1. Operator and scope
Bunny Innovation operates Minddraft at minddraft.design. This statement describes our handling of personal data in connection with the platform, with reference to the Personal Data (Privacy) Ordinance (Cap. 486) of Hong Kong and its Data Protection Principles. Contact info@bunnyinnovation.com for privacy enquiries, access or correction requests and complaints.
2. What we collect
When Google sign-in is enabled, we receive your Google account identifier, name, email address, email verification status and profile image where supplied. We process Google authentication tokens during sign-in; reusable Google access, refresh and ID tokens are not retained in the account record. Sign-in does not grant access to Search Console, Gmail, Drive or other Google content.
We also process session records, IP addresses and browser information for security; workspace membership and permissions; product information, submitted source material and website captures; generated drafts, approvals, publishing records and connected-service credentials; operational and audit records; and information you provide when contacting us. Content and product event data may include personal data supplied by you. Please minimize such data and only submit it with appropriate authority.
3. Why we use it and whether you must provide it
We use this information to authenticate approved users, operate the workspace, follow authorized content and publishing instructions, protect accounts, investigate faults and misuse, respond to requests and meet legal obligations. Identity information is necessary for sign-in; if you do not provide it, we cannot grant access. Workspace submissions and support information are voluntary, but withholding information needed for a requested feature may prevent that feature from working.
We do not sell personal data or use it for advertising. We do not use contact information for direct marketing without meeting applicable consent requirements. We will seek the prescribed consent where required before using personal data for a new purpose unrelated to the purpose for which it was collected.
4. Providers, recipients and overseas processing
The application is hosted on AWS Lightsail in Hong Kong. Google handles sign-in under its own terms and privacy policy. Configured AI providers, including Qwen and DeepSeek, may receive source extracts and prompts when live AI features are enabled. Publishing, repository and other connected providers receive information needed for the authorized operation. Provider processing may occur outside Hong Kong; Hong Kong hosting does not mean all processing stays in Hong Kong.
We limit disclosures to authorized personnel, hosting and service providers needed for these purposes, professional advisers where necessary, and authorities or other recipients where law requires or permits disclosure. Before enabling a provider, we assess the data handling arrangements appropriate to its use. Avoid including unnecessary personal or confidential information in prompts or source material. Google’s own practices are described in its Privacy Policy.
5. Cookies and safeguards
Minddraft uses essential authentication and security cookies and OAuth state to keep sign-in secure. Sessions ordinarily expire after eight hours and may be refreshed during use. The platform does not currently use advertising cookies. Connected services may use their own cookies when you visit them.
We use HTTPS, access restrictions and encrypted storage for connected-service secrets. Passwords in legacy accounts are hashed. We restrict access to information according to operational need. These measures reduce risks but cannot guarantee absolute security; keep your Google account secure and report suspected incidents to us promptly.
6. Retention and deletion
We retain personal data only for as long as necessary for the stated purposes, applicable legal requirements and legitimate security or dispute needs. Workspace records remain while needed for the workspace; closing an account does not automatically delete shared business records needed by its operator. Raw source files, captures, authentication state and audit records have scheduled retention controls, with periods depending on deployment configuration. Contact us for the current periods relevant to your information.
When information is no longer needed, we take practicable steps to erase it or remove identifying details. A deletion request may require identity verification and may be limited by legal obligations or other people’s rights. Where backup copies exist, removal may follow their normal replacement cycle; access to retained copies remains restricted.
7. Access, correction and complaints
You may request access to your personal data and correction of inaccurate data under the Ordinance by emailing info@bunnyinnovation.com. Describe the information and request so we can locate it. We may require proportionate identity verification and may charge a non-excessive fee for an access request where permitted by law. We ordinarily respond to statutory access and correction requests within 40 days, subject to applicable exceptions and procedures.
If you have a concern, contact us first. You may also contact the Office of the Privacy Commissioner for Personal Data, Hong Kong. This statement does not restrict your statutory rights.
8. Updates
We may update this statement as the service or legal requirements change. We will identify updates by their effective date and provide appropriate notice of material changes. This statement is interpreted in accordance with Hong Kong law.