PRIVACY POLICY

1. DATA USER

The data user responsible for your personal data under this Policy is:

Ace It! Education Limited
Email (privacy & data protection enquiries): info@aceit-learning.com

For the purposes of the PDPO, the contact above may be used for data access and correction requests directed to our data protection contact.

2. SCOPE

This Policy applies to personal data we collect through the Services. At launch, the Services focus on HKDSE English Language learning tools, including Quests, mock exams, AI tutor chat (including Ace Sir), Dream Subjects (JUPAS programme planning), diagnostics, skill maps, gamification (XP/streaks), and subscription features.

By registering for or using the Services, you acknowledge that you have read this Policy. If you do not agree, you must not use the Services.

3. PERSONAL DATA WE COLLECT

We may collect the following categories of personal data, depending on how you use the Services:

3.1 Identity and profile data

• Name, display name, date of birth, gender, avatar or profile image (if provided).
• Account identifiers assigned by us or by your sign-in provider (e.g. Microsoft Entra / school account subject ID).

3.2 Contact data

• Email address, phone number (if provided), and messages you send via our contact form.

3.3 Academic and preference data

• School name, form/year of study, HKDSE subject targets and grade goals.
• Dream Subjects / JUPAS programme selections, ordering preferences, and related planning inputs.
• Onboarding responses used to personalize tutoring (e.g. dream university programme text fields).

3.4 Learning activity and content data

• Quest, mock exam, diagnostic, Grammar Lab, and writing/listening/speaking activity results and timestamps.
• Answers, drafts, uploads (including images submitted for OCR or feedback), and AI tutor chat messages.
• Skill-map scores, XP, streaks, achievements, and recommended learning paths.

3.5 Subscription and payment data

• Subscription tier, billing status, and transaction references.
• Payment card details are processed by Stripe; we do not store full card numbers on our servers.

3.6 Technical and device data

• Device fingerprint or identifier used to enforce per-plan device limits.
• Browser type, IP address, log files, and security/audit records.
• Information stored in your browser (local storage / session storage), including authentication tokens and in-progress exam drafts.

3.7 Parental report data (Premium)

• Aggregated progress summaries generated for eligible accounts. These are high-level trends and are not intended to include verbatim chat transcripts unless explicitly described in-product at the time of delivery.

Where lawful, we may also collect data you voluntarily provide in support correspondence.

4. HOW WE COLLECT PERSONAL DATA

We collect personal data:

• Directly from you — when you register, complete onboarding, use learning features, chat with tutors, save Dream Subjects, subscribe, or contact us;
• Automatically — when you interact with the Services (e.g. logs, device identifiers, browser storage);
• From third parties — such as Microsoft (authentication), Stripe (payments), and cloud infrastructure providers that host or process data on our behalf.

5. PURPOSES OF USE

We use personal data for the following purposes, or directly related purposes, including:

1. Creating and administering your account and authenticating your identity;
2. Providing, operating, maintaining, and improving the Services;
3. Personalizing learning paths, recommendations, skill maps, and tutor interactions;
4. Processing subscriptions, payments, refunds enquiries, and fraud prevention;
5. Enforcing plan entitlements (including simultaneous device limits);
6. Generating progress analytics and, where applicable, parental progress summaries;
7. Communicating with you about the Services, security alerts, and support requests;
8. Complying with applicable laws, regulations, and lawful requests; and
9. Protecting the rights, property, and safety of users, us, and others.

We will not use your personal data for a new purpose that is incompatible with the original purpose of collection without notifying you where required by the PDPO.

6. DIRECT MARKETING

In accordance with the PDPO, we will not use your personal data for direct marketing (such as promotional emails or messages about unrelated products) unless we have obtained your express consent or the PDPO permits otherwise.

Service-related communications (e.g. account verification, billing receipts, security notices, or material changes to this Policy) are not “direct marketing” for this purpose.

If you have opted in to marketing and wish to withdraw consent, contact us at info@aceit-learning.com or use any unsubscribe mechanism provided in the message.

7. DISCLOSURE OF PERSONAL DATA

We do not sell your personal data. We may disclose personal data to:

• Service providers who process data on our instructions, including cloud hosting and database providers, payment processors (Stripe), identity/authentication providers (Microsoft Entra), email delivery providers, and—only if enabled—aggregated website analytics providers;
• Professional advisers (e.g. lawyers, accountants) under confidentiality obligations;
• Authorities where required by Hong Kong law or in response to valid legal process; and
• Successors in connection with a merger, acquisition, or asset sale, subject to equivalent protection.

We require service providers to handle personal data only for specified purposes and to apply appropriate security measures. Some providers may process data outside Hong Kong; see Section 10.

8. AI PROCESSING

Certain features send content you submit (e.g. essay text, chat messages, or images) to AI systems to generate feedback, grading, or tutoring responses. This may involve third-party AI infrastructure.

Do not submit passwords, Hong Kong identity card numbers, or other highly sensitive personal data in tutor chat or uploads. You are responsible for content you submit and for complying with your school’s academic integrity rules.

9. DATA RETENTION

We retain personal data only for as long as necessary to fulfil the purposes described in this Policy, including:

• While your account remains active;
• As needed to provide the Services, resolve disputes, enforce agreements, and meet legal obligations; and
• For a reasonable period after account closure to complete backups, billing records, and fraud prevention.

We will take all practicable steps to ensure personal data is not kept longer than necessary. Anonymized or aggregated data that cannot reasonably identify you may be retained for analytics and product improvement.

10. CROSS-BORDER TRANSFERS

Our service providers may store or process personal data in Hong Kong and/or other jurisdictions (for example, where cloud regions or AI services are located). Where personal data is transferred outside Hong Kong, we will take steps reasonably necessary to ensure a comparable level of protection in accordance with the PDPO, such as contractual safeguards with recipients.

11. SECURITY

We implement technical and organizational measures designed to protect personal data against unauthorized access, loss, misuse, or alteration. No method of transmission or storage is completely secure; we cannot guarantee absolute security.

You must safeguard your login credentials and notify us promptly if you suspect unauthorized access to your account.

12. DEVICE STORAGE, COOKIES AND SIMILAR TECHNOLOGIES

We do not operate our own advertising or marketing cookie programme and do not display a cookie consent banner at this time. Most core functions rely on browser storage (local storage and session storage), including Microsoft Entra tokens and in-progress exam drafts.

Third parties (e.g. Microsoft, Stripe, and optionally Google Analytics in production) may set cookies or similar identifiers. For further detail, see Section 9 of our Terms and Conditions (“Device Storage, Cookies and Similar Technologies”).

13. YOUR RIGHTS UNDER THE PDPO

Subject to the PDPO and applicable exceptions, you have the right to:

• Ascertain whether we hold personal data about you and obtain a copy (data access request);
• Require correction of inaccurate personal data;
• Ascertain our policies and practices relating to personal data and the kinds of data held; and
• Object to direct marketing where applicable.

Requests should be sent to info@aceit-learning.com with sufficient information for us to verify your identity. We may charge a reasonable fee for processing a data access request as permitted by the PDPO.

We will respond within a reasonable period. If you are dissatisfied with our handling of your personal data, you may lodge a complaint with the Office of the Privacy Commissioner for Personal Data, Hong Kong.

14. MINORS

The Services are directed at students preparing for the HKDSE, including users under 18. If you are under 18, you represent that you have obtained consent from a parent or legal guardian to use the Services and to provide personal data as described in this Policy.

Parents or guardians with questions about a minor’s account may contact us using the email above.

15. CHANGES TO THIS POLICY

We may update this Policy from time to time. The “Last Updated” date at the top will be revised when changes are made. Material changes may be notified through the Services or by email where appropriate. Continued use after the effective date constitutes acceptance of the updated Policy, to the extent permitted by law.

16. CONTACT

For privacy enquiries, data access or correction requests, or questions about this Policy:

Ace It! Education Limited
Email: info@aceit-learning.com

Please select “Privacy & data” if you contact us through the in-app contact form.