CC English 私隱政策
最後更新日期：2026 年 7 月 21 日
IELTS Master（「本服務」）由 CC English Limited（思悅教育有限公司）（「我們」）營運。 我們承諾按照香港《個人資料（私隱）條例》（第 486 章，「PDPO」）處理你的個人資料。 本政策說明我們收集哪些資料、如何使用、與誰分享，以及你的權利。
1. 我們收集哪些資料
你直接提供的資料：
| 類別 | 內容 | 是否必須 |
|---|---|---|
| 帳戶資料 | 電郵地址、密碼（加密儲存）；如用 Google 登入，則為 Google 帳戶提供的電郵及名稱 | 必須 |
| 個人化設定 | 暱稱、目標 IELTS 分數、預定考試日期、備考目的（升學／移民／工作） | 可選，可略過 |
| 學習內容 | 你提交的作文全文、與 AI 教練的對話內容、讀書計劃偏好 | 使用相關功能時 |
| 付款資料 | 訂單紀錄（方案、金額、貨幣、支付方式、支付商交易編號），以及支付服務商回傳的 原始交易通知紀錄（僅用於核數與除錯）。我們不會收取或儲存你的信用卡號碼——卡號及支付憑證由支付服務商（Stripe）在其託管頁面直接處理 | 購買時 |
| 通訊內容 | 你經 WhatsApp 或電郵與我們聯絡的內容 | 聯絡時 |
系統自動產生的資料：
- 學習紀錄：測驗與模擬試作答、對錯、分數、錯題簿及重溫排程、AI 批改結果、學習計劃進度；
- AI 用量紀錄：各 AI 功能的每日使用次數與成本計數（用於執行用量上限）；
- 學習記憶（僅 Pro 方案）：為令 AI 教練記得你的學習狀況，系統會就你與 AI 的對話建立摘要及向量索引；
- 站內通知的發送與已讀狀態。
我們不收集的資料：我們目前不使用廣告追蹤器或第三方分析工具（如 Google Analytics）。瀏覽器的 localStorage 只儲存功能性狀態（介面語言、音效開關、練習進度）， 不用於跨站追蹤。
2. 我們如何使用你的資料
我們只為以下目的使用你的個人資料：
- 建立及管理你的帳戶，提供你所選方案的功能；
- 批改作文、生成 AI 回應與個人化讀書計劃、追蹤學習進度；
- 處理付款、開通方案、核對訂單及處理退款；
- 向你發送服務通知（站內通知，以及同步電郵通知）；
- 回應你的查詢及提供客戶支援；
- 維護服務安全、執行用量上限、防止濫用及執行服務條款；
- 以去識別化及匯總方式分析使用情況，改進服務品質；
- 遵守法律義務（如稅務紀錄保存）。
直接促銷：如我們擬使用你的姓名及聯絡資料向你發送課程或方案推廣訊息， 會依 PDPO 第 6A 部先取得你的同意，並在每次訊息中提供免費退訂方式。你可隨時通知我們停止（見第 10 條）。
3. 資料儲存位置與跨境轉移
你的資料主要儲存於我們的資料庫服務商 Supabase 位於新加坡的伺服器； 網站由 Vercel 的全球內容分發網絡提供。使用 AI 功能時，相關內容會傳送至 Google 的伺服器 （可能位於香港以外）處理。我們只會將資料轉移至已以合約承諾提供足夠保障的服務商。
4. 我們與誰分享資料
我們不會出售你的個人資料。只在以下範圍向第三方披露：
| 接收方 | 目的 | 涉及資料 |
|---|---|---|
| Supabase（資料庫及帳戶認證） | 儲存及認證 | 全部帳戶及學習資料 |
| Vercel（網站託管） | 提供網站 | 技術性連線資料 |
| Google（Gemini AI） | 生成 AI 批改、回應及計劃 | 你提交的作文／對話內容（見第 6 條） |
| Stripe（支付） | 處理付款 | 訂單金額、交易編號；卡號及支付憑證由其直接收集 |
| Resend（電郵發送） | 發送通知電郵 | 電郵地址、通知內容 |
| 你的導師（僅網課學生／真人批改） | 真人教學與批閱 | 你的學習紀錄及作文 |
| 執法或監管機構 | 法律要求時 | 依法律要求的範圍 |
我們對服務商的政策：只提供其執行特定服務所需的最少資料；只可按我們指示的目的使用； 停用服務時須刪除或匿名化所持資料。
管理員（我們的授權人員）可在營運需要範圍內查閱用戶名單（電郵、方案、到期日）， 以處理 FPS 人手開通及客戶支援；存取受權限控制。
5. Cookies 與 localStorage
- 登入 Cookie：維持你的登入狀態（由認證系統設置），屬必要性 cookie；
- localStorage：儲存介面語言、音效開關、練習進度等功能性狀態，只存在你的裝置上；
- 我們不使用廣告或跨站追蹤 cookies。
停用 cookies 會令你無法保持登入。
6. AI 功能的資料處理
使用 AI 批改、AI 教練等功能時，你提交的內容（作文、訊息）會傳送至 Google Gemini API 處理。 我們在技術上可行的範圍內先作去識別化（不附上你的真實姓名或電郵）才傳送。
你提交予 AI 功能的內容會按 Google 的服務條款處理。我們使用 Google Gemini API 的付費服務層級，按 Google 條款，經付費層級提交的內容不會用於改進 Google 的產品或訓練其模型。
AI 產出僅供參考，可能不準確；請勿在 AI 對話中提交他人的個人資料或敏感資料 （如身份證號碼、醫療資料）。
7. 資料保存期
- 帳戶及學習資料：保存至你刪除帳戶為止；
- 帳戶刪除後：個人資料會在合理期間內（不超過 30 天）刪除或匿名化，惟法律要求保存者除外；
- 付款及訂單紀錄：按香港稅務規定保存 7 年；
- AI 用量計數：僅保留執行每日上限所需的滾動紀錄。
8. 資料保安
我們採取合理的技術及組織措施保護你的資料，包括：傳輸加密（HTTPS）、資料庫行級存取控制 （每名用戶只能存取自己的紀錄）、管理功能白名單授權、支付憑證不落地（由支付商託管頁面處理）。 如發生可能造成實質損害風險的資料外洩，我們會通知受影響用戶及（在適當情況下） 香港個人資料私隱專員公署。
9. 未成年人
本服務面向備考 IELTS 的學習者，包括中學生。未滿 18 歲的用戶須經家長或 監護人同意方可使用；我們不會在知情下於欠缺家長同意的情況下收集 13 歲以下兒童的個人資料。 如你認為我們在未獲適當同意下收集了未成年人資料，請聯絡我們，我們會盡快刪除。
10. 你的權利
根據 PDPO，你有權：
- 查閱：要求取得我們持有關於你的個人資料副本（我們可收取合理的處理費用）；
- 改正：要求改正不準確的資料（帳戶頁可自行修改大部分個人化設定）；
- 刪除：要求刪除帳戶及個人資料（法律要求保存的紀錄除外）；
- 反對直接促銷：隨時要求停止將你的資料用於直接促銷，費用全免。
行使上述權利，請聯絡：cs@ccenglish.com.hk（或 WhatsApp +852 5484 9653）。 我們會於 40 天內回覆查閱及改正要求（PDPO 規定時限）。
如你對我們處理個人資料的方式不滿，可向香港個人資料私隱專員公署 （PCPD，網址 pcpd.org.hk）投訴。
11. 政策修訂
我們會不時檢視及更新本政策，更新版本會發布於本頁並註明生效日期； 重大變更會以站內通知或電郵另行通知。
12. 聯絡我們
私隱事宜聯絡人：CC English Limited（思悅教育有限公司）資料保障主任；電郵：cs@ccenglish.com.hk。
附錄：收集個人資料聲明（PICS）
收集目的：你於註冊及使用 CC English 時提供的個人資料，將用於： (i) 建立及管理帳戶；(ii) 提供備考功能（包括 AI 批改及個人化建議）；(iii) 處理付款； (iv) 發送服務通知；(v) 客戶支援；及 (vi) 遵守法律義務。
轉交類別：為上述目的，你的資料可能轉交我們的服務供應商 （資料庫託管、網站託管、AI 服務、支付處理、電郵發送）及（如你屬網課學生）你的導師。
自願與否：提供電郵及密碼屬必須，否則無法建立帳戶；其餘個人化資料屬自願提供。
查閱及改正：你有權查閱及改正我們持有關於你的個人資料， 請聯絡 cs@ccenglish.com.hk。
直接促銷：除非取得你的同意，我們不會將你的個人資料用於直接促銷。
CC English Privacy Policy
Last updated: 21 July 2026
IELTS Master (the “Service”) is operated by CC English Limited (思悅教育有限公司) (“we”, “us”). We are committed to handling your personal data in accordance with the Hong Kong Personal Data (Privacy) Ordinance (Cap. 486, the “PDPO”). This policy explains what data we collect, how we use it, who we share it with, and your rights.
1. What Data We Collect
Data you provide directly:
| Category | Details | Required? |
|---|---|---|
| Account data | Email address, password (stored encrypted); if you sign in with Google, the email and name provided by your Google account | Required |
| Personalisation | Nickname, target IELTS band, planned exam date, study purpose (study abroad / migration / work) | Optional, skippable |
| Study content | Full text of essays you submit, your conversations with the AI coach, study-plan preferences | When using those features |
| Payment data | Order records (plan, amount, currency, payment method, provider transaction reference), and the raw transaction notification returned by the payment provider (kept for reconciliation and debugging only). We never receive or store your card number — card and payment credentials are handled directly by the payment provider (Stripe) on their hosted page | When purchasing |
| Communications | Content of your WhatsApp or email messages to us | When contacting us |
Data generated by the system:
- Study records: quiz and mock-test answers, correctness, scores, mistake-book and review schedule, AI marking results, study-plan progress;
- AI usage records: daily usage counts and cost counters per AI feature (used to enforce usage caps);
- Learning memory (Pro plan only): to let the AI coach remember your progress, the system builds summaries and vector indexes of your AI conversations;
- Delivery and read status of in-app notifications.
What we do not collect: we currently use no advertising trackers and no third-party analytics (such as Google Analytics). Browser localStorage stores functional state only (interface language, sound toggle, drill progress) and is not used for cross-site tracking.
2. How We Use Your Data
We use your personal data only to:
- create and manage your account and provide the features of your chosen plan;
- mark essays, generate AI responses and personalised study plans, and track your progress;
- process payments, activate plans, reconcile orders and handle refunds;
- send you service notifications (in-app, with parallel email notification);
- respond to enquiries and provide customer support;
- maintain security, enforce usage caps, prevent abuse and enforce the Terms of Service;
- analyse usage in de-identified, aggregated form to improve the Service; and
- comply with legal obligations (such as tax record-keeping).
Direct marketing: if we intend to use your name and contact details to send promotional messages about courses or plans, we will first obtain your consent as required by Part 6A of the PDPO, and every message will include a free opt-out. You may tell us to stop at any time (see section 10).
3. Where Data Is Stored; Cross-Border Transfers
Your data is stored primarily on servers of our database provider Supabase located in Singapore; the website is served via Vercel’s global content-delivery network. When you use AI features, the relevant content is transmitted to Google’s servers (which may be outside Hong Kong) for processing. We transfer data only to providers contractually committed to adequate protection.
4. Who We Share Data With
We do not sell your personal data. We disclose it to third parties only as follows:
| Recipient | Purpose | Data involved |
|---|---|---|
| Supabase (database & authentication) | Storage and sign-in | All account and study data |
| Vercel (hosting) | Serving the website | Technical connection data |
| Google (Gemini AI) | Generating AI marking, responses and plans | Essay/conversation content you submit (see section 6) |
| Stripe (payments) | Payment processing | Order amount, transaction reference; card and payment credentials are collected by them directly |
| Resend (email delivery) | Sending notification emails | Email address, notification content |
| Your tutor (course students / human marking only) | Teaching and marking | Your study records and essays |
| Law-enforcement or regulators | Where legally required | To the extent required by law |
Our policy for service providers: they receive only the minimum data needed for their specific service; they may use it only for the purposes we specify; on termination they must delete or anonymise the data they hold.
Administrators (our authorised staff) may view the user list (email, plan, expiry date) to the extent needed for manual FPS activation and customer support; access is permission-controlled.
5. Cookies and localStorage
- Sign-in cookie: keeps you signed in (set by the authentication system); strictly necessary;
- localStorage: stores functional state (interface language, sound toggle, drill progress) on your device only;
- we use no advertising or cross-site tracking cookies.
Disabling cookies will prevent you from staying signed in.
6. Data Processing by AI Features
When you use AI marking, the AI coach or similar features, the content you submit (essays, messages) is transmitted to the Google Gemini API for processing. Where technically practicable we de-identify submissions (your real name and email are not attached) before transmission.
Content you submit to AI features is processed under Google’s terms of service. We use the paid tier of the Google Gemini API; under Google’s terms, content submitted via the paid tier is not used to improve Google’s products or to train its models.
AI output is for reference only and may be inaccurate. Please do not submit other people’s personal data, or sensitive data (such as ID numbers or medical information), in AI conversations.
7. Data Retention
- Account and study data: retained until you delete your account;
- After account deletion: personal data is deleted or anonymised within a reasonable period (no more than 30 days), except where retention is legally required;
- Payment and order records: retained for 7 years as required by Hong Kong tax rules;
- AI usage counters: only the rolling records needed to enforce daily caps.
8. Security
We take reasonable technical and organisational measures to protect your data, including: encryption in transit (HTTPS), row-level access control in the database (each user can access only their own records), allowlist-based authorisation for admin functions, and keeping payment credentials off our infrastructure (handled on the provider’s hosted page). In the event of a data breach creating a real risk of harm, we will notify affected users and, where appropriate, the Office of the Privacy Commissioner for Personal Data (PCPD).
9. Minors
The Service is aimed at IELTS candidates, including secondary-school students. Users under 18may use the Service only with the consent of a parent or guardian. We do not knowingly collect personal data from children under 13 without parental consent. If you believe we have collected a minor’s data without appropriate consent, contact us and we will delete it promptly.
10. Your Rights
Under the PDPO you have the right to:
- Access: request a copy of the personal data we hold about you (a reasonable processing fee may apply);
- Correction: request correction of inaccurate data (most personalisation settings can be edited on your account page);
- Deletion: request deletion of your account and personal data (except records we are legally required to keep);
- Opt out of direct marketing: require us, free of charge and at any time, to stop using your data for direct marketing.
To exercise these rights, contact cs@ccenglish.com.hk (or WhatsApp +852 5484 9653). We will respond to access and correction requests within 40 days (the statutory PDPO time limit).
If you are dissatisfied with how we handle your personal data, you may complain to the Office of the Privacy Commissioner for Personal Data, Hong Kong (pcpd.org.hk).
11. Changes to This Policy
We review and update this policy from time to time. Updates are posted on this page with a revised effective date; material changes will additionally be notified via in-app notification or email.
12. Contact Us
Data protection contact: Data Protection Officer, CC English Limited; email: cs@ccenglish.com.hk.
Appendix: Personal Information Collection Statement (PICS)
Purpose of collection: Personal data you provide when registering for and using CC English will be used to: (i) create and manage your account; (ii) provide test-preparation features (including AI marking and personalised recommendations); (iii) process payments; (iv) send service notifications; (v) provide customer support; and (vi) comply with legal obligations.
Classes of transferees: For the above purposes your data may be transferred to our service providers (database hosting, website hosting, AI services, payment processing, email delivery) and, if you are a course student, your tutor.
Voluntariness: Providing an email address and password is mandatory — without them an account cannot be created; all other personalisation data is voluntary.
Access and correction: You have the right to request access to and correction of your personal data held by us; contact cs@ccenglish.com.hk.
Direct marketing: We will not use your personal data for direct marketing without your consent.