1. Who we are
Hycorn and Chat Live are operated by Hycorn Technology (Hycorn Technology), a joint stock company registered in Vietnam under enterprise code , with its registered office at (“Hycorn”, “we”, “us”). We operate the Hycorn workflow platform (the website hycorn.ai and the app dashboard.hycorn.ai) and Chat Live, a shared customer inbox built on the open-source Chatwoot software and hosted by us at chat-live.hycorn.ai. A business uses Chat Live to connect its messaging channels — a Facebook Page, an Instagram professional account, a TikTok business account or a Zalo Official Account — and to answer its customers there, by hand or with an automated reply written by a Hycorn workflow. This policy explains what personal data we collect, why, and your rights.
For the accounts of the people who use Hycorn we decide how data is used (we are the controller). For the messages a business's customers send to its channels, the business decides why they are processed and we process them on its behalf, only to provide Chat Live and Hycorn to that business (we are its processor).
2. Data we collect
- Account data
- email, hashed password, name, profile image you upload, your organization and role.
- Workflow content
- graphs you build, files you upload, prompts, generated outputs.
- Connected channels
- the access tokens a platform gives us when you connect a channel (stored encrypted), and the channel's id and name. See sections 11 to 14.
- Customer conversations
- the messages a business's customers send to its connected channels and the replies the business sends (by staff or automated), with what the platform provides about the sender: a platform-scoped id, display name and profile picture, and links to attachments.
- Usage data
- execution metadata, node run logs, token + cost counters, error traces.
- Device & log data
- IP, user agent, timestamps for security and abuse prevention.
- Billing data
- handled by our payment processor; we store only the subscription identifier and last four digits.
3. How we use it
- To operate, secure, and improve the service.
- To deliver a business's customer messages into its Chat Live inbox and send its replies back through the same channel.
- To run the workflows a business sets up, including automated replies (section 10).
- To bill paid plans and metered usage.
- To send transactional emails (verification, password reset, security alerts) and, with your consent, product updates.
We do not sell personal data, do not use messaging data for advertising, and do not use a business's customer conversations to train AI models.
4. Legal basis (GDPR)
- Contract
- to provide the service you signed up for.
- Legitimate interests
- to secure the service, prevent abuse, debug.
- Consent
- analytics cookies, marketing emails. Withdraw any time.
- Legal obligation
- tax, fraud, lawful requests.
5. Sharing
We share data only with:
- Subprocessors — cloud hosting (Cloudflare, including R2 storage, and our server host), email delivery, payment processing, error monitoring. List available on request.
- Messaging platforms — Meta (Facebook, Messenger, Instagram), TikTok and Zalo receive the replies a business sends to its customers through them, under their own terms.
- AI providers a business's workflow calls (for example DeepSeek), only the content needed for that call (section 10).
- Conversation classification — when a business turns on “Conversation outcomes”, Hycorn sends the text of its customer conversations to TypeSafe's decision models (Jev, Clef) running on Cloudflare Workers AI, on Hycorn's own account, to classify them (section 10).
- Legal authorities when required by valid legal process.
6. Storage & retention
Workflow content is retained until you delete it or close your account. Soft-deleted accounts are permanently purged after 30 days (see Settings → Privacy). Customer conversations are kept in the business's Chat Live inbox and Hycorn conversation log until the business deletes them or closes its account, and in any case no longer than the retention period of the business's workspace. Conversation classifications (section 10) hold no message text and are kept for 400 days from the start of the conversation they describe, then deleted; a business can erase one customer's conversations and classifications sooner. Channel access tokens are deleted as soon as the channel is disconnected or the person who granted them asks us to (section 15). Run logs are kept for the retention period of the workspace; audit logs for 90 days, then archived.
7. Security
Encryption in transit (TLS 1.2+) and at rest. Provider API keys and channel tokens are stored encrypted (AES-GCM). Passwords are hashed with bcrypt. Two-factor authentication is available in account settings. Chat Live is reached only through a Hycorn sign-in.
8. Your rights
You can:
- Access and export your data via Settings → Privacy → Export.
- Correct your account information any time in settings.
- Delete your account; all linked content is removed after the 30-day grace window.
- Object to processing or restrict it — email [email protected].
- Lodge a complaint with your local data protection authority.
If you wrote to a business through a channel it connected to Chat Live, that business controls your conversation: ask it first. We help it answer your request, and you can also write to [email protected].
9. Cookies
We set strictly necessary cookies for authentication and session security. Optional analytics cookies are loaded only with your consent (managed via the cookie banner). The banner respects the browser's "Do Not Track" signal — DNT enabled means analytics stays off without prompting.
10. Automated (AI) replies
A business can let a Hycorn workflow answer the conversations it leaves to its bot in Chat Live. The workflow reads the customer's message and the recent turns of that conversation and writes the reply — from the business's own rules and answers, or by calling an AI model provider the business selects (for example DeepSeek). Only the text needed to write that reply is sent to the provider, which processes it under its own terms. Staff can take over a conversation at any time; the bot then stops answering it. Replies are labelled as sent by the business's bot in the inbox.
Conversation outcomes. A business can also switch on, office by office, a background classification of its customer conversations: what the customer asked about, how far it got and how it ended (for example an order or a booking). Hycorn sends the conversation's text to TypeSafe's decision models on Cloudflare Workers AI, which return choices from the business's own list and no generated text; the provider processes it under its own terms only to answer. Hycorn keeps the result — option ids and scores, no message text — for 400 days. If the business chooses, the result is also written back as labels on the conversation in its Chat Live inbox. The business can correct a result, switch the feature off, or erase one customer's conversations and classifications at any time; a customer who wants that should ask the business first (section 8).
11. Facebook, Messenger and Instagram
When a business connects a Facebook Page (and the Instagram professional account linked to it) in Chat Live with Facebook Login, we receive, with the permissions the person grants — pages_show_list, pages_manage_metadata, pages_messaging, pages_read_engagement, business_management and, for Instagram, instagram_basic and instagram_manage_messages — the list of Pages the person manages, the Page's name and the Instagram account linked to it, an access token for each Page chosen, and the app-scoped id of the Facebook account that granted it. When an Instagram professional account is connected with Instagram Login instead, we receive, with instagram_business_basic and instagram_business_manage_messages, the account's id, username and an access token.
We use these only to receive the messages people send to that Page or Instagram account, to show them in the business's inbox, and to send the replies the business (or its workflow) writes. We store tokens encrypted, and keep the granting account's id only to honour a deletion request (section 15). Hycorn can also connect a Page directly to a workflow (“Kết nối Facebook”, pages_show_list, pages_messaging, pages_manage_metadata), where enabled; the same rules apply.
12. TikTok
Business Messaging. When a business connects a TikTok business account in Chat Live, we receive, with the scopes the person grants (user.info.basic, user.info.username, user.info.profile, user.info.stats, user.account.type, user.insights, message.list.read, message.list.send, message.list.manage), the account's open ID, username, display name, avatar and account type, and an access token and refresh token. We use them only to receive the direct messages people send to that account, show them in the business's inbox and send its replies. We do not read the account's followers, comments or videos for any other purpose.
Publishing. When you connect a TikTok account to publish videos from your workflows, we receive, with the permissions you grant (such as user.info.basic, video.upload and video.publish), the account's open ID, display name and avatar, and an access token and refresh token. We use them only to upload or publish the videos your workflow produces, with the caption it writes, to the account you connected.
To delete TikTok data, disconnect the inbox in Chat Live or remove the TikTok key in Hycorn: the tokens are deleted with it. Revoking Hycorn in TikTok (Settings and privacy → Security → Manage app permissions) stops the tokens from working at once, but does not by itself delete them from our systems — to have them deleted, disconnect the inbox as above or write to [email protected]. Messages and videos already delivered stay on TikTok.
13. Zalo
When a business connects a Zalo Official Account in Chat Live, we receive the account's id and name and an access token, and the messages its followers send to it, with their Zalo user id, display name and avatar. We use them only to show those messages in the business's inbox and send its replies.
14. Children
Hycorn is not directed to children under 16. If you believe a child has provided us data, contact us and we will delete it.
15. Deleting channel data
- Remove Hycorn from Facebook (Settings & privacy → Settings → Business integrations, or Apps and websites). Facebook tells us; we delete every Page token that account granted to Hycorn and to Chat Live, disconnect those Page channels (and the Instagram accounts connected through them), turn off the workflows that used them, and give you a confirmation code you can check on /data-deletion. An Instagram account connected with Instagram Login is not covered by this: disconnect its inbox in Chat Live, or write to us.
- Disconnect a channel in Chat Live (Settings → Inboxes → delete the inbox), or delete its key on the Keys page in Hycorn; its tokens are deleted.
- Delete your account in Settings, or write to [email protected].
Conversations stay with the business that received them (they are its records) until it deletes them or its retention period ends. Full steps: /data-deletion.
16. Early-access list
The early-access form on hycorn.ai stores the email you leave, the page's language, where you came from (utm parameters, the referring site, the landing path) and your browser type; your IP address only as a one-way hash, to stop spam. It is used only to tell you when early access opens and to count how many people are waiting — never sold or shared. Write to [email protected] to be removed.
17. Changes
We will post material changes to this policy in-product and by email at least 30 days before they take effect.
18. Contact
Privacy questions and requests: [email protected].
By post: Hycorn Technology (Hycorn Technology), .