Privacy Policy

Minz.ai (“we”, “us”, “our”) operates the Minz.ai Workforce OS, including the Jarmin AI assistant, available at minz.ai. This Privacy Policy explains how we collect, use, store, share, and protect information when you interact with our platform and its integrated communication channels (Facebook Messenger, Zalo, and other supported channels).

By using Minz.ai, you agree to the collection and use of information in accordance with this policy.

2.1 Account Information

• Name, email address, profile picture (via Google OAuth sign-in)
• Organization name, team role, and workspace settings

2.2 Google Calendar and Google Sheets Data

Google data is accessed only after you choose to connect the relevant integration. Minz.ai does not request Calendar or Sheets permissions as part of ordinary Google sign-in.

• Google Calendar: event details needed to display and synchronize your calendar, and to create, update, or delete events that you ask Minz.ai to synchronize.
• Google Sheets and Drive metadata: names and IDs of up to 50 recently modified Google Sheets so that you can choose a destination, plus the spreadsheet and tab you configure for a workflow or report sync.
• OAuth tokens: encrypted access and refresh tokens required to run a connected Calendar or Sheets sync. We use these only to provide that integration.

2.3 CRM Data

• Contacts, leads, deals, accounts, activities, tasks, and notes created by users within the platform
• Products and pricing information uploaded by users

2.4 Messaging Data (via Omni Channel)

When your organization connects external communication channels (Facebook Messenger, Zalo), we collect:

• Messages: text content, images, and files sent and received through connected channels
• Sender information: name and profile picture as provided by the messaging platform (e.g., Facebook Graph API)
• Conversation metadata: timestamps, delivery status, channel type, and conversation status

We collect this data solely to display conversations within Minz.ai’s unified inbox and link them to relevant CRM records (leads, contacts, deals).

2.5 AI Chatbot Interactions

When the L1 Chatbot feature is enabled, an AI assistant may automatically respond to incoming customer messages. The chatbot:

• Accesses only the organization’s product knowledge base and FAQ content (uploaded by the organization admin)
• Collects basic lead information shared by the customer during conversation (name, email, phone, company, needs)
• Does not have access to CRM deal values, pipeline data, internal notes, or other customer records

2.6 Usage Data

• Browser type, device information, IP address, and pages visited within the platform
• Feature usage analytics to improve the product

• Deliver core CRM functionality: manage contacts, leads, deals, pipeline, tasks, and reporting
• Unified inbox: route and display messages from Facebook Messenger, Zalo, and other connected channels to the appropriate team members
• AI-powered features: auto-reply via L1 Chatbot (product Q&A, lead qualification), AI sales coaching, meeting analysis, and research assistance
• Lead management: automatically create and enrich leads from chatbot handoffs, link conversations to CRM records
• Team collaboration: internal messaging, task assignment, and role-based access control
• Analytics: conversation response time, channel performance, and team activity metrics

We do not sell Google user data, use it for advertising, or use it to train generalized AI models. Google user data is used only for the Calendar and Sheets features that you enable in Minz.ai.

• Data is stored in PostgreSQL databases hosted on secure cloud infrastructure (Railway, Google Cloud). Files and documents are stored on Cloudflare R2.
• Data is encrypted in transit (TLS/HTTPS) and at rest
• Access to data is restricted through role-based access control (RBAC) — team members only see data relevant to their role
• Messaging data from external channels is stored in a separate database from core CRM data, following a security-by-architecture approach
• Authentication is handled via OAuth 2.0 (Google) with secure session management. Tokens for connected Google integrations are encrypted before storage.

Minz.ai uses AI models to power features such as the L1 Chatbot, the Jarmin assistant, sales coaching, and meeting analysis. When processing data through AI:

• Content may be sent to AI model providers — currently Google (Gemini) and Anthropic (Claude) — for generating responses and analysis
• AI providers process data according to their respective privacy policies and do not use your data for model training under our API agreements
• If we add a new AI provider, we only use providers with equivalent no-training-on-customer-data terms, and we update this section
• The L1 Chatbot operates within strict context boundaries — it can only access your organization’s product knowledge base, not CRM records or other customer data

We do not sell your personal data to third parties. We share data only in the following circumstances:

• Within your organization: team members with appropriate roles can view conversations, leads, and CRM records according to their permissions
• AI processing providers: as described in Section 5, strictly for providing AI-powered features
• Infrastructure providers: Railway, Google Cloud, and Cloudflare for operating the platform — bound by their data processing agreements
• Operational tooling: Sentry for error monitoring, and the measurement tools listed in Section 9
• Legal requirements: if required by law, regulation, or legal process

Retention

• CRM and messaging data is retained for as long as your organization’s account is active
• When an organization account is deleted, all associated data (CRM records, conversations, messages, chatbot configurations) is permanently deleted within 30 days
• Disconnecting Google Calendar or Google Sheets immediately stops the integration and removes Minz.ai’s encrypted local tokens for that integration

Deletion Requests

You have the right to request deletion of your personal data at any time. There are two ways:

1. Delete your account yourself from Settings in the platform. The account enters a pending state and is permanently deleted after 30 days; you can cancel during that window.
2. Send an email to [email protected] with the subject line “Data Deletion Request”, including your account email, your organization name, and what you want deleted (all data, specific conversations, or specific CRM records).

We will process your request and confirm deletion within 30 days. Note that some data may be retained if required by law or for legitimate business purposes (e.g., billing records).

Facebook Messenger Data

For data collected through Facebook Messenger integration specifically:

• Users can request deletion of all Messenger-related data via the process above
• Upon deletion, all messages, conversation metadata, and sender information from Messenger are permanently removed from our systems
• This does not affect the original messages on the Facebook platform itself — only the copies stored in Minz.ai

You have the right to:

• Access: request a copy of the personal data we hold about you
• Correction: request correction of inaccurate data
• Deletion: request deletion of your data (see Section 7)
• Portability: request your data in a machine-readable format
• Objection: object to certain processing of your data
• Withdraw consent: disconnect external channels or delete your account at any time. You can also revoke Minz.ai’s Google access at any time from your Google Account permissions.

We use essential cookies for authentication and session management. We do not use advertising cookies, and we do not sell personal data.

We measure how our public website and our product are used, with two separate tools:

• Google Analytics 4 — on our public marketing pages only (home, industries, solutions, careers, partners, customer stories). It records page views, referral source and a few interactions such as opening or submitting the demo request form. IP addresses are anonymised. It is not loaded inside the signed-in product.
• PostHog — inside the signed-in product, to understand which features are used and to diagnose problems. Session replay masks all form inputs and any field marked as sensitive. Business data you store in Minz.ai (customers, documents, messages) is not sent to PostHog.

You can block these through your browser settings or an ad/tracker blocker; the product keeps working normally. Google provides an opt-out add-on at tools.google.com/dlpage/gaoptout.

We may update this Privacy Policy from time to time. We will notify users of significant changes via email or an in-app notification. The “Last updated” date at the top reflects the most recent revision.

If you have questions about this Privacy Policy or want to exercise your data rights, contact us:

• Email: [email protected]
• Website: minz.ai
• Legal entity: MINZ AI JOINT STOCK COMPANY · Tax ID 0111504436
• Address: Floor 2, Housing Building, 299 Trung Kinh Street, Yen Hoa Ward, Hanoi, Vietnam