Version 8

Privacy Policy

Published English edition

1. Scope

This Policy describes how ICLICK INTERACTIVE ASIA LIMITED ("Platform", "we", "our") collects, uses, stores, and shares personal information when you use the MIA Platform and the MIA Points top-up and consumption services.

This Policy applies to all users who access Platform services through the website, API, or associated clients. If you do not agree with this Policy, please stop using the Platform.

This Policy forms part of your agreement with the Platform and should be read alongside the MIA Platform Terms of Service.

2. Information We Collect

2.1 Information You Provide

  • Account registration data: email address, username, and any other profile information you choose to supply.
  • Payment information: when you top up, your payment details are entered directly on Stripe's hosted checkout page and processed by Stripe. The Platform does not receive or store your full card number or bank account details. The Platform retains only the transaction identifier, amount, status, and related metadata returned by Stripe.
  • Support communications: records of communications you initiate with Platform support by email.

2.2 Information Collected Automatically

  • Account and transaction records: top-up order data (amount, status, timestamps, payment channel), Points balance, lot records, and Points consumption records (see Section 2.3).
  • Service access logs: request timestamps, the Product or service identifier invoked, and the IP address of the calling party. In API calls received by the Platform, this IP address belongs to the calling service's server, not typically to your personal device.
  • Authentication and security event logs: login events, token issuance and revocation, and session activity, used for account security verification.
  • Telemetry data: aggregated statistics on Product feature usage for service quality monitoring and improvement. The Platform's telemetry contract expressly prohibits including personal contact information in telemetry events.

2.3 Consumption Activity Logs (Special Note)

Because MIA Points are prepaid digital service credits, actual consumption records are the Platform's primary evidence in payment disputes that Points have been delivered — corresponding to Stripe's access_activity_log dispute evidence field. The Platform therefore maintains a dedicated consumption activity log, stored separately from general telemetry, containing:

  • Account identifier
  • Precise consumption timestamp
  • Points deducted
  • Product and service identifier
  • Caller IP address (where available; this is the IP of the server calling the Platform API, not the end user's personal IP)
  • Associated credit-ledger transaction ID

These logs are retained for a minimum of 400 days from the date of consumption (see Section 5) to cover international card-scheme dispute windows.

2.4 Your Inputs and Generated Output

Content you submit when using the Platform's AI features (prompts, files, and the like) and the output returned by the model are transmitted to third-party model providers for processing. The Platform does not use such content to train models (see Section 3), does not retain inputs in a form that identifies you for any purpose beyond delivering the requested service, and does not unlawfully provide them to others.

For the purpose of evidencing delivery to card issuers, the consumption activity log records only consumption metadata (timestamp, quantity, product identifier) and not the substance of any input or output.

2.5 Risk Signals and Tags

If the Platform's risk-management system flags your account as suspicious (for example, unusual top-up patterns or suspected multi-account abuse), the Platform records the relevant signal tags, signal type and value, the operator who applied the flag, and the time of application. Flags are monitoring-only and do not automatically trigger account suspension, but may inform a manual review decision.

3. How We Use Your Information and Our Legal Basis

The Platform processes your personal information for the following purposes:

  • Providing the top-up and Points service: processing account data, payment transaction records, and Points balance, on the basis of contract performance.
  • Dispute evidence and risk management: processing consumption activity logs, risk tags, and transaction records, on the basis of legitimate interests, namely fraud prevention and enforcing contractual rights.
  • Account security: processing authentication logs and device signals, on the basis of legitimate interests, namely protecting user accounts.
  • Service quality monitoring and improvement: processing aggregated telemetry, on the basis of legitimate interests, namely improving product performance.
  • Compliance with legal obligations: processing whatever data the relevant obligation requires, on the basis of legal obligation.
  • Customer support: processing support communications and account data, on the basis of contract performance or legitimate interests.

Model training: The Platform does not use your personal information, or content you submit or generate through the Platform, to train artificial intelligence models. Should this practice change, the Platform will notify you in advance and obtain your consent where required by applicable law.

4. Sharing Your Information

The Platform does not sell your personal information. We may share necessary information with third parties in the following circumstances:

4.1 Payment Processor

Stripe, Inc. (United States): as the Platform's payment processor, Stripe collects and processes payment information directly on its hosted checkout page and returns payment result notifications to the Platform. Information shared includes: transaction amount, payment method type, transaction identifiers, and information Stripe collects independently for fraud-prevention purposes. Stripe's privacy policy is available at https://stripe.com/privacy.

4.2 Model Providers

The Platform delivers its AI features by calling third-party model provider APIs. To complete a task you initiate, your input is transmitted to the relevant provider for processing and the generated output is returned. The Platform's agreements with those providers prohibit use of such content for model training. The providers used and their locations may change as Product features change; you may request the current list using the contact details in Section 12.

4.3 Legal Requirements

The Platform may disclose user information as required by applicable law or valid orders from competent authorities. Where permitted by law, the Platform will endeavour to notify you beforehand.

4.4 Corporate Transactions

In the event of a merger, acquisition, or asset sale, user information may be transferred as part of the transaction. The Platform will notify you in advance and ensure that any recipient is bound by equivalent privacy protections.

5. Retention Periods

The Platform retains data for the following periods:

  • Consumption activity logs: a minimum of 400 days from the date of consumption, to cover international card-scheme dispute windows.
  • Top-up order records: for the life of the account, and for a further 7 years after closure, to meet business record retention requirements under the Hong Kong Inland Revenue Ordinance.
  • Authentication and audit logs: kept as append-only records until the applicable legal and security compliance requirement expires.
  • Telemetry data: 90 days, the minimum useful period for service quality monitoring.
  • Support communications: 3 years after the communication closes, for dispute handling and compliance.
  • Inputs and generated output: processed only for as long as necessary to deliver the requested service; not retained long-term.
  • Risk tags: for the life of the account; removal events are permanently logged, on the basis of legitimate fraud-prevention interests.

On expiry of a retention period, the Platform deletes or anonymises the relevant personal information, except where law requires continued retention.

6. Security

The Platform applies the following technical and organisational measures to protect your information:

  • Payment data isolation: card numbers and sensitive payment credentials are handled exclusively by Stripe and never touch the Platform's servers; the Platform stores only tokens.
  • Credential hashing: personal access tokens (PATs) and Platform Keys are stored only as hashes; plaintext is returned once at creation and cannot be recovered thereafter.
  • Encryption in transit: all data in transit uses TLS.
  • Access controls: sensitive operations are governed by role-based access controls; all operator actions are recorded in an append-only audit log.

No internet transmission or electronic storage can be guaranteed absolutely secure. In the event of a personal data breach, the Platform will notify affected users and the relevant supervisory authorities within the timeframe required by applicable law.

7. Cookies and Similar Technologies

The Platform uses no advertising, analytics, or behavioural tracking cookies, integrates no third-party analytics tools, and does not use cookies to track your activity outside the Platform. It uses only first-party cookies strictly necessary for the service to operate, limited to the following purposes:

  • Maintaining your signed-in state: identifying your session so you do not have to sign in repeatedly.
  • Protecting account and sign-in security: verifying the origin of requests during sign-in and authorisation flows, guarding against cross-site request forgery and similar attacks.
  • Resuming an authorisation flow: recording the state of an authorisation flow you began, so it can continue automatically once you have signed in.

All such cookies carry the Secure flag (transmitted over HTTPS only) and a restrictive SameSite attribute, and expire when your session ends or the relevant flow completes.

Third-party cookies: when you top up, you are redirected to a checkout page hosted by Stripe. Stripe may set cookies under its own domain for payment processing and fraud prevention. That activity is governed by Stripe's privacy policy and is outside the Platform's control.

Because all Platform cookies are strictly necessary for the service to operate, disabling them will prevent you from signing in or completing a top-up.

8. Minors

The Platform does not provide services to users under 18 years of age and does not knowingly collect personal information from minors. If the Platform discovers that it has collected personal information from a minor, it will promptly delete that information and close the account. If you are the guardian of a minor and discover that they have registered an account, please contact us using the details in Section 12.

9. Your Rights

Subject to the laws applicable in your jurisdiction, you have the following rights regarding your personal information:

  • Access: request a copy of the personal information the Platform holds about you.
  • Rectification: request correction of inaccurate or incomplete information.
  • Erasure: request deletion of your personal information where no legal retention obligation applies.
  • Objection / restriction: object to processing based on legitimate interests, or request that processing be restricted.
  • Portability: receive the data you have provided in a machine-readable format.
  • Withdrawal of consent: where processing is based on your consent, you may withdraw it at any time. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.

To exercise any of these rights, submit a request using the contact details in Section 12. The Platform will respond within 15 business days of receipt. If an extension is required, the Platform will explain why.

Note: consumption activity logs serve a legitimate dispute-evidence purpose and may not be erasable before their retention period expires. Financial and tax records are likewise subject to statutory retention periods.

10. International Data Transfers

Platform servers and data processing may involve storage or processing in jurisdictions outside mainland China. Specifically:

  • The Platform's operating entity is incorporated in the Hong Kong Special Administrative Region;
  • The payment processor, Stripe, Inc., operates in the United States and other countries.

The Platform applies appropriate safeguards for cross-border transfers as required by applicable law. Specific provisions for users in mainland China appear in Section 13.

11. Changes to This Policy

The Platform may update this Policy from time to time. Material changes will be communicated by Platform announcement or email to your registered address before taking effect. Continuing to use the Platform after an update constitutes acceptance of the revised Policy.

Last updated: 2026/09/16

12. Contact Us

To exercise your data rights or raise a privacy concern, please contact:

Data controller: ICLICK INTERACTIVE ASIA LIMITED Email: [email protected] Registered address: Unit B, 18/F, MG Tower, 133 Hoi Bun Road, Kwun Tong, Kowloon, Hong Kong

13. Supplementary Provisions for Users in Mainland China

This Section applies to users located in mainland China. Under Article 3(2) of the Personal Information Protection Law of the People's Republic of China ("PIPL"), although the Platform is incorporated in the Hong Kong Special Administrative Region, the obligations set out in this Section apply because the Platform provides services to natural persons within mainland China. Where this Section conflicts with other provisions of this Policy, this Section prevails for users in mainland China.

13.1 Notice and Consent

The Platform processes your personal information on the bases set out in PIPL Article 13. Specifically:

  • Processing necessary to conclude or perform a contract to which you are a party (namely, providing the Points top-up and consumption service) is carried out under Article 13(2) and does not require separate consent;
  • Processing necessary to fulfil statutory obligations is carried out under Article 13(3);
  • All other processing is based on your consent, which you may withdraw at any time.

13.2 Sensitive Personal Information

Payment-related information may constitute sensitive personal information under PIPL Article 28. The Platform processes such information solely to complete top-up transactions you initiate and to fulfil fraud-prevention obligations.

Please note: your full payment credentials (such as card numbers) are collected by Stripe directly on its hosted page, never pass through the Platform's servers, and are not stored by the Platform.

13.3 Separate Consent for Cross-Border Transfer

The Platform's operating entity is located in the Hong Kong SAR, and the payment processor Stripe, Inc. is located in the United States. Your use of the Platform therefore involves providing your personal information outside mainland China.

Under PIPL Article 39, before providing your personal information abroad, the Platform will inform you of the overseas recipient's name and contact details, the purpose and method of processing, the categories of personal information involved, and the means and procedures for exercising your rights against the overseas recipient — and will obtain your separate consent.

The overseas recipients are:

  • ICLICK INTERACTIVE ASIA LIMITED, located in the Hong Kong SAR, China. Purpose: providing Platform services, account management, and Points ledger operations. Categories received: account data, transaction records, consumption logs, and access logs.
  • Stripe, Inc., located in the United States. Purpose: payment processing and fraud prevention. Categories received: payment information, transaction amounts, and transaction identifiers.

You may submit a request to exercise rights against an overseas recipient using the contact details in Section 12; the Platform will relay and follow up on your request.

Basis for the transfer: the Platform provides personal information abroad because it is necessary to conclude and perform a contract to which you are a party, and the number of individuals whose personal information the Platform provides abroad in a calendar year is below the thresholds set out in the Provisions on Promoting and Regulating Cross-Border Data Flows. On that basis the Platform understands that no standard contract for the outbound transfer of personal information and no security assessment declaration is required for these transfers. That does not relieve the Platform of the notice and separate-consent obligations set out in this Section. If the Platform's scale or transfer arrangements change so that this basis no longer holds, the Platform will complete the applicable formalities and notify you.

Withdrawing separate consent: you may withdraw your separate consent to cross-border transfer at any time using the contact details in Section 12. Please note that because the Platform's operating entity is itself located outside mainland China, withdrawing this consent will make it impossible for the Platform to continue providing services to you. You may then request account closure, and any unconsumed Points will be handled under the MIA Points Refund Policy.

13.4 Your Rights Under PIPL

In addition to the rights listed in Section 9, you have the right to:

  • Be informed and to decide: restrict or refuse the processing of your personal information by others;
  • Access and copy: access and obtain a copy of your personal information held by the Platform;
  • Portability: where conditions specified by the national cyberspace authority are met, request transfer of your personal information to a personal information handler you designate;
  • Explanation: require the Platform to explain its personal information processing rules;
  • Rights of a deceased person's next of kin: where a natural person is deceased, their close relatives may exercise rights of access, copying, correction, and deletion over the deceased's relevant personal information for their own lawful and legitimate interests.

The Platform will respond to your request within 15 business days. If the Platform declines a request, it will explain its reasons.

13.5 Local Representative

Pursuant to PIPL Article 53, the Platform's designated dedicated entity or representative within mainland China is:

  • Name: ____________________
  • Contact details: ____________________

You may also contact the Platform directly about personal information matters using the email address in Section 12 of this Policy.

13.6 Automated Decision-Making and Risk Control

The Platform's risk-control system may assess top-up transactions automatically, which can result in a transaction being held or declined (see Terms of Service §4.6). Decisions that restrict an Account are subject to human review rather than being made by automated means alone. You have the right to require the Platform to explain the rules applied in automated decision-making, and to refuse decisions made solely by automated means that significantly affect your rights or interests.

13.7 Generative AI Services

The Platform provides generative AI features by calling third-party model APIs. Inputs you submit and output you receive through those features are handled as described in Section 2.4: not used for model training, not retained long-term in identifiable form, and not unlawfully provided to others.

The Platform may label generated content where applicable law requires; the related rules are set out in Terms of Service §5.5.

13.8 Complaints

If you believe the Platform's processing of personal information infringes your rights, you may first complain to the Platform using the details in Section 12. You also have the right to complain to or report the matter to the authorities responsible for personal information protection, or to bring proceedings before a People's Court in accordance with law.