Privacy policy

This is a draft, pending legal review before PixelPrep launches publicly.

Who this policy covers

This policy explains how Pixel Prep Limited ("PixelPrep", "we", "us") collects, uses, and protects personal data through the PixelPrep website and student/tutor portal. It is written to meet Hong Kong's Personal Data (Privacy) Ordinance (PDPO).

Personal data we collect

We collect only the personal data needed for the purpose you're giving it to us for:

Free consultation form: first name, last name, and phone number, submitted by a parent or guardian or by a prospective student.
Tutor application form: email address, a personal résumé, and examination results, both uploaded as PDF files.
Student and tutor portal accounts: name, email address, lesson schedules, and enrolled subjects. Accounts are created by PixelPrep administrators, not through public signup.
Account Credit and payments: the top-up and refund requests you make in the portal: the amount, a reference code, the date and the request's status (pending, confirmed, rejected, cancelled or expired). When staff confirm a payment, we also record the amount received, the bank or FPS reference, and every change to your Account Credit: top-ups, lesson charges, late-cancellation fees and refunds.
Payments by PayMe or FPS: you pay outside our website. We never ask for, receive or store your bank, card, PayMe or FPS login details. Our payment records may show the payer's name or account name, as provided by the bank or PayMe.
Refund payout details: for a refund, you send us your FPS ID, PayMe link or phone number by WhatsApp. We use it only to pay you back. We don't enter it on our website or in our database; it stays in our WhatsApp chat history with you as a record of the refund.
Course details: the curricula, subjects and exam boards (for example Edexcel or CIE) set on a student account.
Learning materials: when you download a PDF, we stamp your name, email address and the date on its pages, and record which file you downloaded and when.

Do you have to give us this data?

You don't have to give us any personal data. But without your name and phone number we can't reply to a consultation request, without an email address we can't open a portal account, and without your payout details we can't pay a refund.

How we use it

We use this data only for the purpose it was collected for: to respond to consultation requests, to review tutor applications, and to run student and tutor portal accounts (scheduling lessons, tracking enrollment, and related administration). We do not use it for advertising, and we do not sell personal data to third parties.

We also use it to check and record payments, keep your Account Credit accurate and process refunds, and to protect our learning materials: the stamp and download record let us trace a shared copy, and we limit how many downloads one account can make per hour.

Who we share it with

Personal data is only accessible to PixelPrep staff who need it to do the above. We use Hostinger to host our website and database, which may store data outside Hong Kong. We do not share personal data with any other third party unless required by law.

We keep backups of our database and learning materials to recover from data loss. Backups on our server are kept for 90 days; older backups are archived in Google Workspace, which may store data outside Hong Kong. Backups are private and only authorised PixelPrep staff can access them.

We share nothing with WhatsApp ourselves. Messages you send us there, including refund payout details, are also covered by WhatsApp's own privacy policy.

We send technical error reports about the page, browser and error to Sentry to help fix problems, without names, email addresses, passwords or payment details.

Cookies

Signed-in accounts use a strictly necessary session cookie to keep you logged in to the student or tutor portal. We do not use advertising or analytics cookies.

How long we keep it

We keep personal data only as long as we need it for the purpose it was collected for, or as long as the law requires. After that we delete it, or anonymise it so that no one can be identified from it.

Payment and Account Credit records, including refund chats on WhatsApp: 7 years from the end of the financial year they belong to, as Hong Kong tax and company law require.
Material download records: 12 months after the download.
Consultation and tutor application forms: 12 months after we receive them, unless an account or engagement follows.
Portal accounts: while the account is active, then 2 years after it is closed. Payment records follow the 7-year rule above.
Backups: server backups are deleted after 90 days. Archived backups in Google Workspace are deleted once the data in them has passed the periods above.

Children's data

Some of our students are under 18. Where a consultation or account concerns a student under 18, we expect a parent or guardian to have provided or reviewed the information submitted.

Security

We use technical and organizational measures to protect personal data, including encrypted connections and access limited to authorized staff. No system is completely secure, and we can't guarantee absolute security.

Your rights under the PDPO

You can ask us whether we hold personal data about you, request a copy of it, and ask us to correct it if it's inaccurate. You can also ask us to stop using your data for a purpose you no longer consent to, where applicable. We'll answer within 40 days, as the law requires. We may charge a reasonable fee for a copy and will tell you the amount first; correcting your data is free. To do any of this, contact us at imoyang19@gmail.com. If you're not satisfied with our response, you can complain to the Office of the Privacy Commissioner for Personal Data, Hong Kong (pcpd.org.hk).

Changes to this policy

If we make a material change to this policy, we'll update the date below and post a notice on this page.

Contact us

Pixel Prep Limited
Hong Kong
imoyang19@gmail.com
+852 5362 6680

Draft — not yet reviewed by legal counsel.