Operator: This platform is operated by Alpha Innovation Tech Limited (明思創科技有限公司) — incorporated in Hong Kong on 9 February 2021, Business Registration No. 72693665, Company Registration No. 3019375. Address: Room 6, 11/F, Prosperity Place, 6 Shing Yip Street, Kwun Tong, Kowloon, Hong Kong; Tel: +852 5200 4428; Enquiries: the "Contact Us" form (/en/contact/).
01What We Collect
- Account data: registration details such as name, email address, company name and position.
- Query content: the compliance questions you enter on the Platform and the answer dossiers generated.
- Payment data: processed by third-party payment processors; the Platform does not store full credit card numbers.
- Technical data: login records, device type, IP address and similar data used for security and system operation.
- Essential cookies: cookies used for login sessions and security verification (not used for tracking or advertising).
- Anonymous statistics: we use Vercel Analytics plus our own cookie-free counters for page views and feature usage — no IP addresses, no full user-agent strings, no question content or emails, no individual identification.
02Purposes of Use
- Providing, maintaining and improving the Q&A service;
- Handling subscriptions, billing and invoices;
- Sending service notices (e.g. new circular alerts, answer-completion notices);
- Meeting legal or regulatory requirements.
Commitment: Neither we nor our AI service providers use your query text to train any large language model. We use de-identified usage records to improve the Platform's own retrieval and quality-assessment functions (see paragraph 02A). Unless you separately consent, your query text or uploaded documents are not used to train our models. Your query content is not disclosed to third parties for their own purposes.
02AService Improvement and Machine Learning
- For each Q&A we record the question category, the provisions retrieved, the answer, citation-verification results, and your rating or wrong-answer flag.
- These records are stripped of identifying information (name, email, company, ID numbers, phone numbers, case numbers) before being used to train the Platform's own retrieval ranking and risk-assessment models, improving answer accuracy.
- De-identified records are for the Platform's internal use only — never sold and never given to third parties for their own use.
- If you consent in account settings, we may also use your query text to improve the models. You may withdraw consent at any time in Settings; afterwards, new queries are no longer used for training and your data is removed from training data at the next retraining.
- Machine-learning models only rank provisions and flag "human review recommended"; they never make decisions for you. Uploaded documents (e.g. SFC letters) are never used for training.
03Disclosure
The Platform does not sell personal data. To provide the Q&A service, your query content is transmitted, encrypted, to the third-party AI service platform we engage (TeamoRouter), which passes it to its model providers for processing; processing may take place outside Hong Kong. Transferee categories include: AI model service providers (TeamoRouter and its downstream model providers), cloud hosting providers, payment processors, email service providers, and third-party sign-in services (Google / GitHub / Yahoo — which receive only the basic profile data you authorise). Separately, this site's fonts are hosted by Google Fonts, so your IP address is transmitted to Google when pages load. Otherwise data is disclosed only:
- to the transferees above, bound by confidentiality obligations;
- as lawfully required by law, court order or a regulator;
- where reasonably necessary to protect the rights and safety of the Platform, users or the public.
04Retention
- Dossier records are kept for your reference while your account is active.
- After subscription cancellation, dossier records are retained for 90 days and then deleted.
- Audit records (retrieval results and verification logs for each answer) are kept for 2 years.
- Billing and transaction records are kept for statutory periods.
- After account deletion, personal data is permanently deleted or anonymised within a reasonable time, except where the law requires retention.
05Security
Query content is encrypted in transit and at rest; access rights are strictly limited by function; administrator accounts must use two-factor authentication (MFA); and the system undergoes regular security reviews.
06Breach Notification
If a security incident likely to affect your personal data occurs, we will notify affected users as soon as practicable and report to the Office of the Privacy Commissioner for Personal Data where applicable.
07Your Rights (PDPO)
Under the PDPO you have the right to:
- access the personal data the Platform holds about you;
- request correction of inaccurate personal data;
- enquire about the Platform's privacy policies and practices.
To exercise these rights, submit a request via the "Contact Us" form (subject: "privacy data request"); we will handle it within 40 days as the Ordinance requires.
08Policy Updates
Material changes to this policy will be announced on the Platform and notified by email. Continued use constitutes acceptance of the updated policy.