Privacy Policy

1. Operator and scope

This policy is effective October 14, 2026. x100traffic is operated by Trần Dư Khánh, an individual based in Vietnam. It covers x100traffic.com, the x100traffic desktop software, and supporting HTTPS API connection services.

x100traffic is software installed on Windows or macOS. The website provides product information, distribution, support, and public documentation; it does not replace desktop downloading, localization, rendering, or Facebook Page management.

2. Legal basis and processing principles

This policy is structured around Vietnam's Law on Personal Data Protection No. 91/2025/QH15, Decree No. 356/2025/NĐ-CP, and other applicable Vietnamese law. Decree 356 took effect on January 1, 2026 and replaced Decree 13/2023/NĐ-CP.

We process data for specified, clear, and necessary purposes; limit collection; protect data during processing; retain it only as long as needed; and support data-subject rights. Where consent is required, it must be voluntary, clear, purpose-specific, not preselected, and withdrawable. Processing without consent is limited to circumstances permitted by law.

3. Website and cookie data

The public website currently does not require an account. It uses a first-party necessary cookie to remember privacy choices. When configured and allowed under the relevant consent category, Google Analytics 4 may measure aggregate usage, while Meta Pixel and Meta Conversions API may measure page views and campaign performance.

Optional cookies are off by default. Google Analytics does not run without Analytics consent; Meta Pixel and Conversions API do not run without Advertising and measurement consent. Each integration also remains disabled until valid production identifiers and server credentials are configured.

Hosting systems may automatically record limited technical data such as IP address, request time, requested path, browser type, and error codes to operate, secure, and protect the service from abuse. Cookie choices can be changed at any time through Manage cookies in the footer.

4. Data processed on your device

Under the local-first architecture, most data is processed or stored on the user's computer in local databases, project directories, or an application-controlled browser profile.

• Source files, temporary files, and rendered videos.
• Translations, subtitles, audio, and quality-control results.
• Project settings, schedules, queues, and channel mappings.
• Source login sessions created by the user.
• Facebook tokens and API keys configured by the user; on Windows, these secrets are protected with DPAPI for the current Windows account.

5. Connection-service and cross-border data

When a user enables an online service, the minimum data required may be transmitted over HTTPS for authentication, API requests, licensing, troubleshooting, or customer support. A Facebook connection service may process an app-scoped user identifier, authorization state, approved Page list, connection identifier, and encrypted token material. Each customer's data must be separated by customer, project, and connection identifiers.

Meta or a user-selected AI provider may process data outside Vietnam. Where this constitutes a cross-border transfer of personal data, x100traffic will complete the impact-assessment records, agreements, and safeguards required for the applicable activity.

6. Facebook data

x100traffic uses Facebook data only to show Pages the user is authorized to manage, perform publishing actions requested by the user, verify results, and support disconnection. Data may include app-scoped user ID, Page ID and name, Page permissions or tasks, user-selected content and media, publishing schedule, post status, and post identifiers.

x100traffic does not sell Facebook data, use it to build independent advertising profiles, or request a Facebook password. Users may revoke access in Facebook Settings → Apps and websites. The Meta App Secret is not embedded in the public website or desktop installer.

7. Third-party AI providers

When a user deliberately enables cloud AI, content required for the task may be sent to the selected provider, including text, subtitles, audio excerpts, images, video, or processing instructions. Supported providers include OpenAI, Google Gemini, Anthropic Claude, 9Router, DeepSeek, Alibaba Qwen, xAI Grok, Zhipu GLM, and custom OpenAI- or Anthropic-compatible API endpoints configured by the user.

Each provider has its own terms and privacy policy and may process data outside Vietnam. The user or administrator selects the provider and configures the API key. Local processing does not automatically transmit content to cloud AI.

8. Security and data sharing

x100traffic applies safeguards intended to limit unauthorized access, including encryption of stored secrets and transmission, redaction of secrets from logs, access controls, and separation by customer or project. Data is shared with Meta, a selected AI provider, infrastructure provider, or support provider only as necessary to deliver the user-selected function, comply with law, or protect the service.

If a personal-data incident occurs, we will assess, contain, record, and notify the competent authority or affected users where and within the time required by law. No system is completely secure.

9. Retention

• Local files and data: retained until the user deletes them or removes them under the product instructions.
• Cookie choice: up to 180 days or until browser cookies are cleared.
• Facebook tokens: retained until the user disconnects, revokes access, or requests deletion.
• Server security logs: up to 90 days, unless longer retention is needed for an incident investigation or legal compliance.
• Support emails and records: up to 24 months after the request is resolved.
• Valid deletion requests: completed within 30 days, except records that must be retained under Vietnamese law or for dispute, fraud, and security handling.

10. Your rights and choices

Subject to applicable law, you may be informed, consent or withdraw consent, access, correct, obtain, delete, or restrict processing of data; object to processing; and lodge complaints, report violations, bring claims, or seek compensation. You may also decline third-party connections, select specific Pages, revoke access, and delete local data.

For a request to withdraw consent, restrict processing, or object, we will acknowledge or respond within two working days and act within the statutory period—ordinarily up to 15 days, or 20 days where a third party must be coordinated. If a lawful extension is required, we will explain the reason and period.

11. Updates and contact

When this policy changes, we will publish the new version and update date here. Material changes to data processing will be accompanied by an appropriate website or product notice where feasible.

Operator: Trần Dư Khánh, Vietnam. Support, privacy, and data-request email: support@x100traffic.com. Never send access tokens, App Secrets, API keys, passwords, or credential files by email.