私隱政策聲明
破曉有限公司 Dawnbreaker Limited・最後更新：2026 年 8 月 2 日・English version
破曉有限公司(Dawnbreaker Limited，下稱「我們」)於 2026 年在香港註冊，為香港學校設計及營運互動教育科技產品。我們依照香港《個人資料(私隱)條例》(第 486 章)處理個人資料。本聲明說明本網站及我們的產品如何收集、使用及保障個人資料。
1. 本網站(dawnbreaker.ai)
- 本網站不使用 cookie，亦不使用任何追蹤或分析工具。
- 所有字體及資源均由本站自行提供，頁面不向任何第三方服務發出請求。
- 本網站不設表格、不設登入，不收集任何個人資料。
- 網站寄存於 Cloudflare Pages。
- 閣下主動電郵至 [email protected] 時，來信內容只用於回覆閣下的查詢。
2. 產品所處理的資料
我們為學校提供的產品(包括粵語發音練習平台及各校園活動平台)由學校委託我們處理學生資料：學校是資料使用者，我們按學校指示及書面委託處理。每項產品於收集點另設收集個人資料聲明及家長同意書；下表為公司層面的整體說明。
| 資料類別 | 來源 | 用途 | 保存期 |
|---|---|---|---|
| 學生及教職員姓名(中英文)、班別、班號 | 學校名單 | 身份核實、學校管理及學習進度跟進 | 在學期間；離校核實後 30 日內刪除 |
| 學校發放的登入帳號及密碼 | 學校名單 | 登入及帳號連結(密碼只儲存單向加密值，不儲存原文) | 同上 |
| 兒童語音錄音(粵語發音練習平台) | 學生練習時產生 | 發音評估及言語治療師跟進 | 上載後 90 日內自動刪除 |
| 練習及活動紀錄(作品、答題、獎勵及進度) | 學生使用時產生 | 學習進度跟進及進度摘要 | 最多兩個學年，期滿匿名化或刪除 |
| 登入及保安審計記錄 | 系統產生 | 保安及審計 | 12 個月 |
我們不會收集：出生日期、身份證明文件號碼、相片、住址及電話。
3. 保安措施
- 資料傳輸以 TLS 加密，儲存採用靜態加密。
- 資料庫設列級存取控制(row-level security)及最小權限：治療師及教職員只能查閱獲授權的學生資料；每所學校的資料完全分隔。
- 兒童語音錄音存於獨立私有儲存區，以匿名代號引用，期滿自動刪除。
- 所有資料查閱行為均有審計記錄。
- 不設聲紋或說話人識別功能。
- 登入時段短效，登入憑證可即時個別停用。
4. 分判資料處理者
我們使用以下服務供應商處理資料；部分資料因此儲存及處理於香港以外地區：
| 分判處理者 | 所在地區 | 用途 |
|---|---|---|
| Cloudflare | 美國(全球網絡) | 本網站及各產品的寄存與內容傳送 |
| Supabase | 新加坡 | 各產品的雲端資料庫及檔案儲存 |
| Microsoft Azure 語音服務 | 東亞區域 | 粵語發音練習平台的發音評估 |
| 人工智能語言模型服務(按產品而定) | 美國 | 練習內容生成及學習摘要——只接收已完全去除身份資料的內容 |
我們與上述分判處理者已訂有或正在訂立資料處理協議，並持續檢視其保安狀況；完整供應商名單及最新狀況可應學校書面要求提供。我們透過協議及技術措施，要求分判處理者提供相稱的資料保障。
5. 未成年人資料政策
- 我們的產品主要供在學兒童使用。凡收集兒童個人資料，必先透過學校取得家長或監護人的書面同意，並採逐項選擇(opt-in)方式。
- 資料最小化：只收集提供服務所必需的資料。
- 凡涉及人工智能服務的處理，學生姓名、班別及學號一律先以隨機代號取代或完全移除；人工智能服務永不接觸學生身份資料。
- 家長或監護人可隨時透過學校或直接聯絡我們，查閱、更正或要求刪除子女的資料，並可撤回同意。
6. 查閱及改正
按《個人資料(私隱)條例》第 19 條及保障資料第 6 原則，閣下有權查閱及改正我們持有的個人資料。請電郵至 [email protected];我們會於 40 日內回覆。
7. 直接促銷
學生及家長的個人資料永不用於直接促銷，亦絕不出售或出租予任何第三方(《個人資料(私隱)條例》第 6A 部)。
8. 本聲明的修訂
本聲明如有修訂，會於本頁公布；重大變更會透過學校通知家長。
Privacy Policy Statement
Dawnbreaker Limited 破曉有限公司 · Last updated: 2 August 2026 · 中文版本
Dawnbreaker Limited ("we", "us"), incorporated in Hong Kong in 2026, designs and operates interactive education technology products for Hong Kong schools. We handle personal data in accordance with the Hong Kong Personal Data (Privacy) Ordinance (Cap. 486). This statement explains how this website and our products collect, use and safeguard personal data.
1. This website (dawnbreaker.ai)
- This website uses no cookies and no tracking or analytics tools of any kind.
- All fonts and assets are served by this site itself; pages make no requests to any third-party service.
- There are no forms and no sign-in — this website collects no personal data.
- The site is hosted on Cloudflare Pages.
- If you email us at [email protected], your message is used only to answer your enquiry.
2. Data processed by our products
Our school products (including a Cantonese pronunciation-practice platform and our campus activity platforms) process student data on the school's behalf: the school is the data user, and we process data on the school's documented instructions. Each product carries its own Personal Information Collection Statement and parental consent form at the point of collection; the table below is the company-level summary.
| Data | Source | Purpose | Retention |
|---|---|---|---|
| Student and staff names (Chinese and English), class and class number | School roster | Identity verification, school administration and learning-progress follow-up | While enrolled; deleted within 30 days after departure is confirmed |
| School-issued sign-in accounts and passwords | School roster | Sign-in and account linking (passwords are stored as one-way encrypted values only, never in plain text) | Same as above |
| Children's voice recordings (Cantonese pronunciation-practice platform) | Generated during practice | Pronunciation assessment and speech-therapist follow-up | Automatically deleted within 90 days of upload |
| Practice and activity records (artwork, answers, rewards, progress) | Generated during use | Learning-progress follow-up and summaries | At most two school years, then anonymised or deleted |
| Sign-in and security audit logs | System-generated | Security and audit | 12 months |
We do not collect: date of birth, identity document numbers, photographs, home address or phone numbers.
3. Security measures
- TLS encryption in transit; encryption at rest.
- Row-level security and least-privilege access in the database: therapists and staff can only view the students they are authorised to see; each school's data is fully segregated.
- Children's voice recordings are kept in a separate private storage bucket, referenced by anonymous IDs, and deleted automatically when the retention period ends.
- All data access is audit-logged.
- No voiceprint or speaker-identification features.
- Short-lived sign-in sessions; individual credentials can be revoked immediately.
4. Sub-processors
We use the following service providers to process data; some data is therefore stored and processed outside Hong Kong:
| Sub-processor | Region | Used for |
|---|---|---|
| Cloudflare | United States (global network) | Hosting and content delivery for this website and our products |
| Supabase | Singapore | Cloud database and file storage for our products |
| Microsoft Azure Speech Services | East Asia region | Pronunciation assessment for the Cantonese pronunciation-practice platform |
| AI language-model services (varies by product) | United States | Generating practice content and learning summaries — they receive only content with all identifying data removed |
We have data processing agreements in place, or are in the process of putting them in place, with the sub-processors above, and we keep their security posture under review; the full, current list is available to schools on written request. Through agreements and technical measures, we require sub-processors to provide comparable data safeguards.
5. Children's data
- Our products are used mainly by school-age children. Children's personal data is collected only with prior written consent from parents or guardians, obtained through the school on an item-by-item, opt-in basis.
- Data minimisation: we collect only what is necessary to provide the service.
- Wherever AI services are involved, students' names, classes and student numbers are replaced with random codes or removed entirely beforehand; AI services never receive students' identifying data.
- Parents and guardians may at any time — through the school or by contacting us directly — access, correct or request deletion of their child's data, and may withdraw consent.
6. Access and correction
Under section 19 and Data Protection Principle 6 of the Personal Data (Privacy) Ordinance, you may request access to and correction of personal data we hold. Email [email protected]; we respond within 40 days.
7. Direct marketing
Personal data of students and parents is never used for direct marketing, and is never sold or leased to any third party (Part 6A of the Personal Data (Privacy) Ordinance).
8. Changes to this statement
Revisions will be published on this page; material changes will be notified to parents through their schools.
版本 v1.0・2026-08-02 | Version v1.0 · 2026-08-02