1. Who we are
QBIS.VN ("QBIS", "we") is a business-management SaaS platform for small and medium businesses in Vietnam, including QBIS POS, QBIS Tour, QBIS Sales, QBIS HRM and an omnichannel chat inbox integrated with Facebook Messenger. QBIS is the data controller for account data and acts as a data processor on behalf of business customers for the business data they put into the platform.
- Operated by: QBIS Online Technology and Solutions Joint Stock Company (Công ty Cổ phần Công nghệ và Giải pháp Trực tuyến QBIS) – Tax ID: 0108445526
- Address: 12 Nhan Hoa, Thanh Xuan, Hanoi, Vietnam
- Phone: +84 24 7306 8956
- Privacy contact: info@qbis.vn
2. Data we collect
- Account data: name, email, phone number, company details, password (stored only as a hash).
- Business data entered by customers: customers, orders, inventory, staff and other operational records.
- Technical data: IP address, browser, device, pages viewed and security access logs.
- Payment data: QBIS does not store card details; payments are processed by a PCI-DSS certified third-party gateway.
3. Data from Facebook (Meta) when you connect a Facebook Page
When a Page admin logs in with Facebook Login and grants permissions, QBIS accesses only the data needed to run the chat and Page-management features. Users can deselect any permission or Page in Facebook's permission dialog.
| Meta permission | Data accessed | How QBIS uses it |
|---|---|---|
| Facebook Login (public_profile) | Facebook ID, name and profile picture of the admin who logs in | Identify who connected the Page to the QBIS account |
| pages_show_list | Pages the user manages (ID, name, picture) | Show the list so the user can choose which Page to connect |
| business_management | Business portfolios and the Pages they own | Connect Pages owned by a business through Meta Business Suite |
| pages_manage_metadata | Page webhook settings | Subscribe the Page to webhooks so new messages arrive in the QBIS inbox in real time |
| pages_read_engagement | Page details, posts, photos, videos, engagement metrics; public names and profile pictures of followers/customers | Show Page content and customer context to support agents |
| pages_messaging | Messenger messages sent to the Page (text, attachments, timestamps) and Page-scoped IDs (PSID) | Receive and reply to customer messages from the QBIS inbox |
| pages_utility_messaging | Utility message templates and the values filled into them (customer name, order ID, etc.) | Send transactional updates such as order confirmations, delivery updates and appointment reminders |
Page Access Tokens are encrypted with AES-256 at rest and used only to call Meta APIs on behalf of the connected Page.
4. Our commitments for Meta Platform Data
- We use data from Meta only to provide the features in section 3 to the business that connected the Page.
- We do not sell, rent, license or share Meta data with ad networks, data brokers or any third party for commercial purposes.
- We do not use Meta data for ad targeting, surveillance, profiling, discrimination or eligibility decisions (credit, employment, housing, insurance).
- We do not use Meta data to train general-purpose AI models.
- We comply with the Meta Platform Terms, Developer Policies and Messenger Platform policies, including the 24-hour standard messaging window: after 24 hours from the customer's last message, QBIS only allows approved utility templates or permitted message tags.
5. Purposes and legal bases
- Contract: to provide, operate and support the service.
- Legitimate interests: security, fraud prevention and anonymized analytics to improve the service.
- Legal obligations: accounting records and valid requests from authorities.
- Consent: marketing emails, which you can withdraw at any time.
6. Sharing
We do not sell or rent data. We share it only with infrastructure providers (hosting, storage, email delivery) under confidentiality agreements and solely to run the service; with authorities when legally required; or with a successor in a merger or acquisition, with prior notice to users.
7. Security
HTTPS/TLS 1.2+; bcrypt password hashing; AES-256 encryption of tokens and secret keys; role-based access control; daily multi-location backups; 24/7 monitoring and periodic security reviews. If a data breach occurs, we notify affected users within 72 hours of discovery.
8. Retention
- Account and business data: while the service is in use; deleted within 30 days after account deletion.
- Facebook data: access tokens are deleted immediately when a Page is disconnected; synced messages and Page data are deleted within 30 days.
- Backups: overwritten and deleted within 90 days.
- Invoices and financial records: up to 5 years as required by accounting law.
- Security access logs: up to 12 months.
9. Your rights and how to request data deletion
You have the right to access, correct, delete, restrict processing of and export your data, and to object to marketing. To request deletion:
- In QBIS: Settings → Integrations → Facebook → Disconnect, or Settings → Account → Delete account.
- On Facebook: Settings & privacy → Settings → Apps and websites, select QBIS and click Remove.
- Email info@qbis.vn.
Full instructions: https://qbis.vn/en/data-deletion. We respond to every request within 5 business days.
10. Cookies
We use essential cookies (cannot be disabled), functional cookies and analytics cookies (can be turned off in account settings). We do not use advertising or cross-site tracking cookies.
11. Children
The service is intended for businesses and people aged 18 and over. We do not knowingly collect data from anyone under 18.
12. Changes
We will notify you of material changes by email or in the app at least 15 days before they take effect. The effective date at the top always reflects the latest version.
13. Contact
QBIS Online Technology and Solutions Joint Stock Company (Công ty Cổ phần Công nghệ và Giải pháp Trực tuyến QBIS) – Tax ID 0108445526 – 12 Nhan Hoa, Thanh Xuan, Hanoi, Vietnam – Phone +84 24 7306 8956 – Email info@qbis.vn