Legal

Privacy Policy

Last updated: April 10, 2026

This Privacy Policy explains how easecity (“we”, “us”, “our”) collects, uses, stores, and protects your personal data when you use our website and products and services. By accessing or using our services, you agree to the practices described in this policy.

1. Who We Are

easecity is a technology company incorporated in the Hong Kong Special Administrative Region. We operate the products and services platform available at easecity.hk and its associated subdomains.

For any privacy-related enquiries, you can reach our team at: admin@easecity.hk

2. Data We Collect

We collect the following categories of personal data:

Account & Identity Data

  • Full name
  • Email address
  • Password (stored as a one-way bcrypt hash — we cannot read it)
  • Account role and subscription status

Contact & Business Data

  • Company or organisation name (if provided in the contact form)
  • Subject and message content submitted via our contact form

Billing & Payment Data

  • Subscription plan and billing status
  • Stripe Customer ID (a reference token, not raw card data)
  • Payment card details are handled entirely by Stripe — we never receive, store, or process raw card numbers on our servers

Usage & Technical Data

  • Session tokens (stored as secure JWT, invalidated on sign-out)
  • Audit logs of significant account actions (e.g. role changes)
  • AI chatbot conversation history (only if you use the chat feature)
  • Standard web server logs (IP address, browser user-agent, request timestamps) — managed by our hosting provider Vercel

3. How We Use Your Data

Providing the service: Account creation, authentication, dashboard access, subscription management

Billing & payments: Processing subscriptions via Stripe, sending payment confirmations, handling refunds

Communications: Responding to contact form submissions; sending transactional emails (e.g. password reset, payment receipt) via Resend

Security & compliance: Fraud prevention, maintaining audit logs, enforcing our Terms of Service

Product improvement: Analysing anonymised usage patterns to improve platform features

Legal obligations: Complying with applicable laws in the Hong Kong SAR and any other jurisdictions as required

We do not sell, rent, or trade your personal data to third parties for marketing purposes.

4. Third-Party Services

We engage the following sub-processors who may handle your personal data on our behalf. Each operates under its own privacy policy and data processing agreements:

Stripe — Payment processing & subscription billing (https://stripe.com/privacy)

Neon (via AWS Singapore) — Database hosting: stores account, subscription and order records (https://neon.tech/privacy)

Vercel — Web hosting, edge functions, and server-side request logs (https://vercel.com/legal/privacy-policy)

Resend — Transactional email delivery (https://resend.com/privacy)

OpenRouter — AI inference for the in-app chat assistant (https://openrouter.ai/privacy)

5. Data Storage & Transfers

Our primary database is hosted on Neon (powered by AWS in the ap-southeast-1 (Singapore) region). Web traffic and serverless functions are served via Vercel’s global edge network.

If you access our services from the European Economic Area (EEA) or the United Kingdom, your data may be transferred to countries outside those regions. Where such transfers occur, we rely on Standard Contractual Clauses (SCCs) or other lawful transfer mechanisms as required by applicable data protection law.

6. Data Retention

Account data: Retained for the lifetime of your account. Deleted within 30 days of account deletion request.

Subscription & billing records: Retained for 7 years to comply with Hong Kong accounting and tax requirements.

Contact form submissions: Retained for 2 years from date of submission.

AI chat conversations: Retained for 90 days, then automatically deleted.

Audit logs: Retained for 2 years.

7. Your Rights

Depending on your jurisdiction, you may have some or all of the following rights regarding your personal data:

Access: Request a copy of the personal data we hold about you.

Rectification: Ask us to correct inaccurate or incomplete data.

Erasure: Request deletion of your data, subject to legal retention obligations.

Portability: Receive your data in a structured, machine-readable format.

Objection / Restriction: Object to or restrict certain processing activities.

Withdraw consent: Where processing is based on consent, withdraw it at any time without affecting prior processing.

To exercise any of these rights, contact us at admin@easecity.hk. We will respond within 30 days. Hong Kong residents may also refer to the Office of the Privacy Commissioner for Personal Data (PCPD).

8. Cookies & Local Storage

We use a minimal set of technically necessary cookies and browser storage:

Session cookie — a secure, HTTP-only JWT issued by NextAuth to keep you signed in. Expires on sign-out or after 30 days of inactivity.

Language preference — stored in localStorage to remember your zh/en preference.

We do not use third-party advertising cookies or cross-site tracking pixels.

9. Security

We implement industry-standard security measures including:

TLS encryption in transit for all connections

bcrypt password hashing with a work factor of 12

HTTP security headers (CSP, HSTS, X-Frame-Options)

Database connections over encrypted channels with SSL

Role-based access control (RBAC) for administrative functions

No method of electronic transmission is 100% secure. If you discover a security vulnerability, please report it responsibly to admin@easecity.hk.

10. Children's Privacy

Our services are intended for business users aged 18 or older. We do not knowingly collect personal data from children under the age of 18. If you believe a child has provided us with personal data, please contact us and we will delete it promptly.

11. Changes to This Policy

We may update this Privacy Policy from time to time. When we make material changes, we will update the “Last updated” date at the top of this page and, where appropriate, notify you by email. Continued use of our services after such changes constitutes your acceptance of the revised policy.

12. Contact Us

For any questions, requests, or complaints regarding this Privacy Policy or our data practices:

easecity

Hong Kong Special Administrative Region

admin@easecity.hk