1. Who We Are; Our Role

[Company Legal Name] ("we", "us", or "our") is a company incorporated in the Hong Kong Special Administrative Region and operates RDTMK, a business-to-business platform for marketing agencies. We play two roles with respect to personal data. For our customers' own account, billing, and usage data, we act as the data user (controller) and determine how that data is handled. For Client-brand data, campaign content, and Client Reviewer data that a customer inputs into the platform or whose access a customer initiates, the customer (typically an agency) is responsible for that data, and we process it on the customer's behalf. In each case, we handle personal data in accordance with the Hong Kong Personal Data (Privacy) Ordinance (Cap. 486) (the "PDPO").

2. Information We Collect

We collect the following categories of information:

• Account and authentication data. Your name, email address, and profile picture when you sign in with Google, and your email address when you sign in with a one-time code.
• Billing data. Your subscription plan and transaction history, processed via Stripe. Full payment card details are held by Stripe and are never stored by us.
• Usage and technical data. Server logs, device and browser information, IP addresses, and analytics events collected through Google Analytics.
• Content and campaign data. Projects, plans, drafts, posts and comments, tags, and files or attachments you upload.
• Reddit public data. Public posts, comments, engagement metrics, and community information collected via the Reddit API and third-party data providers.
• Client Reviewer data. When a customer shares content through review or project share links, we collect the reviewer's email address, login events, and review actions and comments.
• Webhook configuration. Webhook endpoint URLs you configure and the associated delivery logs.
• Integration API data. API tokens you generate and logs of the requests made with them.

3. How We Use Information

We use the information described above to provide and operate the Services, including generating campaign plans and content; to authenticate you; to process payments; to grant and track credits; to deliver notifications and webhooks; to provide customer support; to protect the Services against fraud, abuse, and security threats; to analyze and improve our products; and to send you service-related communications. We do not sell personal data, and we do not share personal data with third parties for their own marketing purposes.

4. AI Processing

When you use AI-powered features, the content you submit is transmitted to third-party AI model providers via OpenRouter, which routes requests to providers such as Anthropic, OpenAI, and Google, in order to generate the requested outputs. We do not use your content to train our own models.

5. Third-Party Service Providers

We rely on a small number of service providers to operate the platform. Each provider accesses data only as needed to perform its function:

• Stripe — payment processing;
• Google — OAuth sign-in and Google Analytics;
• OpenRouter and underlying AI model providers — AI content generation;
• Reddit API and Reddit-data providers — collection of public Reddit data;
• Tencent Cloud — hosting infrastructure in Singapore and object storage for uploaded files; and
• Mailgun — transactional email, such as verification codes and notifications.

6. International Data Transfers

The Services are hosted on infrastructure located in Singapore (Tencent Cloud). Some of our providers, including Stripe, Google, and AI model providers, process data in the United States and elsewhere. Where personal data is transferred outside Hong Kong, we protect it through contractual safeguards with our providers, consistent with the data protection principles of the PDPO.

7. Data Retention

We keep account data for as long as your account is active, plus a reasonable period afterwards to meet legal, accounting, and dispute-resolution needs. Customer content is retained until you delete it or until 30 days after your account is terminated (matching the export window described in our Terms of Service), after which it is deleted from our active systems. Server logs are kept for a shorter operational period. You may request deletion of your data by contacting us at the email address below.

8. Security

We protect data in transit using TLS/HTTPS. Project attachments are encrypted at rest using AES-256-GCM. We apply access controls and least-privilege practices to limit who and what can access personal data. No method of transmission or storage is 100% secure, but we work to protect your information using appropriate technical and organizational measures.

9. Your Rights

Under the PDPO, you have the right to request access to and correction of your personal data. You can update most account information directly within the Services, and you may submit access, correction, or deletion requests to the contact address below. If you are a Client or Client Reviewer whose data was submitted to the platform by an agency using the Services, please direct your request to that agency first, as it is responsible for that data; we will assist the agency in responding to your request.

10. Cookies and Tracking

We use essential cookies for authentication and session management, and Google Analytics to understand aggregate usage of the platform. You can manage or block cookies through your browser settings, although blocking essential cookies may prevent you from signing in. We do not use third-party advertising cookies.

11. Children

The Services are designed for business use and are not directed at individuals under 18 years of age. We do not knowingly collect personal data from minors. If you believe a minor has provided us with personal data, please contact us and we will delete it.

12. Changes to This Policy

We may update this Privacy Policy from time to time. The current version will always be posted on this page with a revised "Last updated" date. If we make material changes, we will notify you by email or by notice within the Services.

13. Contact Us

If you have questions or concerns about this Privacy Policy or our data practices, please contact us at: [email protected]. Postal correspondence may be addressed to [Company Legal Name], Hong Kong Special Administrative Region.