Privacy policy

1. Who we are

This privacy policy explains how First Principles Professional Services Limited, a company incorporated in Hong Kong ("FPPS", "we", "us"), handles personal data collected through the fpps.ai website. FPPS is the data user for the purposes of the Hong Kong Personal Data (Privacy) Ordinance (Cap. 486) (the "PDPO"). You can reach us about anything in this policy at hello@fpps.ai.

This policy covers the fpps.ai website only. Data we handle in the course of a professional engagement is governed by the relevant engagement letter.

2. What we collect

You can browse the whole site without providing any personal data. We collect personal data only when you submit the contact form:

• Information you provide — your name, organisation (optional), email address, the type of enquiry you select, and your message.
• Information collected automatically with a submission — your IP address, the country it resolves to, your browser's user-agent string, a reference code we generate for the enquiry, and a timestamp.
• Server logs — like most websites, ordinary technical logs (such as IP addresses and requested pages) are processed by our hosting provider, Cloudflare, to serve and protect the site.

The site uses no advertising trackers and no analytics scripts, and sets no cookies of its own. The Cloudflare Turnstile widget on the contact form may set operational cookies solely to distinguish people from bots.

3. Why we collect it

We use the data above to:

• respond to your enquiry and arrange meetings you request;
• evaluate partnership or engagement requests;
• protect the site against spam and abuse (this is why the IP address, country, and user-agent are recorded); and
• keep reasonable business records of enquiries.

We do not sell personal data, and we will not send you marketing without your consent.

4. How it is stored and who sees it

Contact-form submissions are stored in a database on Cloudflare's infrastructure. When a submission arrives, a notification containing its details (including the IP address and country) is delivered to our team through a private internal messaging channel. Access is limited to FPPS personnel who handle enquiries.

5. Service providers

We rely on a small number of service providers to run the site, each of which may process some of your data on our behalf:

• Cloudflare — hosts the site, stores contact submissions, and provides the Turnstile bot check. Verifying a Turnstile response involves sending your IP address to Cloudflare.
• Google — the site's fonts are served from Google's servers, which receive your IP address when pages load. If you book a meeting through our "Talk to us" link, the booking happens on Google's appointment page under Google's own privacy policy.
• Discord — delivers the internal notification of new enquiries to our team.

These providers operate global infrastructure, so your data may be processed outside Hong Kong. We choose providers with appropriate security practices and share only what each one needs.

6. How long we keep it

We keep contact-form submissions for as long as needed to handle the enquiry and to maintain reasonable business records, and we review stored submissions periodically. We will delete your submission earlier if you ask us to (see the next section).

7. Your rights

Under the PDPO you have the right to request access to the personal data we hold about you and to request correction of anything inaccurate. Beyond that, wherever you are located, you can ask us to access, correct, or delete your data by emailing hello@fpps.ai. We will respond within a reasonable time, and in any case within the timeframes the PDPO requires.

8. Security

We take reasonable technical and organisational measures to protect personal data, including encryption in transit (TLS) and restricting access to those who need it. No method of transmission or storage is completely secure, but we work to protect your data in line with the PDPO's data-security requirements.

9. Children

The site is intended for businesses and professionals and is not directed at children. We do not knowingly collect personal data from children; if you believe a child has submitted data to us, contact us and we will delete it.

10. Changes to this policy

We may update this policy from time to time. Changes will be posted on this page with a revised "Last updated" date.

11. Contact and complaints

Questions, requests, or complaints about how we handle personal data can be sent to hello@fpps.ai. If you are not satisfied with our response, you may complain to the Office of the Privacy Commissioner for Personal Data, Hong Kong (pcpd.org.hk).