HomeDash Limited

Privacy Policy

Last Updated: 2026-11-05

1. About Us and This Policy

1.1 This Policy is issued by HomeDash Limited (家速有限公司) ("we", "us" or "our"), a company incorporated in Hong Kong with its registered office at Unit 2556, 25/F, Two Harbour Square, 180 Wai Yip Street, Kwun Tong, Kowloon, Hong Kong and Business Registration No. 78480569.

1.2 This Policy explains how we collect, use, retain, transfer and protect personal data in accordance with the Personal Data (Privacy) Ordinance (Cap. 486) (the "PDPO") when you use the HomeDash AI app, website and related services (together, the "Service"). This Policy also serves as our Personal Information Collection Statement.

1.3 This Policy should be read together with our Terms and Conditions.

2. Our Role

2.1 Your account data: For your own account, personal and brand information, digital human data, payment and usage records, we are the data user under the PDPO.

2.2 Other people's data you submit: When using the Service you may submit personal data of other people, such as the names, phone numbers, addresses and home interior images of owners or clients, or people who appear in your videos (see section 7). You are a data user of that data to the extent that you control its collection, holding, processing or use. We act as your data processor when we process it solely on your behalf. Where we determine our own purposes, including Service security and misuse investigations, we act as a data user and remain responsible for that processing.

3. Data We Collect

We do not collect advertising identifiers (IDFA or Android Advertising ID). Please do not upload identity documents, client financial information or other sensitive documents unrelated to your content.

4. Digital Human and Biometric Data

4.1 Facial images and voice are highly sensitive data. We collect and process them only after you give separate, express consent. This consent is obtained separately from your acceptance of this Policy or the Terms and Conditions, and you may withdraw it at any time.

4.2 Self only: A digital human may be created only from the verified account holder themselves. When you create one, we will ask you to:

• (a) record a live liveness selfie video; and
• (b) read aloud a prescribed consent statement.

Verification includes checking that the submitted likeness and voice correspond to the person completing verification. It does not certify professional qualifications or guarantee that fraud cannot occur. We keep the verification video and consent statement as a consent record to show that the digital human was created with the person's own consent.

4.3 Purpose limitation: Digital human and biometric data are used only to: (a) generate the digital human content you request; (b) verify identity and prevent impersonation; and (c) investigate misuse reports and assist law enforcement as permitted by law (see section 9.3). We will not use this data for marketing, sell it, or use it to train our own artificial intelligence models, and this prohibition is not subject to any other consent you give under this Policy.

4.4 Processors: To generate digital human content, facial images and voice samples are sent to the service providers listed in the Appendix (currently MiniMax and OpenAI). Their processing locations are set out in the Appendix. We do not send facial or voice data to GPU capacity rented from marketplaces where machines are hosted by unidentified individuals.

4.5 Deletion: You may withdraw consent and delete your digital human via "⋯ → Delete" on the digital human page in the app, or by emailing info@homedash.hk. Upon an authenticated request, we will:

• (a) disable further generation and cancel queued tasks where technically possible;
• (b) within 30 days, delete the operational facial images, voice samples and digital human and voice models we hold, and require our processors (including for the cloned voice) to do the same; and
• (c) remove backup copies within 35 days of the request and not restore them to operational use.

The verification video and recorded consent statement are an exception: we retain them, with restricted access, for up to 12 months after deletion, solely where necessary to establish consent or investigate impersonation or fraud. They are never used for generation. Any legal hold applies only to the relevant records and is reviewed periodically.

4.6 We cannot recall digital human content that you or others have already downloaded, published or forwarded.

5. Purposes of Use

We use personal data only for the following purposes or directly related purposes:

• (a) providing sign-in, project management, material storage, content generation and download;
• (b) performing video generation, image processing, digital human, captioning, editing and publishing functions;
• (c) handling orders, credits, refunds and customer support;
• (d) sending service notices relating to your account, security and generation tasks;
• (e) detecting and preventing fraud, impersonation, infringement and other misuse, and handling reports;
• (f) maintaining the security and stability of the Service and improving the product;
• (g) complying with laws, regulations, court orders and lawful requests from law enforcement agencies, and handling disputes.

If we intend to use personal data for a new purpose, we will obtain your prescribed consent beforehand.

6. Direct Marketing

6.1 With your optional consent, HomeDash Limited may use your name, phone number and email to send direct marketing about HomeDash AI content-generation subscriptions, credits, related features and user-training events. Before requesting consent, we explain these data and marketing categories, that we cannot use the data for this purpose without consent, and how to communicate your choice. The consent option is not pre-ticked, and refusal does not affect your access to the Service.

6.2 We will not provide your personal data to any third party for direct marketing without your separate written consent, and we do not sell or rent your personal data.

6.3 You may withdraw consent at any time, free of charge, via the unsubscribe link in any marketing message, in Settings, or by emailing info@homedash.hk. We notify you of your free opt-out right when first using your data for direct marketing. Purely operational or security notices may continue; promotional content in any message remains subject to your marketing choice.

7. Other People's Personal Data You Submit

7.1 If you submit personal data of owners, tenants, buyers, colleagues or other people (including names, phone numbers, addresses, home interior images, likenesses and voices appearing in videos, and comments and messages received through the linked inbox), you must ensure that:

• (a) you have a lawful basis to collect that data and have informed the individuals, as required by the PDPO, that it will be used to produce property marketing content;
• (b) where the data includes a likeness or voice, you have obtained the individual's consent to artificial intelligence processing and public publication. Such consent does not permit creating or imitating another person's digital human, face or cloned voice contrary to section 7 of the Terms and Conditions; and
• (c) you do not disclose personal data without the relevant consent with intent to cause specified harm to the individual or a family member, or being reckless as to whether such harm would or would likely be caused. Such conduct may constitute an offence under section 64 of the PDPO.

7.2 When processing such data on your behalf, we do so only for the purpose of providing the Service and apply the same security measures as to our own data. We assess any access or correction request about such data according to our actual role, and assist or refer it to you where appropriate.

8. Artificial Intelligence Processing and Model Training

8.1 To complete the creative tasks you submit, some data must be sent to the artificial intelligence, media processing and cloud service providers listed in the Appendix.

8.2 We will not use your original materials or generated content for our marketing, or to train our own artificial intelligence models, without separate, express consent. Section 4.3 governs digital human and biometric data and cannot be overridden by such consent. Any permission for other people's materials must come from the relevant rights holders and data subjects; your permission alone does not authorise use of another person's rights or personal data.

8.3 Before sending personal data to a processor, we establish contractual or other effective controls over permitted purposes, model training, security, sub-processors and retention. We do not permit processors to train models using personal data submitted through the Service. The Appendix identifies the applicable downstream AI providers, processing locations and retention periods. We do not enable a processing route until these arrangements have been verified.

8.4 Before a feature first shares your personal data with a third-party AI provider, we identify the relevant recipients, data and purposes in that feature's consent notice, or in the appendix to this Policy identified by that notice, and obtain your explicit permission. Accepting the Terms and Conditions or this Policy does not by itself give that permission. If you decline, your account and other features are not affected.

9. Transfer and Disclosure

9.1 We may transfer personal data to the following classes of persons, only as needed for the purposes in section 5:

• (a) the cloud, artificial intelligence, payment, communications and social platform service providers listed in the Appendix;
• (b) our professional advisers (such as lawyers and auditors), who are bound by confidentiality duties;
• (c) when you choose to publish content, the social platforms you select and their audiences;
• (d) in a merger, acquisition or business transfer, the relevant transferee, which must continue to comply with this Policy.

9.2 Our controls over service providers are described in section 8.3.

9.3 Law enforcement and fraud prevention: We may preserve and disclose relevant information, including to the Hong Kong Police Force, other law enforcement agencies, courts or the Privacy Commissioner for Personal Data, only where permitted or required by applicable law. We assess the recipient's identity, authority and purpose, and the necessity and scope of each disclosure. Where we rely on a PDPO exemption, its statutory conditions must be satisfied. An allegation alone does not entitle a complainant to another person's account details, biometric data or verification recordings.

10. Cross-border Processing

10.1 We and our service providers may process or store data outside Hong Kong, including in Mainland China, the United States, Singapore and South Korea (see the "Processing location" column of the Appendix). Personal data protection laws in these places may differ from those in Hong Kong.

10.2 We protect data transferred across borders with measures proportionate to its sensitivity, such as contractual terms, service provider security certifications and encryption. Digital human and biometric data are transferred across borders only after you have consented under section 4.1.

11. Retention

Where data relates to a pending report, dispute or legal proceeding, we keep only the relevant records until the matter is concluded, and review that hold periodically.

12. Your Rights

12.1 Under the PDPO, you may request access to your personal data and correction of inaccurate personal data. You may also require us to cease using your data for direct marketing. In addition, we provide account deletion and withdrawal of digital human consent as described in this Policy, subject to the limited retention exceptions in sections 4.5 and 11.

12.2 You may request deletion of your HomeDash AI account and associated data in "Settings → Delete account", or, without reinstalling the app, through our public Contact Us page at https://www.homedash.hk/en/contact-us, which provides account-deletion instructions and the option to email info@homedash.hk. Other requests may be made in writing by email or by post to the address in section 16. We may need to verify your identity.

12.3 We comply with data access requests within 40 days under section 19 of the PDPO and handle correction requests under section 23. We may charge a fee that is not excessive for complying with a data access request and will tell you in advance. If we refuse a request or cannot comply within the statutory period, we will notify you in writing with reasons as required by the PDPO.

13. Data Security

13.1 We adopt security measures proportionate to the nature of the data and the risks, including encryption in transit, access controls, staff confidentiality obligations and security requirements for service providers.

13.2 No internet transmission or storage is free of risk. If a data breach occurs that may cause real harm to you, we will notify affected individuals as soon as reasonably practicable and notify the Office of the Privacy Commissioner for Personal Data where appropriate.

14. Minors

Accounts and digital human creation are restricted to adults aged 18 or over. We do not knowingly collect account data from people under 18. User Content may include a minor's image or voice only where the submitting user has obtained appropriate parent or guardian permission and complies with applicable privacy requirements. This does not permit cloning a minor or creating a minor's digital human.

15. Changes to This Policy

We may update this Policy as the Service or the law changes, and will update the date at the top. For material changes, especially new purposes of use or new classes of transferees, we will notify you through the app or by email before they take effect. Where fresh consent is needed, we will obtain it separately.

16. Contact Us

For enquiries about this Policy, or data access or correction requests, please contact:

Data Protection Officer

HomeDash Limited

Address: Unit 2556, 25/F, Two Harbour Square, 180 Wai Yip Street, Kwun Tong, Kowloon, Hong Kong

Email: info@homedash.hk

Phone: (852) 5785 2282

If you are not satisfied with how we handle your request, you may complain to the Office of the Privacy Commissioner for Personal Data, Hong Kong (www.pcpd.org.hk).

This Policy is available in Chinese and English. If there is any inconsistency, the English version prevails.

Appendix: Third-party Service Providers