隐私政策

最后更新：2026 年 10 月 15 日

This Privacy Policy explains how Kite Flyer Software Studio Limited (“Kite Flyer,” “we,” “us,” or “our”) collects, uses, stores, shares, and protects personal information when you use our website at https://www.kiteflyersoftwarestudio.xyz, our contact and marketing pages, and our products and tools—including the website builder, the Kite Flyer Client Portal (portal), and portal products such as AI Bookkeeper (together, the “Services”).

By using the Services, you agree to this Privacy Policy. If you do not agree, please do not use the Services. Our Terms and Conditions also govern use of the Services.

1. Who we are

The data controller for the Services is Kite Flyer Software Studio Limited, a company operating from Hong Kong. For privacy questions, access or deletion requests, or complaints, contact us at kiteflyersoftwarestudio@gmail.com.

2. Scope

This Policy applies to personal information we process when you:

• visit or interact with our websites and marketing pages;
• submit a contact, enquiry, lead, or project brief form;
• create an account, sign in (including with Google), or use the website builder and related dashboards;
• use the Client Portal and products such as AI Bookkeeper (including connecting Google Drive / Sheets when you choose to); or
• purchase, request, or receive paid plans, hosting, publishing, or professional services from us.

3. Information we collect

3.1 Information you provide

• Account and profile data — such as name, email address, password (if you register with email), and profile details you choose to add.
• Business and website content — prompts, briefs, industry selections, business descriptions, contact details for your business, logos, images, copy, and other materials you upload or enter into the website builder.
• Bookkeeping documents and settings — receipts, invoices, and related files you upload to AI Bookkeeper; currency, folder, and team settings you configure in the portal.
• Enquiry and lead data — name, email, phone, company, project details, and similar information submitted through contact or lead forms.
• Billing-related data — information needed to process subscriptions or payments (handled primarily by our payment processor; we do not store full card numbers on our servers).
• Support communications — messages you send us by email, WhatsApp, or other channels.

3.2 Google Sign-In (account authentication)

You may sign in to the Services using Google OAuth / Google Sign-In. When you choose Google Sign-In for authentication, we request and receive only the information necessary to create and authenticate your account, typically:

• your Google account email address;
• your basic profile name; and
• your Google profile image URL (if provided by Google and available to our auth provider).

Google Sign-In alone does not grant us access to your Gmail, Google Drive, Google Calendar, Contacts, or other Google Workspace content. Sign-In tokens are used solely to complete authentication and maintain your session.

How we use Google Sign-In data: solely to authenticate you, create and manage your Kite Flyer account, display account identity in the product, communicate service-related messages (such as security or account notices), and provide or improve user-facing features of the Services.

3.3 Google Workspace API connections (Client Portal products)

Separately from Sign-In, some Client Portal products ask you to connect a Google account so the product can use Google APIs you authorize. The Google OAuth consent screen lists the exact scopes for that connection. You can revoke access at any time in your Google Account permissions.

AI Bookkeeper may request access to Google Drive and Google Sheets (for example, drive.file and spreadsheets scopes) so we can:

• create or use folders you select for filing receipt and invoice evidence; and
• create and update cashflow / bookkeeping spreadsheets and related sheet data for your organization.

We use Drive and Sheets API access only to provide these user-facing bookkeeping features you enable. We do not sell Google Workspace user data, use it for advertising, or use it to train, fine-tune, or improve generalized AI/ML models.

Other portal products may request different Google scopes when you choose to connect them. We only request and use the scopes shown on the consent screen for the features of that product.

How we store Google Workspace connection data: OAuth tokens and connection metadata are stored securely in our application databases (with encryption at rest for secrets) for as long as the connection remains active, or as needed to operate the product and meet legal obligations. You can disconnect Google in the product settings or via Google Account permissions.

3.4 Google API Services Limited Use (affirmative statement)

The use of raw or derived user data received from Google Workspace APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. Google user data obtained via Workspace APIs is used only to provide or improve user-facing features that are prominent in the requesting application. We do not transfer Google Workspace API user data to third-party AI tools for them to train or improve their generalized models. We do not use that data for serving ads, or allow humans to read it unless (a) we have your affirmative agreement for specific messages, (b) it is necessary for security / compliance investigations, (c) it is required to comply with applicable law, or (d) the use is limited to internal operations and the data has been aggregated and anonymized.

3.5 Information collected automatically

• Usage and device data — pages viewed, features used, approximate location derived from IP, browser type, device type, referring URLs, and timestamps.
• Cookies and similar technologies — session cookies for authentication, preference cookies, and analytics cookies (including Google Analytics where enabled) to understand how the Services are used and to improve performance and security.
• Advertising measurement (Meta Pixel and Conversions API) — to measure how our ads perform, we use the Meta Pixel and the Meta Conversions API. When you sign up or file your first receipt, we send Meta a hashed email address, a hashed organisation ID, and browser data (such as IP address, browser type, and the page you were on). Meta uses this to attribute the sign-up to an ad and to show our ads to people likely to be interested, under its own Privacy Policy. We do not send receipt contents, Google data, or bookkeeping data to Meta.
• Logs and diagnostics — error logs, job status (for example website generation or document processing), and security-related events needed to run and protect the Services.

3.6 Information from website generation

When you use the website builder, we process the prompts and business information you submit, intermediate generation parameters, generated website drafts (including text and layout selections), and related job metadata. Where stock imagery is used, we may query third-party stock image providers using search terms derived from your brief.

3.7 Information from AI Bookkeeper document processing

When you upload receipts or invoices to AI Bookkeeper, we store the original file in our storage (for example Google Cloud Storage) and process it to extract structured bookkeeping fields (merchant, date, amount, category, and similar). Extracted results may then be written to your connected Google Drive / Sheets workspace as described in section 3.3.

4. How we use information

We use personal information to:

• provide, operate, secure, and improve the Services;
• authenticate users (including via Google Sign-In) and manage accounts;
• generate, store, preview, regenerate, and publish website drafts and related assets you request;
• process uploaded documents for AI Bookkeeper, deliver results to your Drive / Sheets workspace when connected, and support review and bookkeeping workflows;
• process leads, respond to enquiries, and deliver consultancy or professional services;
• process payments and manage subscriptions when billing is enabled;
• send transactional messages (account, security, billing, product updates related to your use);
• monitor abuse, enforce our Terms, prevent fraud, and protect rights and safety;
• analyse aggregated or de-identified usage to improve product quality; and
• comply with legal obligations and respond to lawful requests.

We do not sell your personal information. We do not use Google user data for serving advertisements.

5. Automated processing and third-party AI / ML providers

Some features use automated systems and third-party AI/ML providers under contract with us:

• Website builder — we may send your prompts, brief details, and necessary context to a model provider (currently DeepSeek) to return draft website content.
• AI Bookkeeper — user-uploaded document images/PDFs may be processed with Google Cloud Vision (text detection) and DeepSeek (structured field extraction). This processing uses the files you upload in the portal. It does not send Google Drive or Sheets API user data to DeepSeek for model training or generalized AI improvement. Drive / Sheets APIs are used to file evidence and update your spreadsheets after extraction.

You should not upload or enter sensitive personal data (such as government ID numbers, full payment-card secrets, or health data) unless it is strictly necessary for the feature and you understand it may be processed by those providers to deliver the result.

We do not use Google Workspace API user data (raw, aggregated, or derived) to create, train, or improve foundational or generalized machine learning or artificial intelligence models. Google Sign-In profile data is used for authentication and account management, not as training input for third-party foundation models.

6. How we share information

We share personal information only as needed to operate the Services or as required by law, including with:

• Infrastructure and auth providers (for example, database, object storage, and authentication hosting);
• Google — when you use Google Sign-In, Google Cloud Vision, Google Cloud Storage, or when you authorize Drive / Sheets access for a portal product;
• Model providers (for example DeepSeek) that process prompts or uploaded documents on our behalf to return extraction or generation results;
• Payment processors (for example, Stripe) when you purchase paid plans;
• Analytics providers (for example, Google Analytics) for aggregated product and site analytics;
• Advertising measurement providers (Meta Platforms, through the Meta Pixel and Conversions API) as described in section 3.5;
• Email and communications providers used to send transactional or support messages;
• Stock media providers when the builder requests licensed imagery based on your brief;
• Professional advisers (legal, accounting) under confidentiality where needed; and
• Authorities or counterparties when required by law, legal process, or to protect rights, safety, and security.

If we are involved in a merger, acquisition, or asset sale, personal information may be transferred as part of that transaction, subject to continuing confidentiality and this Policy (or a successor policy notified to you).

7. Cookies

We use essential cookies to keep you signed in and to protect accounts. We may also use analytics cookies to understand traffic and improve the Services, and the Meta Pixel (which may set cookies) to measure our advertising. You can control cookies through your browser settings; blocking essential cookies may prevent sign-in or core features from working.

8. Data retention

We retain personal information for as long as your account is active or as needed to provide the Services, resolve disputes, enforce agreements, and meet legal, tax, and accounting requirements. Website drafts, published sites, prompts, generation history, uploaded bookkeeping documents, and extraction results may be retained while your account remains open and for a reasonable period afterward for backup, abuse prevention, and legal compliance. Files and sheets in your Google Drive remain under your Google account’s retention controls. You may request deletion as described below.

9. Your choices and rights

Subject to applicable law (including Hong Kong PDPO), you may:

• access the personal information we hold about you;
• request correction of inaccurate information;
• request deletion of your account and associated personal data (subject to legal retention needs);
• withdraw consent where processing is consent-based (without affecting prior lawful processing); and
• object to or request restriction of certain processing where the law provides that right.

To exercise these rights, email kiteflyersoftwarestudio@gmail.com from the address associated with your account and describe your request. For Google Sign-In or Google Workspace product connections, you may also disconnect Google access via your Google Account permissions settings or in-product disconnect controls. Disconnecting Google does not automatically delete your Kite Flyer account or stored content—please submit a deletion request if you want that data removed.

10. Security

We implement administrative, technical, and organizational measures designed to protect personal information, including encrypted transport (HTTPS), access controls, encrypted storage of OAuth secrets, and use of reputable infrastructure providers. No method of transmission or storage is completely secure; we cannot guarantee absolute security.

11. International transfers

We operate from Hong Kong and may process and store information in Hong Kong and other countries where our service providers operate (including AI and cloud providers). Where data is transferred internationally, we take steps consistent with applicable law to protect it.

12. Children

The Services are directed to businesses and adults. We do not knowingly collect personal information from children under 16 (or the minimum age required in your jurisdiction). If you believe a child has provided us personal information, contact us and we will take appropriate steps to delete it.

13. Third-party links and services

The Services may link to third-party websites or integrate third-party tools (including Google Sign-In and Google Workspace APIs). Their privacy practices are governed by their own policies. We encourage you to review those policies.

14. Changes to this Policy

We may update this Privacy Policy from time to time. We will post the updated version on this page and revise the “Last updated” date. If we materially change how we use Google user data, we will update this Policy and, where required, obtain additional consent before using that data in a new way. Continued use of the Services after an update constitutes acceptance of the revised Policy where permitted by law.

15. Contact

Kite Flyer Software Studio Limited
Email: kiteflyersoftwarestudio@gmail.com
Website: https://www.kiteflyersoftwarestudio.xyz
Privacy Policy URL: https://www.kiteflyersoftwarestudio.xyz/en/privacy