Version 1.0 · effective 30 Oct 2026 · under Decree 13/2023/ND-CP and the 2025 Personal Data Protection Law
Applies to the whole Hubz website and app
Draft. This text must be reviewed by a lawyer before it is published.
These terms are an agreement between BMS Technology ("BMS") and the business that signs up for Hubz ("Customer"). By creating a company or accepting an invite to Hubz, you agree to these terms and the Data protection policy.
1. The service
Hubz brings several personal Zalo accounts into one shared inbox so many staff can answer customers, assign, tag, search and manage contacts and friend requests.
Hubz is not a product of Zalo or VNG.
2. Risks of an unofficial method
Important, please read carefully. Hubz connects to personal Zalo accounts through an unofficial open-source library that works like Zalo Web, which is not provided or approved by Zalo or VNG.
Zalo accounts may be restricted or blocked if Zalo sees unusual behavior.
Zalo may change its systems at any time, stopping some or all features.
Messages sent during a disconnect may not all arrive.
Each Zalo account should run in one place; opening Zalo Web with the same number can disconnect Hubz.
BMS does not guarantee uninterrupted service and is not liable for blocked accounts or business losses from these risks.
We recommend a number set aside for work, one proxy or IP per number, no bulk messages, and keeping the phone that holds the account. If you need high stability, consider a Zalo Official Account.
3. Customer accounts and duties
Provide accurate details, keep passwords safe and take responsibility for actions under your company.
Only connect Zalo accounts you are lawfully entitled to use.
Follow Zalo’s terms, anti-spam rules (Decree 91/2020/ND-CP) and data protection law.
Do not use Hubz for spam, fraud, unlawful data collection or overloading the system.
4. BMS rights
Suspend accounts that breach these terms after notice, or immediately for serious breaches.
Apply technical limits that protect the Customer’s Zalo accounts.
Upgrade and change features; significant changes are announced in advance.
5. Plans and payment
Fees and limits per plan are published on the Pricing page. Fees paid are not refunded unless BMS fails to provide the service through its own fault.
6. Data
Data the Customer puts into Hubz belongs to the Customer. History can be exported any time; after the service stops, data is kept for 30 days and then deleted.
7. Limitation of liability
BMS’s total liability does not exceed the fees paid in the 3 months before the event. BMS is not liable for indirect losses or the risks in section 2.
8. Termination
The Customer may stop at any time. BMS may terminate for serious breach or if the service can no longer be provided, with at least 30 days’ notice except in force majeure.
9. Governing law
Vietnamese law applies. Disputes are first negotiated; otherwise they go to the competent court at [BMS HEAD OFFICE LOCATION].
This policy explains how Hubz collects, uses, stores and protects personal data.
1. Roles
The business using Hubz controls the data of its own customers.
BMS processes that data only as the business instructs and configures.
For Hubz user account data, BMS is both controller and processor.
2. Data processed
Hubz user data: name, email, password (stored only as a hash), role, team, sign-in and action logs.
Data from connected Zalo accounts: conversations, public Zalo profiles, group details, contacts, and staff-entered tags and notes.
Hubz does not actively collect sensitive data.
3. Purposes
Provide the shared inbox and customer care for the business.
Manage accounts, access, security and logs.
Operational alerts and technical support.
BMS does not sell or share data for advertising and does not use conversations to train AI models.
4. Legal basis and consent
For Hubz users: the service contract and consent at sign-up. For the business’s customers: the business must give notice and have a lawful basis before processing.
5. Retention
Kept while the business uses Hubz.
After the service stops: kept 30 days for export, then permanently deleted, backups included, within 90 days.
Action logs kept at least 12 months.
6. Data subject rights
To be informed, consent and withdraw, access, correct, delete, restrict, receive, object, complain and claim damages. The business’s customers contact that business; Hubz users contact BMS.
7. Safeguards
Zalo sessions and proxies are encrypted at rest; passwords are hashed.
Each business’s data is separated at the database level.
Role-based and per-account access.
Attachments open only through short-lived links after an access check.
Sensitive action logs are append-only.
8. Where data is stored
Data is stored on servers in Vietnam [CONFIRM BEFORE PUBLISHING]. Any transfer abroad gets an impact assessment and advance notice.
9. Data breaches
BMS notifies the competent authority within 72 hours as required and informs affected businesses.
10. Contact
BMS Technology data protection team · Email: [PRIVACY EMAIL] · Address: [COMPANY ADDRESS]
Hubz is an independent product of BMS TECHNOLOGY.
Not affiliated with Zalo or VNG
Hubz is not a product of Zalo or VNG Corporation and is not sponsored, certified or approved by them.
Zalo is a trademark of its respective owner. The name is used only to describe that Hubz works with customers’ Zalo accounts.
Connection method
Hubz connects to personal Zalo accounts through an unofficial method. See section 2 of the Terms of service for the risks and how to lower them.
Brand use
Hubz does not use Zalo’s logo, brand colors or name in its product name, to avoid confusion with Zalo’s products.