Privacy Policy

Techhit Company Limited (飛研科技有限公司) (“Techhit”, “we”, “us”, or “our”), a company incorporated in the Hong Kong Special Administrative Region with Business Registration No. 75224908-000-04-26-3, operates the Tutor Wong (補習天王) AI-powered learning platform accessible via the website at tutorwong.com and via mobile applications on iOS and Android (collectively, the “Platform” or “Service”). This Privacy Policy explains how we collect, use, store, disclose, and protect personal data when you access or use our Platform, in accordance with the Personal Data (Privacy) Ordinance (Cap. 592) of the Laws of Hong Kong (“PDPO”) and other applicable data protection laws.

The data user (as defined under the PDPO) responsible for the collection, holding, processing, and use of your personal data is:

Techhit Company Limited (飛研科技有限公司), Mow Hing Factory Building, 205 Wai Yip Street, Kwun Tong, Kowloon, Hong Kong. Email: admin@tutorwong.com.

You may contact us via the Contact page on our Platform for any data protection inquiries.

We collect and process the following categories of personal data:

(a) Account Information — name, email address, a one-way hashed password (if you use password sign-in), profile picture, language preference, and account creation date. Section 16 explains the identity data and authorisation tokens involved in Google sign-in; we do not receive your Google password.

(b) Child Profile Data — child’s name or nickname, grade level (K1–S6), school type (e.g. local, international, DSS, private), school name (optional), region, and avatar selection. Child profiles are created and controlled exclusively by the parent or guardian account holder.

(c) Educational Content — photographs of homework submissions uploaded to the Platform, text extracted via optical character recognition (OCR), AI-generated grading results, question-and-answer data, error analysis classifications, step-by-step solutions, AI tutor interaction logs, video tutorial requests, AI-generated worksheet content, and academic performance reports.

(d) Payment and Subscription Information — subscription tier, subscription identifier, product identifier, and transaction history. Subscriptions are sold exclusively as in-app purchases through the Apple App Store and Google Play. Apple Inc. and Google LLC process the payment and hold your payment details; we never receive or store credit or debit card numbers. We store only the transaction identifiers and platform identifiers returned to us by Apple App Store or Google Play.

(e) Usage and Device Data — IP address, browser type and version, device type and operating system, referring URLs, pages and features accessed, timestamps, session duration, and interaction patterns.

(f) Analytics Data — product usage events and metrics collected through PostHog, including feature usage, errors, and performance. After sign-in, these events can be associated with your account identifier, name, and email address to analyse and improve the service; not all analytics data is anonymous.

(g) Communication Data — email address or WhatsApp number provided for newsletter subscriptions, customer support correspondence, and feedback you submit to us.

(h) Referral Data — referral codes, invite codes, referral relationships between users, and bonus credit records.

(i) Push Notification Tokens — device tokens for delivering push notifications on iOS, Android, or web platforms, associated with your user account.

(j) Moments and School Portfolio — photographs of activities, awards, and school life that you upload for your child, together with captions, dates, the template you select, and any generated portfolio PDF. The Platform offers an automatic photo caption feature which, when on, automatically writes and saves a caption for each photo you upload (marked as AI-suggested, and editable at any time); the photo is sent to an AI service provider for that purpose. The feature is on by default and you can switch it off at any time in Settings, after which Moments photographs are not sent for captioning.

In accordance with Data Protection Principle 1 (DPP1) of the PDPO, we process your personal data for the following lawful purposes directly related to the functions of the Platform:

(a) Service Delivery — to provide AI-powered homework grading, step-by-step solutions, AI tutoring (text and video), adaptive worksheet generation, question bank features, and academic progress reports.

(b) Account Management — to create and maintain your account, authenticate your identity, manage child profiles, and facilitate sign-in via email/password credentials or Google OAuth.

(c) Subscription and Billing — to process subscription payments, manage tier access and usage quotas, verify in-app purchase receipts, process refund requests, and maintain billing records.

(d) Service Improvement — to analyse usage patterns, identify and resolve technical issues, improve AI model accuracy and grading quality, optimise algorithms, and enhance user experience.

(e) Communication — to send transactional messages (account verification, password resets, payment confirmations), newsletter content (where you have opted in), and service announcements.

(f) Security and Fraud Prevention — to detect and prevent fraud, unauthorised access, and abuse of the Platform, including through rate limiting, session management, and account protection measures.

(g) Legal Compliance — to comply with applicable laws, regulations, and codes of practice in Hong Kong SAR, respond to lawful requests from courts or regulatory authorities, and establish, exercise, or defend legal claims.

(h) AI Model Processing — to transmit homework images, Moments photographs, and extracted text to our AI service providers for text recognition, grading, solution generation, tutor responses, reports, and caption suggestions, and to produce personalised educational feedback from them. Your data may be transmitted to third-party AI service providers as detailed in Section 6.

Tutor Wong is designed for use by parents, guardians, and tutors on behalf of children. We recognise the sensitivity of children’s educational data and apply the following safeguards:

(a) Parental Control — child profiles are created and managed exclusively by parent or guardian account holders. Children do not independently create accounts on the Platform.

(b) Data Minimisation — we collect only the child data necessary to deliver the grading, tutoring, and analytics services, primarily the child’s name or nickname, grade level, and school information for curriculum alignment.

(c) Purpose Limitation — children’s homework submissions and educational data are used solely for providing grading, tutoring, analytics, and reporting services to the parent or guardian, and for improving AI model accuracy in an anonymised or aggregated manner.

(d) No Marketing to Children — we do not use children’s personal data for marketing purposes, nor do we direct any advertising or promotional content at children.

(e) Parental Rights — parents and guardians may access, correct, or request deletion of their children’s data at any time through the Platform’s account settings or by contacting us.

We may share personal data with the following categories of third parties, in each case only to the extent necessary and subject to appropriate safeguards:

(a) AI Service Providers — when the Platform grades work, recognises text, generates a solution, answers a tutor question, produces a report, or suggests a caption, the images and text needed for that task are sent to the AI service providers we engage, and the result is returned to the Platform to show you. The current processor is the DashScope platform operated by Alibaba Cloud International, whose processing servers are located in Singapore; OpenRouter serves as a fallback route. We send only what that feature needs; account passwords and payment details are never sent to any AI service provider. This list may change as the service evolves, and we will update this policy accordingly.

(b) Payment Processors — Apple Inc. and Google LLC process all subscription payments as in-app purchases through their respective app stores. These processors handle payment card information directly and maintain PCI DSS compliance. We do not engage any other payment processor and do not process payments ourselves.

(c) Cloud Infrastructure — we use Cloudflare R2 for image storage, Neon Inc. (whose databases are hosted on Amazon Web Services) for managed PostgreSQL, and Railway for application hosting. Personal data held with these providers may reside on servers located outside Hong Kong.

(d) Analytics — we use PostHog for product analytics. After sign-in, we send your account identifier, name, and email address, where available, to PostHog to associate feature usage and error events with your account, improve the service, and investigate problems. This data is therefore not fully anonymous.

(e) Email Delivery — we use Resend for transactional email delivery and newsletter distribution.

(f) Legal and Regulatory — we may disclose personal data where required by law, regulation, court order, or request of a governmental or regulatory authority, or where necessary to protect the rights, property, or safety of Techhit, our users, or the public.

We do not sell, rent, or trade your personal data to any third party for their own marketing purposes.

Your personal data may be transferred to and processed in jurisdictions outside Hong Kong SAR, including but not limited to Singapore and the United States, where our cloud infrastructure and AI service providers maintain servers. In accordance with Data Protection Principle 3 (DPP3) of the PDPO, when transferring data outside Hong Kong we take reasonable steps to ensure that the receiving parties provide a level of data protection substantively similar to the standards of the PDPO, and we transfer only what is needed to provide the features of the Platform.

In accordance with Data Protection Principle 4 (DPP4) of the PDPO, we implement appropriate technical and organisational measures to protect personal data against unauthorised or accidental access, processing, erasure, loss, or use, including:

(a) encryption of data in transit using TLS/HTTPS and encryption of data at rest where supported by our infrastructure providers;

(b) password storage using industry-standard one-way hashing algorithms;

(c) role-based access controls and the principle of least privilege for internal access to personal data;

(d) JWT-based authentication with secure session management and token expiry;

(e) rate limiting and abuse detection mechanisms;

(f) regular security reviews of our application codebase and infrastructure configuration.

While we take commercially reasonable precautions, no method of electronic transmission or storage is completely secure. We cannot guarantee absolute security of your personal data and shall not be liable for events beyond our reasonable control.

In accordance with Data Protection Principle 2 (DPP2) of the PDPO, we retain personal data for no longer than is necessary to fulfil the purposes described in this Policy, unless a longer retention period is required or permitted by law:

(a) Account Data — retained while your account is active. Completing account deletion in the app removes your user record, linked Google sign-in record, and its stored authorisation tokens from our primary database. Other usage, transaction, and communication records are handled according to the periods and legal retention obligations in this section.

(b) Homework Submissions and Grading Data — retained for as long as your account remains active and for a reasonable period thereafter to support the question bank and progress analytics features.

(c) Payment and Transaction Records — retained for 7 years in accordance with Hong Kong tax legislation and commercial record-keeping requirements under the Inland Revenue Ordinance (Cap. 112).

(d) Usage Logs — retained for up to 24 months for service improvement, security, and audit purposes.

(e) Newsletter Subscriptions — retained until you unsubscribe or request deletion of your subscription.

You may request deletion of your account and associated data by contacting us. We will action such requests within a reasonable timeframe, subject to any legal retention obligations and legitimate business needs (e.g. fraud prevention, dispute resolution, tax compliance).

Under the Personal Data (Privacy) Ordinance, you have the following rights with respect to your personal data held by us:

(a) Right of Access (Section 18, DPP6) — you may request a copy of the personal data we hold about you. We will respond to valid data access requests within 40 days. We may charge a reasonable fee to cover the administrative cost of complying with a data access request, as permitted by the PDPO.

(b) Right of Correction (Section 22, DPP6) — you may request correction of any personal data we hold about you that is inaccurate. We will action valid correction requests within 40 days.

(c) Right to Withdraw Consent — where processing is based on your voluntary consent (e.g. newsletter subscriptions), you may withdraw consent at any time. Withdrawal of consent does not affect the lawfulness of processing carried out prior to such withdrawal.

(d) Right to Request Deletion — you may request erasure of your personal data, subject to any overriding legal retention obligations and our legitimate business needs.

(e) Right to Opt Out of Direct Marketing (Section 35C) — you have the right to opt out of receiving direct marketing communications at any time by using the unsubscribe link in our emails or by contacting us. We will action opt-out requests without charge.

To exercise any of these rights, please contact us via the Contact page on our Platform. We may require reasonable verification of your identity before processing your request.

Our Platform uses the following categories of cookies and similar technologies:

(a) Essential Cookies — strictly necessary for the Platform to function, including session management, authentication tokens, language/locale preferences, and security features. These cookies cannot be disabled without impairing core functionality.

(b) Analytics Cookies — used by PostHog to recognise your browser and record usage for service improvement and product analytics. After sign-in, this activity can be associated with your account as described in Section 6. You may manage or disable these through your browser settings.

(c) Third-Party Cookies — no payment is taken on the Platform, so no payment provider cookies are set. All payments take place inside the Apple App Store or Google Play.

We do not use cookies for the purpose of behavioural advertising or cross-site tracking.

Our Platform employs AI-powered automated processing to grade homework, generate solutions, analyse error patterns, and produce educational feedback. These automated processes:

(a) are advisory and supplementary in nature and do not produce legal effects or similarly significant effects on any individual;

(b) may be supplemented by deterministic verification mechanisms (e.g. mathematical calculation verification);

(c) should not be relied upon as the sole basis for any educational, academic, or professional decision.

Parents, guardians, and tutors retain full responsibility for reviewing and verifying AI-generated results.

You can switch off automatic photo captions at any time in Settings. Once off, Moments photographs are no longer transmitted to our AI service providers.

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. Material changes will be communicated to registered users via email or through a prominent notice on the Platform. The “Effective date” stated at the top of this Policy indicates when the latest revision took effect. Your continued use of the Platform after the effective date of a revised Policy constitutes your acceptance of the updated terms.

This Privacy Policy is governed by and construed in accordance with the laws of the Hong Kong Special Administrative Region. Any dispute arising out of or in connection with this Policy shall be subject to the exclusive jurisdiction of the courts of Hong Kong SAR.

For privacy-related inquiries, data access requests, data correction requests, or complaints regarding our handling of your personal data, please contact us via the Contact page on our Platform.

If you are not satisfied with our response to a privacy concern, you have the right to lodge a complaint with the Office of the Privacy Commissioner for Personal Data, Hong Kong (https://www.pcpd.org.hk).

(a) Access — Tutor Wong 補習天王 uses Google sign-in to verify your identity and requests only the openid, email, and profile permissions. We receive your Google account identifier, email address and verification status, and your name and profile picture where provided. This sign-in authorisation does not include Gmail messages, Google Drive files, Google Calendar events, or contacts, and does not give us your Google password.

(b) Use — we use this information to create or link your Tutor Wong account, confirm your verified email address, sign you in to the correct account, and display your profile. Your account name and email may also be used for service communications, support, and product analytics as described in Sections 4 and 6. Google sign-in data is not sold, used for personalised advertising, or used to train general-purpose artificial intelligence or machine-learning models. Homework and educational content that you upload separately are handled as described in Sections 3 to 6.

(c) Storage and protection — we store account information, your Google account identifier, and the sign-in link in our Neon-hosted database. The sign-in process also stores a Google-issued access token and, depending on the sign-in method, may store an identity token and related authorisation information. These tokens are not your Google password. Our Railway-hosted backend processes this data using the HTTPS transport protection and access controls described in Section 8. Your Google profile picture may be displayed in your account profile.

(d) Sharing and disclosure — Google handles authentication; Neon and Railway process or store the information above on our behalf. Your name, email, and account identifier may be sent to PostHog to analyse service usage and investigate problems; your email address and necessary message content may be processed by Resend to deliver service emails. Google authorisation tokens are not sent as product analytics data or email content. We may also disclose data in the legal or regulatory circumstances described in Section 6. Section 7 explains cross-border processing.

(e) Retention and deletion — the Google sign-in link and stored tokens are retained with your account until replaced or your account is deleted. Token expiry or removal of authorisation does not mean that the sign-in record has been deleted from our database. Completing in-app account deletion removes the user and Google sign-in records from our primary database; analytics, transaction, and other records subject to legal retention are handled under Section 9.

(f) Your controls — you can remove the Tutor Wong connection or access permission in your Google Account third-party connections settings. This does not automatically delete your Tutor Wong account or data already stored, and is not the same as signing out of an existing Tutor Wong session. To delete your account, choose Delete Account in the app Settings. If you cannot sign in, or need to enquire about or request deletion of other data, email admin@tutorwong.com.