Privacy Policy

Effective Date: 29 April 2026

Koji Limited ("Koji", "we", "us", or "our") respects your privacy and is committed to protecting your personal data. This Privacy Policy explains how we collect, use, store, and protect personal data when you visit https://koji.ltd (the "Site") or use our services. This Policy is governed by the Personal Data (Privacy) Ordinance (Cap. 486) of Hong Kong ("PDPO") and, where applicable, the EU General Data Protection Regulation ("GDPR") for visitors located in the European Economic Area and the United Kingdom.

Who We Are

Koji Limited is a company registered in Hong Kong. We are the data controller responsible for personal data collected via the Site.

Contact: info@koji.ltd

Jurisdiction: Hong Kong SAR

Information We Collect

Information You Provide Directly

When you complete the contact form on our Site, we collect your name, email address, subject, your selected area of interest (e.g. NC Name Card Inbox, BR AI OCR, Soul Compiler), and the content of your message.

If you upload content to try our services (for example, a business card photo for NC Name Card Inbox, or a business registration certificate for BR AI OCR), we collect and process that uploaded content together with any metadata it contains, such as image timestamps or device information.

If you correspond with us by email or other channels, we keep a record of that correspondence.

Information Collected Automatically

We use Google Analytics 4 (measurement ID G-W32WMYGCNP) to understand how visitors use our Site. This collects information such as pages viewed, time on page, approximate geographic location (city-level), device type, browser, operating system, referrer URL, and aggregated behavioural data. Google Analytics processes this data on our behalf in accordance with Google's privacy policy.

Our hosting infrastructure automatically logs your IP address, browser user-agent, timestamps, and pages requested for security monitoring, abuse prevention, and infrastructure diagnostics.

We use cookies to remember your language preference and to support analytics. See Section 5 for details.

Information We Do Not Collect

We do not collect special categories of personal data (such as data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic or biometric data, or data concerning health, sex life, or sexual orientation) unless you voluntarily provide such information in a message to us.

How We Use Your Personal Data

To respond to enquiries submitted via the contact form or by email.
To process and deliver demo or trial results for our services.
To improve our services. Where you submit content via trial or demo features, we may, after anonymisation, use that content to evaluate model performance, debug issues, and improve our AI models.
To analyse Site usage and improve the user experience.
To detect, prevent, and respond to fraud, security incidents, and abuse.
To comply with applicable legal obligations and respond to lawful requests from authorities.
For other purposes with your separate consent.

Legal Basis (GDPR-covered visitors)

Your consent (where you submit a contact form or upload content for a trial).
Our legitimate interests in operating, securing, and improving the Site and our services.
Compliance with our legal obligations.

Data Retention

We retain personal data only for as long as necessary for the purposes set out in this Policy.

Contact form submissions: Retained for up to 24 months from the date of last correspondence, unless a longer period is required to manage an ongoing client relationship or to comply with legal obligations.
Service trial / demo submissions: Original uploads are retained for 30 to 90 days to support debugging, quality control, and dispute resolution. After that period, original uploads are deleted; only anonymised, aggregated information may be retained.
Google Analytics data: Retained according to Google Analytics' standard retention setting (up to 14 months for user-level and event-level data; aggregate reports may be retained longer).
Server logs: Retained for up to 90 days for security and operational purposes.

Cookies and Tracking Technologies

The Site uses cookies. A cookie is a small text file stored on your device when you visit a website. We use the following categories of cookies:

Strictly Necessary Cookies: Required for the Site to function. These include cookies set by our multilingual plugin (WPML) to remember your language preference (e.g. wp-wpml_current_language).
Analytics Cookies: Used by Google Analytics to collect aggregated usage statistics. These cookies (such as _ga, _gid, _gat) help us understand how visitors interact with the Site.

You can manage or disable cookies through your browser settings. Disabling cookies may affect functionality, including the multilingual language selector.

We do not use third-party advertising or marketing cookies (such as Facebook Pixel or LinkedIn Insight Tag) at this time. If we add such trackers in future, we will update this Policy and where applicable seek your consent.

Disclosure of Personal Data

We do not sell your personal data. We may share your personal data with the following categories of recipients, only as necessary:

Service providers and processors: Trusted third-party providers who process data on our behalf. This includes cloud infrastructure providers, AI model providers (which may include OpenAI, Anthropic, Google Cloud, and other comparable AI service providers), analytics providers, email service providers, and customer support tools.
Legal and regulatory authorities: Where required by law, court order, or to protect our rights, safety, or property, or the rights, safety, or property of others.
Business transfers: If we are involved in a merger, acquisition, financing, or sale of assets, personal data may be transferred as part of that transaction, subject to applicable confidentiality and legal protections.

Cross-Border Data Transfers

Because we use cloud and AI service providers, your personal data may be processed in jurisdictions outside Hong Kong, including but not limited to the United States, the European Union, and other countries where our service providers operate.

Where personal data is transferred outside Hong Kong or the EEA, we take reasonable steps to ensure that an adequate level of protection is maintained, including through contractual safeguards with our processors.

Data Security

We take commercially reasonable technical and organisational measures to protect personal data against unauthorised access, alteration, disclosure, or destruction. These measures include transport-layer encryption (HTTPS), access controls, and regular security reviews of our infrastructure.

However, no system is fully secure. We cannot guarantee absolute security of data transmitted over the internet or stored in our systems.

Your Rights

Subject to applicable law, you have the following rights in relation to your personal data:

Right of access — to request a copy of the personal data we hold about you.
Right to rectification — to ask us to correct inaccurate or incomplete personal data.
Right to erasure — to ask us to delete your personal data, subject to legal exceptions.
Right to restrict processing — to ask us to limit how we process your personal data.
Right to object — to object to processing carried out on the basis of our legitimate interests.
Right to data portability (GDPR-covered visitors) — to receive your personal data in a structured, commonly used format.
Right to withdraw consent — where processing is based on consent, you can withdraw it at any time.
Right to lodge a complaint — with the Office of the Privacy Commissioner for Personal Data in Hong Kong (www.pcpd.org.hk), or with a relevant supervisory authority in the EEA or UK.

To exercise any of these rights, please contact us at info@koji.ltd. We will respond within a reasonable period and in accordance with applicable law. We may need to verify your identity before processing your request.

Children

Our Site and services are not directed at children under the age of 13 (or the relevant minimum age in your jurisdiction). We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us and we will take steps to delete that information.

Third-Party Links

Our Site may contain links to third-party websites and services (for example, WhatsApp). We are not responsible for the privacy practices or content of those third parties. We encourage you to review the privacy policies of any third-party services you use.

Changes to This Policy

We may update this Privacy Policy from time to time. The Effective Date at the top of this Policy indicates when it was last revised. Material changes will be communicated through the Site. Your continued use of the Site after changes take effect constitutes your acceptance of the updated Policy.

How to Contact Us

If you have questions, requests, or complaints about this Privacy Policy or our handling of your personal data, please contact us:

Koji Limited

Email: info@koji.ltd

Website: https://koji.ltd

Jurisdiction: Hong Kong SAR