This Privacy Policy explains how LumiTalk Limited (Business Registration No. 75252654) (“we”, “us”), which operates the HKODO (Hong Kong Oracy Dojo) learning centre, collects, uses, discloses and protects personal data, in accordance with the Personal Data (Privacy) Ordinance (Cap. 486) of Hong Kong (the “PDPO”). It applies to the HKODO website and Services and forms part of our Terms and Conditions.
1. Who we are
The data user is LumiTalk Limited (Business Registration No. 75252654), contactable at info@hkodo.com. By using the Services, you (and, for a user under 18, that user's parent/guardian) acknowledge this Policy.
2. Personal data we collect
Account & identity: name and email; sign-in uses a one-time email code — we are passwordless, so no password of yours exists to store or leak. Optionally school and form level.
Parent/guardian (for under-18s): name, email and a record of consent.
Payment: processed by Stripe; we do not store full card numbers.
Submissions & Session Recordings: speaking-practice recordings, transcripts, and audio recordings of live sessions (audio only — no video is recorded).
Learning data: belt/band placements, feedback, drills and progress.
Booking & live sessions: session times and bookings (on our own platform); your random per-session candidate letter; your pre-session confirmation (the name you type is recorded as evidence of consent, is visible to our system and administrators only, and is never shown to any Coach); the Coach's rough written notes of the discussion (kept under candidate letters, never names); your session report (four domain marks, strengths, improvement, practice pointer) and an AI-generated factual summary of the discussion.
Waitlist & placement: if you join the waitlist — your email, role and (optionally) what you are worried about; if you request an emailed placement report — the email address you give and a send log used only to limit abuse.
Technical: device and log data, and cookies (clause 12).
3. How and why we use your data
We use personal data to: provide the learning centre and Coach feedback; place you on the domain radar and track progress; schedule and deliver sessions; process payments; maintain safety, security and quality; send service communications; and comply with law. Where you (or a parent/guardian) have consented, we also use anonymised Submissions to improve materials and to develop or evaluate future features. Consistent with the PDPO, we use data only for these purposes or a directly related purpose, or with fresh consent.
4. Consent
We rely on your consent (and, for under-18s, parental/guardian consent). You may withdraw consent at any time by contacting us, though this may affect our ability to provide the Services.
5. Children and minors
5.1 We treat under-18s as children and take extra care, following the Privacy Commissioner's guidance: parental/guardian consent at sign-up, collecting the minimum necessary, and separating mandatory from optional information.
5.2 Voice recordings are treated as sensitive. A parent/guardian may review, correct or request deletion of their child's data at any time by contacting us.
5.3 We do not knowingly collect more data from children than necessary, and keep notices age-appropriate.
6. Voice and session recordings
6.1 Live coach sessions are audio-recorded and transcribed — audio only, never video: the camera feed is not recorded — for safeguarding, quality and your written report. Everyone in the room is addressed by a random candidate letter, so names stay off the recording and transcript. Recordings and transcripts are kept for 90 days and then deleted; excerpts relevant to a complaint or safeguarding investigation are kept until the matter is closed. Access is restricted to the founder. Parents may observe any session silently, unannounced — by sitting in the same room as the student; for safeguarding reasons we do not admit additional Zoom accounts to observe.
6.2 Dojo practice recordings (the recordings you make while training in the dojo) are stored only in your own browser on your own device — they are never uploaded to us. Deleting them is entirely in your hands.
6.3 Where any recording is retained to improve materials, it is anonymised first, and only with the separate consent given at sign-up. You or a parent/guardian may request deletion at any time.
7. Direct marketing
We will only use your data for direct marketing with your opt-in consent, and you may opt out at any time at no cost. We will not provide your personal data to any third party for that party's own direct marketing without your consent.
8. Who we share data with
We disclose personal data to: our Coaches — who see your candidate letter, belt and score history only, and never your name, email or contact details; service providers acting on our behalf under contract — Stripe (payments), Supabase (database and sign-in), Netlify (hosting and serverless functions), Resend (transactional email), Zoom (live sessions), SleekFlow (WhatsApp messaging, where you choose to contact us there), and Mistral AI (text processing for AI practice and session summaries); and authorities or others where required or permitted by law. We do not sell your personal data. If our business (or part of it) is sold, merged or reorganised, personal data may be transferred to the successor or acquirer, who will be bound to protect it consistently with this Policy.
9. Overseas / cross-border processing
Some providers process personal data outside Hong Kong: Stripe and Resend (United States), Mistral AI (European Union), and Supabase, Netlify and Zoom in their respective hosting regions. We take reasonable steps to ensure such processing is subject to protection consistent with the PDPO, including contractual safeguards, and we minimise what leaves Hong Kong: AI practice sends only your typed practice text, and session summaries are generated from the Coach's notes, which use candidate letters — not names.
10. Automated decisions and AI
10.1 AI supports two things: text-based practice (the practice bot you type or speak to) and the factual summary in your session report, generated from the Coach's written notes of the discussion. The summary describes what was discussed; it never marks, judges or grades.
10.2 No decision that affects a student is made by solely automated means. All marks — placement, dojo drafts and session reports — are a human coach's draft anchored to the public descriptors; AI never judges pronunciation or delivery, and never predicts a grade.
11. Retention
We keep personal data only as long as necessary for the purposes above or as required by law:
| Data | Retention |
|---|---|
| Account & learning data (incl. session reports and marks) | While the account is active, then 6 months after closure. |
| Live-session audio recordings & transcripts (audio only — no video) | 90 days, then deleted (investigation excerpts: until the matter closes). Earlier on request. |
| Coach's raw session notes (candidate letters only) | 12 months (they evidence your report in any dispute), then deleted. Earlier on request. |
| Dojo practice recordings | Your own browser only — never uploaded; you delete them yourself. |
| Consent records (sign-up consents, pre-session confirmations) | 7 years — kept as evidence that consent was given. |
| Waitlist entries | Until the cohort opens + 6 months, or on request. |
| Placement-report send log | 12 months (abuse limiting only). |
| Payment records | As required for accounting and tax purposes — 7 years. |
| Marketing consent | Until you withdraw consent. |
12. Security and data breaches
We use reasonable technical and organisational measures to protect personal data. No system is completely secure. If a data breach occurs that is likely to cause real risk of harm, we will take appropriate steps, which may include notifying affected individuals and the Privacy Commissioner.
13. Cookies and analytics
We use cookies and similar technologies to operate the website, remember preferences, and understand usage (which may include analytics providers such as Google Analytics). You can control cookies through your browser; some features may not work without them. Our systems do not currently respond to “Do Not Track” signals.
14. Your rights under the PDPO
You have the right to: ask whether we hold your personal data and request a copy (a data access request); request correction of inaccurate data; withdraw consent; opt out of direct marketing; and request deletion. To exercise these rights, contact info@hkodo.com. We aim to respond within the timeframe required by the PDPO (generally 40 days) and may charge a reasonable fee for a data access request as permitted.
15. Changes to this Policy
We may update this Policy and will post the updated version with a new effective date.
16. Contact and complaints
For any privacy question or request, contact LumiTalk Limited at info@hkodo.com. Where our WhatsApp line is shown on the site, you may also reach us there; WhatsApp messages are handled through our messaging provider (SleekFlow) acting on our behalf under contract, and the number and hours shown on the site are the current ones. You also have the right to complain to the Office of the Privacy Commissioner for Personal Data, Hong Kong (PCPD) — see pcpd.org.hk.
17. Parental / guardian consent
For a student under 18, the parent or guardian confirms they have read this Policy and the Terms and Conditions, and consent to LumiTalk collecting and using the student's personal data — including voice and session recordings — for the purposes described, and (optionally) to the use of anonymised recordings to improve materials and evaluate future features.