Privacy Policy

BancoOs (“we”, “us”) provides an AI-assisted accounts-payable platform — invoice ingestion, 3-way matching, approvals, payments, and Vietnamese e-invoice compliance — to business customers. For personal data processed inside a customer's workspace (vendor contacts, invoice signatories, employee approvers), the customer is the data controller and BancoOs processes on their instructions. For account data of the people who sign in to BancoOs, we act as controller.

Legal entity & registered address: [TO CONFIRM with counsel].

• Account data — name, work email, and the identifiers your Microsoft Entra ID (Azure AD) organization shares at sign-in. We never see or store your password; authentication happens at your identity provider.
• Workspace content — invoices, purchase orders, goods receipts, vendor records, and the documents you upload or forward. These may contain personal data of your staff and your suppliers' staff.
• Security & usage records — login history (time, IP address, coarse device label), audit-trail entries of actions taken in the product, and API-key usage. These exist to protect your account and satisfy financial-control requirements.

• To provide the service: parsing, matching, approvals, payments, ERP sync.
• To run AI extraction: document images/text are sent to our AI subprocessor to be converted into structured invoice data. See the AI Transparency Policy for exactly what is sent, to whom, and the controls around it.
• To secure the platform: fraud/duplicate detection, audit logging, rate limiting.
• To meet legal obligations, including Vietnamese accounting and tax law.

We do not sell personal data, and we do not use customer workspace content to train AI models.

BancoOs uses a single essential session cookie (an httpOnly cookie that keeps you signed in). We set no advertising, analytics, or cross-site tracking cookies. Because only strictly necessary cookies are used, the product remains fully functional without any optional cookie consent; the in-app cookie notice is informational, and your acknowledgement is recorded in your organization's consent history.

• Accounting records (invoices, matching results, approvals, the audit trail) are retained for 10 years per Vietnam's Law on Accounting.
• Operational data (notifications, webhook logs, intake messages, login history) is purged automatically on configurable schedules — defaults are published in the Trust Center.
• Customers can export their full workspace at any time and can request complete organization deletion. Deletion runs after a 30-day grace window (cancellable by an owner), then erases all workspace data, uploaded files, and the audit trail, except the minimal record that erasure was performed.

Production data is hosted on the cloud infrastructure listed (with regions) in our Subprocessor List. Data residency commitments for Vietnam, including cross-border transfer assessments required by Law 91/2025, are tracked in the Trust Center's Data Residency section.

Data subjects in Vietnam have rights to access, rectify, delete, restrict, and withdraw consent for processing of their personal data. If your data appears in a customer's workspace, we will route your request to that customer and support them in fulfilling it. For account data, contact us directly and we will respond within the statutory window.

Contact: privacy@bancoos.com [TO CONFIRM] · Data Protection Officer: [TO CONFIRM with counsel whether a DPO appointment is required for our processing profile].

Material changes are versioned; signing in after a new version takes effect will ask you to re-acknowledge it, and every acknowledgement is preserved in your organization's consent history.