English ・ 繁體中文 ・ 日本語

Privacy Policy

KATO INFORMATION TECHNOLOGY CO., LIMITED (Business Registration Number 60707143, "we") handles personal data in AIITO as set out below, in accordance with the Personal Data (Privacy) Ordinance (Cap. 486) of Hong Kong.

1. What we collect

Name, email address, telephone number, billing details, login credentials, service usage logs, IP addresses processed in short-lived rate-limiting records and, where applicable, operational mail or server logs, and content you store or send through the service — including email messages and their recipients, website content, enquiries, and what you enter into AI features.

Credit card details are collected and processed by our payment processor (Stripe). We do not hold your card number.

2. Why we use it

To provide the service; to verify your identity; to bill you; to provide support; to prevent misuse; to monitor and improve the reliability, security and performance of the service using usage data and, where practicable, aggregated data; and to send you important notices.

When investigating a fault you have reported, our staff may need to look at the affected email or website content. We do this only so far as necessary to resolve the fault, and access is limited to staff who need it.

The information needed to register an account, verify your identity and take payment is necessary in order to use the service. If you do not provide it, we may be unable to open an account or provide the service.

Your telephone number, the content of your website and email, what you enter into the AI features and other content are provided according to the features you use and the support you ask for. If you do not use the AI features, you do not need to provide anything to them.

3. AI processing and overseas transfer

  1. To provide the AI features — the AI assistant, and machine translation in the AIITO Pro Marketplace — the instructions you enter, the content of the page, email or message concerned, and related data are sent to an AI provider for processing. For customers who contract with us, only the providers named in this section are used.
  2. Providers. Our main provider is Microsoft's Azure OpenAI Service, under our agreement with Microsoft. Our back-up provider, used only when the main provider is unavailable, is Alibaba Cloud Model Studio (international edition), under our agreement with Alibaba Cloud (Singapore) Private Limited (Singapore). Each request is sent to one provider only. Each provider processes the data on our behalf, under its data protection terms.
  3. Where it is processed. Your data is processed outside Hong Kong.
    • Microsoft: we deploy the models in Microsoft's Japan East (Japan) region. Under the deployment type we use, Microsoft may process a request in any Azure region in which the relevant model is available, which may be outside Asia. We therefore cannot tell you in advance in which country a particular request will be processed.
    • Alibaba Cloud: we use Alibaba Cloud's international service. Depending on the model, Alibaba Cloud may process a request in locations other than the region we select, and we cannot tell you in advance in which country a particular request will be processed.
  4. Training. Both providers state that inputs and outputs are not used to train AI models. Microsoft states that they are not made available to OpenAI. We do not give permission for training use.
  5. Retention. Not used for training is not the same as not retained.
    • Microsoft states that the models themselves do not keep inputs or outputs. However, Microsoft runs automated abuse monitoring, and inputs and outputs flagged by that monitoring may be stored and may be reviewed by authorised Microsoft personnel. Microsoft does not publish a fixed retention period for this. Microsoft may also hold part of a request for a few minutes so that it does not have to be processed again (prompt caching).
    • Under Alibaba Cloud's standard terms, inputs and outputs may be kept for up to 30 days.
    • We have not arranged zero data retention, or for abuse monitoring to be switched off, with either provider.
  6. The AI features may be unavailable for a period. The provider we used before, Anthropic, PBC (United States), does not offer its service for Hong Kong; we stopped sending the data of customers who contract with us to it on 12 October 2026. The AI features may be unavailable for a period — for example, if a provider stops serving Hong Kong, or while we change provider. While they are unavailable, nothing you enter is sent to any AI provider. If we change provider, we will update this section before any data is sent to the new provider.
  7. If you do not use the AI features, nothing you enter is sent to an AI provider (see section 2).
  8. Rights in the data you input and the output you receive are governed by our Terms of Service.

4. Disclosure and transfer to others

  1. Stripe and its group companies, for payment processing.
  2. Server providers, to whom we entrust the operation of the hosting platform.
  3. The AI providers described in section 3 (Microsoft and, as back-up, Alibaba Cloud), acting on our behalf.
  4. Kato Tech LLC (Japan), our affiliated company, which provides technical operations and support services and may access personal data where necessary to perform those services.
  5. A purchaser, successor or proposed purchaser of all or part of our business, where the disclosure is reasonably necessary for the proposed or completed transaction and is subject to appropriate confidentiality and data protection safeguards.
  6. These include transfers outside Hong Kong, including to Japan and the United States and, for AI processing, to the places described in section 3. Where we transfer your data outside Hong Kong we take steps, including by contract with the AI providers, to ensure it is handled with a level of protection comparable to that required under the Ordinance.
  7. Apart from the recipients described above, and except where required or permitted by law, we do not disclose your personal data to others without your consent.

5. Direct marketing

We do not use your personal data for direct marketing without your consent, and we do not provide it to others for their marketing. Where we wish to do so we will seek your consent first, and you may withdraw it at any time at no cost by writing to aiito@kato-tech.com.hk.

Service notices — billing, faults, changes to terms — are not direct marketing and are sent as part of providing the service.

6. Cookies

We place one cookie, which remembers the language you chose. It contains no personal data and expires after one year.

We do not use cookies for analytics or advertising, and we do not use any third-party analytics service. Signing in uses your browser's local storage rather than a cookie.

Where you pay by card, the payment pages are operated by Stripe on their own site and any cookies there are theirs, not ours.

You can refuse or delete cookies in your browser settings. If you do, the site will simply not remember your language choice.

7. Security

We apply the following measures to protect personal data against unauthorised access, loss or damage:

  1. Encryption in transit. Connections to the service are encrypted (TLS).
  2. Passwords are not stored in a readable form. They are stored as a cryptographic hash.
  3. Certain stored credentials are encrypted, including mailbox passwords.
  4. We do not hold card numbers. These are handled by our payment processor.
  5. Access controls, log auditing, and supervision of the parties we engage.

Stored service content — email, website files and database records — is not encrypted at rest. It is protected by the access controls and operational measures described above.

8. How long we keep it

Hosted email, website content, files and other service content are deleted 30 days after access ends. Our application keeps one line of record for each request it handles — the time, the operation requested, the result, and which account made it. These lines do not contain the content of your data, what you typed, or your IP address. We have not yet set a retention period for them. Mail and other operational server logs are kept only for as long as the relevant server software retains them — in practice about one month — and are then overwritten. We do not archive the server logs. Billing, transaction and legal records may be retained for longer where required by law or reasonably necessary for legal or accounting purposes.

9. Your rights

Under the Ordinance you may ask us whether we hold your personal data, request a copy of it, and request correction of any inaccuracy. We will respond in accordance with the Ordinance, after verifying your identity. We may charge a fee for complying with a data access request. Any such fee is limited to costs directly related to and necessary for complying with the request, and will not be excessive.

Please write to aiito@kato-tech.com.hk.

10. Changes

We may revise this policy. We will publish the revised version on this page.

11. Who to contact

Requests to access or correct your personal data, and any question about this policy, should be addressed to our Privacy Officer:

Privacy Officer
KATO INFORMATION TECHNOLOGY CO., LIMITED
Flat/Rm A8, 17/F, Sunrise Industrial Centre
10 Hong Man Street, Chai Wan, Hong Kong
Email: aiito@kato-tech.com.hk

Issued: 10 August 2026 / KATO INFORMATION TECHNOLOGY CO., LIMITED

Amended: 14 October 2026 (registered English company name corrected to “KATO INFORMATION TECHNOLOGY CO., LIMITED”; AI providers and overseas transfer (sections 3 and 4) amended; takes effect on 14 October 2026) / KATO INFORMATION TECHNOLOGY CO., LIMITED