Privacy Policy

Agentic Business Intelligence Solutions Limited ("ABIS HK")

Last updated: 21 October 2026

Summary

We wrote this policy to help you understand what information we collect, how we use it, and what choices you have.

ABIS HK is a Hong Kong company providing agentic AI tools. We do not sell your personal data. We do not use your content, prompts, or agent outputs to train AI models. Wherever possible, we run AI inference on local infrastructure so your data never leaves our control. When you use our Student Services, your data is stored in Hong Kong with encryption. When you interact with our public website, we collect only what is necessary and we delete it promptly. You can delete your account at any time.

Notes to Legal Counsel and Drafting Team

This document is a draft for a full Privacy Policy. ABIS HK operates under Hong Kong's Personal Data (Privacy) Ordinance (Cap. 486) ("PDPO"). While this draft covers the key elements required under PDPO and aligns with HK Privacy Commissioner guidance, the final version should be reviewed by qualified legal counsel before publication.

Special considerations for ABIS HK:

• Dual user base: minors (with linked Parent accounts) and corporate clients;
• AI agentic services processing user-generated prompts and third-party web content;
• Optional safety monitoring for minors (opt-in only) — a sensitive child welfare use case;
• Cross-border data transfers via Cloudflare (US/EU) and Stripe (US).

1. Introduction

Agentic Business Intelligence Solutions Limited ("ABIS HK," "we," "us," or "our") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our website, services, and products (collectively, the "Service"). Disputes related to this Privacy Policy are subject to the dispute resolution and governing law provisions in our Terms of Service. If there are any terms in this Privacy Policy that you do not agree with, please discontinue use of our Service.

This Privacy Policy should be read together with our:

• Terms of Service
• Student Services Addendum (if applicable)
• Data Retention Policy

2. How ABIS HK Works

We believe your data belongs to you. Our architecture reflects this principle.

Public website:

• Our public website is hosted on Cloudflare Pages. We use privacy-respecting analytics (no tracking cookies) that cannot identify you personally.

Student Services:

• Agent configurations, task logs, and account data are stored on servers located in Hong Kong.
• We encrypt data at rest and in transit (TLS 1.2+).

Corporate Services:

• Where requested, we deploy dedicated AI solutions on your premises or in your chosen cloud region, ensuring full data sovereignty.
• We do not access your corporate data beyond what is necessary for support and maintenance.

Across all services:

• We do not sell your personal data to anyone.
• We do not use your content, prompts, conversations, or agent outputs to train our own AI models.
• We do not build advertising profiles from your data.

3. Information We Collect

3.1 Information you provide to us

We collect personal information you voluntarily provide when registering for the Service, expressing interest in our products, or contacting us.

All personal information you provide must be accurate and adequate for the purpose for which it is collected. You must notify us of any changes.

3.2 Information collected automatically

We automatically collect certain technical information when you visit, use, or navigate the Service. This does not reveal your specific identity (name or contact information) but includes:

System logs: System and security logs may retain pseudonymised identifiers (such as container names and session IDs) indefinitely for operational monitoring and threat detection. Where possible, we aggregate or hash this data to prevent re-identification.

Cookies and similar technologies: We do not currently use tracking cookies. We may use essential cookies for site functionality. If we introduce analytics cookies in the future, we will update this Policy and display appropriate consent mechanisms.

4. How We Use Your Information

We may use personal information collected via our Service for the following purposes. We process your personal information in reliance on:

• Contractual performance: to provide the service you subscribed to;
• Lawful and fair processing for specified purposes: to maintain security, prevent fraud, and improve the Service, in accordance with DPP 1 of the PDPO;
• Consent: for specific activities such as safety monitoring or marketing communications;
• Legal obligations: to comply with Hong Kong law.

5. Information Sharing and Disclosures

We do not sell your personal information.

5.1 How we share data

5.2 No sale, no marketing profiling

We do not:

• Sell or rent your personal information;
• Share your data for behavioural advertising;
• Build advertising profiles from your data;
• Use your content to train AI models operated by ABIS HK.

5.3 International transfers

Some service providers process data outside Hong Kong, including in the United States and European Union. Where required, we use appropriate safeguards (e.g., Standard Contractual Clauses or equivalent contractual arrangements) to protect your data during transfer.

For Student Services, core data remains stored in Hong Kong. Cross-border transfers are limited to essential service providers (Stripe for payments, Cloudflare for hosting).

6. Data Retention

We retain your information for as long as your account is active or as needed to provide the Service.

Summary of retention periods:

For full details, see our Data Retention Policy.

When we have no ongoing legitimate need to process your personal information, we will securely delete it. If deletion is not possible (e.g., legal hold), we will isolate it from any further processing.

7. Data Security

We implement commercially appropriate technical and organisational measures to protect your information:

• Encryption: Data in transit via industry-standard TLS; data at rest via AES-256.
• Access controls: Role-based access, multi-factor authentication for staff.
• Tenant isolation: Corporate client data is logically separated from other clients.
• Audit logs: Access to personal data is logged and reviewed.
• Security testing: Regular vulnerability assessments.

Important: No method of transmission over the Internet or electronic storage is completely secure. While we will do our best to protect your personal information, transmission is at your own risk.

8. Data Breach

A data breach occurs when there is unauthorised access to or collection, use, disclosure, or disposal of personal information.

Our commitment:

• We will promptly investigate any suspected breach.
• If a breach is likely to result in a risk to the rights and freedoms of data subjects, we will notify the Hong Kong Privacy Commissioner for Personal Data within 72 hours of becoming aware of it, unless the breach is unlikely to result in such risk.
• If a breach poses a high risk of serious harm to you (e.g., financial loss, identity theft, or harm to mental well-being), we will notify you directly without undue delay.
• We will maintain records of all data breaches, including facts, effects, and remedial actions taken.

For Student Services users: if the breach relates to safety monitoring data, we will notify Parents directly.

9. Your Rights

As a data subject under Hong Kong law, you have the following rights:

1. Right to be informed — You have the right to be informed of the purposes for which your data is collected and how it will be used. (DPP 1)
2. Right to access — You may request a copy of your personal data held by us. We charge a fee of HK$50 per request for data not older than one year. Each additional year of data requested will incur a further HK$100 charge. We will inform you of the estimated fee before processing your request. (DPP 6)
3. Right to correction — You may request correction of inaccurate or incomplete data. (DPP 6)
4. Right to request cessation of processing — You may request that we stop processing your data for direct marketing purposes. (PDPO Part VIA)
5. Right to withdraw consent — Where processing is based on consent (e.g., safety monitoring), you may withdraw consent at any time. Withdrawal does not affect processing already conducted.

How to exercise your rights:

• Email: privacy@abishk.ai
• Postal: Unit B, 23/F, Two Chinachem Plaza, 68 Connaught Road, Central, Hong Kong.
• We will respond within 40 days of receiving a valid request.

Parents of minors: You may exercise these rights on behalf of your child.

9.1 Your rights in other jurisdictions

If you are located outside Hong Kong, you may have additional rights under local privacy laws (e.g., GDPR in the EU, CCPA/CPRA in California, PDPA in Singapore, APPI in Japan). ABIS HK is a Hong Kong company. Our services are primarily intended for users in Hong Kong. If you access our services from outside Hong Kong, your local privacy laws may provide additional rights. We will comply with those requirements to the extent they legally apply to us as a non-resident service provider.

9.2 Deleting your account

You (or the Parent, for a minor) may delete your account at any time:

• Via the portal: Navigate to Account Settings > Delete Account.
• Via email: Send a request to privacy@abishk.ai from your registered email address.

Account deletion will disable access to the Service. Data will be handled in accordance with our Data Retention Policy — see Section 6 above. Some data may be retained where necessary for legal, accounting, or safeguarding obligations. We will comply with deletion requests to the extent permitted by applicable law.

10. Children's Privacy

Our commitment:

• We do not knowingly collect personal information from children under 13 without verifiable parental consent.
• For users aged 13–17, all data collection and processing is managed through a linked Parent account. The Parent is the contractual counterparty and data subject representative.
• Safety monitoring: Available only with explicit Parent opt-in. This feature is disabled by default. See the Student Services Addendum for full details.
• No marketing to children: We do not direct marketing communications at users under 18.
• Parental oversight: Parents can view account activity, suspend the account, or request deletion of data at any time.

If we learn we have collected personal information from a child under 13 without parental consent, we will delete it promptly.

11. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. Material changes will be notified to you via:

• Email (for registered users); and/or
• A prominent notice on our website.

The "Last updated" date at the top of the policy will be revised. Continued use of our services after changes take effect constitutes acceptance of the revised Policy.

12. Contact Us

For questions, requests, or complaints about this Privacy Policy:

• Data Protection Officer / Privacy Contact: privacy@abishk.ai
• Postal: Unit B, 23/F, Two Chinachem Plaza, 68 Connaught Road, Central, Hong Kong.

For complaints to the regulator:

• Privacy Commissioner for Personal Data (PCPD):
  • Website: https://www.pcpd.org.hk

Annex A: Data Inventory (Internal Reference)

This document should be reviewed by legal counsel before publication.