Privacy Policy

1. Who we are

SOPAI is an AI enablement practice based in Ho Chi Minh City, Vietnam, and the operator of the website sopai.tech. For anything related to this policy or your personal data, write to contact@sopai.tech.

SOPAI is currently operated directly by its founders while the registration of its Vietnamese company is being completed. This policy will be updated with the registered legal name and address as soon as incorporation is finalised.

2. What we collect

We process personal data in the situations described below:

• Contact form and email — when you write to us, we receive your email address, your message, the enquiry type you select and, only if you choose to provide them, your company name and an attachment.
• SOPAI Assistant — when the assistant is available and you use it, we process your questions, the language you select and the conversation responses. Please do not include personal, confidential or sensitive information.
• Technical and anti-abuse data — Cloudflare processes your IP address and basic request metadata at its edge to deliver and protect the site. The contact form sends the address to Cloudflare Turnstile when available for anti-spam verification. For chat abuse controls, the Pages gateway uses the address transiently to derive a rotating pseudonymous key, then removes raw IP headers before the private Worker.
• Analytics data — only if you accept analytics cookies, Google Analytics records how you use the site: pages viewed, approximate location from your IP address, device and browser type, and interactions on the page. If you decline, none of this is collected.

There are no user accounts or newsletter. The assistant does not share conversation memory between visitors.

3. Why we use it

We use this data only to:

• to respond to your enquiry and follow up on our exchange;
• to protect the website against spam and abuse;
• to provide, secure and temporarily resume your SOPAI Assistant conversation when you choose to use it;
• to understand how visitors use the site so we can improve it, when you accept analytics.

Submitting the contact form asks us to process the information needed to answer you. Analytics relies on your consent. Security and abuse prevention support our legitimate interest in operating the site safely. We never use your data for advertising, and we never sell or rent it to anyone.

4. Who processes it

Your data is handled by a small set of service providers acting on our behalf:

• Cloudflare — Pages hosting and Functions, Workers Paid, private Service Bindings, Durable Objects that temporarily store each assistant conversation, and Turnstile verification;
• Resend — delivery of contact-form messages and optional attachments to our mailbox;
• Our mailbox provider — the mailbox where your message is received and retained under the periods below;
• OpenCode Go — when the assistant is enabled, processes the bounded conversation and approved SOPAI context needed to generate a response using the configured primary model and, only before any visible output, a fallback model;
• Google Analytics (Google LLC) — measures how the site is used, only after you accept.

These providers operate international infrastructure and may process data outside Vietnam, including in countries whose data-protection rules differ from yours. We limit each transfer to what is needed for hosting and security, delivering your message, generating an assistant response or measuring usage. Each provider handles data under its own contractual, privacy and security terms.

5. How long we keep it

We handle your enquiry, then keep the exchange and any attachment in our mailbox for up to 12 months after our last contact so we can follow up if you come back to us. If we enter a working relationship, the correspondence is kept for the duration of that relationship and as required by law.

An assistant conversation is stored in its own Cloudflare Durable Object. It is deleted after 24 hours without activity and no later than 7 days after it begins. You can delete it sooner through the assistant; deletion cancels active work, deletes the stored conversation and expires its session cookie. Starting a new conversation does not restore deleted history.

Cloudflare and Turnstile process request and verification data transiently as needed to provide and protect the services. Cloudflare Pages Function logs for the contact and chat gateways are live-only and are not stored; persistent invocation logs are disabled for the private assistant Worker. SOPAI has no Logpush or permanent Tail consumer and does not keep per-request transcripts, prompts, responses, raw IP addresses, cookies or complete headers in application logs. A time-bounded administrator diagnostic may still expose live request metadata and is not used routinely on real traffic.

Analytics data collected by Google Analytics is retained for 2 months and then deleted.

6. Your rights

Wherever you are — and whether Vietnam’s Law on Personal Data Protection (Law 91/2025/QH15, in force since 1 January 2026, and its Decree 356/2025) or the EU GDPR applies to you — you can ask us to:

• give you a copy of the data we hold about you;
• correct inaccurate data;
• delete your data;
• restrict or object to its processing;
• withdraw your consent at any time.

Write to contact@sopai.tech. We aim to acknowledge every request within 72 hours and to resolve it as quickly as the law requires. You can also lodge a complaint with the data protection authority where you live.

7. Cookies and analytics

The assistant uses one essential cookie named “sopai_chat” only after you start a conversation. It contains a signed opaque session value, not the conversation text, and is restricted to /api/chat with HttpOnly, Secure and SameSite=Lax protections. It lets the gateway resume the correct temporary conversation and expires after at most 7 days or sooner when you delete the conversation. Because it is necessary for the feature you request, it does not depend on analytics consent.

Separately, we use Google Analytics 4 to understand how the site is used and to improve it. It loads only after you accept the consent banner: if you decline, or until you decide, no analytics cookies are set and nothing is sent to Google Analytics.

When you accept, Google Analytics sets cookies (for example “_ga” and “_ga_…”, which last up to two years) to recognise returning visits. We keep IP addresses out of our reports, switch off Google Signals and cross-device advertising features, and retain analytics data for 2 months. We never use this data for advertising and never sell it.

You can change your choice at any time through “Cookie settings” in the footer, or by installing Google’s opt-out browser add-on. Fonts and other assets are served from our own hosting, not from third-party CDNs that could profile you. For more on how Google processes this data, see Google’s privacy policy.

8. Links to other services

The site links to third-party platforms (Zalo, WhatsApp, Facebook, LinkedIn). If you contact us or follow us there, those platforms process your data under their own privacy policies, which we do not control.

9. Children

Our website and offerings are aimed at professionals and are not directed at children under 18. We do not knowingly collect their data.

10. Changes to this policy

We may update this policy as the website or the law evolves. The “last updated” date at the top always reflects the current version, and meaningful changes will be visible on this page. Questions about privacy: contact@sopai.tech.