--- source: https://asaptic.com/legal/privacy title: Legal Notice & Platform Data Protection Architecture | Asaptic description: Detailed legal data protection documentation for Asaptic platform users, covering processor obligations, retention schedules, and cross-border transfer safeguards. --- # Legal Notice & Platform Data Protection Architecture | Asaptic [← Asaptic](/) # Privacy Policy LAST UPDATED · 2026-07-20 Looking for the general site notice? See [/privacy](/privacy). This page is the full policy for the Asaptic account, supplier portal, and mobile app — also linked from Terms of Service ([/legal/terms](/legal/terms)). ## 1. Scope This policy covers asaptic.com, portal.asaptic.com, and the Asaptic mobile app (iOS and Android), published by Asaptic, a company incorporated in Hong Kong (“Asaptic”, “we”, “us”). It explains what personal data we collect, why, where it is stored, and the choices and rights you have — including the in-app account-deletion path. ## 2. What we collect ### 2.1 Visiting the website Nothing beyond standard Cloudflare edge logs — IP address, user agent, and country — retained briefly for security and abuse prevention. No analytics. No cookies, except a single `localStorage` entry named `asaptic-lang` that remembers your language preference. ### 2.2 Creating an Asaptic account To use the tender portal or mobile app beyond public browsing, you create an account with your email address and a password, or sign in via a one-time link sent to your email, plus a display name. If you register as a supplier, we also collect your company name, product/service categories, and region. ### 2.3 Supplier verification If you request supplier verification — required to unlock certain tender information and to submit a Spec Request — we additionally collect: your company’s legal name (and local-language legal name if applicable), business registration number and registration region (Hong Kong, mainland China, or other), a contact name and phone number, an optional WeChat ID, and a photo or scanned copy of your business registration certificate or licence. Before submitting, you confirm this information is accurate and consent to Asaptic verifying it, as required under Hong Kong’s Personal Data (Privacy) Ordinance. ### 2.4 Tender specification requests (“Spec Requests”) If you request a sanitized specification document for a specific tender, we record the tender you requested, any note you add, and the date and time you accepted these Terms for that request. ### 2.5 Using the mobile app specifically - **Sign-in token:** a JWT stored only in your device’s secure keychain (iOS Keychain / Android Keystore, via Expo SecureStore), locked to your device and never included in cloud device backups. It never leaves your device except to authenticate your own requests to our servers. - **Saved tenders:** bookmarking a tender in the app stores only the tender’s ID and the time you saved it, on your device only (labeled “Saved on this device” in the app). This list is never uploaded to our servers and we cannot see it. - **Camera and photo library:** the app requests camera and photo-library access solely so you can photograph or select the business registration document described in 2.3 during supplier verification. We do not access your photo library for any other purpose, and this permission is not requested unless you start the verification flow. - **Session metadata:** when you sign in (web or app), we record your IP address, device/browser user agent, and sign-in timestamps, to secure your account and detect abuse. ## 3. Why we collect it To create and secure your account; to verify supplier eligibility for gated tender information; to prepare and deliver the specification documents you request; to protect the service against abuse and unauthorized access; to respond to support requests you send us; and, only if you separately opt in, to send a weekly tender digest email. ## 4. Where it’s stored Account, verification, and tender-request records are stored in Cloudflare D1 (database) and Cloudflare R2 (object storage, for certificate and document files), operated on Asaptic’s own Cloudflare account. Cloudflare provides global edge infrastructure, so data may be processed in Cloudflare data centres outside Hong Kong. We do not operate our own physical servers. ## 5. Third parties Cloudflare hosts our website, mobile-app backend, database, and file storage, and provides security/abuse-prevention infrastructure. Resend delivers our transactional emails (account confirmation, verification status, spec-request notifications) on our behalf. Apple and Google independently process data needed to distribute the app and to handle device-level permissions (camera, photo library) under their own privacy policies — Asaptic does not control that processing. Google Fonts serves our website’s typefaces. We do not use advertising networks, analytics trackers, or any service that profiles you for marketing. We do not sell personal data. ## 6. Retention & account deletion We retain your account and verification data for as long as your account remains open. You can delete it at any time — from Account ’ Delete account in the app, or by emailing us — and we act on that immediately (see below). We may retain limited records for longer where the law requires it. You can also request deletion at any time: in the app, go to *Account -> Delete Account*; on the web portal, use the equivalent option; or write to [privacy@asaptic.com](mailto:privacy@asaptic.com). Deletion is immediate and irreversible — we erase your login credentials, display name, and email address, and, if you had submitted supplier verification, your company contact details, business registration number, and business registration certificate/licence file are permanently deleted, including from file storage. Some records are kept after deletion for legal, audit, and business-recordkeeping purposes: delivered specification documents, the tender requests you made, and our compliance audit trail are retained — but any personal-identifier fields inside the audit trail are removed at the same time your account is deleted. ## 7. Your rights Under Hong Kong’s Personal Data (Privacy) Ordinance (Cap. 486), you have the right to ask whether we hold personal data about you, to access it, and to request correction of inaccurate data, by writing to [privacy@asaptic.com](mailto:privacy@asaptic.com). If you are located in the European Economic Area or the United Kingdom, we also honor requests to access, correct, delete, or object to the processing of your personal data, applying GDPR-equivalent standards on a best-efforts basis. If you opted in to the weekly tender digest, you can withdraw consent at any time via the unsubscribe link in any digest email. ## 8. Cookies and local storage The website sets no cookies except the single `localStorage` entry described in 2.1. The mobile app sets no cookies; it uses your device’s operating-system-level secure storage for your sign-in token and ordinary local app storage for your saved-tenders list, both described in 2.5. ## 9. Children Asaptic is a business-to-business service. It is not directed at, and we do not knowingly collect personal data from, anyone under 18. ## 10. Changes to this policy We will update the “last updated” date above when we make material changes to this policy, and will notify active account holders by email of any change that materially affects how their data is used. ## Contact Questions or requests: [privacy@asaptic.com](mailto:privacy@asaptic.com).