Privacy Policy

ThinkThinkSyn Limited (“we”, “us”) runs KongPaper. We are the data user for personal accounts, for visitors to this website, and for people who contact us.

When a school uses KongPaper, the school decides which teachers and students get accounts and what they use them for. For that school's data, the school is the data user, and we process the data on its behalf and on its instructions.

• Account details: name, email address, password (stored only in a one-way encrypted form), role, and your school and classes. If you sign in with Google, we receive your name, email address and profile picture from Google.
• What you create and submit: papers, homework, answers, uploaded files, marks, comments, announcements and class materials.
• Forms: what you enter when you apply for a school trial, register for a mock exam, post on the wishing tree, or write to us through the contact page.
• Usage and device data: pages viewed, actions taken, browser and device type, and IP address, collected through server logs, error reports and analytics (see section 9).

• to create and protect your account and keep you signed in;
• to generate, lay out, release and mark papers, and to show teachers how their classes are doing;
• to send service emails, such as sign-in links, invitations and password resets;
• to answer your messages and questions;
• to bill schools and keep accounting records;
• to keep the service safe: stopping bots, limiting abuse and fixing errors;
• to learn which features are used, so we can improve them.

We do not sell personal data. We use your name and email address for direct marketing only if you agree first, for example by ticking “Send me news and offers from KongPaper” when you register for a mock exam. We then send you news and offers about KongPaper's services and events. You can withdraw that consent at any time by emailing hello@kongpaper.ai, and we will stop at no charge to you.

Many students on KongPaper are under 18. A school that gives students accounts is responsible for getting any consent it needs from the students and their parents or guardians. A person under 18 needs a parent's or guardian's consent to open a personal account.

A student's answers, marks and essays are shown to that student and to the teachers of their class. A school's admins can see the accounts in their school. In our analytics, we identify a signed-in user by account ID and role only, never by name or email, and in the app we mask the text on the page.

We share personal data only as far as we need to run KongPaper:

• your school, as section 4 describes;
• the KongPaper Core service, which generates, lays out and marks papers;
• providers that work for us: Vercel (website and app hosting), Fly.io (servers), Neon (database), Upstash (cache and job queue), Cloudflare (domain names, file storage and bot checks), Resend (email delivery), Sentry (error reports), PostHog (product analytics), Google (Google Analytics on this website, and Sign in with Google) and OpenRouter (AI models for some features);
• the police, courts or regulators, when the law requires it.

Each provider receives only the data its job needs.

Our servers and database are in Singapore. Some providers, including PostHog and Cloudflare, also process data elsewhere, including in the United States. When we transfer personal data outside Hong Kong, we take reasonable steps to keep it protected to a standard similar to the Personal Data (Privacy) Ordinance.

• Personal accounts: until you ask us to delete the account. We delete the data, or make it anonymous, within 30 days of your request.
• School accounts: while the school's subscription runs. 180 days after a subscription ends, the school's data is archived; 30 days after that, it is deleted from our database and file storage. A school can ask us to keep its data longer or to delete it sooner.
• Essay marking: we do not keep the full text or photos of an essay on our own servers. The marking service deletes its copy 180 days after marking.
• Invoices and payment records: 7 years, as Hong Kong tax law requires.
• Server logs and error reports: only as long as we need them to run and fix the service.

We may keep anonymous data, which no longer identifies anyone, for statistics.

Every page uses HTTPS. Passwords are stored only in a one-way encrypted form. Uploaded files sit in private storage and can only be opened through links we issue. Our staff get access by role, and only to what their work needs. No system is perfectly secure: if a data breach is likely to harm you, we will tell you and the school concerned as soon as we can.

We use a few cookies and similar technologies:

• Essential: your sign-in, language, theme and cookie choice. The site does not work without them.
• Product analytics: PostHog counts page views and clicks, so we can see which features are used. It does not record sessions, it skips browsers that send Do Not Track, and in the app it masks the text on the page.
• Google Analytics: on this website only, and only after you choose “Accept all” in the cookie notice.

You can change your choice at any time with “Cookie settings” at the foot of this website, or block cookies in your browser.

Under the Personal Data (Privacy) Ordinance, you can ask to access or correct your personal data. You can also ask us to stop using it for direct marketing, or to delete your account. Email hello@kongpaper.ai. We reply to access and correction requests within 40 days.

If your account belongs to a school, we may pass your request to the school, because the school manages that account. A parent or guardian can make a request for a child under 18.

If we change this policy in a way that matters, we will post the new version on this page and tell signed-in users before it takes effect. For questions or complaints, email hello@kongpaper.ai. If our reply does not settle the matter, you can complain to the Office of the Privacy Commissioner for Personal Data, Hong Kong.