Privacy statement & collection notice

1. Information and whether it is required

Your email address is required for sign-in codes, account access and service communications; without it we cannot provide an account. We also hold account identifiers, session and security records, team permissions, purchase references, amounts and service entitlements. Website text, images, documents, domain information and AI prompts are supplied when you choose those features. Do not upload unnecessary identity documents, private contact lists or sensitive information.

Infrastructure providers may process IP addresses, device/browser and request information for delivery, security and abuse prevention. Stripe collects card, billing and anti-fraud information directly on its hosted checkout. We receive payment status and transaction identifiers, not full card numbers or security codes.

2. Purposes

We use necessary information to authenticate users, manage websites and teams, process purchases, generate requested AI output and exports, publish approved content, provide support, prevent abuse, resolve disputes and meet legal or accounting obligations. We do not sell personal data. We do not currently use account details for direct marketing or add advertising analytics. A materially new purpose will require the notice and consent required by applicable law.

3. Recipients and processing locations

Information may be processed by our authorised personnel and providers for hosting, storage, content delivery, AI, email, payment, security and professional advice. These include Cloudflare (including Workers AI), IOPass and its AWS SES/SMTP delivery providers, Stripe, and Huawei when the delivery add-on is used. Only information needed for the relevant function is shared. Authorities or professional advisers may receive information where legally required or necessary to protect lawful rights. Providers may process information outside Hong Kong; the service does not promise exclusive Hong Kong data residency.

4. Drafts, public websites and AI

Drafts and account records are access-controlled. Publishing intentionally makes approved text and files public. The Huawei mirror receives only approved public website files, not account details, payment records, private drafts or secrets. AI assistance sends the selected facts, text and prompts to the AI provider to fulfil your request; avoid supplying confidential or unnecessary personal data.

Customers decide the personal data published on their own websites and must provide their own appropriate notices and obtain required permissions. Contact buttons open email, phone or third-party services; ZAP does not maintain a visitor-enquiry form database. Third-party destinations apply their own privacy policies.

5. Security and retention

We use tenant permissions, time-limited sign-in codes and sessions, encrypted secret storage and signed export links. No internet service is completely secure. Sign-in codes expire after ten minutes and sessions normally after fourteen days. Account, content, order, consent and publication records are retained as necessary for the service, purchased downloads, disputes and legal obligations. Retention depends on the record and purpose; there is no promise that all data is automatically deleted when hosting ends. You may request account closure or deletion, subject to necessary legal retention. Keep your own election records.

6. Access, correction and enquiries

You may request access to or correction of your personal data under the PDPO. Contact the Privacy Officer, tag.digital Limited, at info@tag.one or 19/F 33 Wyndham Street, Central, Hong Kong. We may request proportionate identity information to handle your request and may charge a lawful, non-excessive access fee. We will respond within applicable statutory time limits (ordinarily 40 days for a data access request), subject to lawful exceptions, and explain any refusal. You may also contact the Office of the Privacy Commissioner for Personal Data at pcpd.org.hk.