Zorbi Privacy Policy

This Privacy Policy explains how we collect, use, share and protect personal information when you visit zodinet.com or zorbi.zodinet.tech, use Zorbi, our platform and its web and mobile applications (including at intranet.odpso.com), OneHub, and any other products or services that link to this policy (together, the “Services”), and what rights you have.

If you do not agree with this policy, please do not use the Services.

1. Summary of key points

• We collect only the information needed to provide the Services: account details, content you add, and data from services you choose to connect.
• If you connect Google Drive, we request read-only access (https://www.googleapis.com/auth/drive.readonly). We never edit, create or delete your files.
• Google user data is used only to provide the features you see in the app (browsing, indexing and searching your documents). It is not sold, not used for advertising, and not used to train generalized AI/ML models.
• You can disconnect Google Drive and delete the imported data at any time.
• Contact: info@zodinet.com

2. Information we collect

Information you give us

• Account and profile data: name, work email, username, phone number, job title, department, avatar.
• Content you create or upload in the Services: documents, files, messages, requests, comments and similar business records.
• Messages you send to us for support or sales.

Information collected automatically

• Device and log data: IP address, browser type, operating system, pages and features used, timestamps, error logs.
• Cookies and similar technologies needed for sign-in, security and preferences (see section 11).

Information from connected accounts (only when you choose to connect them)

• Social or single sign-on login: basic profile information (name, email, profile picture) from the provider you choose.
• Google Drive (including Shared Drives): file and folder metadata (names, types, locations, modification times, sharing information) and file content of files in the Drive folders you connect, read through the Google Drive API with the read-only scope, together with the text and document-type information we extract from those files (see section 4).

We do not knowingly collect sensitive personal information beyond what you or your organization choose to store in the Services.

3. How we use your information

We use personal information to:

• create and manage accounts and authenticate users;
• provide, maintain and improve the Services and their features;
• index, search and display documents you or your organization connect, and answer your questions about them;
• send service notifications, security alerts and support responses;
• protect the Services against fraud, abuse and security incidents;
• comply with legal obligations.

4. Google user data

Our use and transfer of information received from Google APIs to any other app will adhere to theGoogle API Services User Data Policy, including the Limited Use requirements.

What we access. When you connect a Google Drive account, we request only thedrive.readonly scope. This lets the Services read file metadata and content from the Drive locations you choose. The Services cannot modify, create or delete anything in your Google Drive.

How we use it. We use Google user data only to provide and improve user-facing features within the Services that are visible in the application:

• listing the Shared Drives and folders you can access so an administrator can choose which folder to connect;
• automatically scanning the files in the connected folder with optical character recognition (OCR) and text extraction, and indexing the result, so that administrators can search the documents and check which required document types are missing;
• showing your Drive files in the document explorer and downloading them on demand for preview;
• enabling search and AI-assisted answers for you and for the people in your organization who are already permitted to see those files.

How we protect it.

• Access tokens are stored encrypted and used only to call the Google APIs on your behalf.
• Indexed content is subject to the same access controls as in the source: a person can only find or see documents they are authorized to see.
• Data is transmitted over encrypted connections (TLS).

What we do not do.

• We do not sell Google user data.
• We do not use Google user data for advertising, including retargeting or interest-based advertising.
• We do not transfer Google user data to third parties except as necessary to provide the user-facing features you request, to comply with applicable law, or as part of a merger or acquisition with prior notice; and never to data brokers or information resellers.
• We do not use Google user data to develop, improve or train generalized or non-personalized AI/ML models.
• No human reads your Google user data, except with your explicit consent for specific content, where required for security purposes or to investigate abuse, or where required by law.

Revoking access and deleting data. You can disconnect Google Drive inside the Services at any time, or revoke access atmyaccount.google.com/permissions. When a connection is removed, we stop accessing your Drive and delete the associated tokens, and, on request, the indexed content and metadata derived from it (see section 9).

5. Artificial intelligence features

Some features use artificial intelligence and machine learning, for example document search, summarization, question answering, text extraction (OCR) and classification.

• AI processing, including OCR and text extraction on files in a connected Drive folder, runs only to deliver a feature you or your organization has enabled (such as document search and checking for missing document types), and only on content you are authorized to access.
• OCR and text extraction of files from a connected Google Drive are processed on our own infrastructure. The extracted text is not sent to third-party OCR or cloud AI services.
• Data obtained from Google APIs is not used to train generalized AI/ML models, by us or by our providers.
• AI output can be inaccurate. Please review it before relying on it.

6. How we share information

We do not sell your personal information. We share it only:

• Within your organization, according to the permissions your administrators configure;
• With service providers who help us operate the Services (cloud hosting, storage, email delivery, AI processing, analytics, support), under confidentiality and data-protection obligations;
• For legal reasons, to comply with law, a court order or a lawful request from authorities, or to protect rights, safety and security;
• In a business transfer, such as a merger or acquisition, with notice to you.

7. Social and third-party logins

If you sign in with a third-party account (for example Google or Facebook), we receive the basic profile information that provider shares with us, such as name, email address and profile picture. We use it only to authenticate you and set up your account. Please review the provider’s privacy policy to understand what it shares.

8. Retention and security

We keep personal information only as long as needed to provide the Services, meet legal and contractual obligations, resolve disputes and enforce our agreements. Data derived from a connected Google Drive is deleted after you disconnect it and ask for deletion, or when your organization’s account is closed, subject to short backup cycles.

We use technical and organizational measures such as encryption in transit, encryption of credentials, access control, logging and regular reviews. No system is completely secure, so please protect your credentials.

9. Your rights and choices

Depending on where you live, including under Vietnam’s Personal Data Protection Law and Decree 13/2023/ND-CP, you may have the right to know how your data is processed, access and obtain a copy, correct it, delete it, restrict or object to processing, withdraw consent, and lodge a complaint with the competent authority.

To exercise these rights, email info@zodinet.com. We will verify your identity and respond within the period required by law. If you use the Services through your employer or another organization, your request may be forwarded to that organization, which controls your data.

You can also:

• disconnect Google Drive and other connected accounts in the Services’ settings;
• revoke Google access at myaccount.google.com/permissions;
• delete content you uploaded, where your permissions allow it.

10. International transfers

Your information may be processed in Vietnam and in other countries where we or our providers operate. Where required, we put appropriate safeguards and notices in place for cross-border transfers.

11. Cookies and Do-Not-Track

We use cookies and local storage that are necessary for sign-in, security and preferences. Most browsers let you block or delete cookies; doing so may break parts of the Services. There is no uniform standard for browser “Do Not Track” signals, so we do not currently respond to them.

12. Children

The Services are intended for business use and are not directed to children under 16. We do not knowingly collect their data. If you believe a child has given us personal information, contact us and we will delete it.

13. California residents

California residents may request information about the personal information we disclose to third parties for direct marketing purposes. We do not sell personal information. Contactinfo@zodinet.com to make a request.

14. Changes to this policy

We may update this policy from time to time. The “Last updated” date shows the current version. If changes are material, we will notify you in the Services or by email.

15. Contact us