CC English 私隱政策
最後更新日期：2026 年 10 月 21 日
IELTS Monster（「本服務」）由 CC English Limited（思悅教育有限公司）（「我們」）營運。 我們承諾按照香港《個人資料（私隱）條例》（第 486 章，「PDPO」）處理你的個人資料。 本政策說明我們收集哪些資料、如何使用、與誰分享，以及你的權利。
1. 我們收集哪些資料
你直接提供的資料：
| 類別 | 內容 | 是否必須 |
|---|---|---|
| 帳戶資料 | 電郵地址、密碼（加密儲存）；如用 Google 登入，則為 Google 帳戶提供的電郵及名稱 | 必須 |
| 個人化設定 | 暱稱、目標 IELTS 分數、預定考試日期、備考目的（升學／移民／工作） | 可選，可略過 |
| 學習內容 | 你提交的作文全文、與 AI 教練的對話內容、讀書計劃偏好 | 使用相關功能時 |
| 口說錄音 | 口說模擬考中你回答各題的語音錄音。錄音與批改結果一併保存， 供你在成績紀錄頁重聽自己的作答；只有你本人登入後可以收聽 | 使用口說模擬考時 |
| 付款資料 | 訂單紀錄（方案、金額、貨幣、支付方式、支付商交易編號），以及支付服務商回傳的 原始交易通知紀錄（僅用於核數與除錯）。我們不會收取或儲存你的信用卡號碼——卡號及支付憑證由支付服務商（Stripe）在其託管頁面直接處理 | 購買時 |
| 通訊內容 | 你經 WhatsApp 或電郵與我們聯絡的內容 | 聯絡時 |
系統自動產生的資料：
- 學習紀錄：測驗與模擬試作答、對錯、分數、錯題簿及重溫排程、AI 批改結果、學習計劃進度；
- AI 用量紀錄：各 AI 功能的每日使用次數與成本計數（用於執行用量上限）；
- 功能使用紀錄：使用過的頁面及功能、點擊、停留時間、完成情況、正確率及常用功能；
- 學習記憶（僅 Pro 方案）：為令 AI 教練記得你的學習狀況，系統會就你與 AI 的對話建立摘要及向量索引；
- 站內通知的發送與已讀狀態。
我們不收集的資料：我們目前不使用廣告追蹤器或第三方分析工具（如 Google Analytics）。瀏覽器的 localStorage 只儲存功能性狀態（介面語言、音效開關、練習進度）， 不用於跨站追蹤。
2. 我們如何使用你的資料
我們只為以下目的使用你的個人資料：
- 建立及管理你的帳戶，提供你所選方案的功能；
- 批改作文、生成 AI 回應與個人化讀書計劃、追蹤學習進度；
- 處理付款、開通方案、核對訂單及處理退款；
- 向你發送服務通知（站內通知，以及同步電郵通知）；
- 回應你的查詢及提供客戶支援；
- 維護服務安全、執行用量上限、防止濫用及執行服務條款；
- 以去識別化及匯總方式分析使用情況，改進服務品質；
- 只在你另行明確同意後，以去識別化學習內容及使用紀錄訓練及改善 CC English 自家的學習模型；
- 遵守法律義務（如稅務紀錄保存）。
直接促銷：如我們擬使用你的姓名及聯絡資料向你發送課程或方案推廣訊息， 會依 PDPO 第 6A 部先取得你的同意，並在每次訊息中提供免費退訂方式。你可隨時通知我們停止（見第 10 條）。
3. 資料儲存位置與跨境轉移
你的資料主要儲存於我們的資料庫服務商 Supabase 位於新加坡的伺服器； 網站由 Vercel 的全球內容分發網絡提供。使用 AI 功能時，相關內容會傳送至 Google 的伺服器 （可能位於香港以外）處理。我們只會將資料轉移至已以合約承諾提供足夠保障的服務商。
4. 我們與誰分享資料
我們不會出售你的個人資料。只在以下範圍向第三方披露：
| 接收方 | 目的 | 涉及資料 |
|---|---|---|
| Supabase（資料庫及帳戶認證） | 儲存及認證 | 全部帳戶及學習資料 |
| Vercel（網站託管） | 提供網站 | 技術性連線資料 |
| Google（Gemini AI） | 生成 AI 批改、回應及計劃 | 你提交的作文／對話／口說錄音內容（見第 6 條） |
| Stripe（支付） | 處理付款 | 訂單金額、交易編號；卡號及支付憑證由其直接收集 |
| Resend（電郵發送） | 發送通知電郵 | 電郵地址、通知內容 |
| Google（Google 日曆，僅限自行連接的導師） | 避免預約撞到導師的私人行程；把課堂寫入導師日曆 | 導師的 Google 帳戶電郵、日曆清單、日曆忙碌時段；寫入的課堂時間及學生名稱（見第 6 條） |
| 你的導師（僅網課或 1 對 1 課程學生／真人批改） | 真人教學、批閱及安排課堂內容 | 你的學習紀錄（練習及打卡日子、各題型答對率、模擬考及寫作口說成績、讀書計劃進度）、打卡內容及相片、作文 |
| 執法或監管機構 | 法律要求時 | 依法律要求的範圍 |
我們對服務商的政策：只提供其執行特定服務所需的最少資料；只可按我們指示的目的使用； 停用服務時須刪除或匿名化所持資料。
管理員（我們的授權人員）可在營運需要範圍內查閱用戶名單（電郵、方案、到期日）， 以處理付款對帳、方案人手開通及客戶支援；存取受權限控制。
5. Cookies 與 localStorage
- 登入 Cookie：維持你的登入狀態（由認證系統設置），屬必要性 cookie；
- localStorage：儲存介面語言、音效開關、練習進度等功能性狀態，只存在你的裝置上；
- 我們不使用廣告或跨站追蹤 cookies。
停用 cookies 會令你無法保持登入。
6. AI 功能的資料處理
使用 AI 批改、AI 教練、口說模擬考等功能時，你提交的內容（作文、訊息、口說錄音）會傳送至 Google Gemini API 處理。 我們在技術上可行的範圍內先作去識別化（不附上你的真實姓名或電郵）才傳送。
你提交予 AI 功能的內容會按 Google 的服務條款處理。我們使用 Google Gemini API 的付費服務層級，按 Google 條款，經付費層級提交的內容不會用於改進 Google 的產品或訓練其模型。
AI 產出僅供參考，可能不準確；請勿在 AI 對話中提交他人的個人資料或敏感資料 （如身份證號碼、醫療資料）。
CC English 自家模型訓練（自願參與）
我們會保存提供服務所需的學習紀錄。只有當你在帳戶頁另行明確同意後，我們才會把你過往及日後的作文、 練習答案、AI 對話、批改結果、功能使用及學習表現紀錄，以去識別化方式加入 CC English 自家模型的訓練資料集。 密碼、付款資料、電郵、電話及復原聯絡資料不會加入訓練資料集。你可隨時在帳戶頁取消同意；取消後， 你的紀錄會即時撤出之後使用的訓練資料集，但已完成訓練的模型未必能逐項倒推移除其已學習的統計模式。
Google 日曆（僅限導師）
導師可以自行選擇在導師台連接 Google 日曆。連接後，我們只會：（一）讀取其日曆清單，以及主日曆和其擁有或可編輯、並設定為顯示的其他日曆的忙碌時段（只有開始及結束時間，不包括行程標題、地點、說明或參與者），用來避免學生預約到導師已有安排的時間； （二）在由本服務建立的「CC English 課堂」日曆中新增及刪除課堂。我們不會讀取任何日曆的行程內容，亦不會修改導師的其他日曆。
經 Google API 取得的資料只用於上述排課功能，不會用於廣告，不會出售，亦不會轉移予第三方（法律要求者除外）； 只有在提供此功能、處理保安事故或遵守法律所需時，才會由獲授權人員查閱。 我們使用這些資料時遵守 Google API Services User Data Policy，包括其 Limited Use 要求。 授權憑證以加密方式儲存。導師可隨時在導師台解除連接，我們會撤銷授權，並刪除授權憑證及忙碌時段資料。
7. 資料保存期
- 帳戶及學習資料：保存至你刪除帳戶為止；
- 帳戶刪除後：個人資料會在合理期間內（不超過 30 天）刪除或匿名化，惟法律要求保存者除外；
- 付款及訂單紀錄：按香港稅務規定保存 7 年；
- AI 用量計數：僅保留執行每日上限所需的滾動紀錄。
- 模型訓練資料：保存至你取消訓練同意或刪除帳戶為止；取消後不再納入新的訓練批次。
- Google 日曆授權憑證及忙碌時段（導師）：保存至導師解除連接為止；忙碌時段每次同步時更新，只保留未來約 90 日。
- 打卡相片（1 對 1 課程學生）：上載後 14 日自動刪除；打卡文字、自評及老師留言保存至你刪除帳戶為止。
8. 資料保安
我們採取合理的技術及組織措施保護你的資料，包括：傳輸加密（HTTPS）、資料庫行級存取控制 （每名用戶只能存取自己的紀錄）、管理功能白名單授權、支付憑證不落地（由支付商託管頁面處理）。 如發生可能造成實質損害風險的資料外洩，我們會通知受影響用戶及（在適當情況下） 香港個人資料私隱專員公署。
9. 未成年人
本服務面向備考 IELTS 的學習者，包括中學生。未滿 18 歲的用戶須經家長或 監護人同意方可使用；我們不會在知情下於欠缺家長同意的情況下收集 13 歲以下兒童的個人資料。 如你認為我們在未獲適當同意下收集了未成年人資料，請聯絡我們，我們會盡快刪除。
10. 你的權利
根據 PDPO，你有權：
- 查閱：要求取得我們持有關於你的個人資料副本（我們可收取合理的處理費用）；
- 改正：要求改正不準確的資料（帳戶頁可自行修改大部分個人化設定）；
- 刪除：要求刪除帳戶及個人資料（法律要求保存的紀錄除外）；
- 反對直接促銷：隨時要求停止將你的資料用於直接促銷，費用全免。
行使上述權利，請聯絡：cs@ccenglish.com.hk（或 WhatsApp +852 5484 9653）。 我們會於 40 天內回覆查閱及改正要求（PDPO 規定時限）。
如你對我們處理個人資料的方式不滿，可向香港個人資料私隱專員公署 （PCPD，網址 pcpd.org.hk）投訴。
11. 政策修訂
我們會不時檢視及更新本政策，更新版本會發布於本頁並註明生效日期； 重大變更會以站內通知或電郵另行通知。
12. 聯絡我們
私隱事宜聯絡人：CC English Limited（思悅教育有限公司）資料保障主任；電郵：cs@ccenglish.com.hk。
附錄：收集個人資料聲明（PICS）
收集目的：你於註冊及使用 CC English 時提供的個人資料，將用於： (i) 建立及管理帳戶；(ii) 提供備考功能（包括 AI 批改及個人化建議）；(iii) 處理付款； (iv) 發送服務通知；(v) 客戶支援；及 (vi) 遵守法律義務。
轉交類別：為上述目的，你的資料可能轉交我們的服務供應商 （資料庫託管、網站託管、AI 服務、支付處理、電郵發送）及（如你屬網課學生）你的導師。
自願與否：提供電郵及密碼屬必須，否則無法建立帳戶；其餘個人化資料屬自願提供。
查閱及改正：你有權查閱及改正我們持有關於你的個人資料， 請聯絡 cs@ccenglish.com.hk。
直接促銷：除非取得你的同意，我們不會將你的個人資料用於直接促銷。
CC English Privacy Policy
Last updated: 21 October 2026
IELTS Monster (the “Service”) is operated by CC English Limited (思悅教育有限公司) (“we”, “us”). We are committed to handling your personal data in accordance with the Hong Kong Personal Data (Privacy) Ordinance (Cap. 486, the “PDPO”). This policy explains what data we collect, how we use it, who we share it with, and your rights.
1. What Data We Collect
Data you provide directly:
| Category | Details | Required? |
|---|---|---|
| Account data | Email address, password (stored encrypted); if you sign in with Google, the email and name provided by your Google account | Required |
| Personalisation | Nickname, target IELTS band, planned exam date, study purpose (study abroad / migration / work) | Optional, skippable |
| Study content | Full text of essays you submit, your conversations with the AI coach, study-plan preferences | When using those features |
| Speaking recordings | Audio recordings of your answers in speaking mock tests. Recordings are stored with the marking results so you can replay your answers on the score-history page; only you can listen to them after signing in | When taking speaking mock tests |
| Payment data | Order records (plan, amount, currency, payment method, provider transaction reference), and the raw transaction notification returned by the payment provider (kept for reconciliation and debugging only). We never receive or store your card number — card and payment credentials are handled directly by the payment provider (Stripe) on their hosted page | When purchasing |
| Communications | Content of your WhatsApp or email messages to us | When contacting us |
Data generated by the system:
- Study records: quiz and mock-test answers, correctness, scores, mistake-book and review schedule, AI marking results, study-plan progress;
- AI usage records: daily usage counts and cost counters per AI feature (used to enforce usage caps);
- Feature-usage records: pages and features used, clicks, time spent, completion, accuracy and frequently used features;
- Learning memory (Pro plan only): to let the AI coach remember your progress, the system builds summaries and vector indexes of your AI conversations;
- Delivery and read status of in-app notifications.
What we do not collect: we currently use no advertising trackers and no third-party analytics (such as Google Analytics). Browser localStorage stores functional state only (interface language, sound toggle, drill progress) and is not used for cross-site tracking.
2. How We Use Your Data
We use your personal data only to:
- create and manage your account and provide the features of your chosen plan;
- mark essays, generate AI responses and personalised study plans, and track your progress;
- process payments, activate plans, reconcile orders and handle refunds;
- send you service notifications (in-app, with parallel email notification);
- respond to enquiries and provide customer support;
- maintain security, enforce usage caps, prevent abuse and enforce the Terms of Service;
- analyse usage in de-identified, aggregated form to improve the Service; and
- only with your separate, explicit consent, use de-identified learning content and usage records to train and improve CC English’s own learning models;
- comply with legal obligations (such as tax record-keeping).
Direct marketing: if we intend to use your name and contact details to send promotional messages about courses or plans, we will first obtain your consent as required by Part 6A of the PDPO, and every message will include a free opt-out. You may tell us to stop at any time (see section 10).
3. Where Data Is Stored; Cross-Border Transfers
Your data is stored primarily on servers of our database provider Supabase located in Singapore; the website is served via Vercel’s global content-delivery network. When you use AI features, the relevant content is transmitted to Google’s servers (which may be outside Hong Kong) for processing. We transfer data only to providers contractually committed to adequate protection.
4. Who We Share Data With
We do not sell your personal data. We disclose it to third parties only as follows:
| Recipient | Purpose | Data involved |
|---|---|---|
| Supabase (database & authentication) | Storage and sign-in | All account and study data |
| Vercel (hosting) | Serving the website | Technical connection data |
| Google (Gemini AI) | Generating AI marking, responses and plans | Essay, conversation and speaking-recording content you submit (see section 6) |
| Stripe (payments) | Payment processing | Order amount, transaction reference; card and payment credentials are collected by them directly |
| Resend (email delivery) | Sending notification emails | Email address, notification content |
| Google (Google Calendar, tutors who connect it only) | Avoiding bookings that clash with a tutor’s own events; adding lessons to the tutor’s calendar | The tutor’s Google account email, calendar list and calendar free/busy times; lesson times and student names written to the calendar (see section 6) |
| Your tutor (course or 1:1 students / human marking only) | Teaching, marking and planning lessons | Your study records (practice days, accuracy by question type, mock, writing and speaking results, study plan progress), check-ins and check-in photos, and essays |
| Law-enforcement or regulators | Where legally required | To the extent required by law |
Our policy for service providers: they receive only the minimum data needed for their specific service; they may use it only for the purposes we specify; on termination they must delete or anonymise the data they hold.
Administrators (our authorised staff) may view the user list (email, plan, expiry date) to the extent needed for payment reconciliation, manual plan activation and customer support; access is permission-controlled.
5. Cookies and localStorage
- Sign-in cookie: keeps you signed in (set by the authentication system); strictly necessary;
- localStorage: stores functional state (interface language, sound toggle, drill progress) on your device only;
- we use no advertising or cross-site tracking cookies.
Disabling cookies will prevent you from staying signed in.
6. Data Processing by AI Features
When you use AI marking, the AI coach, speaking mock tests or similar features, the content you submit (essays, messages, speaking recordings) is transmitted to the Google Gemini API for processing. Where technically practicable we de-identify submissions (your real name and email are not attached) before transmission.
Content you submit to AI features is processed under Google’s terms of service. We use the paid tier of the Google Gemini API; under Google’s terms, content submitted via the paid tier is not used to improve Google’s products or to train its models.
AI output is for reference only and may be inaccurate. Please do not submit other people’s personal data, or sensitive data (such as ID numbers or medical information), in AI conversations.
Training CC English’s own models (optional)
We retain learning records needed to provide the Service. Only after you separately opt in on the account page will we add your past and future essays, practice answers, AI conversations, marking results, feature usage and learning-performance records to a de-identified dataset for training CC English’s own models. Passwords, payment information, email addresses, phone numbers and recovery contact details are excluded. You may withdraw at any time on the account page. Withdrawal removes your records from future training batches, although a model that has already been trained may not be able to unlearn an individual contribution to statistical patterns item by item.
Google Calendar (tutors only)
Tutors may choose to connect Google Calendar in the tutor desk. Once connected, we only (1) read the free/busy times of their primary calendar and of other calendars they own or can edit and have chosen to display, using their calendar list only to find those calendars (start and end times only — not event titles, locations, descriptions or attendees) so that students cannot book times when the tutor is already busy; and (2) add and delete lessons in a “CC English 課堂” calendar created by this service. We do not read event details in any calendar or modify the tutor’s other calendars.
Data obtained through Google APIs is used only for this scheduling feature. It is not used for advertising, not sold, and not transferred to third parties except where required by law; it is viewed by authorised staff only where needed to provide the feature, handle security incidents or comply with the law. Our use of this data adheres to the Google API Services User Data Policy, including the Limited Use requirements. Authorisation credentials are stored encrypted. Tutors can disconnect at any time in the tutor desk; we then revoke the authorisation and delete the stored credentials and free/busy data.
7. Data Retention
- Account and study data: retained until you delete your account;
- After account deletion: personal data is deleted or anonymised within a reasonable period (no more than 30 days), except where retention is legally required;
- Payment and order records: retained for 7 years as required by Hong Kong tax rules;
- AI usage counters: only the rolling records needed to enforce daily caps.
- Model-training data: retained until you withdraw training consent or delete your account; after withdrawal it is excluded from new training batches.
- Google Calendar credentials and free/busy data (tutors): retained until the tutor disconnects; free/busy data is replaced at each sync and covers only about the next 90 days.
- Check-in photos (1:1 course students): deleted automatically 14 days after upload; check-in text, self-ratings and tutor comments are kept until you delete your account.
8. Security
We take reasonable technical and organisational measures to protect your data, including: encryption in transit (HTTPS), row-level access control in the database (each user can access only their own records), allowlist-based authorisation for admin functions, and keeping payment credentials off our infrastructure (handled on the provider’s hosted page). In the event of a data breach creating a real risk of harm, we will notify affected users and, where appropriate, the Office of the Privacy Commissioner for Personal Data (PCPD).
9. Minors
The Service is aimed at IELTS candidates, including secondary-school students. Users under 18 may use the Service only with the consent of a parent or guardian. We do not knowingly collect personal data from children under 13 without parental consent. If you believe we have collected a minor’s data without appropriate consent, contact us and we will delete it promptly.
10. Your Rights
Under the PDPO you have the right to:
- Access: request a copy of the personal data we hold about you (a reasonable processing fee may apply);
- Correction: request correction of inaccurate data (most personalisation settings can be edited on your account page);
- Deletion: request deletion of your account and personal data (except records we are legally required to keep);
- Opt out of direct marketing: require us, free of charge and at any time, to stop using your data for direct marketing.
To exercise these rights, contact cs@ccenglish.com.hk (or WhatsApp +852 5484 9653). We will respond to access and correction requests within 40 days (the statutory PDPO time limit).
If you are dissatisfied with how we handle your personal data, you may complain to the Office of the Privacy Commissioner for Personal Data, Hong Kong (pcpd.org.hk).
11. Changes to This Policy
We review and update this policy from time to time. Updates are posted on this page with a revised effective date; material changes will additionally be notified via in-app notification or email.
12. Contact Us
Data protection contact: Data Protection Officer, CC English Limited; email: cs@ccenglish.com.hk.
Appendix: Personal Information Collection Statement (PICS)
Purpose of collection: Personal data you provide when registering for and using CC English will be used to: (i) create and manage your account; (ii) provide test-preparation features (including AI marking and personalised recommendations); (iii) process payments; (iv) send service notifications; (v) provide customer support; and (vi) comply with legal obligations.
Classes of transferees: For the above purposes your data may be transferred to our service providers (database hosting, website hosting, AI services, payment processing, email delivery) and, if you are a course student, your tutor.
Voluntariness: Providing an email address and password is mandatory — without them an account cannot be created; all other personalisation data is voluntary.
Access and correction: You have the right to request access to and correction of your personal data held by us; contact cs@ccenglish.com.hk.
Direct marketing: We will not use your personal data for direct marketing without your consent.