Privacy Policy

At A.I. Pet ("we," "us," "our," or "the Service"), we take your privacy seriously. This Privacy Policy explains how we collect, use, share, and protect your personal data when you use our AI companion platform at pet.altech.hk.

This Privacy Policy is published in accordance with the Hong Kong Personal Data (Privacy) Ordinance (PDPO) and aligns with the principles of the EU General Data Protection Regulation (GDPR) and the California Consumer Privacy Act (CCPA) where applicable to our users.

1. Data We Collect

1.1 Account Information

When you register for an account, we collect the following information:

• Your chosen username
• Your email address
• Your display name (optional)
• Your bcrypt-hashed password (never stored in plaintext)
• Your account status and role (user or admin)
• Your credit balance and transaction history

1.2 Pet Companion Data

When you create and interact with AI pet companions, we collect and store:

• Pet name, type, personality tags, fur style, colors, and art style
• Custom pet type (if you selected "Custom" during creation)
• Backstory (user-written or LLM-auto-generated)
• AI-generated avatar images and the prompts used to create them
• Pet creation and modification timestamps

1.3 Chat Conversation Data

When you chat with your AI companions, we collect and store:

• Messages you send to your AI companions
• AI companion responses generated for you
• Conversation timestamps and frequency
• The system prompt constructed from your pet's personality (not stored separately, but used for each LLM call)

Conversation history is retained for the lifetime of your account to maintain conversation continuity. Your AI companion references past conversations to provide contextual responses.

1.4 Payment Data

When you subscribe to a paid plan or purchase credits, payment processing is handled by Stripe, our payment processor. Stripe collects and processes your payment card information directly. We do not store your full card number, CVV, or other sensitive card details on our servers. We receive from Stripe only the last four digits of your card, card brand, and transaction status for record-keeping purposes.

For details on how Stripe handles your payment data, please review Stripe's Privacy Policy and Stripe's Privacy Center.

1.5 Technical Data

We automatically collect certain technical information when you access the Service:

• IP address and approximate geographic location
• Browser type, version, and language settings
• Device type and operating system
• Pages visited and time spent on the Service
• Session cookies for authentication

2. How We Use Your Data

We use your personal data for the following purposes:

• Service Provision: To create and manage your account, generate AI companion responses, create pet avatars, and deliver all features of the Service
• AI Processing: To send your chat messages and pet personality data to our AI language model provider for generating companion responses and auto-generated backstories
• Image Generation: To send pet configuration data to our AI image generation provider for creating avatar images
• Credit Management: To track your credit balance, record transactions, and process credit deductions and refunds
• Billing and Payments: To process credit purchases through Stripe and maintain transaction records
• Communication: To send you service notifications, billing confirmations, policy updates, and support responses
• Service Improvement: To analyze usage patterns, identify bugs, and improve the quality and performance of the Service
• Security and Fraud Prevention: To detect, prevent, and respond to fraud, abuse, and security incidents
• Legal Compliance: To comply with applicable legal obligations and respond to lawful requests from authorities

3. Third-Party Data Sharing

We share your data with the following third-party service providers, each of whom processes data on our behalf under appropriate data processing agreements:

3.1 AI Language Model Provider

Your chat messages, pet personality tags, and backstory are sent to our AI language model provider (currently GPT-based models) to generate AI companion responses and auto-generated backstories. The provider processes this data solely to return responses to us. Conversation content is included in the context window (last 20 messages) for each LLM call to maintain conversation continuity.

3.2 AI Image Generation Provider

When you create a pet or regenerate an avatar, your pet's configuration (type, color, fur style, personality, art style) is sent to our AI image generation provider to produce the avatar image. The generated image is stored in our cloud storage and associated with your pet record.

3.3 Stripe (Payment Processor)

We share limited account information (such as your email address) with Stripe to process credit purchases. Stripe processes your payment card data directly and independently. Stripe's use of your data is governed by Stripe's Privacy Policy.

3.4 Cloud Storage Provider

AI-generated avatar images and other media are stored in cloud storage (S3-compatible). The storage provider hosts the files but does not access or process the content.

3.5 Analytics Provider

We use Google Analytics to understand how users interact with the Service. Google Analytics collects anonymized usage data, including page views, session duration, and interaction events. We do not share personally identifiable information with analytics providers beyond what is necessary for the service to function.

3.6 Legal Disclosures

We may disclose your data to law enforcement or government authorities if required by law, court order, or if we believe in good faith that disclosure is necessary to protect our rights, your safety, or the safety of others.

4. Data Security

We implement industry-standard security measures to protect your personal data:

• Encryption at Rest: All stored data is encrypted using AES-256 encryption
• Encryption in Transit: All data transmitted between your device and our servers is encrypted using TLS 1.2 or higher
• Password Hashing: Passwords are stored as bcrypt hashes, never in plaintext
• Access Controls: Access to personal data is restricted to authorized personnel who require it to perform their job functions
• Secure Authentication: User sessions are managed via signed JWT tokens
• Regular Audits: We conduct regular security reviews and vulnerability assessments

Despite these measures, no system can be guaranteed to be 100% secure. If we become aware of a data breach affecting your personal data, we will notify you and the relevant authorities within 72 hours of discovery, in accordance with applicable laws.

5. Data Retention

We retain your personal data for as long as your account is active. If you delete your account, we will permanently delete your personal data within 30 days, including:

• Account information (username, email, hashed password)
• Pet companion records (personality, backstory, avatar references)
• Chat conversation history
• Credit transaction records

Financial records for tax purposes are retained for 7 years as required by law. AI-generated avatar images in cloud storage are deleted when the associated pet record is deleted.

You may request deletion of specific conversations at any time by contacting us at cs@altech.hk.

6. Your Privacy Rights

Depending on your jurisdiction, you may have the following rights regarding your personal data:

• Access: Request a copy of the personal data we hold about you
• Correction: Request that we correct inaccurate or incomplete personal data
• Deletion: Request that we delete your personal data (right to be forgotten)
• Restriction: Request that we restrict the processing of your personal data
• Data Portability: Request a machine-readable copy of your personal data
• Objection: Object to our processing of your personal data for direct marketing
• Withdrawal of Consent: Withdraw consent to data processing where we rely on consent

To exercise any of these rights, please contact us at cs@altech.hk. We will respond to your request within 30 days.

7. Cookie Policy

We use cookies and similar technologies to operate the Service and improve your experience:

• Session Cookies: Used to maintain your login session and authenticate requests. These are essential for the Service to function.
• Preference Cookies: Remember your settings such as language and theme preferences.
• Analytics Cookies: Google Analytics cookies to help us understand how visitors use the Service. These are anonymized.

You can control cookies through your browser settings. Disabling essential cookies may prevent you from using the Service.

8. Children's Privacy

The Service is not directed to children under 13 years of age. We do not knowingly collect personal data from children under 13. If you believe we have collected data from a child under 13, please contact us at cs@altech.hk, and we will promptly delete such data.

Users between 13 and 18 years of age must obtain parental or guardian consent before using the Service, as stated in our Terms of Service.

9. International Data Transfers

Your personal data may be transferred to and processed in countries other than your country of residence, including Hong Kong, the United States, and other jurisdictions where our service providers operate. We ensure that such transfers comply with applicable data protection laws and that appropriate safeguards are in place.

10. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by posting the updated policy on this page and, for significant changes, sending an email notification. We encourage you to review this page periodically.

11. Contact Information

If you have any questions, concerns, or requests regarding this Privacy Policy or your personal data, please contact our Data Protection Officer at:

General support: cs@altech.hk