group identifier, message identifier, delivery outcome, error details, request identifier
• The body is not included; instead, only the character count is recorded (the extent needed to investigate a failed delivery or a character-limit issue)

(6) Inbound and operation logs

• The source IP address, event identifier, processing outcome, and processing time of a notification received from a platform
• Sign-in records (date and time, outcome, and connection information)

(7) Billing information

• Your plan, subscription status and billing period, and the identifiers Paddle assigns to you as a customer and to your subscription
• Card and other payment details are entered on Paddle's checkout and never reach the Company; the payment page loads Paddle's checkout, which is subject to Paddle's own privacy policy
• To show prices in your currency, your IP address is sent to Paddle when you view a pricing page

(8) Cookies

The Service uses only a cookie that keeps you signed in. It does not use cookies for advertising or behavioral tracking, and it does not use any third-party analytics tag.

3. Purposes of Use

1. Providing the Service — translating messages in a target group and posting the translated text
2. Authenticating an account, verifying identity, and confirming authority (only the customer who created a target group's link may change that group's settings)
3. Verifying an email address, resetting a password, and sending important notices
4. Responding to incidents, investigating defects, and improving quality
5. Preventing misuse and responding to violations of the Terms
6. Calculating and billing usage fees (where a paid plan is offered)
7. Responding to requirements under applicable law

4. Handling of Message Content (Important)

1. A message body is kept in an in-memory data store, solely for translation and for reference to the surrounding context, for 24 hours only, and is automatically deleted afterward.
2. The Company's database does not store message bodies. A delivery record retains only the date and time, identifiers, outcome, and character count.
3. As the sole exception, for a message that is automatically flagged as a suspected attack such as a prompt injection attempt, an excerpt of it (up to 500 characters) is stored encrypted for the prevention and investigation of misuse. This record is automatically deleted after 90 days. An ordinary message is never stored this way.
4. For translation, a target group's messages (including the messages immediately before and after it that are referenced as context, which may include a sender's display name) are sent to a third-party generative AI provider.
5. Once a target group's link is removed (/unbind), messages from that group are no longer processed in any way.
6. The Company does not use message content for advertising, profiling, or training its own machine learning models.

5. Provision to and Entrustment with Third Parties

To the extent necessary to provide the Service, the Company entrusts handling to, or provides necessary information to, the following parties.

• LINE (the provider of the LINE messaging and login platforms): sending translated text, identifying the customer
• WhatsApp (Meta): sending translated text (carried out through the customer's own linked account)
• The generative AI provider: generating the translation. The model the Service uses is gemini/gemini-3.7-flash
• Cloud and server providers: providing the infrastructure the Service runs on
• The email delivery provider: sending verification and password-reset email
• Paddle (Paddle.com Market Ltd, the reseller and Merchant of Record for paid plans): processing payments, tax, invoices and refunds. The Company provides your email address, name and account identifier, and your IP address for local prices

These parties may be located outside Vietnam, in which case information is transferred abroad. The Company exercises necessary and appropriate supervision over each party it entrusts. Other than as described above, the Company does not provide personal information to a third party except where required by law or where the customer has consented.

6. Retention Periods

• Message bodies: 24 hours (deleted automatically)
• Delivery records and inbound logs: for the period needed for incident response and misuse prevention
• A target group's link and settings: until the link is removed
• Billing information: while the account exists, and afterwards for as long as applicable tax and accounting law requires
• Account and linked-account information: until the account is deleted (after deletion, records the Company must keep under applicable law are the only ones retained)

7. Security Measures

• Encryption of communications (TLS)
• Encryption of highly sensitive items such as credentials using AES-256-GCM with key-generation management
• Passwords stored hashed
• Restriction of internal access through role-based access control (RBAC), with operation records retained
• Signature verification of received notifications, to exclude spoofed submissions

8. Your Rights

1. You may request disclosure, correction, addition, deletion, suspension of use, or suspension of third-party provision regarding your own personal information the Company holds. Please contact us at the contact address below. The Company will respond in accordance with applicable law after verifying your identity.
2. You may perform the following operations yourself at any time.
   • /unbind in a target group (stops processing for that group)
   • Removing a linked account from the dashboard
3. If you wish to delete your account, please contact us at the contact address below.

9. Use by Minors

A minor should use the Service only after obtaining the consent of a parent or other legal representative.

10. Amendment of this Policy

The Company may revise this Policy in response to a change in applicable law or to the content of the Service. A material change will be announced within the Service or by another appropriate method.