私隱政策

生效日期：2026 年 10 月 13 日

ChopReality 是一個 AI 數字人教學平台，網址為 chopreality.com。平台由 Ydot Studio Limited（於香港註冊）開發及營運，並由 INDEX Academy Limited 負責推廣、銷售及與學校訂立服務合約。本政策中的「我們」指這兩間公司。本政策說明我們收集哪些個人資料、如何使用，以及你可以怎樣行使你的權利。我們按照香港《個人資料（私隱）條例》（第 486 章）處理個人資料。

1. 我們的角色

平台主要由學校訂用，服務合約由學校與 INDEX Academy Limited 訂立；平台的系統及資料由 Ydot Studio Limited 管理。學生及教師的資料由學校決定如何使用，我們代表學校處理這些資料，只會按學校的指示及本政策使用。學生的帳戶由其學校或教師建立；如你是家長或學生，並對資料的使用有疑問，可以聯絡所屬學校或直接聯絡我們。

2. 我們收集的資料

類別	內容
帳戶資料	姓名、電郵地址、身分（教師或學生）、所屬學校及班別、頭像（如有）、經加密處理的密碼、登入紀錄。
學習紀錄	與數字人的對話內容（包括對話中上傳給 AI 處理的圖片）、測驗及練習的作答和分數、知識點進度、面試練習的對話文字及評估結果。
教師提供的內容	數字人的設定、教材及知識庫、題目、對學生的評語。
語音	使用語音輸入時，聲音會轉換成文字；我們只保存轉換後的文字，不保存錄音。
使用紀錄	功能使用次數等統計資料，用於計算用量及維持服務運作。
網站訪客	使用學校網站或本網站上的數字人聊天框時，我們不保存對話內容，只記錄使用次數；被安全篩查標記的個別訊息（例如不當用語）會保留給負責的教師跟進。

我們不會要求學生提供身份證號碼、住址、電話號碼等資料。平台設有篩查，學生在對話中輸入電話號碼或身份證號碼等個人資料時會被提醒並攔截。

3. 使用目的

• 提供教學功能：數字人對話、出題及批改、學習報告。
• 讓教師了解學生的學習情況並作出跟進。
• 保障學生安全：偵測不當用語及情緒困擾的訊號，並通知負責的教師。
• 維持及改善服務、處理查詢、防止濫用。

我們不會出售個人資料，不會把學生資料用於廣告，也不會以學生的個人資料訓練 AI 模型。

4. Google Classroom 資料

教師可以選擇連結學校的 Google 帳戶，從 Google Classroom 匯入班別和學生名單。授權後，我們只會讀取：

• 該教師任教的課室清單（classroom.courses.readonly）；
• 所選課室的學生名單（classroom.rosters.readonly）；
• 學生的姓名及學校電郵地址（classroom.profile.emails）。

這些資料只用於在平台建立學生帳戶和班別。名單由教師的瀏覽器直接向 Google 讀取；授權憑證只在該次匯入期間存在於教師的瀏覽器內，不會傳送到或儲存在我們的伺服器。我們不會讀取作業、成績或 Google 雲端硬碟的內容，也不會修改 Google Classroom 內的任何資料。教師可以隨時在 Google 帳戶的「第三方應用程式存取權」移除授權。

ChopReality 使用及轉移從 Google API 取得的資料時，會遵守 Google API 服務使用者資料政策，包括當中的「有限使用」規定。我們不會把這些資料轉移給第三方（提供或改善上述功能所必需者除外），不會用於廣告，也不會用於訓練 AI 模型。

5. 協助我們提供服務的第三方

我們使用以下服務供應商處理資料。他們只可按我們的指示處理資料，用於提供有關服務：

供應商	用途
Google（Gemini、Vertex AI）	生成數字人的回覆、出題、批改及語音轉文字。
MiniMax	把數字人的回覆轉成語音，以及製作數字人的聲音和動畫。
Railway、Vercel	伺服器、資料庫及網站寄存。

Ydot Studio Limited 及 INDEX Academy Limited 的獲授權人員，可能因開設帳戶、提供客戶支援或維護系統而接觸學校及學生的帳戶資料；他們只會在有需要時才查閱。

除上述情況、法律要求，或取得你或學校的同意外，我們不會向其他人披露個人資料。

6. 資料存放地點

資料儲存在雲端服務供應商的伺服器上。這些伺服器，以及上述第三方處理資料的地點，可能位於香港以外的地區。我們會採取合理措施，確保資料在這些地區得到與本政策相若的保障。

7. 保留期限

我們在學校的服務合約期內保留資料。合約終止後：

• 學校可以要求我們刪除或匯出其資料，我們會在收到要求後 30 日內處理；
• 如學校沒有提出要求，我們會在合約終止後 12 個月內刪除有關的個人資料，或把它變成無法識別個人的資料。

上述期限適用於個人資料。數字人的形象、聲音及動畫、知識庫、教材和題目等不屬個人資料的內容，以及已去除身份、無法識別個人的統計數據，不受上述期限限制；這些內容的擁有權及使用安排按服務合約處理。

8. 資料保安

資料在傳輸過程中經加密（HTTPS），密碼以不可還原的方式儲存。教師只可以查看自己名下學生的資料，學生只可以查看自己的資料。只有上述兩間公司內需要提供支援或維護服務的獲授權人員才可以接觸資料。

9. 你的權利

你有權查閱及改正我們持有的你的個人資料，也可以要求刪除。學生和家長可以透過所屬學校提出，或直接聯絡我們；我們會與學校核實後處理。

10. Cookie 及本機儲存

我們只使用運作所需的本機儲存，例如保持登入狀態和記住介面語言，不使用廣告追蹤。

11. 政策更新

我們可能不時更新本政策。如有重大改動，我們會在本頁更新生效日期，並通知已訂用的學校。

12. 聯絡我們

Ydot Studio Limited（平台營運）
INDEX Academy Limited（銷售及客戶服務）
電郵：info@chopreality.com

Privacy Policy

Effective date: 13 October 2026

ChopReality is an AI digital human teaching platform at chopreality.com. It is developed and operated by Ydot Studio Limited, a company registered in Hong Kong, and is marketed and sold by INDEX Academy Limited, which enters into the service agreements with schools. In this policy "we" and "us" mean these two companies. This policy explains what personal data we collect, how we use it, and how you can exercise your rights. We handle personal data in accordance with the Personal Data (Privacy) Ordinance (Cap. 486) of Hong Kong.

1. Our role

The platform is mainly subscribed to by schools. The service agreement is between the school and INDEX Academy Limited; the platform's systems and data are managed by Ydot Studio Limited. Schools decide how student and teacher data is used; we process that data on their behalf, only as instructed by the school and as described here. Student accounts are created by the school or teacher. Parents and students with questions may contact their school or contact us directly.

2. Data we collect

Category	Details
Account data	Name, email address, role (teacher or student), school and class, profile picture (if any), a hashed password, and sign-in records.
Learning records	Conversations with digital humans (including images uploaded for the AI to process), quiz and practice answers and scores, knowledge point progress, and the text and assessment of interview practice.
Teacher content	Digital human settings, teaching materials and knowledge bases, questions, and comments on students.
Voice	When voice input is used, speech is converted to text. We keep the text only and do not keep the recording.
Usage records	Statistics such as feature usage counts, used to measure usage and keep the service running.
Website visitors	When a visitor uses a digital human chat widget on a school website or on this site, we do not keep the conversation and record only usage counts; individual messages flagged by safety screening (for example inappropriate language) are kept for the responsible teacher to follow up.

We do not ask students for identity card numbers, home addresses or phone numbers. The platform screens student messages and warns and blocks when personal data such as phone or identity card numbers is entered.

3. How we use data

• To provide teaching features: digital human conversations, question setting and marking, and learning reports.
• To let teachers understand and follow up on their students' learning.
• To keep students safe: detecting inappropriate language and signs of distress and alerting the responsible teacher.
• To maintain and improve the service, handle enquiries and prevent abuse.

We do not sell personal data, do not use student data for advertising, and do not train AI models on students' personal data.

4. Google Classroom data

A teacher may choose to connect their school Google account to import classes and student lists from Google Classroom. Once authorised, we read only:

• the list of classes that teacher teaches (classroom.courses.readonly);
• the student roster of the classes the teacher selects (classroom.rosters.readonly);
• students' names and school email addresses (classroom.profile.emails).

This data is used only to create student accounts and classes on the platform. The roster is read from Google directly by the teacher's browser. The access token exists only in the teacher's browser for the duration of that import and is not sent to or stored on our servers. We do not read coursework, grades or Google Drive content, and we do not change anything in Google Classroom. A teacher can remove access at any time under "Third-party apps with account access" in their Google Account.

ChopReality's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements. We do not transfer this data to third parties except as necessary to provide or improve the feature described above, do not use it for advertising, and do not use it to train AI models.

5. Service providers

We use the following providers to process data. They may process it only on our instructions, to provide their service:

Provider	Purpose
Google (Gemini, Vertex AI)	Generating digital human replies, setting and marking questions, and speech-to-text.
MiniMax	Turning digital human replies into speech, and producing digital human voices and animations.
Railway, Vercel	Servers, database and website hosting.

Authorised staff of Ydot Studio Limited and INDEX Academy Limited may access school and student account data to set up accounts, provide customer support or maintain the system. They do so only when needed.

Other than the above, where required by law, or with your or the school's consent, we do not disclose personal data to anyone else.

6. Where data is stored

Data is stored on the servers of cloud service providers. Those servers, and the locations where the providers above process data, may be outside Hong Kong. We take reasonable steps to ensure data in those locations receives protection comparable to this policy.

7. Retention

We keep data for the term of a school's service agreement. After the agreement ends:

• the school may ask us to delete or export its data, and we will act within 30 days of the request;
• if the school makes no request, we will delete the personal data, or make it no longer identify any individual, within 12 months of the end of the agreement.

These periods apply to personal data. Content that is not personal data, such as a digital human's appearance, voice and animation, knowledge bases, teaching materials and questions, and statistics that have been de-identified so they no longer identify any individual, is not subject to these periods; its ownership and use are governed by the service agreement.

8. Security

Data is encrypted in transit (HTTPS) and passwords are stored in a form that cannot be reversed. Teachers can see only the data of their own students, and students can see only their own. Only authorised staff of the two companies above who need to provide support or maintain the service can access data.

9. Your rights

You may request access to and correction of the personal data we hold about you, and may ask for it to be deleted. Students and parents may do so through their school or by contacting us; we will verify with the school before acting.

10. Cookies and local storage

We use only the local storage needed to run the service, such as keeping you signed in and remembering your interface language. We do not use advertising trackers.

11. Changes

We may update this policy from time to time. For significant changes we will update the effective date on this page and notify subscribing schools.

12. Contact

Ydot Studio Limited (platform operator)
INDEX Academy Limited (sales and customer service)
Email: info@chopreality.com