Privacy & Personal Data Protection Policy

2. Definitions

Elastic Labs Company Limited

The legal entity that develops and operates SpeedGrowth AI, including its affiliates, branches, representative offices, and business locations, if any.

SpeedGrowth AI

The conversational AI software product available at https://speedgrowth.ai, developed and operated by Elastic Labs Company Limited.

Customer

Any individual or organization that registers, accesses, or uses SpeedGrowth products or services, or participates in SpeedGrowth programs or events.

Vietnamese Customer

Any customer whose registered business address or primary place of use is within the territory of the Socialist Republic of Vietnam.

Global Customer

Any customer whose registered business address or primary place of use is outside the territory of Vietnam.

End-User

Natural persons whose personal data is processed through the SpeedGrowth platform on behalf of a customer, such as the customer's own customers or contacts.

Personal Data

Any information relating to an identified or identifiable natural person in the form of symbols, text, numbers, images, audio, or similar formats in an electronic environment, including basic personal data and sensitive personal data.

Processing of Personal Data

Any operation performed on personal data, including collection, recording, analysis, verification, storage, modification, disclosure, combination, access, retrieval, encryption, decryption, copying, sharing, transmission, provision, transfer, deletion, or destruction.

Data Controller

Elastic Labs Company Limited, which determines the purposes and means of processing personal data in connection with SpeedGrowth AI.

Data Processor

Any third party that processes personal data on behalf of and under the instruction of Elastic Labs.

3. Categories of Personal Data We Process

3.1 Basic Personal Data

Depending on how you interact with SpeedGrowth, we may process full name, nationality, phone number, email address, job title, employer name, work address, work phone number, account credentials, and subscription or billing details. Passwords are hashed and never stored in plaintext, and payment card data is handled exclusively by third-party PCI-DSS compliant processors.

3.2 Sensitive Personal Data

Elastic Labs generally does not require customers to submit sensitive personal data and asks customers not to do so unless expressly agreed in writing. If sensitive personal data is submitted, you consent to processing under this policy and may withdraw consent as described below.

3.3 Technical and Usage Data

When you visit the website or use the platform, we automatically collect data such as IP address, country or region level location, browser type, operating system, device identifiers, pages visited, features accessed, time spent, referring URLs, search queries, log files, error reports, cookie identifiers, and similar tracking signals.

3.4 AI Interaction Data

SpeedGrowth processes conversation content between deployed AI agents and end-users, customer-uploaded configuration data, training documents, knowledge bases, agent performance metrics, and response quality signals. Conversation data is used solely to deliver requested responses through retrieval-augmented generation and not to train or improve any general AI or machine learning model.

4. How We Collect Personal Data

1. Direct interactions such as creating an account, subscribing to a plan, completing forms, contacting support, answering surveys, or communicating with us by email, phone, live chat, or social media.
2. Platform usage, where our systems automatically record technical and usage data while you access or use SpeedGrowth.
3. Third-party sign-in, including Google or other authorized OAuth providers, limited to the data you authorize them to share.
4. Data your organization uploads to configure an AI agent, including knowledge bases, documents, FAQs, and website conversations with deployed AI agents.
5. Third-party integrations that you authorize, such as CRM systems and messaging platforms.
6. Cookies and similar tracking technologies.

5. Purposes of Processing Personal Data

• Providing, operating, and maintaining the SpeedGrowth platform and service features.
• Authenticating identity and managing user accounts.
• Processing payments and managing subscriptions through third-party processors.
• Communicating about accounts, service updates, security alerts, and support requests.
• Sending marketing communications, promotional offers, and product news only where you have opted in.
• Personalizing user experience and improving platform features based on usage analytics.
• Measuring performance and conducting business analytics to develop services.
• Detecting and preventing fraud, unauthorized access, and terms violations.
• Fulfilling legal obligations and responding to lawful requests from competent authorities.
• Carrying out any other specific purpose for which you have given explicit consent.

6. Who Processes Your Personal Data

7. Data Storage: Vietnamese Customers vs. Global Customers

8. Data Storage and Retention

• Account and service data is retained for the duration of the active subscription plus a reasonable period thereafter to meet legal obligations, prevent fraud, or resolve disputes.
• AI conversation and interaction data is retained according to the configurable retention settings available in the account dashboard.
• Marketing and prospect data is retained until it is no longer commercially relevant or until consent is withdrawn.
• Legal, tax, and compliance records are retained for the periods mandated by law.

9. Your Rights as a Data Subject

9.1 Right to Be Informed

You have the right to receive clear and transparent information about how your personal data is collected, processed, and used.

9.2 Right of Access

You may request confirmation of whether Elastic Labs holds personal data about you and request access to that data. Elastic Labs will respond within 2 business days of a verified request.

9.3 Right to Rectification

You may request correction of inaccurate or incomplete personal data held about you. Verified rectification requests will be processed within 2 business days.

9.4 Right to Erasure

You may request deletion of your personal data. Verified erasure requests will be processed within 72 hours unless retention is required by law.

9.5 Right to Restrict Processing

You may request that Elastic Labs restrict processing of your personal data in certain circumstances. Verified restrictions will be implemented within 72 hours unless law provides otherwise.

9.6 Right to Data Portability

Where technically feasible, you may request your personal data in a structured, commonly used, machine-readable format.

9.7 Right to Object

You may object to processing for direct marketing, profiling, or other purposes not strictly necessary to provide the service.

9.8 Right to Withdraw Consent

Where processing is based on consent, you may withdraw that consent at any time without penalty.

9.9 Right to Self-Protection

You have the right to self-protect in accordance with the Vietnamese Civil Code, including demanding cessation of infringing conduct, public correction, and compensation for harm where applicable.

10. Consent and Withdrawal of Consent

11. Cookies and Tracking Technologies

• Enable essential platform functionality and maintain authenticated sessions.
• Remember user preferences and settings across visits.
• Analyze platform usage and improve performance and user experience.
• Deliver relevant service communications where consent has been given.

12. Data Security and Protection Measures

• Customer data is encrypted at rest using AES-256 and in transit using TLS 1.2 or higher.
• Role-based access controls ensure only authorized personnel with a documented need can access personal data, and access events are logged and periodically audited.
• Vietnamese customer data is hosted on Vietnam-based infrastructure. Global customer data runs on AWS us-east-1, managed via Supabase and Vercel with security hardening and continuous monitoring.
• API endpoints and AI agent interactions are protected by rate limiting to prevent abuse and unauthorized automated access.
• Elastic Labs has designated a DPO in accordance with Decree 356/2025/ND-CP to oversee the data protection program.
• In the event of a personal data breach, Elastic Labs will notify competent authorities and affected data subjects within the legally required timeframe and will take immediate steps to contain, investigate, and remediate the incident.

13. AI-Specific Data Provisions

• Elastic Labs will never use customer data or end-user conversation content to train, benchmark, evaluate, or improve any general-purpose AI or machine learning model.
• SpeedGrowth uses retrieval-augmented generation so uploaded data is retrieved contextually at inference time and never incorporated into the underlying model.
• Data accessed through Google Workspace APIs is used solely to deliver the specific functionality requested and is not used for AI model development, improvement, or evaluation.
• Where SpeedGrowth processes personal data within AI systems or cloud environments covered by Decree 356/2025/ND-CP, Elastic Labs applies the required data minimization, purpose limitation, auditability, encryption, access control, and contractual protections.

14. Age Restriction

15. Customer Obligations Regarding End-User Data

• Customers must obtain all necessary prior consents and have a lawful basis to provide end-user data to Elastic Labs for processing.
• Customers must inform their end-users that their data may be processed by SpeedGrowth AI under this policy.
• Customers must ensure the data they provide is accurate, complete, and current.
• Customers must promptly notify Elastic Labs of any withdrawal of consent by an end-user.
• Customers must comply with all data protection laws applicable to their collection and use of end-user data in their own jurisdiction.

16. Consequences of Not Providing Personal Data

• The relevant processing purpose may not be fully fulfilled.
• Provision of the SpeedGrowth service may be interrupted, limited, suspended, or terminated.
• The action may be treated as a unilateral termination of the service relationship by the user and may constitute a breach of obligations under the Terms of Service.

17. Changes to This Policy