Privacy Policy

This policy explains how Haru — a software product at haru.com.vn operated by Hộ kinh doanh Nguyễn Đức Nam (business household, registration no. 8412496920-001) ("we") — collects, uses, shares and deletes personal data when you use our AI assistant for Facebook Page messages (Messenger) and Meta ads management. It applies to shop owners (Haru account holders) and to people who message a Page (the shop's customers). It follows Vietnam's Decree 13/2023/ND-CP on personal data protection and the Meta Platform Terms.

Data controller and contact

Send any privacy request (access, correction, deletion, complaint) to the data controller below:

Data we collect

• Haru account: email, display name, password (scrypt-hashed — never stored in plain text), role, creation time.
• Data from Meta when you log in with Facebook: only what you grant in the Facebook data section, including the access token issued by Meta.
• Page message data (when you enable a Page): messages customers send and replies sent (including AI-drafted ones), the sender's public name and profile picture, labels/notes you add; order details a customer voluntarily provides in the conversation (name, phone, address, products).
• Comments on your Page posts (when you enable comment automation): the comment text and the commenter's public name, so the bot can reply publicly, send a private reply, or hide the comment according to the rules you set; part of the text is written to the activity log for your own reference.
• Data you enter: product catalog, AI context, message templates, automation rules; AI API keys if you connect your own.
• Technical data: IP address, request time and type (server logs), login session cookie.
• Contact form: name, phone, email, shop name and the message you send.

Data from Facebook and how we use it

When you click Log in with Facebook, Haru requests only the minimum access through Meta's official login dialog, in order to:

• See the list of Pages you manage and let you choose which Pages use Haru.
• Receive messages customers send to the Pages you enable and send replies (yours or the AI's) from that Page.
• Send Meta-approved utility message templates (order updates) to customers after 24 hours.
• If you enable the optional comment automation: read comments on posts of the Pages you enabled, reply publicly, send a private reply to the commenter, or hide a comment according to the rules you set.
• If you enable the optional Meta Ads module: read metrics and perform the actions you request on the ad accounts you choose.

Haru does not request access to your friends, personal posts or any data beyond the scope above. You can review, limit or revoke access at any time in Facebook Settings › Business Integrations; revoking removes Haru's access immediately.

How we use data

• Show your Page inbox so you or the AI can reply; create and manage orders at the customer's request.
• Send conversation content to your chosen AI provider solely to generate a reply for that conversation.
• Send utility templates (order updates) after the 24-hour window when an order changes status.
• Show ad reports and perform the actions you request on your own ad accounts.
• Security, abuse prevention, troubleshooting; support when you ask for it.
• When you turn on Real messages to improve the bot in Settings yourself (off by default): statistics on the messages of your own account's Pages — what customers ask, which questions the bot could not answer — so you can tune your own bot. The copy used for this has phone numbers, emails, links, addresses and customer names masked, is kept separately for each account and is never combined with other customers' accounts.

Who we share data with

• Meta Platforms: to read/send messages and ad metrics as you request, under the Meta Platform Terms.
• The AI provider you choose (DeepSeek, OpenAI, Google, Anthropic, xAI, Moonshot, OpenRouter, Z.AI): receives conversation content and shop context to generate replies. These providers are located outside Vietnam and process data under their own policies.
• Shipping carriers: only if you enable the integration, to deliver orders.
• Authorities: when required by law.

As a Tech Provider under the Meta Platform Terms, we process Meta data only to serve the specific customer (shop owner) who connected it; each customer's data is stored separately and never used for another customer.

Where data is stored and international transfers

Haru servers are located in Singapore (Vultr). Transfers outside Vietnam (hosting and AI providers) follow the requirements of Decree 13/2023/ND-CP; data is encrypted in transit (HTTPS) and at rest.

Security

Protection layers currently in place on Haru:

Retention

• Meta access tokens: until you disconnect, remove the app on Facebook, or the token expires.
• Messages, orders, catalog, context: until you delete the Page/account or request deletion.
• Sender profile pictures: stored as the Facebook image URL alongside the conversation so the list can render it; deleted together with the conversation when you delete the Page, delete your account, or remove the app on Facebook.
• Real-message store (only if you turn it on): until you click Delete store in Settings; one customer's part is deleted when you delete that conversation from Haru; the whole store is deleted when you remove the app on Facebook or delete your account.
• Technical logs: kept briefly for troubleshooting, then deleted.

Your rights

Under Decree 13/2023/ND-CP you have the rights to be informed, to consent, to access, to rectify, to withdraw consent, to erase, to restrict and object to processing, and to complain. How to exercise them:

• Disconnect Facebook on the Connections page → the token is deleted immediately.
• Remove Haru in your Facebook Settings → Meta sends a deletion request to our callback; related Facebook data is deleted automatically and you receive a confirmation code.
• Email lienhe@haru.com.vn with the subject "Personal data request" — we respond and complete deletion within 72 hours of a valid request. See the Data Deletion Instructions.

People who message a Page (the shop's customers)

The shop owner decides the purposes of processing their customers' data; Haru processes it on the shop owner's behalf. If you messaged a Page that uses Haru and want your data deleted, contact that Page or email lienhe@haru.com.vn; we delete within 72 hours and notify the shop owner.

Cookies and browser storage

Haru uses only a login session cookie (strictly necessary) and browser storage for display preferences. No third-party advertising or tracking cookies.

Children

The service is for shop owners aged 18 or older. We do not knowingly collect children's data; if discovered, we delete it immediately.

Meta policy compliance

Our use of information received from Meta complies with the Meta Platform Terms and Developer Policies. We have registered a Data Deletion Callback with Meta and complete the annual Data Use Checkup.

Changes

Changes are posted on this page with a new date; material changes are announced in the app. Questions: lienhe@haru.com.vn.