Privacy Policy

1. Personal Information Collection Statement (PICS)

When we collect your personal data (e.g. on registration, payment, or use of features), we inform you of: the purposes of collection and use, the classes of persons to whom the data may be transferred, whether providing the data is voluntary or obligatory and the consequences of not providing it, and your rights of access and correction together with contact details.

2. Data We Collect

• Account data: email, name, login identifiers.
• Usage content: your instructions, uploaded files, generated results and project data.
• Payment data: transaction identifiers, order and plan information processed by our payment processors (we do not store full card numbers).
• Device and logs: IP address, device / browser information, activity logs, cookies and analytics data (e.g. PostHog).

3. Purposes of Use (DPP1 / DPP3)

We use personal data to: provide and maintain the Service, authenticate identity, handle billing and reconciliation, ensure security and prevent abuse, provide customer support, improve the Service, and comply with legal obligations. We use data only for the purposes stated at collection or purposes directly related to them; any new purpose will require your further consent.

4. Classes of Transferees (DPP3)

• Payment processors (Stripe, Alipay): to complete payments;
• Cloud and AI sub-processors: providers of model inference / vision / retrieval / object storage, to operate the corresponding features;
• Affiliates, professional advisers, and law-enforcement / regulatory authorities where necessary to comply with the law or protect legitimate interests;
• A transferee in the event of a business transfer. We require the above processors to process your data only to the extent needed to provide their services.

5. Cross-border Transfers

Some of the recipients above are located outside Hong Kong (e.g. Singapore, the United States, mainland China). Section 33 of the PDPO is not yet in force, so such transfers are currently lawful; we nonetheless follow the best practices of the Privacy Commissioner for Personal Data (PCPD) and adopt the PCPD's recommended model contractual clauses in our contracts with sub-processors, to ensure the recipients provide a comparable level of protection.

6. Security and Retention (DPP2 / DPP4)

We take reasonable technical and organisational measures to protect your personal data, and retain it for no longer than is necessary to fulfil the purposes of processing, unless a longer period is required by law.

7. Your Rights (DPP6 / PDPO Part 5)

You have the right to access and correct your personal data. We will respond within 40 days of receiving a request; a fee not exceeding a reasonable level may be charged for access requests. Please submit requests to [email protected].

8. Direct Marketing (PDPO Part 6A)

If we intend to use your personal data for direct marketing, we will obtain your separate consent (separate from your consent to the Service, and never pre-ticked) and provide an opt-out channel in every marketing message; without your consent, your data will not be used for marketing.

9. Cookies, Analytics, Minors and AI Content

• We use cookies and analytics tools to improve the experience; you can manage cookies in your browser settings.
• The Service is not directed at minors; do not provide personal data if you have not reached the age of majority.
• Content you submit is sent to AI models to generate results. We do not use your private business content to train models made available to the public; any change will be separately notified to you and subject to your consent.

10. Supplement for Mainland China Users (PIPL)

If you are located in mainland China, then under the Personal Information Protection Law (PIPL): before providing your personal information to recipients outside mainland China (e.g. sending it to overseas AI / payment / cloud services), we will obtain your "separate consent" in a prominent manner, and separately inform you of the overseas recipient's name and contact details, the purposes and methods of processing, the categories of personal information involved, and how to exercise your rights against the overseas recipient; we perform one of the applicable cross-border compliance routes (standard contract, certification, or security assessment). You may withdraw your separate consent at any time (withdrawal may affect related features).

11. Contact and Complaints

For personal data enquiries, access / correction requests and complaints, please contact our data protection contact: [email protected]. If you are not satisfied with our handling, you may lodge a complaint with the Office of the Privacy Commissioner for Personal Data (PCPD), Hong Kong.

12. Updates to this Policy

We may update this Policy from time to time. Material changes will be notified by reasonable means, and the "last updated" date on this page will be revised.