Privacy Policy

This Privacy Policy explains how HK Study Hub (“we”, “us” or “our”) collects, uses, discloses and protects personal data in connection with Copilot by HK Study Hub, the online study platform available at www.trycopilot.study, including the Compass AI tutor (together, the “Service”).

In this Privacy Policy, “you” and “your” refer to the person using the Service. Where that person is under 18 years of age, references to “you” also include their parent or guardian.

HK Study Hub is a tutoring centre in Hong Kong and is the data user responsible for personal data processed in the Service. We handle personal data in accordance with the Personal Data (Privacy) Ordinance (Cap. 486) of Hong Kong (the “PDPO”) and its Data Protection Principles.

This Privacy Policy should be read together with our Terms of Use. As most students who use the Service are under 18, we encourage students and their parents or guardians to read it together.

Account information. Your email address, your display name and your role in the Service (student, tutor or administrator). Your password is processed by our authentication provider, Supabase, and is stored only in hashed form. Our staff cannot read it.

Enrolment information. The subjects and levels (for example, SL or HL) in which HK Study Hub has enrolled you.

Practice records. The practice sessions you start, the answers you type, whether those answers were correct, marks and self-marking, the number of attempts, whether you revealed a worked solution, questions you flagged and the time spent.

Progress information. Your experience points (XP), your study streak and the last day on which you were active.

Compass AI usage information. The number of messages you send to Compass AI each day and the number of tokens (units of text) processed by the AI model. We do not store the content of your messages or of Compass AI's replies (see section 5).

Technical information. Our hosting providers keep short-lived technical logs, such as IP address, browser type and the time of a request, to keep the Service secure and operational.

The account and enrolment information described in clauses 2.1 and 2.2 is necessary for us to provide the Service. If it is not provided, we are unable to create an account for you.

We use personal data for the following purposes:

1. to authenticate you and to display the subjects in which you are enrolled;
2. to mark your practice, record your progress and display it on your dashboard;
3. to enable your HK Study Hub tutors to review your progress so that they can support you in lessons;
4. to provide Compass AI, including tailoring its help to your practice results, apply its daily usage limits and manage the cost of the Service;
5. to maintain the security of the Service, diagnose and resolve problems, and improve our questions and study guides.

We do not use personal data for any purpose other than those set out in clause 3.1, or a directly related purpose, without your consent.

We do not use personal data for direct marketing, and the Service does not display advertising.

We collect personal data only for lawful purposes directly related to the tutoring services provided by HK Study Hub, and only to the extent necessary for those purposes.

Accounts for the Service are created by HK Study Hub for its enrolled students and staff. There is no public registration.

Where a student is under 18 years of age, we rely on the consent of the student's parent or guardian, given when the student is enrolled with HK Study Hub. A parent or guardian may withdraw that consent at any time by contacting us, in which case we will close the student's account and delete their data in accordance with section 8.

Compass AI is an AI tutor. To generate a reply, the following information is sent through the Vercel AI Gateway to a third-party AI model provider:

1. your message;
2. the recent messages in the same conversation;
3. the names and levels of your subjects;
4. a summary of your practice performance, sent with each message, consisting of your scores by topic and subtopic, the topics you have not yet attempted and, for your most recent incorrect or partly correct answers, the syllabus subtopic, the text of the question and whether you revealed the worked solution; and
5. where your message concerns a practice question or study guide, the text of that question or guide and the answer you typed for that question.

The practice summary described in clause 5.1 is prepared from your practice records each time you send a message, so that Compass AI can suggest what to work on next and relate its help to mistakes you have made before. It does not include your name, email address, account identifiers or the answers you typed for earlier questions. Compass AI does not remember previous conversations.

Your name and email address are not sent to the AI model provider.

Compass AI conversations are not stored in our database. A conversation is held only in your open browser tab and is lost when the tab is closed or refreshed.

We use only AI model providers that have committed to zero data retention and not to use the data they receive to train AI models. At present, Compass AI uses the open DeepSeek model, run by providers such as Alibaba Cloud, Microsoft Azure, Baseten, DigitalOcean or Wafer. These providers' servers may be located outside Hong Kong.

HK Study Hub staff also use the same AI service to help prepare study guides. This involves syllabus content only and never involves student information.

We engage the following service providers, which process personal data on our behalf as data processors:

1. Supabase, which provides our database and authentication services. Account information and practice records are stored on its servers in the United States (US East).
2. Vercel, which hosts the website and runs the Service's application code in the United States (Washington, D.C. area).
3. Vercel AI Gateway and the AI model providers to which it routes requests, which process Compass AI messages as described in section 5.

We select providers that protect the data they hold, and we share with them only the data necessary for them to provide their services.

Within HK Study Hub, student progress is available only to staff who need it in order to support students.

Other than as described in this section, we disclose personal data to third parties only where required to do so by law.

We do not sell, rent or trade personal data.

Personal data in the Service is stored and processed outside Hong Kong, including in the United States by Supabase and Vercel, and in the locations of the AI model providers described in section 5.

The data protection laws of those places may differ from those of Hong Kong. We transfer personal data only to the providers described in section 6, and only for the purposes set out in this Privacy Policy.

We retain account information and practice records for as long as the student is enrolled with HK Study Hub.

When a student leaves HK Study Hub, or on request by the student or their parent or guardian, we delete the student's account.

Deleting an account also deletes the associated practice records, progress information and Compass AI usage information.

Copies held in our service providers' routine backups may take a short time longer to be overwritten.

The Service is available only over encrypted (HTTPS) connections.

Database access rules ensure that students can view only their own records, and that student progress is available only to HK Study Hub staff who need it.

Passwords are stored only in hashed form by our authentication provider.

No system is completely secure. You should keep your password confidential and inform us immediately if you believe that another person has used your account.

Under the PDPO, you have the right to:

1. request access to, and a copy of, the personal data we hold about you (a data access request); and
2. request the correction of any personal data that is inaccurate.

In addition, you may ask us to delete your account and personal data. You may also change your display name on your Account page.

Where a student is under 18 years of age, their parent or guardian may make these requests on their behalf.

To make a data access or correction request, email contact@hkstudyhub.com, stating the student's name and the email address used to sign in to the Service. You may also use the Data Access Request Form published by the Office of the Privacy Commissioner for Personal Data, Hong Kong. We may need to verify your identity before acting on a request.

We will respond to data access and correction requests within 40 days of receiving them.

If you are dissatisfied with how we have handled your personal data, please contact us first. You may also lodge a complaint with the Office of the Privacy Commissioner for Personal Data, Hong Kong (PCPD).

Most students who use the Service are under 18 years of age. Accounts are created only for students enrolled with HK Study Hub, with the consent of a parent or guardian given at enrolment (see section 4).

Compass AI is instructed not to ask students for personal details and not to repeat any personal details a student shares. Students must nevertheless follow the notice in clause 5.6.

A parent or guardian may exercise the rights described in section 10 on behalf of a student under 18 years of age.

The Service uses only essential cookies. These are authentication cookies set by our authentication provider, Supabase, which keep you signed in and allow us to restrict the student and staff areas of the Service to signed-in users. The Service cannot function without them.

The Service also uses your browser's local storage to remember the subject you last selected.

We do not use analytics, advertising or tracking cookies, and we do not use third-party analytics services.

You may block cookies through your browser settings. If you do so, you will not be able to sign in to the Service.

We may update this Privacy Policy from time to time. When we do, we will publish the revised version on this page and update the “Last updated” date above.

Where we make a material change to how we use personal data, we will also notify students and their parents or guardians through HK Study Hub.

Questions about this Privacy Policy, and data access or correction requests, should be addressed to: