私隱政策Privacy Policy

1.資料使用者Data user

本政策的資料使用者為香港藍色鯨魚人工智能科技有限公司，註冊辦事處位於香港九龍尖沙咀亞士厘道34號天星大廈7樓A5室。本政策適用於本網站、客戶服務電郵，以及由本公司收費的任何購買或訂閱。

This Privacy Policy (the “Policy”) is issued by Hong Kong Blue Whale AI Technology Limited (香港藍色鯨魚人工智能科技有限公司) (“we”, “us” or the “Company”), a private company limited by shares incorporated in the Hong Kong Special Administrative Region, whose registered office and principal place of business is at Room A5, 7/F, Astoria Building, No. 34 Ashley Road, Tsim Sha Tsui, Kowloon, Hong Kong SAR (香港九龍尖沙咀亞士厘道34號天星大廈7樓A5室). The Company is the data user responsible for the personal data described in this Policy.

This Policy applies to personal data collected through the website whaletech.hk, through our customer-service email hello@whaletech.hk, through any purchase or subscription that is billed by the Company, and through the Whaletech AI products that the Company operates. Where an individual product publishes its own product-specific privacy notice, that notice supplements this Policy for that product.

2.適用法例Legal framework

本公司按照香港《個人資料（私隱）條例》（第486章）及其六項保障資料原則處理個人資料。監管機構為個人資料私隱專員公署。

We handle personal data in accordance with the Personal Data (Privacy) Ordinance (Cap. 486) of the laws of the Hong Kong SAR (《個人資料（私隱）條例》, the “Ordinance”) and the six Data Protection Principles set out in Schedule 1 to the Ordinance, which govern the purpose and manner of collection, accuracy and retention, use, security, openness, and access and correction. The Ordinance is administered by the Office of the Privacy Commissioner for Personal Data, Hong Kong (個人資料私隱專員公署, the “Privacy Commissioner”).

In this Policy “personal data” has the meaning given in the Ordinance: any data relating directly or indirectly to a living individual from which it is practicable to ascertain the identity of that individual, and which is in a form in which access to or processing of the data is practicable.

3.收集的個人資料Personal data we collect

本公司收集帳戶資料、聯絡資料、帳單及交易紀錄、使用及日誌紀錄，以及 cookies。信用卡號碼由閣下直接輸入付款服務供應商 Airwallex 的付款頁面，本公司不會接收或儲存。

帳戶資料 Account data

When you create an account with one of our products: your name or display name, email address, a password (stored only in hashed form), your organisation where you provide it, your language and other preferences, and the settings you choose within the product.

聯絡資料 Contact data

When you write to hello@whaletech.hk or otherwise contact us: your email address, your name, the content of your message and any attachments, and our correspondence with you.

帳單及交易資料 Billing and transaction data

When you make a purchase or subscribe to a paid plan: your billing name and billing address, the plan or item purchased, the amount and currency, the date and status of each transaction, invoices and receipts, and the limited card information returned to us by our payment service provider (card brand, the last four digits and the expiry month and year). Your full card number and security code are entered on a payment form served by Airwallex and are transmitted directly to Airwallex; we never receive or store them.

使用及日誌資料 Usage and log data

When you visit this website or use our products: your IP address, browser and device type, operating system, language settings, referring page, the pages and features you use, the time and duration of your visits, request and error logs, and technical identifiers assigned to your session or device. Within a product we also record the features you use and the volume of requests made under your account, which we need to operate usage limits and billing.

Cookies 及類似技術 Cookies and similar technologies

As described in Section 12.

We do not intentionally collect sensitive personal data such as identity-card or passport numbers, health data or biometric data, and we ask you not to include such data in messages or content you send to us. Providing the data marked as required when you create an account, contact us or make a purchase is necessary; without it we cannot open the account, answer the enquiry or process the order.

4.收集目的Purposes

個人資料只用於提供及運作服務、處理付款及帳單、客戶支援、保安及防止詐騙、遵守法律責任，以及（經閣下同意後）向閣下發送產品資訊。

We collect and use personal data for the following purposes and for purposes directly related to them:

• to provide, operate, maintain and secure this website and our products, including creating and administering your account and delivering the services you have requested;
• to process payments, issue invoices and receipts, manage subscriptions and renewals, handle refunds and keep the accounting and tax records that Hong Kong law requires;
• to answer your enquiries and provide customer support;
• to detect, prevent and investigate fraud, abuse, security incidents and breaches of our Terms;
• to comply with applicable laws, regulations, court orders and lawful requests from regulators and law-enforcement authorities;
• to understand how our services are used and to improve them, using aggregated or de-identified data wherever practicable; and
• with your consent, to send you information about our products, features and offers (see Section 5).

5.法律基礎及同意Lawful basis and consent

本公司只會將個人資料用於收集時說明的目的或直接相關的目的，否則須先取得閣下的明確同意。直接促銷須先取得閣下同意，閣下亦可隨時免費要求停止。

We collect personal data only for lawful purposes directly related to our functions and activities, by means that are lawful and fair, and we collect no more than is adequate for those purposes. We use personal data only for the purposes for which it was collected, or for a directly related purpose, unless you have given your express and voluntary consent to a new purpose or the use is otherwise permitted or required by the Ordinance.

Direct marketing. In accordance with Part 6A of the Ordinance we will not use your personal data (your name and email address) to send you direct marketing about our products, features and offers unless you have consented, or indicated that you do not object, after being informed of the kinds of data to be used and the classes of marketing subjects. You may withdraw that consent at any time and free of charge by emailing hello@whaletech.hk or by using the unsubscribe link in any marketing message, and we will stop within a reasonable time. We do not provide your personal data to any other person for use in their direct marketing.

6.閣下提交予 AI 服務的內容Content you submit to AI services

閣下提交予 AI 服務的內容只用於生成閣下要求的輸出、維持閣下使用的功能，以及防止濫用。除非產品通知另有說明並經閣下同意，本公司不會將閣下的內容用作訓練 AI 系統。

Our products process the text, documents, spreadsheets and other content that you submit (“inputs”) in order to generate the output you have requested. Inputs and outputs may be stored for as long as needed to provide the features you use, such as chat history, project files and version history, and for a limited period for the purposes of abuse monitoring, security and compliance with law.

We do not use your inputs or outputs to train or improve any AI system unless a product-specific notice tells you so and you have agreed. Where an input contains personal data about other people, you are responsible for ensuring that you may lawfully provide it to us. Outputs generated by an AI system may be inaccurate; please review them before relying on them.

7.披露及分享Disclosure and sharing

個人資料只會披露予付款服務供應商（Airwallex）、雲端基建及電郵服務供應商（包括 Cloudflare），以及法律規定的情況。本公司不會出售個人資料。

We disclose personal data only to the following recipients, and only to the extent necessary for the purposes in Section 4:

• Payment processing. Airwallex, our payment service provider, which collects and processes your card details directly on our behalf, screens transactions for fraud and settles funds to us. Airwallex handles your card data under its own privacy policy and the card-scheme rules.
• Cloud infrastructure, hosting and email delivery. Cloudflare, Inc., which serves this website and protects it against attacks, and the cloud infrastructure and email-delivery providers that host our products and send transactional email. These providers act on our instructions as data processors.
• Legal and safety. Courts, regulators, law-enforcement authorities and professional advisers where disclosure is required by law, is necessary to establish, exercise or defend legal claims, or is necessary to protect the rights, property or safety of the Company, our users or others.
• Business transfers. A successor or prospective successor to all or part of our business, subject to this Policy or to protections no less stringent.

We require every service provider that processes personal data on our behalf to protect it by contract and to use it only for the services they perform for us. We do not sell personal data.

8.跨境轉移Cross-border transfers

部分服務供應商位於香港以外。個人資料轉移至香港以外時，本公司會以書面合約要求接收方提供不低於本政策及條例所要求的保障。

Some of the recipients listed in Section 7 are located, or store data, outside the Hong Kong SAR. Depending on the product and provider this may include Singapore, Australia, the United States and the European Union. When personal data is transferred outside Hong Kong we take reasonable steps to ensure that it is protected to a standard no lower than that required by this Policy and the Ordinance, including by written contractual obligations on the recipient based on the Privacy Commissioner's recommended model clauses, and we disclose only the data needed for the purpose of the transfer.

9.保留期限Retention

帳戶資料於帳戶有效期間保留，帳戶關閉後於合理期間內刪除。交易及帳單紀錄按香港法例保留七年。其他資料於目的達成後刪除或匿名化。

We keep personal data for no longer than is necessary for the purpose for which it was collected, and thereafter only as required by law:

• account data: for as long as your account is active, and for a reasonable period after closure to handle residual enquiries, after which it is deleted or anonymised;
• transaction, billing and tax records: for at least seven years after the transaction, as required by the Inland Revenue Ordinance (Cap. 112) and the Companies Ordinance (Cap. 622);
• customer-service correspondence: for as long as needed to resolve the enquiry and any follow-up, and thereafter for a limited period in case the matter is reopened;
• usage, access and security logs: for a limited period appropriate to their security purpose, after which they are deleted or aggregated so that they no longer identify you; and
• inputs and outputs of AI services: as described in Section 6, and deleted when you delete them or close your account, subject to the limited retention needed for abuse monitoring and legal compliance.

10.資料保安Security

本網站及服務全程以 TLS 加密傳輸。信用卡資料由符合 PCI DSS Level 1 標準的 Airwallex 處理，本公司不會接收或儲存完整卡號或安全碼。如發生資料外洩事故，本公司會按私隱專員的指引通知受影響人士。

We take all reasonably practicable steps to protect personal data against unauthorised or accidental access, processing, erasure, loss or use. This website and our products are served over encrypted connections (HTTPS with TLS). Access to personal data is restricted to staff and service providers who need it to perform their duties and who are bound by confidentiality obligations. Data held by our infrastructure providers is encrypted at rest.

Payment data. Payments are processed by Airwallex, a payment service provider certified to PCI DSS Level 1. Your card details are entered on and transmitted over an encrypted connection directly to Airwallex; the Company never receives or stores your full card number or security code. Your card issuer may ask you to complete 3-D Secure authentication. Please keep a copy of your receipt email for your records.

No method of transmission or storage is completely secure. If a data breach occurs that is likely to result in a real risk of harm to affected individuals, we will notify those individuals and the Privacy Commissioner in accordance with the Privacy Commissioner's guidance.

11.閣下的權利Your rights

閣下有權查閱及改正本公司持有的個人資料，並可隨時拒收直接促銷。請電郵 hello@whaletech.hk 提出要求，本公司會於收到要求後 40 日內回覆。閣下亦可向個人資料私隱專員公署投訴。

Under the Ordinance you have the following rights, which you may exercise by emailing hello@whaletech.hk with the subject line “Privacy” or by writing to the address in Section 15:

• Access. To ask whether we hold personal data about you and, if so, to be given a copy of it (section 18 of the Ordinance). You may use the Privacy Commissioner's Data Access Request Form (OPS003) if you wish. We may charge a fee that is not excessive to cover the cost of complying with a data access request.
• Correction. To ask us to correct personal data that is inaccurate (section 22 of the Ordinance).
• Deletion and account closure. To ask us to close your account and to erase personal data that we no longer need for the purposes in this Policy or are not required by law to keep.
• Direct marketing. To withdraw your consent to direct marketing at any time, free of charge (Section 5).

We will respond to a data access or correction request within 40 days of receiving it, as the Ordinance requires. Before acting on a request we may ask you to verify your identity, so that we do not disclose personal data to the wrong person. If we are unable to comply with a request we will tell you why in writing within the same period.

If you are not satisfied with how we handle your personal data or your request, you may lodge a complaint with the Office of the Privacy Commissioner for Personal Data, Hong Kong (個人資料私隱專員公署).

12.Cookies 及類似技術Cookies and similar technologies

whaletech.hk 不設廣告或分析 cookies；寄存服務供應商可能設置保安所需的 cookies。本網站的字體由 Google Fonts 載入。本公司的產品使用 cookies 或本機儲存以維持登入狀態及記住偏好設定。

This website (whaletech.hk) sets no advertising or analytics cookies. Our hosting provider, Cloudflare, may set strictly necessary cookies for security and traffic management, such as bot mitigation, that do not identify you to us. The typefaces on this website are loaded from Google Fonts; when your browser fetches them, Google receives your IP address and standard browser information under Google's privacy policy. No other third-party resources are loaded on whaletech.hk.

Our products use cookies and browser local storage that are necessary to keep you signed in, to remember your preferences and to protect your account. Where a product also uses analytics cookies, its product-specific notice says so and explains how to opt out. You can delete or block cookies through your browser settings; if you block cookies that are strictly necessary, parts of a product may stop working.

13.兒童Children

本公司的服務以年滿 18 歲的人士為對象，本公司不會在知情的情況下收集 18 歲以下人士的個人資料。

Our services are intended for users aged 18 or over, as set out in our Terms. We do not knowingly collect personal data from anyone under 18. If you believe that a person under 18 has provided personal data to us, please email hello@whaletech.hk and we will delete it.

14.政策修訂Changes to this Policy

本政策如有修訂，本公司會在本頁刊登新版本，並更新生效日期及版本號。重大修訂會以電郵或本網站通知。

We may update this Policy from time to time. The current version, with its effective date and version number, is always published at whaletech.hk/privacy/. If we make a material change to how we handle personal data we will give reasonable notice before the change takes effect, normally by email to account holders or by a notice on this website. Your continued use of our services after the effective date of a revised Policy means that the revised Policy applies to you.

15.聯絡Contact

私隱事宜、查閱或改正資料的要求及拒收直接促銷的要求，請電郵 hello@whaletech.hk（標題註明「私隱」），或郵寄至香港九龍尖沙咀亞士厘道34號天星大廈7樓A5室。本公司於 2 個工作天內回覆一般查詢（香港時間）。

Privacy enquiries, data access and correction requests and direct-marketing opt-outs should be sent to hello@whaletech.hk with the subject line “Privacy”, or by post to:

Hong Kong Blue Whale AI Technology Limited
香港藍色鯨魚人工智能科技有限公司
Room A5, 7/F, Astoria Building, No. 34 Ashley Road, Tsim Sha Tsui, Kowloon, Hong Kong SAR
香港九龍尖沙咀亞士厘道34號天星大廈7樓A5室

We acknowledge general enquiries within 2 business days (Hong Kong time, Monday to Friday, excluding Hong Kong public holidays). Statutory data access and correction requests are answered within the 40-day period described in Section 11.

16.語言Language

本政策以英文本為準。中文標題及摘要僅供參考，如有歧義，概以英文版本為準。

This Policy is written in English. Chinese-language headings, summaries or translations are provided for convenience only. In the event of any inconsistency or ambiguity between the English text and any Chinese text, the English version prevails.