Privacy Policy

1. Operator and contact

Helsup Chat is operated by Nguyen Vương Thành, Hanoi, Vietnam. For privacy questions or requests, email zindoc@gmail.com.

For our own account administration and service operations, we determine how information is handled. When an organization deploys a chatbot for its visitors, it determines its own purposes for collecting visitor information, and Helsup processes hosted content to provide that service. Contact the website operator as well when your request concerns its use of your data.

2. Local Lite tools and optional Cloud

Local FAQs: Reading or searching Lite's local FAQs does not send those questions to Helsup. FAQ content and plugin settings stay in the site's WordPress installation unless the operator separately transfers them.

Local email form: The form sends a visitor's name, email and message through the site's mail provider to its chosen recipient. Lite does not keep a local message archive. Hosting and mail providers may retain logs or copies. The website operator's privacy policy applies.

Optional AI connection: Lite loads the hosted Helsup widget only after the administrator configures it and the visitor gives consent and chooses Use AI. This sends a request to Helsup, including connection information, site origin and the public chatbot identifier. Messages entered into the hosted widget are processed by the Cloud service. Lite does not automatically upload its FAQ library or synchronize customers.

3. Information we handle

• Account and workspace information: identifiers, name/email supplied through account or sign-in flows, workspace membership, permissions and settings.
• Content you provide: chat messages, AI replies, contact details you choose to enter, knowledge articles, documents and relevant configuration or instructions submitted to the service.
• Technical information: IP address and browser request information received by the server, website origin, chatbot/release identifiers, timestamps, session or conversation identifiers, usage records and security/audit events.
• Support and commercial records: information you send when requesting support and the order or entitlement information needed for any service you purchase. Payment information handled by a checkout provider is also subject to that provider's notice.

Only provide information needed for your question. Do not submit passwords, provider API keys, full payment-card details or unnecessary sensitive personal records in a chat.

4. Purposes and legal basis

We process information to authenticate users, maintain workspaces and assistants, retrieve configured knowledge, generate replies, retain conversation history, deliver support, manage applicable service entitlements and investigate abuse or technical problems.

Depending on the activity and applicable law, processing relies on performing the service requested, consent, legitimate interests in operating and securing the service, or legal obligations. Where consent is required, you may withdraw it for future processing. Withdrawal does not automatically erase data already processed lawfully.

5. AI processing and recipients

We do not use your chat data to train AI models. This applies to chat messages and conversation content processed through Helsup Chat. It does not mean messages never leave the application: the configured AI provider may receive relevant messages, recent conversation context, instructions and knowledge excerpts to generate a response.

The current application integration uses OpenAI's API for external AI inference when enabled. The provider's own processing, security and retention terms apply to that API processing. See OpenAI's Privacy Policy (opens in a new tab). An account operator using its own provider credentials is also responsible for the applicable provider account settings and agreement. We do not promise that providers keep no operational or security records.

Information may also be handled by hosting/infrastructure providers, authentication or connected service providers, mail providers and authorized people supporting the service, to the extent needed for their role. Relevant conversation records may be available to authorized members of the organization operating the chatbot. We may disclose information where required by law or to address fraud, security threats or legal claims. We do not sell chat content.

6. Cloud storage, retention and transfers

Hosted chat data is stored in the cloud. Account, workspace, knowledge and conversation records are retained to maintain the service and history requested by the workspace operator. Removing a widget or uninstalling Lite does not itself delete these hosted records.

There is no single automatic deletion period covering all record types. The criteria are the lifetime and purpose of the workspace or conversation, a valid deletion request, unresolved support or security incidents and any legal record-keeping obligations. Ordinary conversation records may remain until deletion is requested or arranged with the operator. Temporary conversation context can expire sooner; expiry of that context is not a promise that all conversation, audit, provider or backup records have been erased.

To request deletion or clarify retention for a particular workspace, contact zindoc@gmail.com. We assess the request, verify authority where needed and explain any records that must be retained and why. Backup, mail-provider and AI-provider records can have separate retention conditions; ask us for the arrangements relevant to your deployment.

Cloud hosting and external providers may process information outside Vietnam or the country where you live. This policy does not promise storage in a particular country. Contact us before sending information subject to a specific residency, contractual or regulatory restriction so the deployment can be assessed.

7. Cookies and browser storage

The application uses session cookies for account/session functions and browser storage for preferences, guest drafts, workspace navigation and conversation or design state. The exact records depend on which features you use. Clearing cookies or browser storage can sign you out or remove a local draft; it does not itself delete records stored in Cloud.

Lite's local spam protection uses a salted IP-derived hash and temporary counters on the WordPress site. Lite does not store the raw IP in those counters. The counters expire after up to one hour, although expired database rows may remain until WordPress cleanup runs. Lite does not remember the visitor's Cloud-consent choice between page loads.

A website's own theme, plugins, host and embedded services may use additional cookies or analytics outside Helsup's control. Consult that website's privacy and cookie notices.

8. Choices, access and deletion requests

You can continue using local Lite FAQs and contact options without enabling AI. After choosing the hosted widget, reload the page to end its current page connection and do not enable it again if you no longer wish to use it.

Depending on applicable law, you may request access, correction, deletion or a copy of personal information, restriction of processing, withdrawal of consent or objection to certain processing. Email us with enough information to identify the account, website or conversation; do not include a password or unnecessary sensitive documents. We may ask for proportionate identity or authority verification and respond as required by applicable law.

If an organization operates the chatbot, contact it for requests concerning its purposes or records. You may also contact an appropriate data-protection authority where the law provides that right.

9. Security, sensitive information and children

The application uses access controls, validation and security measures intended to protect service data. No network or storage system can be guaranteed completely secure. Report suspected unauthorized access privately to our contact address.

The service is not intended for children to create independent accounts. If you believe a child has provided personal information without appropriate authorization, contact us so we can investigate. Organizations deploying assistants in education or other sensitive settings must assess their own notices, authorization, data minimization and legal obligations before use.

10. Updates and contact

We may update this policy to reflect changes to service operations or legal requirements. We will publish the revised policy and date here and provide additional notice or obtain consent when required for a material change.