Last updated: November 10, 2026
This is a translation for convenience. If it differs from the Vietnamese version, the Vietnamese version prevails.
This policy explains how GOFA collects, uses, shares, stores and deletes data when you use GOFA ChatBot, including the website https://chatbot.gofa.com.vn, the admin area and the connected messaging channels.
1. Operator and scope
GOFA SOFTWARE CO.,LTD (CÔNG TY TNHH PHẦN MỀM GOFA), referred to below as "GOFA". Tax code 0313314163. Address 490A Dien Bien Phu, Ho Chi Minh City, Vietnam. Phone 0973341574. Email vantu.hoang@gofa.com.vn.
This policy applies to three groups of people:
- People who send messages: anyone who messages a Page or business account connected to GOFA ChatBot.
- Businesses using the service: businesses or individuals who connect their Page to GOFA ChatBot, together with the administrators and staff given accounts.
- Website visitors: people who view the GOFA ChatBot website.
GOFA ChatBot is a software service for businesses. For a Page owned by another business, that business decides the purpose of its conversations with its customers, and GOFA processes the data to provide the service to that business. For a Page owned by GOFA, GOFA decides this itself. People who send messages can contact the Page owner or GOFA to exercise the rights in section 9.
2. Active channels
| Channel | Status |
|---|---|
| Facebook Messenger | Active |
Other channels are not active. Before a new channel goes live, GOFA will update this table and state any data for that channel that differs from the description below. Each channel is operated by its platform, so messages on that channel are also subject to the platform's policies. For Messenger, those are Meta's policies.
3. Data we collect
3.1. People who send messages
- The identifier the platform assigns per Page (on Messenger, the Page-scoped ID) and the ID of the Page you message.
- The text of your messages, when they were sent, and the replies staff send you.
- The type of any attachment, such as an image. GOFA does not download or store file contents or file links.
- Button taps in the conversation.
- How you arrived at the conversation, such as a link or an ad.
- Information you write in your messages, such as your name, phone number or what you need help with.
GOFA does not request your profile name or photo from the platform.
3.2. Businesses, administrators and staff
- On self sign-up: email, hashed password, full name, business name, the business contact name and email, the version of the Terms accepted and when it was accepted.
- Account: email, name, role, hashed password, second-factor information (encrypted TOTP secret or passkey).
- Login sessions: IP address, browser information, login and activity times.
- When connecting a Page with Facebook Login: the app-scoped ID of the person logging in, the list of Pages that person manages, Page names and Page access tokens. Access tokens are encrypted and stored only on the server. GOFA requests the permissions
pages_show_list,pages_manage_metadataandpages_messaging, and uses them only to list Pages, receive message events and send replies. - Content the business enters: business information, greeting, assistant configuration and the on or off setting of the assistant.
- Knowledge base: frequently asked questions, the text extracted from PDF or DOCX files (GOFA does not keep the files), and the content of public web addresses the business provides (one page, fetched once).
- Replies staff send in the admin area.
3.3. Website visitors
IP address, page path and access time in technical logs. The sign-up, forgotten-password and resend-verification forms collect the information you enter. Apart from these forms, the website does not collect information through forms.
4. How we use data
- To receive and answer messages and keep the context of the conversation.
- To transfer the conversation to the Page's staff. Authorized staff can read the conversation in order to help you.
- To let businesses sign in, connect Pages and manage conversations.
- To send transactional email such as account verification and password reset.
- To provide technical support when a business needs it, within the limits in section 8.
- To keep the system secure, detect faults and prevent abuse.
- To carry out deletion requests and meet legal obligations.
GOFA does not sell your data and does not use data received from the platform for advertising.
5. Automated assistant and AI
When you message a Page with the assistant on, you are told you are talking to an automated assistant: at the start of the conversation, after a long period without interaction, and when the conversation moves from staff back to the assistant. You can send "gặp nhân viên" (talk to staff) at any time.
Stopping automated messages: send a message containing only "dừng", "dừng lại", "stop", "hủy", "đừng nhắn nữa" or "ngừng nhắn tin". The system confirms once, stops replying automatically, and staff cannot send you messages through GOFA ChatBot until this is turned back on. Messages you send afterwards are still stored but are not processed by AI. If Page staff message you directly in the platform's inbox, the system cannot block that. To turn it back on, send "bật lại" or "start", or send "gặp nhân viên" to move to staff. Page staff can also turn it back on.
As of the date at the top of this page, AI replies are off on all Pages. Messages from people who message a Page are not sent to any AI provider. A Page with the assistant on only sends automated notices and the option to talk to staff. Before AI is turned on, GOFA will update this section to state what data is sent and where it is processed.
Test chat in the admin area: when an administrator test-chats with the assistant, what the tester types, the draft configuration, the business information and relevant passages from the knowledge base are sent to an AI service provider to generate a test reply, even while AI is off for customers, and may be processed outside Vietnam. Test chat creates no conversation, sends nothing to customers and is not stored by GOFA. Do not enter customers' personal data in test chat.
GOFA does not use your messages to train AI models.
6. Sharing
| Recipient | Data | Reason |
|---|---|---|
| Messaging platform (Meta for Messenger) | Messages and identifiers | To send and receive messages |
| The business that owns the Page | Conversations with that Page | To support its customers |
| Cloudflare | Website, admin and platform event traffic passing through it | Content delivery and website protection |
| Amazon Web Services (Amazon SES), processed in the United States | Email address and transactional email content | To send transactional email |
| AI service provider | Business content during test chat in the admin area, as in section 5 | To generate test replies |
| Competent authorities | As requested | When the law requires |
Apart from the recipients above and the infrastructure providers that operate GOFA's systems, GOFA does not provide your data to third parties.
7. Retention
| Data | Period |
|---|---|
| Conversations, messages and identifiers of people who send messages | 12 months from the most recent interaction, then deleted automatically, unless you request earlier deletion or the law requires longer retention. A business disconnecting a Page does not shorten this period, but the business can delete all data of the Page |
| Incoming message events | Content removed right after processing, record removed after 7 days |
| Page access tokens | Until the Page is disconnected |
| GOFA support access log | 12 months, then deleted automatically. Records only who accessed, the business, the operation, object ID, reason and time, with no content |
| Knowledge base | Until deleted. Deleting one document only removes it from search; passages already used in a chat turn remain until the conversation is deleted, retention expires, or the whole knowledge base is deleted. Deleting all data of a Page deletes the whole knowledge base |
| Page access tokens in an unfinished connection session | Encrypted, up to 15 minutes, then expire and are cleaned up periodically |
| Deletion request records | After completion, only counts and times remain, with no identifier of the person who sent messages |
| Page deletion audit record | Keeps the Page ID, requester, time and number of items deleted. No customer identifiers or message content |
| Unverified accounts | Deleted automatically after 7 days |
| Accounts | Until the account is deleted. The account, login sessions and second factor are then deleted. Messages staff sent remain in the conversation, not linked to the account |
| Login sessions | Expire after 1 hour of inactivity, 24 hours at most, then removed in the hourly cleanup |
| Technical logs | At most about 31 days |
Technical logs contain no message content or identifiers of people who send messages.
8. Security
GOFA verifies the signature of every platform event, encrypts Page access tokens, transmits data over HTTPS, stores passwords only in hashed form, and supports a second factor, which is required for administrators of GOFA and of businesses that turn this requirement on. Data is separated by business. Within a business, access is by role and by Page: staff see only the Pages assigned to them, owners and administrators see that business's Pages. GOFA staff can view a business's data only for support and only when granted access; this access is read-only, requires a stated reason, lasts 1 hour and is logged. No measure is perfectly secure. Please do not send passwords, payment card numbers or sensitive information in the conversation.
If you find a security vulnerability, please report it to vantu.hoang@gofa.com.vn.
9. Your rights and how to request deletion
You can ask to access, correct or delete your data, or stop automated messages as described in section 5.
People who send messages: send "xóa dữ liệu" to the Page, then tap "Xác nhận xóa" (Confirm). If you cannot message the Page, email vantu.hoang@gofa.com.vn with the Page name, the time of your last message and the content of a recent message. GOFA will process your request within 30 days and tell you the result. See the data deletion instructions.
Businesses, administrators and staff: disconnect a Page in the admin area (/app/pages) to delete the Page access token and stop receiving messages, or email the address above to request account deletion. Disconnecting does not delete stored conversations. A business can delete data itself in the admin area: an owner or administrator of the business deletes a Page's data after typing the exact Page name; an owner deletes all data of the business. A business can also send a request to GOFA. When a Page's data is deleted, the Page is disconnected immediately, then the system deletes the Page's conversations, messages, assistant configuration and knowledge base in a background job.
Deletion requests apply to data on GOFA's systems. The message history in your Messenger account is managed by Meta.
10. Cookies and browser storage
| Name | Type | Purpose | Duration |
|---|---|---|---|
__Host-Http-session |
Necessary cookie | Keeps the admin login session | Expires after 1 hour of inactivity, 24 hours at most |
gofa-chatbot.theme |
Local storage | Remembers light or dark mode | Until you clear it |
Both items are used only in the admin area. The public pages of the website set no cookies and use no browser storage. GOFA uses no advertising cookies or external analytics tools. Cloudflare may set technical cookies to protect the website. You can clear cookies in your browser, after which you will need to sign in again.
11. Changes to this policy
When this policy changes, GOFA will update this page and the date at the top.
12. Contact
For any questions about data, please contact vantu.hoang@gofa.com.vn or 0973341574.