Privacy Policy

1. Who we are

This Privacy Policy explains how InfoDev Solutions Limited (“InfoDev”, “we”, “us” or “our”), a company incorporated in the Hong Kong Special Administrative Region (Company Registration No. [XXXXXXXX]), with its registered office at Room 2904-05, 29/F, Universal Trade Centre, 3 Arbuthnot Road, Central, Hong Kong, collects, uses, discloses and protects personal data.

InfoDev is the data user under the Hong Kong Personal Data (Privacy) Ordinance (Cap. 486) (“PDPO”), and, as applicable, the controller under the EU and UK General Data Protection Regulation (“GDPR”), the APP entity under the Australian Privacy Act 1988, the personal information handler under the PRC Personal Information Protection Law, the business under U.S. state privacy laws, and the controller (controlador) under the Brazilian LGPD, for the personal data described in this policy, except where we process data on behalf of a business client, in which case that client is the controller and we act as its processor.

Our users are located around the world. This policy is governed by Hong Kong law and is designed to meet the PDPO together with the core requirements of the privacy laws of Australia, mainland China, the European Union, the United Kingdom, North America and Latin America. Jurisdiction-specific information is set out in Section 14.

2. Scope

This policy applies to:

• our website and any page that links to this policy (the “Website”);
• our mobile applications distributed through the Apple App Store, Google Play or other stores (the “Apps”);
• our browser extensions distributed through the Chrome Web Store and other extension marketplaces (the “Extensions”);
• our web applications, APIs and related online services (together with the Website, Apps and Extensions, the “Services”); and
• communications with prospective and existing business clients.

Individual products may publish a short product-specific disclosure that supplements this policy. Where a product disclosure is more specific, it prevails for that product.

3. Personal data we collect

3.1 Data you provide

• Contact and account data — name, email address, company name, password (stored only as a salted hash) and account preferences.
• Communications — the content of emails, support requests and feedback you send us.
• Business and contract data — information needed to negotiate and perform a services contract with you or your organisation, including billing details.
• User content — text, files or other inputs you choose to submit to a Service in order for the Service to process them.

3.2 Data collected automatically

• Technical data — device type, operating system, browser and extension version, app version, language, and IP address (used for security and abuse prevention).
• Diagnostics — crash reports and error logs, which we configure to exclude user content wherever technically possible.
• Usage data — aggregated, de-identified information about which features are used, where a product discloses that it collects such data.

3.3 Data from third parties

• App stores and payment providers — Apple, Google and other platforms may share with us limited purchase or subscription information (for example, a transaction identifier and subscription status). We do not receive your full card number.
• Sign-in providers — if you choose “Sign in with Apple”, “Sign in with Google” or a similar option, we receive the identifier and profile data you authorise.

3.4 Data we do not collect

Unless a product disclosure explicitly says otherwise, our Services do not collect precise location, contacts, photos, health or fitness data, financial account credentials, biometric data, or your browsing history. We do not knowingly collect special-category or sensitive personal data.

4. How we use personal data and our legal bases

We do not use personal data for purposes that are not compatible with the purpose for which it was collected (PDPO Data Protection Principle 3) without your prescribed consent. We do not make decisions that produce legal or similarly significant effects about you based solely on automated processing.

5. Artificial intelligence features

Some Services may include features powered by machine-learning models, which may be operated by us or by a third-party model provider acting as our processor. Where a Service sends your input to an AI model:

• we send only the content needed to fulfil your request and disclose this in the product;
• we contractually require our model providers not to use your content to train their general-purpose models;
• we do not use your content to train our own models unless you have expressly opted in; and
• AI outputs may be inaccurate — you should review them before relying on them.

6. How we share personal data

We do not sell personal data, and we do not share it for cross-context behavioural advertising. We disclose personal data only to:

• Service providers (processors) — cloud hosting, databases, email delivery, crash reporting, customer support tools, payment processing and AI model providers, each bound by written contracts requiring confidentiality, security and use only on our instructions;
• Platform providers — Apple, Google and other distribution platforms, to the extent required to deliver, bill for or support a product;
• Professional advisers — lawyers, auditors and insurers under duties of confidentiality;
• Authorities — where required by applicable law, court order or a valid request from a competent authority, or to protect the rights, property or safety of InfoDev, our users or the public; and
• Corporate transactions — a successor entity in a merger, acquisition or sale of assets, subject to this policy continuing to apply.

A current list of our principal sub-processors is available on request from privacy@infodevsolve.com.

7. Browser extensions and the Chrome Web Store User Data Policy

Our Extensions are designed to request only the permissions strictly necessary for their single, disclosed purpose. Each Extension’s store listing and in-product disclosure states what data it handles and why.

Specifically, for data handled by our Extensions:

• we use it only to provide or improve the Extension’s single disclosed purpose and user-facing features;
• we do not sell it or transfer it to third parties, except as necessary to provide the features, to comply with law, to protect against malware, spam or fraud, or as part of a merger or acquisition with your notice;
• we do not use or transfer it for personalised advertising, or to determine creditworthiness or for lending purposes;
• we do not allow humans to read it, unless you give affirmative consent for specific data, it is necessary for security purposes (such as investigating abuse), it is necessary to comply with law, or the data is aggregated and anonymised for internal operations;
• where an Extension processes web page content, it does so only on pages and at times you trigger, and does not collect your browsing history; and
• data stored locally by an Extension (for example, via chrome.storage) stays on your device unless a feature you enable syncs it, as disclosed in the product.

8. Mobile apps

• Permissions. Our Apps request device permissions (such as camera or notifications) only when a feature you use needs them, and you can withdraw them in your device settings at any time.
• Tracking. Our Apps do not track you across apps and websites owned by other companies, as defined by Apple’s App Tracking Transparency framework, and do not access the device advertising identifier for that purpose.
• Store disclosures. The Apple “App Privacy” label and Google Play “Data safety” section for each App reflect the practices in this policy and the App’s product disclosure.
• In-app purchases. Payments are processed by Apple or Google under their own privacy policies; we receive only the information needed to confirm your entitlement.
• Account deletion. Where an App lets you create an account, you can delete it from within the App or by following the steps on our Data Deletion page.

9. Cookies and similar technologies

Our Website uses only cookies and local storage that are strictly necessary for it to function. We do not use advertising cookies or third-party tracking pixels. See our Cookie Policy for details.

10. International data transfers

We are based in Hong Kong and serve clients worldwide, and our team and service providers may be located in other jurisdictions. Personal data may therefore be transferred to, stored in and processed in countries other than the one in which it was collected, including Hong Kong, the United States, Singapore and member states of the European Economic Area.

Where we transfer personal data out of the EEA, the UK or Switzerland, we rely on an adequacy decision or on appropriate safeguards such as the European Commission’s Standard Contractual Clauses and the UK International Data Transfer Addendum. For transfers from Hong Kong, we take all reasonable precautions and exercise due diligence to ensure the data receives protection comparable to the PDPO, including through contractual measures. Where the law of your jurisdiction requires your consent (including separate consent under the PRC PIPL) or a specific transfer mechanism (such as ANPD standard contractual clauses under the Brazilian LGPD), we will obtain it or put it in place before transferring your data. Australian users should also see Section 14.3. You may request a copy of the relevant safeguards by contacting us.

11. Data retention

We keep personal data only for as long as necessary for the purposes described in this policy (PDPO Data Protection Principle 2(2)), and in particular:

• Account data — for the life of your account, then deleted within 30 days of account closure, except for limited records we must keep;
• Support communications — up to 24 months after the request is resolved;
• Diagnostics and security logs — typically up to 90 days;
• Contract, billing and tax records — up to 7 years, as required by Hong Kong accounting and tax law; and
• Backups — overwritten on a rolling cycle of up to 35 days.

12. Security

We implement technical and organisational measures appropriate to the risk, including encryption in transit (TLS 1.2 or higher) and at rest, least-privilege access controls, multi-factor authentication for administrative systems, code review, dependency vulnerability scanning, logging and monitoring, and staff confidentiality obligations. No method of transmission or storage is completely secure, but if we become aware of a personal data breach that is likely to result in a risk to you, we will notify you and the relevant authorities within the timeframes required by applicable law (for example, within 72 hours of becoming aware of it to the competent EU or UK authority, and as soon as practicable under the Australian Notifiable Data Breaches scheme and the PRC PIPL).

13. Your rights

We extend the following core rights to all users, wherever they live, subject to verification of identity and to limited exceptions permitted by applicable law:

• Access — confirm whether we hold personal data about you and obtain a copy;
• Correction — correct inaccurate or incomplete data;
• Deletion — ask us to delete your data;
• Portability — receive data you provided to us in a structured, machine-readable format;
• Objection and restriction — object to, or ask us to restrict, certain processing, and opt out of direct marketing at any time free of charge;
• Withdraw consent — where processing is based on consent, withdraw it at any time without affecting processing carried out before withdrawal; and
• Complain — lodge a complaint with us and with the data protection authority in your jurisdiction (see Section 14).

How to make a request. Email privacy@infodevsolve.com with the subject “Privacy request”, or use the in-product options where available. You may use an authorised agent where your local law allows. We will not discriminate against you for exercising your rights. We respond within the shortest period required by the law that applies to you, and in any event within 30 days unless a longer period is permitted and we tell you why. If we decline a request, we will explain our reasons and how to challenge the decision.

14. Regional privacy information

InfoDev is a Hong Kong company serving users worldwide. This Privacy Policy is designed to meet the Hong Kong PDPO and the core requirements of the privacy laws listed below. Where a local law gives you greater protection than this policy, that law prevails for you.

14.1 Hong Kong SAR

We comply with the Personal Data (Privacy) Ordinance (Cap. 486) and its six Data Protection Principles. This policy serves as our Personal Information Collection Statement and Privacy Policy Statement: it sets out the purposes of collection, the classes of persons to whom data may be transferred (Section 6), and your rights to request access to and correction of your data. Whether you supply personal data is voluntary, but if you do not supply data marked as required we may be unable to provide the relevant Service. We will not use or provide your personal data for direct marketing without your consent under Part 6A of the PDPO. We respond to data access and correction requests within 40 days. Complaints may be lodged with the Office of the Privacy Commissioner for Personal Data (www.pcpd.org.hk).

14.2 European Economic Area, United Kingdom and Switzerland

• Controller and legal bases. InfoDev is the controller. Our legal bases are set out in Section 4. Where we rely on legitimate interests, we have balanced them against your rights; you may request details of that assessment.
• Additional rights. In addition to the rights in Section 13, you have the right to object at any time to processing based on legitimate interests, and the right not to be subject to a decision based solely on automated processing that produces legal or similarly significant effects.
• Representatives. Where required by Article 27 of the EU GDPR and UK GDPR, we appoint representatives: EU representative — [EU Representative Name, Address, Email]; UK representative — [UK Representative Name, Address, Email].
• International transfers. Hong Kong does not currently benefit from an adequacy decision. Transfers to us and our providers outside the EEA, UK or Switzerland are protected by the European Commission’s Standard Contractual Clauses, the UK International Data Transfer Addendum or other lawful mechanisms.
• Complaints. You may complain to the supervisory authority in your country of residence or work, or where an alleged infringement took place; in the UK, the Information Commissioner’s Office; in Switzerland, the Federal Data Protection and Information Commissioner.

14.3 Australia

• We handle personal information in accordance with the Australian Privacy Principles (“APPs”) in the Privacy Act 1988 (Cth).
• Anonymity. Where practicable, you may deal with us anonymously or by using a pseudonym, for example when making a general enquiry.
• Overseas disclosure (APP 8). We are located in Hong Kong, and your personal information is likely to be disclosed to recipients in Hong Kong, the United States, Singapore and the European Union, as described in Section 10. We take reasonable steps to ensure those recipients do not breach the APPs.
• Data breaches. If an eligible data breach occurs, we will notify affected individuals and the Office of the Australian Information Commissioner (“OAIC”) as required by the Notifiable Data Breaches scheme.
• Complaints. Please contact us first; we will acknowledge your complaint promptly and aim to resolve it within 30 days. If you are not satisfied, you may complain to the OAIC (www.oaic.gov.au).

14.4 Mainland China

Where the Personal Information Protection Law of the People’s Republic of China (“PIPL”) applies to our processing of personal information of individuals located in mainland China:

• Personal information handler. InfoDev Solutions Limited, contact details in Section 18.
• Consent. Where PIPL requires it, we obtain your consent, and your separate consent before: providing your personal information to another handler; transferring it outside mainland China; or processing sensitive personal information. You may withdraw consent at any time.
• Cross-border transfer. Your personal information will be processed in Hong Kong and may be transferred to the jurisdictions in Section 10. The recipients, purposes, methods and categories of data are described in Sections 4, 6 and 10; you may exercise your rights against overseas recipients by contacting us.
• Your rights. You have the rights to know, decide, restrict or refuse processing; to access, copy, transfer, correct, supplement and delete your personal information; and to ask us to explain our processing rules. The close relatives of a deceased user may exercise these rights for their own lawful and legitimate interests unless the deceased arranged otherwise.
• Minors. Personal information of a child under 14 is sensitive personal information; we process it only with the consent of a parent or guardian.
• Representative in China. Where required by Article 53 of PIPL, our designated representative in mainland China is: [Name and contact details].

14.5 United States

This section supplements this policy for residents of California and other U.S. states with comprehensive consumer privacy laws (including Colorado, Connecticut, Virginia, Utah, Texas, Oregon and others).

• Notice at collection. In the past 12 months we have collected the following categories of personal information: identifiers (such as name, email and IP address); commercial information (purchase and subscription records); internet or other electronic network activity (diagnostic and usage data); and any user content you submit. Sources, purposes, recipients and retention periods are described in Sections 3, 4, 6 and 11.
• No sale, no sharing, no targeted advertising. We do not sell personal information, “share” it for cross-context behavioural advertising, or process it for targeted advertising or profiling with legal or similarly significant effects. We have no actual knowledge of selling or sharing the personal information of consumers under 16. We honour Global Privacy Control signals as an opt-out request.
• Sensitive information. We do not use or disclose sensitive personal information for purposes other than those permitted by law.
• Your rights. You may request to know, access, correct and delete your personal information, and to opt out of sale, sharing and targeted advertising. We will verify your request using information associated with your account.
• Appeals. If we decline your request, you may appeal by replying to our decision with the subject “Privacy appeal”. If you remain dissatisfied, you may contact your state Attorney General.
• Children. We comply with the Children’s Online Privacy Protection Act (COPPA); see Section 15.

14.6 Canada

We handle personal information in accordance with the Personal Information Protection and Electronic Documents Act (PIPEDA) and applicable provincial laws, including Québec’s Act respecting the protection of personal information in the private sector. Our Data Protection Officer is the person responsible for the protection of personal information (contact in Section 18). Your information may be stored and processed outside Canada and may be accessible to courts and authorities in those jurisdictions. You may complain to the Office of the Privacy Commissioner of Canada or, in Québec, the Commission d’accès à l’information.

14.7 Latin America

• Brazil. We process personal data in accordance with the Lei Geral de Proteção de Dados (Law No. 13,709/2018, “LGPD”), on the legal bases of contract performance, legitimate interest, legal obligation and consent described in Section 4. You have the rights under Article 18 of the LGPD, including confirmation of processing, access, correction, anonymisation, blocking or deletion of unnecessary or excessive data, portability, information about sharing, and revocation of consent. International transfers are carried out using the standard contractual clauses approved by the Autoridade Nacional de Proteção de Dados (“ANPD”) or other mechanisms permitted by the LGPD. Our Data Protection Officer (encarregado) can be contacted at privacy@infodevsolve.com. You may also petition the ANPD.
• Argentina. You may exercise your rights of access, rectification and deletion under Law No. 25,326. The right of access may be exercised free of charge at intervals of not less than six months, unless a legitimate interest is shown. THE AGENCY OF ACCESS TO PUBLIC INFORMATION, in its capacity as Supervisory Body of Law No. 25,326, has the power to hear complaints and claims filed by those whose rights are affected by non-compliance with the regulations on personal data protection.
• Chile, Colombia, Peru, Mexico and other countries. We respect the rights of access, rectification, cancellation/deletion, objection and portability provided by local law, including Chile’s Law No. 19,628 as amended by Law No. 21,719, Colombia’s Law 1581 of 2012, Peru’s Law No. 29733 and Mexico’s Federal Law on the Protection of Personal Data Held by Private Parties. By using the Services, you are informed that your data will be transferred to and processed in Hong Kong and the other jurisdictions in Section 10; where local law requires your consent for such transfers, we will request it. You may lodge a complaint with your national data protection authority.

15. Children

Our Services are intended for general audiences and are not directed to children. We do not knowingly collect personal data from children under 13, or under the higher minimum age that applies where you live (for example, 14 in mainland China, and up to 16 in some EEA countries), without verifiable consent from a parent or guardian. If you believe a child has provided us with personal data without such consent, please contact us and we will delete it promptly.

16. Product-specific disclosures

Before publishing an App or Extension, we add a disclosure for it below (or on the product’s own page) describing: the product’s purpose; the data it accesses; the permissions it requests and why; whether data leaves your device; and the third parties involved.

17. Changes to this policy

We may update this policy from time to time. We will post the updated version on this page with a new “Last updated” date and, where changes are material, notify you through the Service or by email before they take effect.

18. Contact us

For any question or request about this policy or your personal data, contact our Data Protection Officer:

InfoDev Solutions Limited
Attn: Data Protection Officer
Room 2904-05, 29/F, Universal Trade Centre, 3 Arbuthnot Road, Central, Hong Kong SAR
Email: privacy@infodevsolve.com

If you are not satisfied with our response to a privacy complaint, you may contact the data protection authority in your jurisdiction (see Section 14).

This policy may be made available in other languages. If this policy is translated, the English version prevails to the extent of any inconsistency, except where local law requires the local-language version to prevail.