Privacy Policy
Effective date: 26 October 2026
1. Who We Are (Data Controller)
The data controller is PeopleAI Limited, a company incorporated in Hong Kong (Business Registration No. 77996892-000-04-26-0), with its registered office at Room 728, 7/F, Liven House, 61–63 King Yip Street, Kwun Tong, Kowloon, Hong Kong. This policy covers the PAI Workstation application ("PAI Workstation", including its macOS, Windows, iOS and Android editions) and the people-ai.hk website (together, the "Services"). Data protection inquiries: [email protected].
2. Scope
This policy explains how PeopleAI Limited collects, uses, shares and protects personal data when you use PAI Workstation or this website. It does not cover third-party websites or services we link to, which are governed by their own privacy policies.
3. What Data We Collect
Website: contact details you choose to submit (name, email, company, country, message) and anonymized usage data collected via Google Analytics 4 (with IP anonymization and no advertising cookies).
PAI Workstation: account data (name, email, license information) when you create a PeopleAI account or activate a license; minimal technical data necessary to provide support (such as crash reports you choose to send). We do not operate our own analytics or advertising SDKs inside the application.
4. PAI Workstation Application Data (Local-First Architecture)
PAI Workstation employs a local-first architecture. Your messages, chat history, calendar entries, to-dos and AI model API keys are stored primarily on your device. The application communicates with our cloud only for account, licensing and channel-provisioning functions.
Instant messaging channels work as follows: WhatsApp Business API and LINE messages are delivered through the cloud infrastructure of our affiliated company (operated under the EASTAR group), which acts as a processor for channel delivery; Telegram personal-account messages are handled directly on your device via the official Telegram client library and do not pass through any PeopleAI-controlled server. Message content in transit is protected by TLS encryption.
5. AI Model API Keys (BYOK)
You may connect your own AI model API keys ("Bring Your Own Key"). Your API keys are stored locally on your device and are transmitted only from your device directly to the third-party AI endpoint you configure. Keys are never displayed back in full after entry. We do not collect, receive, access or store your API keys on any PeopleAI-controlled server.
Third-party AI model providers act as independent controllers for their own processing. Your use of such providers is governed by their terms and privacy policies; usage costs are billed directly between you and the provider.
6. Instant Messaging Platforms
Message content exchanged through WhatsApp, Telegram and LINE is processed by the respective platform provider under their own privacy policies. PeopleAI is not affiliated with, endorsed by, or sponsored by WhatsApp/Meta, Telegram, or LINE. Where required, you must use official Business APIs and remain responsible for compliance with each platform’s terms of service.
7. Payment Data
Payments are processed by Airwallex as our payment service provider. We support payment by credit/debit card, Apple Pay, Google Pay and the Airwallex App. We receive only your name, email and transaction status; we never receive or store full card numbers, CVV or authentication credentials. Card data is captured directly by Airwallex’s PCI DSS certified hosted checkout.
Airwallex acts as a processor for the execution of your payment and as an independent controller for its own fraud-prevention, know-your-customer and regulatory compliance purposes, as described in Airwallex’s own privacy policy.
8. How We Use Your Data
To provide and maintain the Services, process payments and licenses, respond to inquiries, improve the Services, and comply with legal obligations. We do not sell personal data or use it for automated decision-making.
9. Legal Bases
Where the GDPR applies, we rely on: performance of a contract (account, licensing, channel delivery), consent (analytics cookies, optional crash reports), and legitimate interests (website security and service improvement). You may withdraw consent at any time without affecting the lawfulness of processing carried out before withdrawal.
10. Cookies and Analytics
This website uses only strictly necessary cookies and Google Analytics 4 under Consent Mode v2 (no cookies set before consent; cookieless measurement when consent is denied). Details and controls are set out in our Cookie Policy.
11. Data Sharing and Processors
We share data only with service providers strictly necessary to run the Services, each acting as a processor under data protection agreements: Alibaba Cloud (Singapore) for cloud hosting, Cloudflare, Inc. for CDN and security, Airwallex for payment execution, and Google (Google Analytics 4) for website analytics. IM channel delivery for WhatsApp Business and LINE is performed by the EASTAR group affiliated company operating the channel cloud.
12. International Data Transfers
Our providers process data in Singapore, the United States and other locations. Where personal data is transferred from the EEA or the UK, we rely on appropriate safeguards such as the European Commission’s Standard Contractual Clauses and the UK International Data Transfer Addendum, supplemented where applicable by certifications such as the EU-US Data Privacy Framework.
13. Data Retention
Account and license data is kept for as long as your account is active and for the statutory retention period thereafter. Inquiry data is kept no longer than necessary to handle your request. Locally stored data (messages, calendar entries, API keys) remains on your device until you delete it. Analytics data is retained as set out in the Cookie Policy.
14. Account Deletion
If you have created a PeopleAI account, you may request deletion at any time in the application (Settings → Account → Delete Account) or via our web form at people-ai.hk/delete-account. Deletion removes your account profile and cloud-synced data within 30 days; data we must retain for legal, security or fraud-prevention reasons is described in Section 13. Locally stored data can be deleted by uninstalling the application or via Settings → Data.
15. Data Security
We apply technical and organizational measures including TLS encryption in transit, access controls, least-privilege administration and secure local storage. The local-first architecture of PAI Workstation keeps your content on your device by default — an additional protective measure under GDPR Article 32.
16. Your Rights
Subject to applicable law, you may request access to, correction or deletion of, restriction of or objection to the processing of, and portability of your personal data, and you may withdraw consent at any time by emailing [email protected]. We respond within the timeframes required by applicable law.
17. PDPO Statement (Cap. 486)
For individuals in Hong Kong, PeopleAI Limited complies with the Personal Data (Privacy) Ordinance (Cap. 486). Under Schedule 1 Data Protection Principle 6, you have the right to request access to and correction of your personal data held by us, by emailing [email protected]; we will respond within the period required by the Ordinance.
18. Children's Privacy
The Services are intended for business and professional users aged 18 or older and are not directed to children. We do not knowingly collect personal data from children under 13 (or under 16 where required by applicable law, including the EEA and UK). If we learn we have collected such data, we will delete it promptly.
19. Changes and Contact
We may update this policy; the current version is always published on this page. Questions: [email protected].