Privacy Policy｜HK Learn AI

Introduction

This notice explains how the HK Learn AI ("we") handles personal data in accordance with the Personal Data (Privacy) Ordinance (Cap. 486) of Hong Kong.

What we collect

Customer accounts: email, profile name and authentication records. Orders and support: contact details, selected products and variants, VPN term, totals, payment status, fulfilment status, messages and audit history. Newsletter and contact forms: email, optional role or industry, name and message. Analytics: device, referral, page, session, consent and conversion events. We receive payment references and status from Airwallex but do not store full card numbers.

Credentials we do not request

Do not send us a provider password, one-time verification code, MFA QR code, recovery code, API key or full payment-card details. The interactive security checklist stores nothing you tick. If sensitive credentials are submitted accidentally, contact us immediately so we can restrict access and arrange deletion where possible.

How we use data

We use data to create and secure customer accounts; calculate carts and discounts; process, fulfil and support orders; prevent fraud and duplicate payments; issue receipts or refunds; answer enquiries; send requested newsletters; maintain audit records; and measure and improve the site. We do not sell personal data or use it for cross-site advertising.

Consent & withdrawal

You provide your data voluntarily. You can unsubscribe from the newsletter at any time using the link in every email, or ask us to stop contacting you.

Payments and service providers

Airwallex processes payments and receives the data required for payment, fraud checks, cancellation and refund handling. Supabase provides database and authentication infrastructure. Google Analytics 4 and our first-party analytics measure site use. An email provider delivers newsletters. These providers process only the data needed for their role and may operate outside Hong Kong under their own safeguards and privacy terms.

Retention and security

We retain data only for the operational, security, dispute, accounting and legal period relevant to it, then delete or aggregate it. Google Analytics event data is retained for up to 14 months; our first-party events are periodically aggregated and pruned. Access is restricted by role, sensitive operations are audited, and payment data is handled by the payment processor. No internet service can guarantee absolute security.

Your rights

Under the Ordinance you may request access to, or correction of, your personal data. To do so, contact us at the address below.

Cookies & analytics

We use two analytics systems: our own first-party analytics (stored on our infrastructure) and Google Analytics 4. These set first-party cookies to measure visits, sessions and the purchase journey — for example hkl_vid, hkl_sid, _ga and your consent preference (hkl_consent). Visitors in the EU / EEA / UK are asked to consent before analytics cookies are set (Google Consent Mode v2); elsewhere analytics runs with IP-based safeguards. Completed purchases are also recorded server-side (including via the Google Analytics Measurement Protocol) to measure conversions. We honour Do-Not-Track / Global Privacy Control signals and do not use analytics data for cross-site advertising.

Children and changes

The shop is not intended for children to purchase independently. Provider age requirements still apply. We may update this notice when our services or processors change and will show the latest update date on this page.

Contact

For any privacy request, email hello@hklearnai.com.