私隱政策

This policy is issued by Play Lazy Limited ("we", "us") and covers www.contentmama.ai and app.contentmama.ai. For the purposes of the Hong Kong Personal Data (Privacy) Ordinance (Cap. 486) we are the data user in respect of your personal data.

We collect: your email address (required at sign-up, not changeable afterwards — passwords are managed by Amazon Cognito and are never visible to or stored by us); what you type (topic, audience, tone, slide count, post type, chat messages, your edits to the copy); files you upload (reference images); generated output (copy, captions, images); usage records (time, action type, Tokens consumed, success or failure); billing data (Stripe customer id, plan, subscription status, invoices — we never receive or store your card number, which Stripe handles directly); and technical logs (IP address, timestamps, error messages) for security and debugging.

We do not ask for identity card numbers, home addresses, phone numbers or any sensitive personal data.

To provide the Service; to run your account and bill you; to answer support requests; for security and abuse prevention; to improve the Service on an aggregate basis; and to meet legal and accounting obligations.

We do not use your personal data for direct marketing without your separate consent, and we do not sell your personal data.

Your data is shared with service providers strictly to run the Service: AWS (hosting — Cognito, DynamoDB, S3, CloudFront), OpenAI (image generation — receives your topic, copy and uploaded reference images), OpenRouter and the model providers it routes to (text generation — receives your topic, audience, tone and related text), Stripe (payments — receives your email and payment details), and Google Fonts (web fonts — your browser requests font files from Google, which may log your IP).

Otherwise we disclose data only with your consent, where required by law or court order, or to protect the legitimate interests of us, our users or the public.

Our primary systems are in AWS Asia Pacific (Singapore), ap-southeast-1. The site is delivered through CloudFront's global edge network. Generation requests are sent to OpenAI and OpenRouter servers, which may be located in the United States or elsewhere; payment data goes to Stripe.

In other words, your data leaves Hong Kong. We select providers with appropriate security and confidentiality commitments, but legal protections in other jurisdictions may differ from Hong Kong's. By using the Service you understand and agree to these transfers.

Images (uploads and generated output): automatically deleted about 30 days after creation. Download what you need promptly — deleted files cannot be recovered. Copy, chat and run records, and account and usage records, are kept until you delete your account. Transaction and invoice records are retained after account deletion as required by Hong Kong tax and accounting law (generally 7 years). Technical logs are kept for a short period for security and debugging.

www.contentmama.ai uses no cookies, no analytics and no advertising trackers. The only outbound request is to Google Fonts.

app.contentmama.ai stores sign-in credentials in your browser (a refresh token in localStorage; the id token is held in memory only). These exist solely to keep you signed in and are not used for tracking or advertising. They are removed when you log out or clear your browser data.

We do not use your content to train our own models.

We access third-party models through APIs (OpenAI, OpenRouter and the providers it routes to). Those providers have their own data-handling policies; API data is generally not used to train their models, but the actual position is governed by their policies at the time and is outside our control. If your content is highly confidential, please assess this risk yourself.

All connections use HTTPS. Data in S3 and DynamoDB is encrypted at rest. File storage blocks public access and images are served only through time-limited signed URLs. Authentication is handled by Amazon Cognito; passwords are hashed and inaccessible to us. Provider API keys are held in an encrypted parameter store readable only by the service.

No system is perfectly secure. If a security incident affects your personal data we will notify you as soon as reasonably practicable.

Under the Hong Kong Personal Data (Privacy) Ordinance you have the right to access the personal data we hold about you, to request correction of inaccurate data, to request deletion of your account and associated data (except transaction records we must retain by law), and to opt out of direct marketing.

To exercise any of these, email info@contentmama.ai. We will respond within 40 days, the period set by the Ordinance. A reasonable fee may be charged for a data access request.

The Service is not offered to anyone under 18. If we learn that an account belongs to someone under 18 we will delete it and the associated data.

We will notify you by email before any material change takes effect and will update the date at the top of this page.