Privacy Policy
Hong Kong AI Film Academy Limited determines how personal data is used for the Academy services described here. You can contact us through hkaifa.academy/support and select a privacy request.
2026-10-07.1 · 2026-10-07
Information we handle
We handle the email and account details you provide; profile and language preferences; applications, portfolios and role assessments; course participation, submissions and contribution evidence; enterprise enquiries and authorised organisational contacts; order and refund records; support messages, consent choices and necessary security logs. Do not submit identity documents, payment-card information or unrelated sensitive information through an ordinary research form. Optional access needs should contain only what is necessary to arrange participation.
Why information is needed
We use information to authenticate accounts, assess and manage applications, deliver courses and collaboration, handle enterprise requests, administer payments and refunds, verify agreed experience records, provide support, protect the service and fulfil applicable obligations. Required fields are identified in each form. Without necessary information we may be unable to provide the requested service; optional marketing or publicity permission is not required for professional assessment.
People and services with access
Access depends on the task. Relevant Academy personnel, assigned reviewers, course leads and authorised service providers receive only information needed for their functions. Course colleagues see the collaboration content you share with the team, not your private application or payment information. A sponsor or prospective employer does not automatically receive private evidence, contact details or evaluations. We do not sell personal data.
Public profiles and experience records
Profiles and new credentials start private. If you choose to publish them, their selected facts and record status can be viewed globally. Private email addresses, payment information and support requests do not form part of a public archive. Before publication, review the material and your authority to share information about others. You may make a record private again, although the Academy cannot recall copies independently made while it was public.
INDEX and connected services
Associating an existing INDEX record stores its identifier, source, version and the consented connection to your contribution. Separate platforms retain their own data practices. Account linking or further transmission of contribution information requires a specific connection and permission. A matching email address alone is not treated as authorisation to merge identities or publish a person’s private history.
Providers and international processing
The website uses Vercel for hosting and Supabase for account and application infrastructure. The Academy database is hosted in Singapore; provider operations and authorised support may involve other locations. The payment provider identified at checkout handles payment credentials under its own notice. Where an optional third-party production tool receives personal material, the course must first identify the purpose, recipients and relevant handling conditions. We use appropriate contractual, access and security measures for the information involved.
Cookies and local storage
Essential first-party cookies maintain authenticated sessions and protect account actions. Local storage remembers language and appearance; temporary browser session storage preserves an unfinished application while you sign in. The installable app may cache public pages and artwork for offline reading. Private account responses, evidence and payment information are not intentionally cached for offline use. This release does not require advertising trackers or third-party analytics cookies. Browser controls can clear stored preferences and cached content.
Communication and optional permission
Service messages concern an application, accepted course, order, security or support request. Promotional subscriptions, public recording, interviews and reuse of your likeness or voice require a distinct choice where applicable. Declining optional publicity does not reduce the evidence-based assessment of your contribution. You can withdraw an optional consent through Support or the corresponding account control.
Retention
We retain active account information while needed to provide the service. Unsuccessful application materials are reviewed for deletion or anonymisation within 12 months of the final decision, unless you request continued consideration. Private review evidence is reviewed within 12 months of course completion and resolution of an appeal. Limited accounting and transaction records may be kept for seven years, or another period required by applicable law. Verified public records can remain as historical records while their publication is authorised; their supporting private material need not remain public or be retained indefinitely. Open disputes, security investigations and legal obligations can require a limited extension with restricted access.
Your requests and controls
You may request access, correction, export, deletion, restriction of use or withdrawal of optional consent through your account or Support. We verify only what is reasonably needed to protect the account and respond within the applicable legal period. Where a request cannot be fully met because of a specific obligation, unresolved dispute or another person’s rights, we explain the limitation and consider an appropriate alternative. Account deletion does not automatically erase necessary accounting records or falsify a historical contribution record.
Security and incidents
We use role-based access, protected uploads, transport encryption and logging appropriate to the service. Keep login codes private and use a trusted device for sensitive work. Report a suspected incident through Support. We investigate, take proportionate protective action and notify affected people or authorities where required. No system can promise the elimination of every risk.
Other people, young participants and updates
Only provide another person’s information when you have authority and have explained the relevant use. Participation by minors requires an agreed guardian process before personal materials are collected for enrolment. We maintain this Policy with a version and date, and notify material changes affecting existing processing. The Hong Kong Personal Data (Privacy) Ordinance and other applicable requirements govern our handling of personal data.