This supplement explains additional privacy practices for users of Aflowbiz, operated by CÔNG TY TNHH PHẦN MỀM OCTO. It supplements the existing Privacy Policy.
Information processed may include account identifiers (name, work email, phone, organization and role); authentication and service-operation logs; IP address and browser or device data; billing, invoice and transaction records; and information or files voluntarily placed into the workspace, including audit and approval records.
Information is used to register and administer accounts, authenticate users, provide and support the AI workspace, execute user-authorized workflows, create evidence and audit trails, process orders and invoices, protect security, prevent misuse, respond to user rights requests, and comply with applicable law.
We do not use submitted workspace content for an unrelated purpose without a valid legal basis or other authorization required by law. Access to users’ confidential business information is limited to the legitimate service and legal purposes described here.
Account and workspace information is generally retained while the relevant account or contracted service remains active. After closure, each data category is evaluated against its operational necessity, the applicable legal, tax and accounting record-retention period, security and audit obligations, and any live dispute or legal hold.
Once no lawful retention reason remains, information is deleted or irreversibly anonymized under the applicable deletion process. Users may ask, through the contact channel below, for the retention basis of a data category and its expected disposal date. Backups and legally required transaction or audit records may follow different lawful retention schedules.
Access may be granted on a need-to-know basis to authorized Aflowbiz personnel (such as security, operations, billing and support teams); contracted infrastructure, cloud hosting, payment, customer-support and AI-processing vendors where necessary and under suitable restrictions; the customer organization’s own authorized workspace administrators; and competent authorities where lawfully required.
Third-party integrations enabled by the customer may obtain access according to the permissions the customer authorizes. Each party’s processing is subject to applicable safeguards and legal requirements.
The existing Privacy Policy describes encryption in transit (TLS), encryption at rest, least-privilege access controls and audit trails. In addition, rights requests are subject to identity or authority verification before account information is disclosed or changed, and access permissions are reviewed under internal security procedures.
No online service can guarantee absolute security. Users should protect their login credentials and promptly report suspected unauthorized access.
Step 1. Sign in and review account or workspace information using the available profile and administrative controls.
Step 2. If a field cannot be corrected in the interface, send a request to aws@aflowbiz.com from the registered account email, or through in-app Support.
Step 3. State the affected information and the accurate replacement; attach supporting evidence only if reasonably necessary.
Step 4. We verify authority, make the permitted correction or explain a justified limitation, and confirm the outcome through the original channel.
Send a request headed “Delete data”, “Restrict processing” or “Object to processing” to aws@aflowbiz.com or through in-app Support. Identify the account, the data concerned and the action requested, without sending sensitive identification documents unless they are requested securely.
We acknowledge the request, verify the requester, evaluate it under applicable law and any retention obligations, and confirm the completed action or explain why particular data must be retained or a request cannot be fully met. Where the law requires, processing may be restricted while a request is assessed.
Report unauthorized access, suspected disclosure or other privacy complaints to aws@aflowbiz.com or through in-app Support. Provide a short description, the date, the affected account and any available evidence. We register and categorize the report, investigate, ask for clarification where appropriate, give a written outcome and offer escalation under the Complaint Handling policy.
Privacy and data-rights matters are handled within the deadlines required by applicable data-protection law; the Complaint Handling page describes our general service response targets. You may also approach a competent authority as the law permits.
This is an additional disclosure, not a replacement for the Privacy Policy. If the two differ, we reconcile them promptly, and mandatory data-protection requirements always take precedence.
This disclosure supplements, and does not replace, the existing Aflowbiz pages listed below. Mandatory consumer and data protection law prevails to the extent applicable.