1. Who We Are
PingHand is operated by AIC China Holdings Limited ("we", "our", or "us"), a company incorporated in Hong Kong. We provide an AI-powered WhatsApp automation service for Hong Kong small and medium businesses.
For privacy enquiries, contact us at: hello@pinghand.com
2. What Data We Collect
Data you provide directly:
- Your name and email address when you create an account
- Your business name, type, address, pricing, and services
- Your WhatsApp Business Account credentials (WABA ID, Phone Number ID)
- Your contact phone number for escalation alerts
Data generated through use of the service:
- WhatsApp message content sent to your business number (stored for dashboard display)
- Customer phone numbers and names associated with bookings (masked in logs)
- Booking records (date, time, service, status)
- Conversation metadata (timestamps, response type, language detected)
- If you enable missed-call text-back: the phone number of callers to your forwarding number, and the date/time of the call
2A. Google Calendar Data (Limited Use)
If you connect your Google Calendar, PingHand requests access to two Google Calendar scopes (calendar.events and calendar.readonly) via Google OAuth. This section describes exactly how we access, use, store, and share that Google user data.
What we access:
- Your calendar's busy/free periods, so customers are only offered appointment times that do not conflict with your existing events
- The ability to create, update, and delete calendar events for bookings made through PingHand
- Notifications when a booking event you created through PingHand is deleted directly in Google Calendar, so we can alert you
How we use it:
- Google Calendar data is used solely to provide the booking and calendar-sync features of PingHand that you initiated
- We store only your Google OAuth refresh token (encrypted), the IDs of calendar events we created, and your calendar ID — we do not copy or mirror your calendar's contents
- Google Calendar data is never sold, shared with third parties, used for advertising, or used to train AI models
PingHand's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
You can disconnect Google Calendar at any time in Settings, which deletes your stored Google tokens. You can also revoke access from your Google Account permissions page.
3. How We Use Your Data
- To provide and operate the PingHand service
- To generate AI replies to your customers' WhatsApp messages
- To display analytics and booking information in your dashboard
- To send you escalation alerts when a customer complaint is detected
- To process subscription payments via Stripe
- To improve the accuracy and quality of AI responses
We do not sell your data or your customers' data to third parties.
4. Data Storage and Security
Your data is stored on Supabase servers located in Singapore (ap-southeast-1 region), operated by Supabase Inc. All data is encrypted at rest and in transit using TLS 1.2+.
Customer phone numbers in conversation logs are masked (e.g. +852XXXX1234) to reduce privacy exposure in the event of unauthorised access.
Payment processing is handled by Stripe. We do not store credit card numbers.
5. Your Rights Under Hong Kong PDPO
Under the Personal Data (Privacy) Ordinance (Cap. 486) of Hong Kong, you have the right to:
- Request access to personal data we hold about you
- Request correction of inaccurate personal data
- Request deletion of your account and associated data
- Withdraw consent to the use of your personal data for direct marketing
To exercise any of these rights, email us at hello@pinghand.com. We will respond within 40 days as required by the PDPO.
6. Data Retention
- Conversation logs: retained for 12 months, then automatically deleted
- Booking records: retained for 24 months
- Account data: retained until account deletion is requested
- Payment records: retained for 7 years as required by Hong Kong law
6A. Data Deletion
You can delete your data at any time:
- Conversation history and bookings — delete individual records from your dashboard
- Google Calendar connection — disconnect in Settings; this deletes your stored Google tokens immediately
- Your entire account — email hello@pinghand.com and we will delete your account and all associated data within 30 days, except payment records we must retain by law
If you connected via Facebook/Meta and wish to request deletion through Meta, you can use Meta's data-deletion flow in your Facebook settings, or email us directly — both routes lead to the same deletion process.
7. Third-Party Services
We use the following third-party services to operate PingHand:
- Meta (WhatsApp Cloud API) — message delivery
- Google (Calendar API) — optional calendar sync, only if you connect it (see Section 2A)
- Together AI / Meta Llama 3.3 — AI response generation
- Supabase — database and authentication
- Upstash Redis — session caching
- Stripe — payment processing
- Twilio — optional phone-call answering and missed-call text-back
- Netlify — website hosting
- Fly.io — server hosting
Each provider has their own privacy policy and data processing agreements in place.
8. Cookies
We use minimal cookies required for authentication (session tokens from Supabase). We do not use tracking cookies or third-party advertising cookies.
9. Changes to This Policy
We may update this Privacy Policy from time to time. We will notify you by email and by posting the updated policy on this page with a revised date. Continued use of the service after changes constitutes acceptance of the updated policy.
10. Contact
For any privacy-related questions or to exercise your rights, contact:
AIC China Holdings Limited
Email: hello@pinghand.com