Privacy Policy

Controller: InfiniNova Limited (星天域有限公司), trading as VeyJet Sites: edu.infini-nova.com, edu.infininova.cn Privacy contact: legal-privacy-ofac@infini-nova.com Postal: Kai Tak Industrial Building, Block 2, Unit D07, 8th Floor, Kai Tak, Hong Kong · Mailbox 108, 13030 Eastgate Park Way, Louisville, KY 40223, USA

This policy covers our website, enquiries, and the delivery of our education consulting services. Supplementary notices: US State Privacy Notice and Rights Requests (US State Privacy Notice and Rights Requests), Canada Privacy Notice (Canada Privacy Notice (PIPEDA, Quebec Law 25, CASL)), Cookie and Tracking Policy (Cookie and Tracking Policy), No Data Exchange Commitment and data locations (the “No Data Exchange Commitment, and Where Your Data Lives”), Minors and Guardian Consent Policy (Minors, Guardian Consent and Student Records Policy).

1. The three things most people want to know first

1. We do not sell or exchange your personal information, and we do not disclose it to any third party for that party's own purposes. We do not share it for cross-context behavioural advertising. We have not done any of this in the preceding 12 months. There is no advertising pixel, no data broker and no ad network on this site. We only process information we obtained ourselves, directly from you — we buy no lists and accept none from any partner or agency. The commitment, and what it does and does not cover, is at the “No Data Exchange Commitment, and Where Your Data Lives”.
2. We do not use your information, or any student's work, to train machine-learning models, and we do not permit any vendor to do so.
3. Your data is held and processed in Hong Kong, not in the United States. See §9. We say this plainly because a site with a North American face often implies US storage; ours is not.

2. Who we are and what role we play

InfiniNova Limited is the controller (US state law: "business"; PIPEDA: "organization") that decides why and how your information is processed. Our mentors and advisers in North America are independent contractors who process information under our instruction and under contract, not for their own purposes.

3. What we collect

3.1 Information you give us

We do not ask for, and ask you not to send: government ID or passport scans, full financial account or card numbers, health or diagnostic records, or credentials for any school, competition or application platform. If a specific service genuinely needs something in this list, we will ask separately and explain purpose, minimum scope, retention and protection first.

3.2 Information collected automatically

Aggregate, cookieless analytics via self-hosted Umami (page path, referrer, screen size, country, browser) and standard server logs (IP address, timestamp, user agent) kept for security and abuse prevention. Details and opt-out: Cookie and Tracking Policy.

3.3 Sensitive information

We do not seek sensitive personal information. Where a student's accessibility or learning support need is genuinely relevant to planning, we process it only with separate, specific, revocable consent (the “Consent Form — Collection, Sensitive Information, Cross-Border Transfer and Marketing” Part B), only for that purpose, and never for inference or profiling. We do not use or disclose sensitive personal information for any purpose other than those permitted under CPRA §1798.121, so the right to limit its use does not arise in practice.

4. Why we process it, and on what basis

5. Who we disclose it to

For a business purpose only, and under contract:

Analytics (self-hosted Umami) receives no identifiers at all (Cookie and Tracking Policy §2), so it is not a recipient of personal information.

We also disclose where legally compelled, to establish or defend a legal claim, or to prevent serious harm — and we will tell you unless legally prohibited.

None of the above is a sale or an exchange. Each is a service provider or contractor acting on our instruction, for our purposes only, bound by contract not to sell, share or retain the data beyond the engagement and not to use it to train any model (the “Data Processing Addendum”). The distinction between a contracted provider and an exchange is explained at the “No Data Exchange Commitment, and Where Your Data Lives” §2 — we draw it there rather than let the word "never" do work it cannot do.

Stripe is an independent controller for its own fraud-prevention and regulatory purposes and processes your payment data under its own privacy policy, which you should read.

6. Minors

Services concern students, most of whom are minors. The contracting party is always the parent or legal guardian. We do not knowingly collect personal information from a child under 13 without verifiable parental consent (COPPA). We verify guardian authority so far as reasonably practicable. A student may ask what we hold about them and have it explained in terms they can understand. Full detail: Minors, Guardian Consent and Student Records Policy.

7. Marketing

We send non-essential marketing only after you opt in, separately from engaging us, and never as a condition of service. Every message carries an unsubscribe link and our postal address; we act on an unsubscribe within 10 business days (CAN-SPAM) and honour it permanently. For Canada we rely on express consent under CASL and keep the record. We do not send autodialed or pre-recorded marketing calls or texts without prior express written consent (TCPA). Detail: Communications and Marketing Consent Policy.

8. Retention

At the end of a period we delete or irreversibly anonymise, except where law requires retention.

9. Where your data is

The client file and the enquiry archive are held in Hong Kong (Alibaba Cloud Object Storage, infininova-hk-storage). Notification email transits a relay in the United States. Mentors in the US and Canada work from a de-identified brief by default. The full table, and what each location is for, is at the “No Data Exchange Commitment, and Where Your Data Lives” §4.

What this means for you:

• If you are in the US or Canada: your data is in Hong Kong, under Hong Kong law, which is not equivalent to CPRA or PIPEDA and may be reachable by Hong Kong authorities under lawful order. We protect it by contract, minimisation and the controls in the “Complaints, Refunds and Incident Response”, and we will not claim an equivalence that does not exist. You may ask us to delete it at any time.
• If you are in mainland China: see the “No Data Exchange Commitment, and Where Your Data Lives” §5 for the route by which information reaches Hong Kong, and the separate consent we ask for.

10. Security

Access control and least privilege; TLS in transit; storage on access-restricted cloud buckets; rate limiting on the enquiry form; separate credentials per system; an incident response procedure (the “Complaints, Refunds and Incident Response”).

We state what we actually do, and no more. We do not hold SOC 2 or ISO 27001. We have not undergone independent penetration testing. We do not offer multi-factor authentication on a client portal, because there is no client portal. No internet transmission can be guaranteed secure.

11. Your rights

Depending on where you live you may have the right to know, access, obtain a portable copy, correct, delete, withdraw consent, opt out of sale/share (we do neither), limit use of sensitive information (not applicable — see §3.3), and not be retaliated against for exercising a right.

• United States: see US State Privacy Notice and Rights Requests for the categories table, the request procedure, authorised agents, appeals and Global Privacy Control.
• Canada: see Canada Privacy Notice (PIPEDA, Quebec Law 25, CASL) for PIPEDA access and challenge procedures, and Quebec Law 25.
• Mainland China / Hong Kong: see the “No Data Exchange Commitment, and Where Your Data Lives”. Hong Kong residents may also complain to the PCPD.

How to make a request: email legal-privacy-ofac@infini-nova.com with "Privacy request" in the subject. We verify identity proportionately to the sensitivity of what is asked, respond within 45 days (extendable once by 45 days with notice) in the US and within 30 days in Canada, and do not charge, except for a manifestly unfounded or excessive repeat request.

We cannot act on data held independently by a school, university, competition or application platform. Direct those requests to them.

12. Automated decision-making

We do not make decisions about you by automated means, and we do not profile you. Every assessment and recommendation is made by a person.

13. Complaints

Write to us first: legal-privacy-ofac@infini-nova.com. If you are not satisfied you may complain to your state Attorney General, the California Privacy Protection Agency, the Office of the Privacy Commissioner of Canada (in Quebec, the Commission d'accès à l'information), the Hong Kong PCPD, or the competent mainland China authority.

14. Changes

We will post a dated new version and describe material changes at least 14 days before they take effect. Where a change requires fresh consent, we will ask for it rather than rely on continued use.

15. Contact

legal-privacy-ofac@infini-nova.com Kai Tak Industrial Building, Block 2, Unit D07, 8th Floor, Kai Tak, Hong Kong · +852-6418-1625 Mailbox 108, 13030 Eastgate Park Way, Louisville, KY 40223, USA