Privacy Policy

Last updated: 2026-09-26 · Bản tiếng Việt

Scaleon ("we", "us") is web-based sales management software for businesses in Vietnam, developed and operated by QUYEN MINH VU IMPORT EXPORT COMPANY LIMITED. Businesses use Scaleon to answer their customers on Facebook Messenger, take orders, manage products and stock, ship through delivery carriers, reconcile payments and read sales reports. This policy explains what data Scaleon processes, why, how long it is kept and how to have it deleted.

Who is responsible

For the conversations, customer records and orders a business manages in Scaleon, that business decides what is collected and why; we process this data on its behalf and only to provide Scaleon to it. For the accounts of people who sign in to Scaleon, we are responsible.

How accounts are connected

• Facebook Pages are connected through Facebook's official authorization screen (Facebook Login); the administrator chooses the Pages. Scaleon never asks for a Facebook password.
• Meta ad accounts and Conversions API: the administrator enters an access token of a system user in the business's own Meta Business account (used to read ad reports), and, if the business turns on the Conversions API, its pixel or dataset ID and access token.
• Delivery carriers and payment services: the administrator enters the API key, token or API account (user name and password issued for API use) that the carrier or payment service gives the business.
• Zalo OA (in testing), TikTok Shop and Shopee (in development): through each platform's own authorization screen once available.
• Every token, API key and API password is encrypted with AES-256-GCM before it is stored.

Data we receive from connected platforms

Facebook Pages and Messenger (Meta)

• The Pages the administrator selects (name, ID) and each Page's access token.
• Messenger conversations between customers and those Pages: message text, attachments and time; the customer's Page-scoped ID (PSID), name and profile picture as provided by Meta. Received through Page webhooks and the Conversations API.
• Messages the business's staff send from Scaleon, including replies with the HUMAN_AGENT tag within 7 days of the customer's last message. Every such reply is typed by a person; Scaleon sends no automated or promotional messages with this tag.

Meta advertising

• For ad accounts the business assigns to a project: account, campaign, ad set and ad names, spend and results (read-only, to calculate advertising cost per order). Scaleon does not create or edit ads.

Meta Conversions API (only if the business turns it on)

• Events sent to the business's own pixel or dataset: Purchase (an order is confirmed, with its value), LeadSubmitted (a customer left a phone number in a Messenger conversation) and LeadQualified (staff confirmed the customer by phone).
• Each event may include SHA-256 hashes of the customer's phone number (also used as external ID), first and last name, country and city or province; and, unhashed as Meta requires, the Page ID and the customer's PSID, plus the fbc/fbp click identifiers, IP address and browser user agent when the customer came from the business's landing page.

Zalo Official Account (in testing)

• The Official Account (OA) ID and name; access and refresh tokens.
• Messages between users and the OA (text, attachments, time); the user's Zalo ID for that OA, display name and avatar as provided by Zalo.

Instagram (in development)

• Only if a business connects an Instagram professional account once available: the account ID and username, direct messages with that account (text, attachments, time), and the sender's Instagram-scoped ID, username and profile picture as provided by Meta.

TikTok Shop and Shopee (in development)

• Only after a seller authorizes its shop once available: shop ID and name; access tokens; orders (order ID, items, quantities, prices, fees, status) with the buyer's name, phone number and delivery address as provided by the marketplace for fulfilment; products and stock levels; settlement amounts.
• Used only to sync the seller's orders and stock, arrange delivery and produce the seller's reports, never to contact the marketplace's buyers for other purposes.

Delivery carriers and payment services

• Carriers the business connects (such as GHN, GHTK, Viettel Post, J&T Express, Ahamove): we send the recipient's name, phone number, address, parcel details and COD amount of the orders the business ships, and receive tracking statuses and COD reconciliation data.
• VietQR codes are generated from the business's own bank account. If the business connects SePay or payOS, we receive incoming transfer notifications (amount, transfer content, time, transaction reference) to match payments to orders.

The business's own landing pages (optional)

• Form submissions: name, phone number, address, product, quantity and order value, plus the tracking data the page sends (fbclid, fbc, fbp, UTM parameters, campaign, ad set and ad IDs, IP address and browser user agent).
• Page views: a random visitor ID, the page, campaign and ad IDs and UTM parameters, without name, phone number or IP address.
• Used to create leads for the business's staff and to measure its conversion rate and ads. The business is responsible for informing visitors of its own website.

Data entered in Scaleon

• Business data entered or imported by staff: customers (name, phone number, address, notes), orders, products, stock and costs.
• Staff accounts: name, user name, role, password hash (bcrypt), two-factor settings and passkeys, sign-in history (time, IP address, device) and security logs.

How we use data

• Only to provide Scaleon to the business: show conversations to its staff and send their replies, create and ship orders, reconcile payments, produce reports and keep accounts secure.
• Staff see only the projects (stores) they are assigned to; each connected Page belongs to one project.
• We do not sell data, do not share it with third parties for their own purposes, do not use it for our own advertising and do not use it to train AI models.

Sharing

Data leaves Scaleon only to carry out the business's instructions: to Meta when the business uses Meta features (replies through the Messenger Platform, Conversions API events), to the carriers and payment services it connects, to our hosting provider that stores it on our behalf, or to competent authorities when Vietnamese law requires it. Each platform processes what it receives under its own terms.

Where data is stored and how it is protected

Data is stored on servers located in Vietnam that we rent and manage, and travels over HTTPS. Tokens, API keys and API passwords are encrypted with AES-256-GCM; staff passwords are hashed. Two-factor sign-in is available and administrators can require it for their staff; access is role-based and sign-ins are logged.

Cookies

Scaleon uses only the cookies it needs to work: keeping a user signed in, the two-factor, passkey and re-verification steps, the selected project, a short-lived cookie while a Facebook Page is being connected, and interface preferences. We use no advertising or analytics cookies. The public pages of this website set no cookies.

Retention

• Facebook Page access tokens are deleted immediately when an administrator removes the Page ("Gỡ").
• Other keys (ad-account token, Conversions API token, carrier, payment and marketplace keys): turning a connection off stops its use but keeps the encrypted key, so it can be turned back on and parcels already on the way can still be tracked. They are deleted within 7 days of a request, and within 30 days after the business stops using Scaleon.
• Conversations, customer records, orders, landing-page leads and marketplace buyer data are kept while the business uses Scaleon. They are deleted within 7 days of a verified deletion request, and within 30 days after the business stops using Scaleon, unless Vietnamese law requires a longer period (for example, accounting records the business must keep).
• Sign-in history (time, IP address, device) is deleted after 180 days.
• Security and permission audit logs are append-only: they cannot be edited or deleted from the application and are kept while the business's account exists, to protect it.

Your rights and data deletion

Businesses can remove a Facebook Page in Scaleon themselves at any time. Every other deletion request is handled by our staff: email lienhe@scaleon.vn, we verify the request, carry it out within 7 days and confirm by email. People who messaged a business through a connected Page can ask that business, or us, to access, correct or delete their data. Step-by-step instructions are in the Data Deletion Instructions.

Children

Scaleon is a tool for businesses and is not directed to children.

Changes

When this policy changes we update this page and the date above. Significant changes are announced to administrators inside Scaleon.

Contact

QUYEN MINH VU IMPORT EXPORT COMPANY LIMITED, 15 Lý Nam Đế, Phường Hàng Mã, Quận Hoàn Kiếm, Thành phố Hà Nội, Việt Nam. Email: lienhe@scaleon.vn · Phone: 0342946386.