Privacy Policy

Last updated: 9 August 2026

1. Who we are

This website, heidi-lai.com (the “Website”), is owned and operated by Esperanto Limited (“we”, “us” or “our”), a company registered in Hong Kong SAR, operating under the brand “Heidi Lai”.

  • ·Registered address: FLAT/RM 1101, 11/F, SHANGHAI IND INVESTMENT BLDG, 48-62 HENNESSY ROAD, WAN CHAI HK
  • ·Telephone: +85298274007
  • ·Email: business@heidi-lai.com

We are committed to protecting your personal data and complying with the Hong Kong Personal Data (Privacy) Ordinance (Cap. 486) (the “PDPO”). This policy explains what data we collect, how we use it, and the rights you have.

2. Data we collect

2.1 Information you provide directly

  • ·Account information — when you register or sign in with a Google account or email address: your name, email address and profile picture.
  • ·Contact details — paying members and event participants provide a WhatsApp number, and paying members an Instagram username, for community onboarding and event notifications.
  • ·Enquiry and application forms — information you submit when applying for our services (such as consulting, coaching or events), for example your name, phone number, company or brand name, industry and the content of your enquiry or message.
  • ·Tool inputs — answers and form inputs you submit to our tools (such as the free IP test and the AI personal-IP positioning tool) and the reports generated for you.
  • ·Payment records — payments are processed by Stripe. We do not collect or store your card number; we keep only the records needed for your order and membership status.

2.2 Data received through Meta Platforms

Where we provide customer-communication services through Meta platforms (WhatsApp, Instagram and Facebook), we receive the following data through Meta’s official APIs:

  • ·Platform profile information — such as your name, username and profile picture as provided by the platform.
  • ·Message and comment content — the content of messages and comments you send to a business account we operate or service.
  • ·Message metadata — such as timestamps and conversation identifiers.

2.3 Technical data

  • ·IP address, device and browser type;
  • ·pages visited and usage data such as article reading progress and view counts;
  • ·cookies and local storage necessary to keep you signed in and remember your preferences. You can manage cookies in your browser settings, but some features (such as member sign-in) may not work if they are disabled.

3. How we use data

  • ·to respond to your enquiries and messages, including replies drafted with AI assistance under human supervision (see section 5);
  • ·to assign conversations to the appropriate staff member;
  • ·to provide the information, services, content or events you request;
  • ·to provide and manage memberships, courses, events and tools, and to process payments, renewals and transactional notices (such as registration confirmations and event reminders);
  • ·to send you our latest content and event updates where you have agreed or where permitted by law (you can unsubscribe at any time);
  • ·to operate, secure and improve the Website and our services; and
  • ·to comply with our legal obligations.

4. Our commitments

  • ·We do NOT sell personal data.
  • ·We do not use data received from Meta Platforms for advertising to third parties.
  • ·Data from Meta Platforms is used solely to provide the customer-service features described in this policy, in accordance with Meta’s Platform Terms and Developer Policies.

5. AI processing

Some replies to customer enquiries may be drafted by AI systems and may be reviewed by a human before or after sending. AI processing is used only to help answer enquiries and provide the services described in this policy. We do not use AI processing to build advertising profiles.

6. Sharing of data

We share personal data only with:

  • ·the business you contacted and the staff members assigned to handle your conversation or request;
  • ·service providers who process data on our behalf — such as cloud hosting (Google Firebase), payment processing (Stripe), email delivery (Resend), image hosting (Cloudinary) and AI processing (Anthropic) — under confidentiality obligations and only as instructed by us; and
  • ·authorities where disclosure is required by law.

We do not sell, rent or otherwise disclose your personal data to any other third party.

7. Data retention

We keep personal data only for as long as needed to provide our services and for the purposes described in this policy. Data received from Meta Platforms is deleted or anonymised when it is no longer needed for those purposes. After your membership ends we may retain transaction records necessary to meet legal and accounting requirements.

8. Your rights

Under the Hong Kong Personal Data (Privacy) Ordinance (Cap. 486), you have the right to access and correct the personal data we hold about you, and you may request deletion of your account and related data (except records we are required by law to keep). To exercise these rights, email business@heidi-lai.com and we will respond within a reasonable time. For step-by-step deletion instructions, see our Data Deletion Instructions.

9. Security

Your data is stored with Google Firebase (servers located in the United States). We take reasonable technical and organisational measures to protect it, including access controls and encryption in transit. No method of transmission or storage is completely secure, but we work to protect your data against unauthorised access, alteration or loss.

10. Children

Our services are intended for adults. We do not knowingly collect personal data from anyone under the age of 18.

11. Changes to this policy

We may update this policy from time to time. The revised version will be posted on this page with an updated “Last updated” date, and we will notify you of material changes by reasonable means.

12. Contact us

If you have any questions about this policy or your personal data, contact us at business@heidi-lai.com or by telephone / WhatsApp at +85298274007.