Privacy Policy

01What we collect

We collect very little, and only what you choose to give us:

• Your details, when you start the AI Transformation Diagnostic: your name, company name, industry and contact number, and any message you write. We don't ask for your email address there.
• "Notify me" forms: your name and email address, so we can tell you when a SHOOPIX app launches.
• Usage analytics and ad measurement: we use Google Analytics 4, which sets cookies and collects anonymised usage data — pages visited, approximate location, device and browser type. We also use the Meta Pixel, which sets cookies and tells Meta when you view a page here or take certain steps — starting or finishing the AI Transformation Diagnostic, asking to talk to us, or joining a notify list — so we can see how our ads on Facebook and Instagram perform. Meta may connect this to your Facebook or Instagram account if you have one. We never send your name, email address, company or anything you type to Google Analytics or the Meta Pixel. Apart from these two, we don't use any other cookies or trackers.
• AI Transformation Diagnostic: what you type into the diagnostic chat, the notes our AI keeps on it, and the framework it writes for you. See section 06.

This site has no user accounts and takes no payments, so we never collect passwords or payment details here.

02Why we collect it

• To reply to your enquiry and discuss potential work.
• To email you when an app you asked about becomes available.
• To understand how the site is used so we can improve it, and to measure how our ads on Facebook and Instagram perform.
• To run the AI Transformation Diagnostic: to generate the AI consultant's replies and the framework it writes for you; to check the quality of its answers and fix problems, using the chat logs described in section 06; and to prepare for our conversation with you, using the details you give before the chat begins.

That's it. We don't build advertising profiles ourselves, and we don't send marketing you didn't ask for.

03Legal basis

We collect and use personal data in line with Hong Kong's Personal Data (Privacy) Ordinance (PDPO). Data is collected directly from you, for purposes we state at the point of collection, and is not used for unrelated purposes without your consent.

04How long we keep it

Enquiries, including any diagnostic you send us, are kept for as long as needed to handle your enquiry and any engagement that follows. Logs of diagnostic chats kept in our account with our AI service provider expire after no more than 55 days and are then marked for deletion. Notify-list entries are kept until the relevant app launches and we've notified you, or until you ask us to remove you — whichever comes first. Analytics data is retained on Google's standard GA4 retention schedule.

05Third parties we use

Six service providers process data on our behalf:

• Google Analytics 4 — usage analytics (Google's privacy policy).
• Meta Pixel (Meta Platforms) — advertising measurement: tells us whether people who saw or clicked our ads on Facebook and Instagram went on to visit this site, use the AI Transformation Diagnostic or join a notify list (Meta's privacy policy). To stop Meta using this activity to choose the ads you see, change your Meta ad preferences.
• Our AI service provider — a third-party AI service that generates the replies in the AI Transformation Diagnostic chat, and writes your framework, from the messages you type there and the name, company and industry you give before it begins (never your contact number), and keeps a log of each chat in our account for us (see section 06).
• formsubmit.co — backup relay: forwards a form submission to our inbox at enquiry@cre8tor.work only if Resend cannot deliver it (FormSubmit's privacy policy).
• Vercel — hosts this website and processes standard server logs (Vercel's privacy policy).
• Resend — delivers every form submission, including any AI Transformation Diagnostic conversation and framework that travel with it, to our inbox at enquiry@cre8tor.work and, where an email address was given, sends an acknowledgment email. That email is a confirmation only: it never carries a copy of your conversation or your framework (Resend's privacy policy).

These providers may store data outside Hong Kong. We don't share your data with anyone else except where the law requires it.

06AI Transformation Diagnostic

The diagnostic at /diagnostic is a chat with an AI consultant. Before it begins, we ask for your name, company, industry and contact number, so a CRE8TOR consultant can pick up from it. You don't need to use it to contact us — you can email us instead. Here is what happens to what you give us:

• What's collected: the name, company, industry and contact number you give before the chat; your messages; the notes the AI consultant keeps from them — your type of business, how the work is done today, the pain points you describe, the tools you name, the impact, what you have tried, the outcome you want and any success measure you mention; and the framework the AI writes from them. We don't ask for your email address. Everything you type is processed, so please don't include sensitive personal details beyond these.
• Where it goes: each message goes through our server function on Vercel to our AI service provider, which generates the reply. Your name, company and industry travel with it as data, so the AI consultant can greet you and never asks for them again; your contact number is never sent to the AI service. When the consultation is ready, the conversation and the AI's notes are sent to the provider once more, the same way, to write your framework. Our function doesn't store the conversation or write its text to our server logs, but our AI service provider keeps a log of each chat in our account with it: your messages, the AI's replies and notes, and your framework (see below). Our AI service provider and Vercel may process it outside Hong Kong.
• What our AI provider does with it: we use a third-party AI service provider's paid business service. Under its terms, the provider doesn't use your messages or its replies to improve its products, and doesn't use them to train its AI models other than the systems it uses to detect misuse. It processes them as our data processor, including the log it keeps in our account for us (see below). For its own purposes, it keeps them for a limited period, only to detect and prevent misuse of its service and for any disclosures the law requires; if its automated checks flag a message, authorised staff at the provider may review it for that purpose. It may store or cache them in any country where it or its agents have facilities.
• In your browser: while you chat, the details you gave, the conversation and the AI's notes are kept in this browser tab's session storage, so they survive a page reload. They're removed from there when you close the tab, restart the diagnostic or reach your framework. Your framework stays in the open page until you leave it; apart from the chat log kept in our account with our AI service provider (see below), we don't store it. Copy and Print, which let you keep it, happen in your browser and send nothing to us.
• When it reaches our inbox: your name, company, industry, contact number and any message you write travel to our inbox at enquiry@cre8tor.work (through Resend, or formsubmit.co as a backup). When your framework is ready, your conversation, the AI's notes, the framework shown to you and how you reached the page (the page, the referring site and any campaign tags in the link) are sent automatically — there is nothing to press and no way to leave the conversation out. If the automatic send fails, or you have anything to add, the page's message step sends the same bundle again when you press Send. If you would rather we didn't receive the conversation, email enquiry@cre8tor.work directly instead of using the diagnostic. (Separately, every chat is logged in our account with our AI service provider, as described below.) We don't ask for your email address, so we don't email you a confirmation. Once we receive it, it's kept like any other enquiry (see section 04).

A log of every diagnostic chat (your messages, your name, company and industry, the AI's replies and notes, and any framework — never your contact number) is kept in our account with our AI service provider, whether or not your framework is written. We use it only to check the quality of the AI consultant's answers and to fix problems. Only authorised people at CRE8TOR can view it in that account, and the provider doesn't use it to improve its products. Each log expires after no more than 55 days and is then marked for deletion. To ask for access to or correction of your personal data in a diagnostic you sent us or in a chat log, or for deletion of a diagnostic you sent us, email enquiry@cre8tor.work. Tell us roughly when you used the diagnostic and the name or company you gave, so we can find it.

07Your rights

Under the PDPO you can ask us to confirm whether we hold personal data about you, request a copy of it, and ask us to correct it. You can also ask us to delete your details from the notify list or our enquiry records at any time. Email enquiry@cre8tor.work and we'll respond within the timeframe the PDPO requires (normally 40 days).

08We don't sell your data

We never sell, rent, or trade your personal data. Full stop.

09Children

This site is aimed at businesses and isn't directed at children. We don't knowingly collect data from anyone under 18. If you believe a child has submitted data to us, contact us and we'll delete it.

10Changes to this policy

If we change how we handle personal data, we'll update this page and the effective date at the top. Significant changes will be flagged on the site.

11Contact

Questions about your data, and requests to access or correct the personal data we hold about you, go to our Data Protection Officer at enquiry@cre8tor.work. CRE8TOR Group Limited (創想集團有限公司), Hong Kong SAR.