Privacy Policy

1. Introduction

Novix Star Limited ("the Company", "we", "us") operates the NovixOne platform (including novixone.ai and app.novixone.ai, the "Platform"). This Privacy Policy explains how we collect, use, store, and protect personal data processed through the Platform.

This Privacy Policy serves as a Personal Information Collection Statement under Data Protection Principle 1 of the Personal Data (Privacy) Ordinance (Cap. 486, Laws of Hong Kong) ("PDPO"). The categories of data collected are set out in Section 2 and the purposes of collection in Section 4. Collection of each category is necessary for those purposes.

When you create an account, use the Platform, or check any consent box, you expressly consent to this Privacy Policy, the Terms of Service, the Acceptable Use Policy, and the Data Processing Addendum (collectively, the "Agreement"), constituting a legally binding agreement under the Electronic Transactions Ordinance (Cap. 553). If you do not agree, do not use the Platform.

2. Data We Collect

We collect the following categories of data:

3. Data Controller and Processor Roles

With respect to Merchant Data (Section 2.1) and Automatically Collected Data (Section 2.3), Novix Star Limited is the data user (controller) under the PDPO.

With respect to End User (Merchant Customer) Data (Section 2.2), the merchant is the data controller, and Novix Star Limited acts solely as a data processor on the merchant's written instructions. Merchants are solely responsible for: (a) establishing a lawful basis for collection and processing; (b) providing complete and accurate privacy notices to end users; (c) obtaining required consents; (d) handling and responding to end-user data rights requests; and (e) complying with all applicable laws.

We assume no controller responsibilities to end users with respect to customer data we process. Any request or claim by an end user concerning their data may be redirected by us to the relevant merchant, and we have no obligation to respond directly.

4. How We Use Data

We may use collected data for the following purposes:

• Providing, operating, and maintaining the NovixOne platform and its features
• Automatically processing customer conversations, orders, bookings, and customer relationships via AI
• AI analysis and extraction of structured information from conversations and customer data (including preference memories, purchase intent, sentiment, customer health scores, and recommended actions) to assist merchants
• Improving, developing, and testing platform features, AI model performance, and product experience (using anonymised or aggregated data)
• Processing payments, subscriptions, credit pack purchases, and billing
• Sending service, billing, security, and transactional notifications
• Detecting, investigating, and preventing fraud, abuse, violations, and security threats
• Internal business analytics, reporting, and commercial planning
• Complying with legal, regulatory, governmental, or court requirements
• Exercising, defending, or protecting the legitimate interests of the Company, users, or third parties

5. AI Automated Processing and Customer Analysis

The Platform uses AI to automatically analyse customer conversations, including but not limited to: extracting customer preference memories, calculating purchase intent scores, analysing sentiment and satisfaction, identifying topics and objections, generating customer health scores, and recommending next-best-actions.

These automated processes are merchant business management tools. Final decisions and actual execution remain under the human oversight of merchant personnel. We expressly state that such automated processing does not, by itself, produce legal effects or similarly significant effects on end users, and is therefore not subject to the special restrictions on solely automated decision-making in any applicable jurisdiction.

Merchants must disclose such AI analysis activities in their own privacy notices to end users and bear sole responsibility for such disclosure.

6. Data Storage and Security

We adopt reasonable technical and organisational measures with respect to stored data, including but not limited to:

• Storage in encrypted cloud infrastructure
• Logical isolation between merchants
• HTTPS / TLS encryption in transit
• Role-based access control and least-privilege principles
• Logging, monitoring, and anomaly detection
• Payment data handled by Stripe in compliance with PCI DSS standards
• Media files (images, voice) automatically deleted after 90 days

Despite these measures, no system can be guaranteed to be absolutely secure. We accept no liability for any security incident or data breach beyond what is provided in the Limitation of Liability section of the Agreement.

7. Data Retention

We retain personal data only for as long as reasonably necessary to fulfil the purposes for which it was collected:

• Account and business data: Retained during the merchant's subscription. Following account termination, generally deleted or anonymised within 180 days, except where retention is required for legal, compliance, dispute resolution, fraud prevention, or business record-keeping purposes.
• Conversation content and AI memories: Retained during the subscription unless earlier deletion is requested in writing.
• Media files (images, voice): Automatically deleted after 90 days.
• Billing, financial, and transaction records: Retained for at least 7 years pursuant to the Inland Revenue Ordinance (Cap. 112).
• System and security logs: Retained for up to 24 months for security, debugging, and compliance purposes.
• Anonymised or aggregated data: May be retained indefinitely and continue to be used to improve the Platform, train AI models, and conduct business analytics.
• Legal hold: Data necessary for any pending or foreseeable legal proceedings, disputes, investigations, or regulatory requirements may be retained until such matters are resolved.

8. Data Sharing

We do not sell your personal data. We may share data in the following circumstances:

(a) Service providers and sub-processors: We use third-party services (including but not limited to cloud infrastructure, databases, messaging gateways, AI model inference, payment processing, error monitoring, push notifications) to operate the Platform. Such providers receive only the minimum data necessary. The current category-level list of sub-processors is set out on the Sub-processors page.

(b) Merchants: Messages and customer data received via the merchant platform will be provided to the relevant merchant.

(c) Legal and compliance requirements: When required by law, court order, regulator, or government; or to detect, prevent, or address fraud, security, or technical issues; or to protect the rights, property, or safety of the Company, users, or the public.

(d) Business transfers: In connection with a merger, acquisition, restructuring, asset sale, or bankruptcy, data may be disclosed and transferred as part of the transferred assets.

(e) With your consent: With your prior consent for any sharing not covered above.

9. Sub-processors

We may select, change, or add sub-processors at our sole discretion. The current category-level list of sub-processors is set out on the Sub-processors page, including processing purposes, regions, and data categories.

We reserve the right to change sub-processors at any time. Material additions take effect upon update of the Sub-processors page. Continued use of the Platform constitutes the merchant's consent to the updated sub-processor list. A merchant's sole remedy for objecting to any sub-processor is to terminate the use of the Platform.

For commercial confidentiality and security reasons, we do not publicly disclose the specific corporate names of individual sub-processors. Enterprise customers with special compliance requirements may make a written request for further disclosure under a non-disclosure agreement, which we may grant at our discretion.

10. Cross-Border Data Transfers

We and our service providers may operate in multiple jurisdictions worldwide. You expressly consent that your personal data may be transferred to, stored on, and processed by servers or personnel located outside Hong Kong, including but not limited to the United States, the European Union, the United Kingdom, Singapore, Japan, and other jurisdictions.

Use of the Platform constitutes your express consent to such cross-border transfers and is equivalent to written consent under Section 33 of the PDPO (if and when in force).

11. Direct Marketing

In accordance with Sections 35A–35C of the PDPO, we will not use your personal data for direct marketing without your prior consent (or, in the case of electronic communications, your indication of no objection).

You may withdraw consent or opt out at any time by contacting contact@novixone.ai.

12. Your Rights

Under the PDPO, you have the right to:

• Access your personal data held by us (Section 18, PDPO)
• Request correction of inaccurate data (Section 22, PDPO)
• Request that we cease using your personal data for direct marketing (Section 35C, PDPO)
• Request deletion of personal data we no longer need to retain (to the extent permitted by applicable law)
• Lodge a complaint with the Office of the Privacy Commissioner for Personal Data, Hong Kong, regarding our processing of your personal data

To exercise these rights, please contact contact@novixone.ai in writing with reasonable proof of identity. We may charge a reasonable administrative fee for, or refuse, requests that are manifestly repetitive, unreasonable, or excessive. We generally respond within 40 days.

13. End User (Merchant Customer) Rights

If you are a customer who interacted with a merchant via the merchant's WhatsApp account on NovixOne, please contact the relevant merchant directly to exercise your data rights. The merchant is the controller of your data and is responsible for responding to your request.

We process such data solely as a processor on the merchant's instructions and have no obligation to respond directly to end-user requests. If you contact us directly, we may redirect your request to the relevant merchant and provide assistance only as instructed and authorised by the merchant.

14. Children's Data

The Platform is not directed at individuals under the age of 16. We do not knowingly collect personal data from children under 16.

Merchants represent and warrant that their end customers are adults. If a merchant's business involves minors, the merchant assumes sole responsibility for obtaining parental consent and complying with all applicable laws (including the PDPO and any child protection laws), and shall indemnify us against any claims arising therefrom.

15. Data Breach Notification

If a security incident occurs that affects personal data we process, we will, where reasonably practicable, notify affected merchants within 72 hours of becoming aware of the incident, and notify relevant authorities as circumstances and law require.

We retain sole discretion as to the timing, form, and content of breach notifications. Our liability for any data breach is subject to the Limitation of Liability provisions of the Agreement.

16. Cookies

The Platform currently uses essential cookies to maintain login sessions and ensure proper operation. We do not currently use tracking or advertising cookies. We reserve the right to introduce analytics or marketing cookies in the future and will update this Policy before doing so.

17. Policy Updates

We may update this Privacy Policy from time to time. Material changes will be posted on this page with an updated effective date and may also be communicated via platform notifications or email. Continued use of the Platform constitutes acceptance of the updated Policy.

18. Contact Us

For any questions regarding this Privacy Policy or to exercise your data rights, please contact:

Novix Star Limited Address: Rm 1805-06, 18/F, Hollywood Plaza, 610 Nathan Road, Mong Kok, Kowloon, Hong Kong Email: contact@novixone.ai