Privacy Policy

1. Who we are

AO Group Holdings Limited (美洲网集团控股有限公司), a company registered in Hong Kong (Business Registration No. 78443824), Room 915, 9/F, North Tower, Concordia Plaza, 1 Science Museum Road, Tsim Sha Tsui, Kowloon, Hong Kong ("AO Group", "we"), is responsible for the personal data collected through aogroupai.com and its client portal (the data user / controller).

Privacy Officer and Data Protection Officer: [email protected], +852 6098 3677. Write to us at the address above or by email for any privacy question or request.

2. Personal data we collect

Account data: company legal name, country, website, employee range, contact name, work email, phone number and password (we store only a salted hash, never the password itself).

Ownership and eligibility declaration: the name, nationality or headquarters country and percentage held of every shareholder holding 10% or more, the ultimate parent company and its headquarters country, your answers to the control and resale questions, and a record of your acceptance of this Privacy Policy and the Terms of Service (version and time).

Application data: the platforms you select, your use-case description and the documents you upload (for example a business registration certificate or product deck).

Communications: emails, WhatsApp messages and call notes. Technical data: IP address (used for security and rate limiting in short-lived counters), session cookies and your language choice stored in your browser.

We do not ask for sensitive personal data. Please do not upload identity documents unless we specifically request them.

3. Why we use it and our legal bases

We use personal data to create and manage your account; to check eligibility, including ownership and control screening required by the AI platform providers; to prepare, submit and follow up on platform and support-credit applications on your behalf; to communicate with you; for invoicing and accounting; to keep the site and portal secure; and to comply with the law.

Where the law requires a legal basis, we rely on performing our contract with you or taking steps before entering into it, your consent (which you may withdraw at any time without affecting earlier processing), our legitimate interests in security and eligibility screening, and compliance with legal obligations.

The registration form automatically declines registrations whose answers show that the company is not eligible. You can ask a person at AO Group to review this outcome by emailing [email protected]. We do not sell personal data, do not share it for cross-context behavioural advertising and do not use it for marketing without your consent.

4. Who receives your data

The AI platform(s) you choose (Amazon Web Services, Google Cloud and/or Microsoft) when we submit an application on your behalf; they act under their own privacy policies.

Our service providers acting on our instructions: Cloudflare, Inc. (United States) for hosting, the portal database (D1), private document storage (R2) and security; our business email provider; and WhatsApp / Meta Platforms if you contact us on WhatsApp.

Our professional advisers (lawyers, accountants), banks that process payments, and public authorities where the law requires it. We do not disclose your data to anyone else without your consent.

5. Storage location and cross-border transfers

The portal database and uploaded documents are stored by Cloudflare in Eastern North America (United States). Requests to the site may be processed in Cloudflare data centres worldwide. AO Group staff access data from Hong Kong. AI platforms may process data in the United States and other regions.

Your data may therefore be transferred outside your country to places whose laws may offer a different level of protection, and may be accessible to authorities there. We protect transfers with contractual safeguards from our providers (including Cloudflare's data processing terms), access controls and encryption in transit, and, where the law requires it, your consent, which you give when you register and accept this policy.

6. How long we keep data

Account and ownership declaration data: while your account is active and for 24 months after your last activity or after account closure. Application documents: up to 12 months after the application is decided or withdrawn, or sooner at your request.

Contracts, invoices and payment records: 7 years, as required by Hong Kong tax law. Emails and WhatsApp messages: 24 months. Sign-in sessions expire after 7 days (staff sessions after 8 hours); security counters are kept only for their short time window.

Deleted data may remain in encrypted database backups for up to 30 days before being overwritten.

7. Your rights and how to delete your data

Depending on where you are, you may have the right to access, correct, delete, object to or restrict the use of your personal data, to receive a copy in a portable format, to withdraw consent, and to complain to a regulator.

To make a request, email [email protected] from your registered address. We will verify your identity and reply within 30 days, or sooner where local law sets a shorter deadline. Requests are free unless the law allows a reasonable fee.

Deletion process: once your request is verified, we delete your account, ownership declaration, applications and documents from the portal and our document storage within 30 days and confirm in writing. Records we must keep by law (such as invoices) are kept, restricted, until the retention period ends. Data already sent to an AI platform is governed by that platform's own policy; we will tell you how to contact it.

8. Security and data breaches

We use encrypted connections (TLS), hashed passwords, private document storage, role-based access and a security check for staff sign-in.

If a personal data breach occurs, we will contain it, assess the risk within 24 hours, notify affected clients without undue delay and, where feasible, within 72 hours, and notify regulators where required (for example the Personal Data Protection Commissioner in Malaysia, the PDPC in Thailand, the Office of the Privacy Commissioner of Canada, and authorities in Mexico, Argentina and US states). We may also notify the Privacy Commissioner for Personal Data in Hong Kong. We keep a record of every breach.

9. Cookies and similar technologies

aog_sess: essential cookie that keeps you signed in to the client portal; expires after 7 days or when you sign out.

aog_admin: essential cookie used only for AO Group staff sign-in; expires after 8 hours.

aog_lang: stored in your browser's local storage (not a cookie) to remember your language; kept until you clear it.

Cloudflare may set security cookies (such as __cf_bm, about 30 minutes) to protect the site from abuse, and the staff sign-in page uses Cloudflare Turnstile. We do not use analytics or advertising cookies. If we ever add them, we will ask for your consent first.

10. Notices for specific countries

Hong Kong (Personal Data (Privacy) Ordinance) — Personal Information Collection Statement: providing the data marked as required is obligatory; without it we cannot open your account or process your application. The purposes and classes of transferees are set out in sections 3 and 4. You have the right to request access to and correction of your personal data; send requests to our Privacy Officer at [email protected]. We may charge a reasonable fee for a data access request. We will not use your data for direct marketing without your consent.

United States: we collect identifiers, business contact and professional information and limited internet activity data for the purposes above. We do not sell or share personal information and do not use sensitive personal information to infer characteristics. Where a state privacy law applies to us, you may request to know, correct or delete your information, and we will not discriminate against you for doing so. You may use an authorised agent.

Canada (PIPEDA and, in Quebec, Law 25): our Privacy Officer is accountable for compliance and can be reached at [email protected]. Your data is processed outside Canada (mainly in the United States) and may be accessible to the courts and authorities there. You may complain to the Office of the Privacy Commissioner of Canada or, in Quebec, the Commission d'accès à l'information.

Mexico (Ley Federal de Protección de Datos Personales en Posesión de los Particulares): the Spanish version of this policy is our comprehensive privacy notice (aviso de privacidad integral). The purposes in section 3 are all necessary for the service; we have no secondary purposes. You may exercise your ARCO rights (access, rectification, cancellation and opposition) and revoke consent by email to [email protected], and complain to the competent Mexican data protection authority. Transfers to the AI platforms you choose are necessary to provide the service you request.

Argentina (Law 25,326): the data subject may exercise the right of access free of charge at intervals of no less than six months, unless a legitimate interest is shown (article 14, section 3 of Law 25,326). The Agency for Access to Public Information (AAIP), as the control body of Law 25,326, handles complaints from anyone whose rights are affected by non-compliance with personal data protection rules.

Thailand (Personal Data Protection Act B.E. 2562): you have the rights of access, portability, objection, erasure, restriction, rectification and withdrawal of consent described above. You may complain to the Office of the Personal Data Protection Committee. Transfers outside Thailand are protected as described in section 5.

Malaysia (Personal Data Protection Act 2010, as amended in 2024): this notice is also available in Bahasa Melayu at aogroupai.com/privacy-ms. Providing the data marked as required is obligatory. You may request access to and correction of your data, withdraw consent and request data portability by contacting our Data Protection Officer at [email protected]. Your data is transferred outside Malaysia as described in section 5.

11. Changes to this policy

We will post any update on this page with a new version and date, and email registered clients at least 14 days before a material change takes effect. Where the law requires your consent, we will ask for it again and record the version you accept.

This policy is a draft pending review by legal counsel. Version 2026-10-10. Last updated: 10 October 2026.