Privacy Policy

The data controller is Proj XS Limited. Privacy enquiries: info@projxs.hk. Legal notices: info@projxs.hk.

Account and identity data: when you sign in with Google, we receive identifiers and profile information Google provides (such as Google account ID, name, email address, and profile image), plus account metadata we create (account ID, locale preferences, tier/entitlements, token balances, timestamps).

Party and content data: company/party names, cake sets, messages, images, comments, reactions, guest notes, marketplace listings, creator profile information, and similar content you or visitors submit.

Visitor and usage data: device/browser information, IP address, approximate location derived from IP, referral URLs, pages viewed, interaction events (including box opens), visitor session identifiers, cookies or similar technologies, diagnostics, and security logs.

Payment data: we do not store full card numbers. Payment processors (such as Stripe) process payment method details. We receive transaction status, amounts, currency, customer/payment identifiers, payout status for creators, and related billing records.

AI processing data: prompts, generation parameters, outputs, moderation signals, and token consumption records when you use AI features.

Support and communications: messages you send us, and records needed to investigate abuse, disputes, or legal requests.

We use personal data to: provide and operate the Service; authenticate users; create and host parties; enable marketplace and creator features; process payments and entitlements; deliver AI features; prevent fraud, abuse, spam, and security incidents; enforce Terms; analyse and improve performance and product quality; provide customer support; comply with law; and communicate service-related notices.

We do not sell your personal data. We may use aggregated or de-identified data for analytics and product improvement.

Where required, we process data because it is necessary to perform our contract with you, to pursue legitimate interests (security, abuse prevention, product improvement, asserting legal rights) that are not overridden by your interests, to comply with legal obligations, or with your consent (for example certain optional guest contact sharing).

If you refuse to provide data necessary for an account or a feature, that account or feature may be unavailable.

We share personal data with service providers who process it on our instructions, including: authentication (Google), hosting/database/auth infrastructure (such as Supabase), application hosting/CDN, payment processing and payouts (such as Stripe), AI model/API providers (such as BytePlus / ModelArk or successors), email/ops tools, and analytics or error monitoring if enabled.

We may also disclose data to: other users as part of normal Service operation (for example public party content you choose to share); creators/buyers as needed for marketplace fulfilment; professional advisors; authorities when required by law or to protect rights, safety, and security; and successor entities in a merger, acquisition, or asset transfer, subject to appropriate safeguards.

Third parties have their own privacy practices. Review Google’s and our processors’ policies for their handling of data.

We use cookies, local storage, and similar technologies for authentication/session continuity, preferences, security, and measuring Service usage. You can control cookies through browser settings, but disabling them may break sign-in or core features.

Your data may be processed in Hong Kong and in other countries where we or our processors operate. Where we transfer personal data outside Hong Kong, we take steps we consider appropriate in the circumstances, including contractual and organisational measures with processors.

We retain personal data only as long as needed for the purposes above, including account lifetime, legal, accounting, dispute, and security requirements. Backup and log systems may retain residual copies for a limited period after deletion. We may retain limited records of abuse, fraud, or terminations to protect the Service.

We implement technical and organisational measures designed to protect personal data, including access controls, encrypted transport (HTTPS), and provider security features. No method of transmission or storage is completely secure; you use the Service at your own risk to that extent.

You are responsible for securing your Google account credentials and for choosing appropriate visibility settings for parties and content you share.

Subject to the Personal Data (Privacy) Ordinance and other applicable law, you may request access to and correction of your personal data, and raise questions about our practices. You may also request account deletion; we will delete or anonymise personal data where feasible, except where retention is required or permitted by law (for example billing records, security logs, or unresolved disputes).

To exercise rights, email info@projxs.hk from the email associated with your account and describe your request. We may need to verify your identity before acting.

Party visitors who did not create an account may have limited identifiers (such as visitor session data). Owners are responsible for guest contacts they collect with guest consent.

The Service is not directed to children under 16. We do not knowingly create accounts for children under 16. If you believe a child has provided personal data, contact info@projxs.hk and we will take appropriate steps.

If you create a party, you may receive messages, reactions, or optional guest contact details. Use that information only for the farewell purpose disclosed to guests, and comply with applicable privacy laws. Do not use guest data for unrelated marketing without a lawful basis and clear notice.

We may update this Privacy Policy from time to time. The “Last updated” date will change when we do. Material changes may be communicated through the Service or other reasonable means. Continued use after the effective date means you acknowledge the updated Policy.

Proj XS Limited — Privacy: info@projxs.hk — Legal: info@projxs.hk — Web: https://886.rip.

If there is a conflict between language versions of this Policy, the English version controls, except where mandatory local law requires otherwise.