Privacy Policy

This Privacy Policy applies to SynergyOne AI COS (the “Service”), available at aicos.synergyone.vn and its related sub-services, and operated by ActsOne Vietnam Co., Ltd.

The Service is an internal business system. The Company uses it to produce, review, publish and analyze short-form marketing content for the brands it distributes in Vietnam. The Service is not a consumer product and is not offered to the general public:

• There is no public registration. Accounts are created only by the Company, by invitation.
• Authorized users are Company employees and business partners engaged by the Company (for example brand partners, content creators and contractors) who need access for their work.
• Access may be suspended or removed at any time, and ends when the employment or business engagement ends.

The Service uses YouTube API Services to publish videos to YouTube channels that the Company owns or manages. When an authorized user connects a YouTube channel, the Service requests only the following permissions:

• Upload videos (youtube.upload) — to upload videos that the Company has prepared and approved to the connected channel, with their title, description, tags and thumbnail.
• View the YouTube account (youtube.readonly) — to identify the connected channel and to read the statistics of videos the Service published, for the Company’s internal performance reporting.

Access credentials received from Google are stored encrypted and are used only to perform these functions. We do not sell data received from Google APIs, do not use it for advertising, do not share it with third parties except as needed to operate the Service or as required by law, and do not use it to develop, improve or train generalized artificial intelligence or machine learning models.

The use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. By connecting a YouTube channel, users are also subject to the YouTube Terms of Service and the Google Privacy Policy.

You can disconnect a channel at any time in the Service (Settings › Channels › Disconnect), which deletes the stored credentials and asks Google to revoke the access. You can also revoke the Service’s access from your Google Account permissions page. Upon request, we will delete the YouTube data we have stored within 30 days, except records we are required to keep by law.

We process personal data in compliance with Vietnamese law, including the Law on Cybersecurity (No. 24/2018/QH14), Decree No. 13/2023/NĐ-CP on personal data protection, and other applicable regulations. Our legal bases are:

• Contractual necessity: to perform employment, service and partnership agreements.
• Consent: for example the consent of people who appear in content, and of users who connect a platform account.
• Legitimate interests: to operate, secure and improve the Company's business operations.
• Legal obligation: when required by Vietnamese law, court order or a competent authority.

Where processing is based on consent, you may withdraw it at any time by contacting support@actsone.vn. Withdrawal does not affect processing carried out before it.

• To provide accounts, control access by role and brand, and keep the Service secure.
• To produce, edit, caption, review and approve marketing content.
• To publish approved content to the channels the Company manages, at the scheduled time.
• To measure the performance of published content and plan future content.
• To analyze content with AI tools that run on Company-managed servers or are provided by service providers acting on our behalf.
• To detect and prevent misuse, and to comply with legal obligations.

We do not sell, trade or rent personal information. We share it only as follows:

• Platforms you publish to: content and its metadata are sent to the platform (for example YouTube, TikTok, Meta or Shopee) when it is published, as instructed by an authorized user.
• Service providers: hosting, email delivery, publishing and storage providers that process data on our behalf under confidentiality obligations.
• Brand partners: content and performance reports are shared with the brand owners the Company works for, within the scope of the business agreement.
• Parent company: ActsOne Corp. (Republic of Korea), for business coordination, under equivalent data protection safeguards.
• Legal requirements: when required by law, regulation, court order or a competent authority.
• Business transfers: in a merger, acquisition or sale of assets, where the acquirer agrees to honor this Policy.

We protect information with access controls by role and brand workspace, encrypted connections (HTTPS), encryption of stored access credentials and secrets, audit logging, and periodic security reviews. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

If a personal data breach poses a risk to your rights and freedoms, we will notify the competent Vietnamese authorities within 72 hours of becoming aware of it, and notify affected individuals without undue delay, in accordance with Decree 13/2023/NĐ-CP.

The Service uses only the cookies and browser storage it needs to work:

• Strictly necessary: keeping you signed in and protecting the session.
• Trusted device: if you choose “Trust this device”, so that future sign-ins on that device are easier.
• Preferences: language, theme and similar display settings.

We do not use advertising or cross-site tracking cookies.

• Account and access data: for the duration of your employment or engagement, and afterwards only as long as needed for business records and legal obligations.
• Platform access credentials: until the channel is disconnected or the access is revoked.
• Business content and performance records: as long as needed for the Company's business and the applicable brand agreements.
• Audit, security and legal records: as required by applicable Vietnamese law (typically 5–10 years).

When data is no longer required, we securely delete or anonymize it. You may request earlier deletion as described in the next section.

Under Decree 13/2023/NĐ-CP and applicable standards, you have the right to be informed, to access, correct and delete your personal data, to withdraw consent, to object to or restrict processing, to receive your data in a portable format, and to lodge a complaint with the Ministry of Public Security or another competent authority.

To exercise these rights, send a written request to support@actsone.vn. We will respond within 30 days and may need to verify your identity first. Some data may need to be kept to meet legal obligations.

The Service is a business tool for authorized adult users and is not directed to children under 16. We do not knowingly collect personal data from children through the Service.

Data may be processed outside Vietnam, including in the Republic of Korea, where our parent company ActsOne Corp. operates, and by the platforms and service providers described above. We apply appropriate safeguards, including contractual obligations with the recipients and compliance with Vietnamese rules on cross-border transfers under Decree 13/2023/NĐ-CP.

We may update this Policy to reflect changes in the Service, our practices or the law. Material changes will be shown by a new “Last updated” date at the top of this page, and we will inform users through the Service where appropriate.

This Policy is governed by the laws of the Socialist Republic of Vietnam, including the Law on Cybersecurity (No. 24/2018/QH14) and Decree No. 13/2023/NĐ-CP, and any successor legislation.

For questions or requests about this Policy or our handling of personal data: