Privacy Policy

1. Who We Are

Pinghand is operated by AIC China Holdings Limited ("we", "our", or "us"), a company incorporated in Hong Kong. We provide an AI-powered WhatsApp automation service for Hong Kong small and medium businesses.

For privacy enquiries, contact us at: hello@pinghand.com

2. What Data We Collect

Data you provide directly:

• Your name and email address when you create an account
• Your business name, type, address, pricing, and services
• Your WhatsApp Business Account credentials (WABA ID, Phone Number ID)
• Your contact phone number for escalation alerts

Data generated through use of the service:

• WhatsApp message content sent to your business number (stored for dashboard display)
• Customer phone numbers and names associated with bookings (masked in logs)
• Booking records (date, time, service, status)
• Conversation metadata (timestamps, response type, language detected)

3. How We Use Your Data

• To provide and operate the Pinghand service
• To generate AI replies to your customers' WhatsApp messages
• To display analytics and booking information in your dashboard
• To send you escalation alerts when a customer complaint is detected
• To process subscription payments via Stripe
• To improve the accuracy and quality of AI responses

We do not sell your data or your customers' data to third parties.

4. Data Storage and Security

Your data is stored on Supabase servers located in Singapore (ap-southeast-1 region), operated by Supabase Inc. All data is encrypted at rest and in transit using TLS 1.2+.

Customer phone numbers in conversation logs are masked (e.g. +852XXXX1234) to reduce privacy exposure in the event of unauthorised access.

Payment processing is handled by Stripe. We do not store credit card numbers.

5. Your Rights Under Hong Kong PDPO

Under the Personal Data (Privacy) Ordinance (Cap. 486) of Hong Kong, you have the right to:

• Request access to personal data we hold about you
• Request correction of inaccurate personal data
• Request deletion of your account and associated data
• Withdraw consent to the use of your personal data for direct marketing

To exercise any of these rights, email us at hello@pinghand.com. We will respond within 40 days as required by the PDPO.

6. Data Retention

• Conversation logs: retained for 12 months, then automatically deleted
• Booking records: retained for 24 months
• Account data: retained until account deletion is requested
• Payment records: retained for 7 years as required by Hong Kong law

7. Third-Party Services

We use the following third-party services to operate Pinghand:

• Meta (WhatsApp Cloud API) — message delivery
• Together AI / Meta Llama 3.3 — AI response generation
• Supabase — database and authentication
• Upstash Redis — session caching
• Stripe — payment processing
• Vercel — website hosting
• Fly.io — server hosting

Each provider has their own privacy policy and data processing agreements in place.

8. Cookies

We use minimal cookies required for authentication (session tokens from Supabase). We do not use tracking cookies or third-party advertising cookies.

9. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you by email and by posting the updated policy on this page with a revised date. Continued use of the service after changes constitutes acceptance of the updated policy.

10. Contact

For any privacy-related questions or to exercise your rights, contact:
AIC China Holdings Limited
Email: hello@pinghand.com