Privacy Policy

Effective 19/08/2026 · Last updated 12/10/2026. This English version is provided for users and platform reviewers; if it differs from the Vietnamese version, the Vietnamese text prevails under Vietnamese law (Decree 13/2023/ND-CP on personal data protection).

1. Who we are

Socsom (the website socsom.com and the web app app.socsom.com, together the “Service”) is operated by CENTREXIA COMPANY LIMITED, enterprise code 0111605265, VP905, 9th floor, block C, Ho Guom Plaza, 102 Tran Phu Street, Ha Dong Ward, Hanoi, Vietnam. Contact: hello@socsom.com, phone +84 988 668 475.

2. What the Service does

Socsom helps small businesses run daily operations with AI assistants: answering customer messages, drafting social posts and short videos, keeping order and cash records, and planning tasks. The business owner (“Customer”) approves drafts before anything is sent or published.

3. Data we collect

• Account data: name, phone number, email, business name and the business description the Customer enters.
• Business records the Customer enters or imports: orders, products, customers’ names and contact details, cash entries.
• Data from platforms the Customer connects (Google, Meta, TikTok, Zalo, e-commerce platforms, payment notifications): only what each connected feature needs, described below.
• Technical data: log-in time, IP address and error logs needed to secure the Service.

4. Google user data

This section describes exactly how Socsom accesses, uses, stores, shares and deletes data obtained through Google APIs (“Google user data”). Every Google connection is optional, is started by the Customer from the app’s “Connections” screen, and uses Google’s own consent screen. We never see or store the Customer’s Google password.

4.1 Data accessed

We request only the scopes below, and only when the Customer turns on the matching feature:

• https://www.googleapis.com/auth/drive.file (Google Drive / Sheets) — the contents of the spreadsheet files the Customer picks with the Google Picker (rows of orders, products, prices), and files the Service itself created. We cannot list or open any other file in the Customer’s Drive.
• https://www.googleapis.com/auth/youtube.upload — permission to upload a video file, its title and its description to the Customer’s own YouTube channel. We receive back the ID of the uploaded video.
• https://www.googleapis.com/auth/youtube.force-ssl — the channel ID and channel name, the list of the Customer’s own videos with their public statistics (views, likes, comment counts), and the comments on those videos (comment text, the commenter’s public display name, time posted). It also lets us post a reply the Customer has approved.
• https://www.googleapis.com/auth/business.manage (Google Business Profile) — the Customer’s business locations, customer reviews of those locations (review text, star rating, reviewer’s public display name), and permission to post a reply the Customer has approved.
• https://www.googleapis.com/auth/webmasters.readonly (Search Console) — search performance of the Customer’s own website (queries, pages, clicks, impressions, position). Read-only.

We also receive the basic account identifier Google returns with the connection (account or channel ID and name) so the Customer can see which account is connected.

4.2 How we use it

• Sheets data — imported into the Customer’s own order and product records in Socsom; order summaries are written back to a sheet the Service created.
• YouTube upload — to publish a video only after the Customer has approved that specific video in the app.
• YouTube comments and Business Profile reviews — shown to the Customer in one inbox, and used to prepare a draft reply. A reply is posted only after the Customer approves it.
• YouTube statistics and Search Console data — shown to the Customer as reports and used to suggest what to post or write next.

We do not use Google user data for any other purpose. In particular it is not used for advertising, profiling, retargeting, credit assessment, or resale.

4.3 Sharing and transfer

We do not sell Google user data and do not share it with advertisers, data brokers or other customers. It is transferred only:

• to our hosting provider, which stores it on our behalf;
• to an AI language-model provider acting as our processor (currently the Google Gemini API, DeepSeek and Anthropic), and only the text needed to draft one reply or suggestion — for example the text of a comment. Before sending we mask direct identifiers (names, phone numbers, addresses) as far as technically possible. We do not use Google user data to train any AI model, and we do not allow it to be used that way on our behalf;
• when required by law, or as part of a merger or acquisition, with notice to Customers.

4.4 Storage and protection

Google access and refresh tokens are encrypted at rest and are readable only by the Service. Imported data is isolated per business account in our database, so one Customer can never read another Customer’s data. All traffic uses HTTPS. Access by our staff is limited to what is needed to operate and support the Service.

4.5 Retention and deletion

• Google user data is kept only while the Google connection is active.
• When the Customer disconnects Google in the app, or revokes access at myaccount.google.com/permissions, we delete the stored tokens immediately and delete the data obtained through that connection.
• The Customer can ask us to delete all Google user data at any time by emailing hello@socsom.com; we complete the request within 72 hours. See also section 8.

4.6 Limited Use

Socsom’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. Specifically, Google user data:

• is used only to provide and improve the user-facing features described above;
• is not sold, and not transferred to third parties except as necessary to provide those features, to comply with law, or as part of a merger/acquisition with notice to users;
• is not used for advertising, retargeting or credit assessment;
• is not used to develop, improve or train generalized AI or machine-learning models;
• is read by humans only with the Customer’s explicit permission (e.g. a support request), for security purposes, to comply with law, or when aggregated and anonymized for internal operations.

4.7 YouTube API Services

The YouTube features of Socsom use YouTube API Services. By using them, the Customer also agrees to be bound by the YouTube Terms of Service. Google’s handling of data is described in the Google Privacy Policy. The Customer can revoke Socsom’s access to YouTube data at any time on the Google security settings page.

4.8 Generative AI and prohibited content

Socsom’s AI features produce text: draft replies, captions, post ideas and plans. The only graphics the Service makes are simple brand items (a logo, text cards) that never depict people. Socsom has no feature that generates, edits or alters images or videos of people, no face-swap, and no “undress” or similar function. Videos uploaded to YouTube through Socsom are assembled from the business’s own product photos, text and templates. Socsom does not create, store or distribute sexually explicit or intimate imagery, including AI-generated non-consensual intimate imagery (AI NCII), and does not use Google APIs or Google user data for any such purpose. Uploading such content through the Service is forbidden by our Terms of Service and may lead to suspension or closure of the account.

5. Data from Meta, TikTok, Zalo and marketplaces

Handled the same way: the Customer authorizes on the platform’s own page, we never store platform passwords, access tokens are encrypted at rest, and data is used only for the features the Customer uses, in line with each platform’s developer terms.

6. Sharing

We do not sell personal data. We share it only with service providers that host or process data for us (cloud hosting, AI model APIs, email delivery), under contracts limiting use to providing the Service, or when required by law.

7. Storage, retention and security

Data is encrypted in transit (HTTPS) and access tokens are encrypted at rest. Depending on the infrastructure provider, data may be stored or processed inside or outside Vietnam, in compliance with Article 25 of Decree 13/2023/ND-CP. Retention: account and operating data — while the account is active and up to 90 days after the Customer stops using the Service (or sooner on request); data received from a connected platform — deleted as soon as the Customer disconnects that platform; technical logs — up to 12 months; accounting documents — 10 years as required by the Vietnamese Law on Accounting.

8. Your rights and data deletion

You may access, correct, export or delete your data, disconnect any platform in the app, or revoke Google access at myaccount.google.com/permissions. To delete your account and all data, email hello@socsom.com from the account’s email with the subject “Data deletion request”, or remove the Socsom app from the platform (Facebook, Instagram, Zalo) — see Article 11 (Data deletion). Deletion is free of charge. We respond to requests within 72 hours.

9. Children

The Service is for businesses and is not directed to anyone under 16.

10. Changes and contact

We will post changes on this page and notify Customers of material changes in the app. Questions: hello@socsom.com.