Privacy Policy
How DeepLoop Limited handles personal data, under the Personal Data (Privacy) Ordinance (Cap. 486) of Hong Kong.
DeepLoop Limited
Last updated: 11 August 2026
Effective: 11 August 2026
Contents
- Who we are
- Our approach, in one paragraph
- Personal Information Collection Statement
- Source of the personal data we hold
- Account and service data
- Cookies and storage on your device
- Who we share with
- Third-party websites and links
- Transfers outside Hong Kong
- Your choices
- Direct marketing
- Retention
- Security
- Your rights under the Ordinance
- Children
- Changes to this Policy
- Contact
"The Ordinance" means the Personal Data (Privacy) Ordinance (Cap. 486) of Hong Kong.
1. Who we are
DeepLoop Limited ("DeepLoop", "we", "us", "our") is a company incorporated in the Hong Kong Special Administrative Region.
| Legal entity | DeepLoop Limited |
| Company Registration No. | 80954158 |
| Contact | [email protected] |
This Policy covers everything we provide — our website, our applications, our products, and any related service, feature or content we make available, on any domain or subdomain we operate (together, the "Services"). It applies whether you simply read a page, register an account, or use a paid plan.
Because the Services differ, so does what we collect. Section 3 describes what is collected when you browse our website. Section 5 describes what is collected when you register and use a service. Where a particular service collects something not described here, we will tell you at the point of collection, in a notice specific to that service, which supplements this Policy rather than replacing it.
DeepLoop Limited is the data user — the Ordinance's term for what other jurisdictions call a data controller — for all personal data described in this Policy, for every visitor and every customer, wherever located.
Your use of the Services is also governed by our Terms and Conditions.
2. Our approach, in one paragraph
Browsing our website is anonymous. It does not ask who you are. It measures how pages are used, using our own system, which we built and run ourselves. We do not use your IP address to identify you — it is turned into a stand-in code that changes every day. We do not use Google Analytics, advertising pixels, tracking cookies, data brokers, or anyone else's analytics product. We do not sell personal data, and we do not share it for anyone else's marketing.
Registering for a service is different — there we do need to know who you are, and section 5 sets out exactly what we take and why. We keep the two separate: your account is never linked to the anonymous browsing data in section 3.
3. Personal Information Collection Statement
This section is our notification under Data Protection Principle 1(3) of the Ordinance.
3.1 What we collect on the website
When you visit a page on deeploopos.ai, our own server records the following in our own database. Each row describes a page view, not a person.
Identifier
| Data | Detail |
|---|---|
| Visitor code | A stand-in for your IP address. It changes every day, so we cannot use it to track you. |
Sent by your browser or derived from your connection
| Data | Detail |
|---|---|
| Rough location | Your country, region and city. This comes from Cloudflare, the service that sits in front of our website. We never pay anyone to look up where an IP address is. |
| Network | Who provides your internet connection (for example, your broadband or mobile company), and roughly what kind of connection it is. We work this out on our own server, without asking anyone else. |
| Device and software | Which browser, operating system and kind of device you are using, and the full description your browser sends us to say so. |
| Page | Which page you are on, in which language, and the page you came from if your browser tells us. |
| Campaign tags | If you arrived from an advert or a campaign link, the tags in that link that say where it came from. |
Sent by the page you are viewing
| Data | Detail |
|---|---|
| Display | The size of your screen and of the window, and whether you prefer dark mode. |
| Environment | Time zone, preferred languages, connection type. |
| Engagement | Time on page, scroll depth, and which element you clicked. |
Automated visitors. Traffic we identify as a search-engine or AI crawler is written to a separate list holding only the crawler's name, the page it asked for, how it described itself, its country, and a scrambled version of its IP address.
3.2 Purposes of collection
We collect the above only to:
- understand which pages, languages and countries our content reaches;
- measure whether the site performs and renders correctly;
- detect abusive, automated or fraudulent traffic, and keep the service secure;
- produce aggregate statistics and long-run trend analysis for our own planning.
We do not use this data to build advertising profiles, to score or rank individuals, to make any automated decision that affects you, or for any form of direct marketing.
3.3 Whether supply is obligatory
Supplying the data in 3.1 is not obligatory — it is the ordinary technical consequence of requesting a web page. You may prevent most of it as described in section 10.
For the registration data in section 5, supply is obligatory: an account cannot be created without it.
3.4 Classes of transferee
See section 7.
3.5 Access and correction
Section 14 sets out your rights to request access to and correction of your data, and who to address a request to.
4. Source of the personal data we hold
We obtain personal data from three sources only:
| Source | What |
|---|---|
| Directly from you | Anything you type into a form — account registration details and any enquiry you send us — and any content you upload to a service. |
| Automatically, from your device and connection | Everything in section 3.1, generated by the ordinary act of requesting a page. |
| From a social login provider, if you use one | The profile fields you approve when signing in with Google or LinkedIn. |
We do not buy personal data, and we do not obtain it from data brokers, list vendors, enrichment services or any other third-party source.
A note on our legal basis. Some privacy policies state that by using the site you "consent" to all collection described. Hong Kong's Ordinance does not work that way for ordinary collection: under Data Protection Principle 1 we must collect only what is necessary for a lawful purpose directly related to our function, by means that are lawful and fair. We therefore rely on that principle rather than on a blanket consent, and we seek your specific consent where the Ordinance requires it — most importantly for direct marketing under section 11, and for any new purpose under Data Protection Principle 3.
5. Account and service data
5.1 Registration
When you register for a service, our sign-up forms collect:
- email address;
- password;
- mobile telephone number;
- farm or business name;
- display name, if you give one;
- your interface language.
The form passes these to the service over an encrypted connection. Your password is never stored in readable form — only as a scrambled version that cannot be turned back into your password.
We use these fields to create and operate your account, to authenticate you, to contact you about the service, and to bill you where the service is paid. We do not use them for marketing unless you separately ask us to.
Social sign-in. If you choose to continue with a third-party sign-in provider, you are redirected to that provider, which returns the profile fields you approve (typically name, email address and avatar). Your dealings with that provider are governed by its own privacy policy, not ours.
Verification email. On sign-up one email is sent to confirm the address. This is a service message, not marketing.
5.2 Content you put into a service
Once you use a service, we hold the content you provide to it — records, images and video.
Where that content captures identifiable individuals, such as workers appearing in camera footage, you are the data user for collecting that footage and for your own use of it, and you are responsible under our Terms for giving any notice and obtaining any consent the Ordinance requires — including for the use described in the next paragraph. When we host, store, process and display that content to provide and support the service to you, we do so on your instructions and for your purposes.
We may also use your content to operate, evaluate, improve and train the models and software behind our Services, as set out in section 6.3 of our Terms. That is our own purpose, not yours: for that use we are a data user in our own right, and the obligations of the Ordinance apply to us directly. You may opt out of it at any time by writing to [email protected]. We do not publish your content, disclose it to any other customer, or present it in any form that identifies you or your business.
5.3 Usage of a service
We record how an account uses a service — sign-in times, the features used, and technical logs of errors and requests — to operate the service, keep it secure, support you, and diagnose faults.
6. Cookies and storage on your device
The website sets no advertising or tracking cookies, and no third party sets cookies through it. Our page measurement uses no cookie at all — that is the whole point of the daily code in 3.1.
We do store the following strictly-functional items:
| Item | Type | Purpose | Lifetime |
|---|---|---|---|
theme | Cookie (first-party) | Remembers light/dark choice so the correct theme renders on the first frame | 1 year |
theme | Local storage | The same preference, read by the page as it loads | Until cleared |
dl_langScroll | Session storage | Restores scroll position when you switch language | Until the tab closes |
freyjaRememberMe | Local storage | Remembers whether you ticked "remember me" on a sign-in form | Until cleared |
deeploop:session | Local storage | Set after you sign in; marks the session for the application. Contains the phone number or identifier you signed in with. | Until cleared or sign-out |
None of these is used to track you between sites, and none is used for advertising. You can clear them at any time through your browser; the website will still work, and will simply forget those preferences.
When you sign in to a service, that service also sets a strictly-necessary authentication cookie so it knows you are signed in. It is not used for tracking or advertising, and clearing it signs you out.
7. Who we share with
We do not sell personal data, and we do not disclose it for any third party's own purposes. Personal data is handled by the following classes of recipient, each acting for us and under contract:
| Class of recipient | Role | What it sees |
|---|---|---|
| Content delivery and security providers (currently Cloudflare, Inc.) | Serves our pages quickly and worldwide, encrypts them, and blocks attacks and bad traffic | Your IP address, the page you asked for, and what your browser sent with the request, as it passes through. This is where the country and city we record come from. |
| Hosting and infrastructure providers (currently Hostinger International Ltd) | Server and database hosting | Hosts our server and database; has no purpose of its own for the data. |
| Transactional email providers | Delivery of verification and service messages | Your email address and the content of the message. |
| Professional advisers | Legal, accounting and audit | Only what is necessary for the advice or audit in question. |
We may also disclose personal data where we are required by law, by a court, or by a regulator with jurisdiction; or where necessary to establish, exercise or defend legal claims. If our business or any part of it is sold, merged or reorganised, personal data may be transferred to the acquirer, who will be bound by terms no less protective than this Policy.
Error reporting. Our codebase includes the Sentry error-reporting SDK, but it is not enabled — no reporting endpoint is configured, so no data is transmitted to it. If we enable it, we will update this Policy first.
8. Third-party websites and links
The website links to sites we do not control — for example our LinkedIn and Crunchbase pages, and the sign-in flows of Google and LinkedIn. Following such a link takes you outside this Policy.
We are not responsible for the content or privacy practices of any third-party site, and we do not control what data it collects once you arrive. We encourage you to read the privacy policy of any site you visit from ours.
We put no advertising, social media buttons or outside measurement code on our pages, so no third party observes your visit merely because you loaded one of our pages.
9. Transfers outside Hong Kong
Our servers are located in Malaysia, and Cloudflare processes requests at the edge location nearest you. Personal data described in this Policy is therefore handled outside Hong Kong.
Section 33 of the Ordinance, which restricts transfers of personal data outside Hong Kong, has not been brought into force. We nevertheless apply the same standard of protection to data wherever it is handled, and use recipients bound by written contractual obligations of confidentiality and security.
10. Your choices
- The "Do Not Track" setting in your browser. Turn it on and we record nothing about your visit. Most browsers have it, or something called Global Privacy Control that does the same job; either one works.
- Blocking the page code. Turning off JavaScript, or using an ad or content blocker, does the same thing.
- What you cannot switch off. Your IP address, rough location and browser description reach our server the moment you request any page — that is how the web works. In our records of your visit, your IP address appears only as the stand-in code in 3.1; your country, region and city are kept as place names, and your browser description in full.
- Device storage. Clear cookies and site data for
deeploopos.aiin your browser to remove everything in section 6. - Your account details. Correct them in the service at any time, or by contacting us.
- Marketing. We will not send you marketing email unless you have separately asked for it. Every marketing message we do send will carry an unsubscribe link, and we will act on an unsubscribe request without charge.
11. Direct marketing
This section reflects Part 6A of the Ordinance.
If we intend to use your personal data in direct marketing, we will, before doing so:
- tell you that we intend to do so;
- tell you that we may not use your data in that way unless we have received your consent;
- tell you the kinds of personal data to be used and the classes of goods, services or subjects to be marketed;
- provide a channel, free of any charge by us, through which you may communicate your consent — which includes simply telling us you do not object; and
- obtain your consent or indication of no objection.
We will not provide your personal data to any other person for that person's direct marketing. You may require us to cease using your data in direct marketing at any time, free of charge, by writing to [email protected]. We will comply without charge.
12. Retention
We keep personal data only for as long as is necessary for the purposes in 3.2, in accordance with Data Protection Principle 2(2).
| Data | Retention |
|---|---|
| Analytics rows (page views and crawler hits) | Kept indefinitely, on the basis explained below. |
| Account data | For the life of the account, then deleted or anonymised, except records we must keep to meet legal, tax and accounting obligations — retained for 7 years, as required by the Companies Ordinance (Cap. 622) and the Inland Revenue Ordinance (Cap. 112) |
| Content you put into a service | For the life of the account, then for the 30-day export window in section 6.4 of our Terms, after which it is deleted |
| Enquiries you send us | 2 years from our last correspondence with you, then deleted |
Why we keep the browsing records for good. They hold no name, no email address, no account, no contact detail and no IP address. The only thing identifying a visit is the daily code in 3.1, and you cannot work backwards from a record to a person. What they are is a long-run picture of how our pages get used — purpose 4 in 3.2 — and that is a purpose you cannot serve by throwing the older half away.
The honest limit of that. One record holds your browser description, city, internet provider, screen size, time zone and language together. That is a lot of detail in one place. We are not saying nobody could ever pick a person out of it — only that we cannot, with what we hold, and we do not try. If you would rather not be in it at all, section 10 shows you how.
13. Security
- Everything you send us travels encrypted.
- The database holding the browsing records cannot be reached from the internet at all. It only accepts connections from the website itself, running on the same machine, and it is kept separate from our other systems.
- The passwords our systems use to reach that database are held on the server, not written into our software.
- Your own password is never stored. We keep only a scrambled version, deliberately slow to test, which cannot be turned back into your password.
- Our servers can only be logged into with a digital key, not a password.
No system is perfectly secure, and we cannot guarantee absolute security.
Hong Kong has no mandatory data-breach notification requirement. Notwithstanding that, our policy is to notify affected individuals and the Privacy Commissioner for Personal Data where a breach is likely to cause a real risk of significant harm.
14. Your rights under the Ordinance
You have the right to:
- ask whether we hold personal data about you, and to be given a copy — a Data Access Request under section 18 of the Ordinance;
- require us to correct data that is inaccurate — a Data Correction Request under section 22;
- require us to stop using your data for direct marketing, at no charge (see section 11).
Send requests to the Data Privacy Officer, DeepLoop Limited, by email to [email protected]. We will respond within 40 days, as the Ordinance requires. We may charge a fee for complying with a data access request, which will not be excessive; we will tell you the amount before proceeding.
One thing we cannot do. Our browsing records hold no name, account or contact detail, and the daily code changes every day. So in most cases we cannot tell which records are yours, and cannot usefully act on a request to see or correct them. We will say so plainly rather than guess, and we will explain what we did check. This limit does not apply to your account data, your content, or an enquiry you have sent us — all of which we can locate and act on.
Complaints. If you are dissatisfied, please complain to us first at [email protected]. You may also complain to the Office of the Privacy Commissioner for Personal Data, Hong Kong (PCPD) — www.pcpd.org.hk, [email protected], +852 2827 2827.
15. Children
The website and the Services are directed at agricultural businesses and are not intended for children. We do not knowingly collect personal data from anyone under 18. If you believe a person under 18 has provided us personal data, contact us and we will delete it.
16. Changes to this Policy
We may amend this Policy. The "Last updated" date above will change. Where an amendment materially affects how we handle your personal data, we will post notice of it on the website for at least 30 days before it takes effect, and, if you hold an account, notify you by email. Continuing to use the website or the Services after a change takes effect means you accept the amended Policy.
17. Contact
DeepLoop Limited (CR No. 80954158) [email protected]