Privacy Policy

1. Applicable law

This Policy is designed to meet our obligations under the laws of the Hong Kong Special Administrative Region, including the Personal Data (Privacy) Ordinance (Cap. 486) (“PDPO”) and related guidance issued by the Office of the Privacy Commissioner for Personal Data (“PCPD”).

Where a merchant’s end customers are located outside Hong Kong, additional local laws may apply to that merchant as controller. Those laws do not change the controller / processor split described in Section 2 unless a written agreement says otherwise.

2. Who is the controller (and who is the processor)

2.1 Danko AI as controller

Danko AI is the data controller (data user under the PDPO) for:

• personal data collected through the danko.ai website (including enquiry forms);
• company account, billing, partner, reseller, and service-administration data relating to merchants, partners, and authorised users of our control plane; and
• technical, security, and analytics data we generate or collect to operate and secure our websites and platform (except where that data is processed solely on a merchant’s documented instructions as chat content).

2.2 Merchants as controllers; Danko AI as processor / service provider

When a merchant connects its WhatsApp Business Account (“WABA”) and uses DankoChat to handle customer conversations:

• the merchant is typically the controller of end-customer message content, contact identifiers, and related chat data; and
• Danko AI, through DankoChat, processes that data as a processor / service provider on the merchant’s instructions, except where we must process it independently to operate, secure, or improve the service, meet legal duties, prevent abuse or fraud, or establish, exercise, or defend legal claims.

End-customer rights relating to WhatsApp chat content are often most appropriately exercised via the merchant. We will redirect or assist where appropriate (see Section 9).

2.3 Data Processing Addendum (optional)

Merchants who require a written Data Processing Addendum (DPA) for DankoChat may request one through the contact channels above. A signed DPA or customer agreement prevails over this Policy to the extent of any conflict on processing instructions.

3. Scope and WhatsApp Business Platform

This Policy applies to danko.ai and danko.chat (marketing pages, control plane, and the managed service).

We do not sell end-customer personal data. We use WhatsApp-related data to provide the contracted AI and human-handoff support service, verify webhook authenticity, prevent abuse, measure delivery, and meet compliance and contractual requirements. We use information submitted through the danko.ai enquiry form to respond to and manage enquiries.

4. Personal data we collect

4.1 Website enquiry data

Name, email address, company, area of interest, and message content when you submit a contact or enquiry form on danko.ai.

4.2 Account and business data

Merchant or partner names; contact persons; phone numbers; email addresses; company details; reseller or referral relationships; orders, invoices, and fees; DankoChat tenant configuration; and authorised administrator identities.

4.3 WhatsApp / messaging data

WABA and phone-number identifiers; webhook payloads (including message content, media metadata, and delivery or read status where provided by Meta); conversation transcripts needed for AI replies and human follow-up; and knowledge-base materials the merchant supplies or confirms.

4.4 Technical and security data

IP addresses, user-agent strings, authentication tokens or session cookies, request logs, error logs, and similar diagnostics required to operate and secure danko.ai, danko.chat, and related services.

4.5 Cookies, preferences, and analytics

We use functional cookies and similar technologies as needed for language preference, session continuity, authentication, and security.

DankoChat uses Google Analytics on its marketing and control-plane site for aggregated traffic and usage statistics (for example, page views and referral sources). Analytics settings configured for that product site apply there. Detailed cookie controls, if offered on danko.chat, will appear on that site; this Policy does not invent a separate cookie-banner product.

You may also use browser settings to block or delete cookies; some features may not work correctly if essential cookies are blocked.

5. How we use personal data

We use personal data to:

1. Operate and maintain the Danko AI website and respond to enquiries.
2. Provide, configure, support, and improve DankoChat (AI replies, knowledge base, human takeover, notifications, and related tooling).
3. Authenticate administrators, resellers, and tenant users; process orders and service periods; detect fraud, spam, and security incidents.
4. Generate AI draft replies from confirmed merchant knowledge and conversation context; merchants confirm material knowledge or policy changes before they take effect where the product requires confirmation.
5. Comply with applicable law, Meta platform policies, and lawful requests; improve reliability; and document service quality for contracted reporting where applicable.
6. Establish, exercise, or defend legal claims.

We do not use end-customer chat content to train publicly available foundation models for unrelated third parties, and we do not sell personal information.

6. Sharing and subprocessors

We share personal data only as described below and as needed to operate the service.

6.1 Categories of subprocessors / recipients

Meta processes messaging data under its own terms and privacy policy as a platform provider. AI providers receive conversation and knowledge excerpts solely for service delivery features the merchant has enabled—not for DankoChat to sell personal data.

6.2 Subprocessor list

We maintain an updatable list of material subprocessors (or will publish one) at https://danko.ai/subprocessors, or the list is available on request via the contact channels above until that page is published. We will update the list when material subprocessors change.

6.3 Other disclosures

We disclose data when required by law, to protect rights, safety, or security, in connection with a corporate transaction (subject to appropriate safeguards), or with the relevant controller’s direction.

7. International transfers

Infrastructure, edge, and AI providers may process personal data in regions outside Hong Kong. Where we transfer personal data internationally, we do so as needed to operate the website and DankoChat, and we implement contractual and technical safeguards available from or agreed with our providers (for example, contractual confidentiality and security obligations, access controls, and encrypted transport).

Merchants who require specific transfer terms may address them in a DPA or signed customer agreement.

8. Retention

We apply the following retention bands, unless a longer or shorter period is required by law, a written agreement, or an ongoing dispute, security investigation, or enforcement matter:

Merchants may request export of knowledge-base and conversation records through support channels where the product supports export. Phone numbers and Meta business portfolios remain under the merchant’s Meta relationship; DankoChat does not claim ownership of the merchant’s WhatsApp number.

9. Data subject rights (PDPO)

Subject to the PDPO and applicable exemptions, individuals may request:

• access to personal data we hold about them;
• correction of inaccurate personal data; and
• erasure or cessation of use where applicable (for example, where retention is no longer necessary and no legal exception applies).

How to submit a request. Contact us using the details at the top of this Policy. We will:

1. take reasonable steps to verify identity;
2. respond within the timeframe required by the PDPO—targeting within 40 days of receiving a valid, verified request (or such other period as the PDPO then requires); and
3. explain if a request must be directed to the merchant (for end-customer chat content where the merchant is controller) or to Meta.

Merchants who are controllers remain responsible for responding to their end customers’ requests relating to WhatsApp conversations handled through DankoChat. We will provide reasonable assistance consistent with our processor role and product capabilities.

10. Personal data breach notification

If we become aware of a personal data breach affecting personal data we process, we will:

• investigate and take steps to contain and remediate the incident;
• notify affected individuals and/or the PCPD where legally required under Hong Kong law; and
• where the breach affects data for which a merchant is controller, notify that merchant without undue delay, and where feasible within 72 hours of confirming a notifiable breach affecting merchant-controlled data, so the merchant can meet its own obligations.

Notifications will include information reasonably available to us about the nature of the breach and recommended mitigation steps, without disclosing security details that would increase risk.

11. Security

We apply access controls, encrypted transport (HTTPS), secret management for API credentials, and least-privilege service bindings between control-plane and data-plane components. No method of transmission or storage is perfectly secure. Merchants should protect admin WhatsApp access, Meta Business Manager permissions, and credentials.

12. Children

Our websites and DankoChat are business-focused. They are not directed at children, and we do not knowingly collect children’s personal data for marketing purposes. If you believe we have collected a child’s personal data in error, contact us and we will take appropriate steps.

13. Changes to this Policy

We may update this Privacy Policy to reflect changes to our websites, products, law, or Meta platform requirements. The “Last updated” date will change when we publish a revision. Material changes may also be communicated through the service or contact channels. The published version at https://danko.ai/privacy is the current Policy once Danko authorises publication of that revision.

14. Contact

Danko AI Limited (Hong Kong) Website: https://danko.ai DankoChat: https://danko.chat WhatsApp: +852 6144 0647