1. Information we collect
We collect the following categories of information:
- Account data: your full name, email address, and sign-in method (Google, or email and password via Firebase Authentication), and your acceptance of these policies. We never see or store your password; Firebase manages it.
- Workspace content: messages, tasks, documents and files, and customer, order, and quote records that you and your bots create in the workspace.
- Voice notes: audio you record in the product, which is transcribed to text so bots can act on it.
- Usage records: information about how the Service is used, such as tokens consumed and bot runs, used for billing, plan limits, and reliability.
- Credentials you save for bots: any login or API credential you choose to store for a bot, kept in encrypted secure cards. These are never shown to the AI model; bots use them only through controlled actions.
- Integration tokens: authorization tokens created when you connect a third-party integration (for example a calendar, email, or storage provider) you have approved.
2. How we use information
We use the information above to:
- operate the Service, including running bots, chat, tasks, documents, scheduling, and the sandboxed cloud computer where enabled;
- authenticate you and secure your account and workspace;
- generate AI responses and Output, as described in Section 3;
- calculate usage against your plan and process billing;
- maintain, troubleshoot, and improve the Service, including diagnosing errors;
- communicate with you about the Service, including security or policy notices.
3. AI processing and third-party model providers
To generate bot replies and Output, relevant messages and workspace context are sent to AI model providers (for example, Google Gemini) and a decision service that routes requests to the right provider and model.
We do not sell your data, and we do not use your workspace content to train our own models. Processing by AI model providers is subject to their own terms; we choose providers we believe handle data responsibly, but we cannot make representations about a provider's own training practices beyond what its terms state.
Where a company enables the sandboxed cloud computer or browser for a bot, actions taken there and any pages or files the bot accesses are processed to complete the task the company assigned.
6. Data retention
We retain workspace content and account data for as long as your account is active, and for a reasonable period after account closure to allow data export and to meet legal, tax, and security obligations, after which it is deleted or anonymized.
You can ask us to delete your account and associated data earlier, subject to Section 10 and Section 11.
7. Data security
We use technical and organizational measures, including encryption of stored credentials, access controls, and secure transmission, to protect information against unauthorized access, loss, or misuse. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.
8. International data transfers
dualforceOS is a global service. Your information may be processed in Singapore, Vietnam, the United States, and other regions where our infrastructure and AI model providers operate. Where required, we rely on appropriate contractual or legal safeguards for these transfers.
9. Your rights (EU/UK and similar jurisdictions)
If data protection law such as the GDPR or UK GDPR applies to you, you have the right to access, correct, delete, or restrict the processing of your personal data, to object to certain processing, to receive a copy of your data in a portable format, and to withdraw consent where processing is based on consent, without affecting processing carried out before the withdrawal.
To exercise any of these rights, contact us at [email protected]. You also have the right to lodge a complaint with your local data protection authority.
10. Your rights (Vietnam)
If you are in Vietnam, your personal data is also protected under Decree 13/2023/ND-CP on Personal Data Protection. Under this Decree, you have the right to be informed about the processing of your personal data, to access it, to correct it, to withdraw your consent, to request deletion, to restrict processing, and to object to processing, subject to the conditions set out in the Decree.
Where processing relies on your consent, we ask for that consent clearly, for a specific purpose, and you may withdraw it at any time by contacting [email protected]. Withdrawing consent does not affect processing carried out before the withdrawal or processing we are required or permitted to continue under applicable law.
11. Age requirement
The Service is intended for business users who are at least 18 years old. We do not knowingly collect personal data from anyone under 18. If you believe a minor has provided us with personal data, contact us and we will take appropriate action.
12. Changes to this Policy
We may update this Policy from time to time. If we make material changes, we will notify you, for example by email or an in-product notice, before the changes take effect.
13. Contact us
ThinkPrompt, Floor 9-10-11, DreamPlex Building, 21 Nguyen Trung Ngan Street, Ben Nghe Ward, District 1, Ho Chi Minh City, Vietnam. Phone: 0776 147 969.
For any question about this Policy, or to exercise a data protection right described above, contact [email protected].