Privacy policy and personal information collection statement

Information we process

An account requires an email address and sign-in information. When you use Google sign-in, we receive the account identifier, verified email and basic profile supplied by Google. The platform does not retain Google access or refresh tokens. Without the required sign-in or verification information, we cannot create or verify an account.

You may provide your name, contact details, business information, requirements, reference images and files as needed. The platform also records submitted messages, scope confirmations, delivery feedback, acceptance, invoices, receipts and related actions. Submit only relevant information that you are entitled to provide.

How information is used

Information supports identity verification, account and business permissions, requirements, design and delivery, payment reconciliation, enquiries, and verification, invoice, receipt, renewal and service messages. Technical and activity records support issue investigation, access control and protection against duplicate processing.

Personal information must not be used for a new purpose unrelated to its collection without the required consent. Service communications and promotional messages should be handled separately.

Who can access information

Business members access shared work according to their assigned roles. Personal drafts are restricted by author and business; submitted requirements are shared with the KDS team for handling. Consider which shared information your business owners and authorised members can access.

Cloudflare serves static website content. KDS-managed cloud servers operate the platform and MongoDB, with Cloudflare R2 used for offsite backups when enabled. Google provides sign-in identity verification, and the independent KDS Email Service uses Google Workspace for service email. Airwallex processes payments when enabled. Providers process information as needed for their services, potentially outside Hong Kong; KDS manages access and protection according to service needs and applicable requirements.

Payments and email

When payment services are enabled, Airwallex payment components or hosted pages handle online payments. KDS stores transaction references, status, amounts and authorisation references, not full card numbers or CVCs. Payment success requires provider verification; a return page alone is not payment evidence.

The independent KDS Email Service processes recipient addresses, message content and delivery status for transactional messages. Provider acceptance, delivery and actual inbox receipt are distinct. Do not send passwords, one-time verification codes or full payment credentials with enquiries.

Cookies and browser storage

The platform uses sign-in and security cookies. Some interface preferences and unfinished text are stored in your browser to support recovery. Recovery checks the account and business; payment credentials and payment consent are not saved as offline drafts. Sign out after using a shared device and consider the information stored locally.

Analytics collection is disabled by default for the first production release. Enabling analytics or other non-essential tracking later requires updated information and the appropriate choice mechanisms.

Retention, correction and deletion

General account and project information is kept for up to twelve months after the relevant account or project is confirmed closed, then scheduled for deletion or anonymisation. Accounting, transaction and dispute records with a continuing lawful retention need are kept separately with restricted access. Shared records still needed by other business members are not deleted merely because one member leaves.

Contact [email protected] to request access to or correction of personal information, or to enquire about deletion or closing an account. We first verify your identity and the scope of the request, then explain the items that can be addressed, any information that must be retained and the next steps.

The two KDS Owners verify and handle requests manually. We aim to complete the applicable parts within thirty days after verifying a deletion request, explaining retention exceptions or delays. Backups rotate over thirty days, so deleted information may remain in restricted backups during that period. Confirmed deletion instructions are reapplied after a recovery.

Protection and incidents

Sign-in verification, business access restrictions and private-file authorisation control access to platform information. These measures cannot guarantee that an incident will never occur. Report suspected unauthorised use to the email above with the time and relevant record references.

KDS Owners investigate incidents, restrict affected access, and arrange notification and recovery according to the actual impact and applicable requirements. Policy changes identify the revision and effective date, with notice arranged according to their impact.

Policy and privacy enquiries

Kern Design Studio Limited
間距設計工作室有限公司