1. Our Approach to Privacy
We take your privacy seriously. Counsel HK is a Hong Kong-based legal document service — we collect only what we need to prepare your documents and deliver them to you. We do not sell your data, we do not use it for marketing, and we do not keep it longer than necessary. Here is exactly what we do with your information.
2. What We Collect
When you submit a document request through doccouncil.org, we collect the following categories of information:
2.1 Intake Form Data
The details you provide to populate your document — typically party names, contact information, dates, addresses, and other particulars relevant to the document type you select. The specific fields depend on the document requested.
2.2 Contact & Delivery Information
Your email address, which we use to deliver your completed document and send order confirmations. Counsel HK does not currently require user accounts — your email is the primary identifier for your order.
2.3 Generated Document Content
The documents we generate on your behalf, including both AI-drafted drafts (Basic tier) and professionally reviewed finals (Professional tier). These documents contain the personal and commercial information you supplied.
2.4 Payment Metadata
We record transaction references, amounts, currency, and payment status for order tracking and refund processing. We do not receive, store, or have access to your full credit card number or CVC — payment processing is handled entirely by Stripe, our third-party payment provider.
2.5 Technical Data
Cloudflare, which hosts our platform, may process your IP address and browser metadata as part of essential service delivery and security (DDoS protection, traffic routing). We do not use analytics scripts, tracking pixels, or advertising cookies of any kind.
3. How We Use Your Data
Your data is used for a single purpose: to prepare and deliver your requested legal documents. Specifically:
- Document generation: Intake form data is passed through our AI drafting engine (via Cloudflare Workers) and, for Professional-tier orders, professionally reviewed.
- Delivery: Your email address is used to send you the completed document and order confirmation.
- Quality review: Professional-tier documents and their corresponding intake data are shared with the professional reviewer assigned to your order.
- Payment processing: Payment metadata is used to confirm successful payment, issue refunds, and maintain financial records.
- Legal & compliance: We retain limited records to comply with Hong Kong legal obligations, resolve disputes, and prevent fraud.
We do not use your data for marketing, profiling, automated decision-making beyond document drafting, or any purpose not directly related to fulfilling your order.
4. Where Your Data Is Stored
All data is stored on Cloudflare infrastructure:
- Document content and intake data are stored in Cloudflare R2 object storage, encrypted at rest using AES-256 and in transit via TLS 1.3.
- Processing occurs within Cloudflare Workers, which execute in the Hong Kong region where available and within the Asia-Pacific network otherwise.
- Payment information is processed and stored by Stripe. Stripe's handling of your payment data is governed by their own privacy policy and PCI-DSS compliance. We never receive or store your full card details.
5. Retention Periods
We keep your data only as long as it serves a legitimate purpose:
- Generated documents: Automatically purged 90 days after delivery. You are encouraged to download and save your document upon receipt — we will not retain it beyond this period.
- Intake form data: Retained for 12 months after your order for audit, dispute resolution, and regulatory compliance.
- Payment metadata: Retained for 7 years as required by Hong Kong tax and company records obligations.
- Email correspondence: Retained for 12 months for customer service continuity.
At the end of the applicable retention period, data is securely deleted from our systems. You may also request earlier deletion — see Section 7.
6. Third-Party Sharing
We share your data only with the parties necessary to deliver our service. We do not sell, rent, or trade your data.
- Cloudflare: Our infrastructure provider. Cloudflare processes data on our behalf under our instructions and does not use it for their own purposes.
- Stripe: Payment processor. Stripe receives your payment card details directly — we never see them. Stripe provides us with transaction metadata (amount, status, reference) only.
- Professional reviewers (Professional tier only): Your intake data and draft document are shared with the qualified professional reviewer assigned to your order. Reviewers are bound by professional confidentiality obligations under Hong Kong law.
- Legal obligations: We may disclose data if required by law, court order, or regulatory authority in Hong Kong.
7. Your Rights Under Hong Kong Law
Under the Hong Kong Personal Data (Privacy) Ordinance (Cap. 486) ("PDPO"), you have the following rights in respect of your personal data:
- Right of access: You may request a copy of the personal data we hold about you. We will respond within 40 days as required by the PDPO.
- Right of correction: If any data we hold about you is inaccurate, you may request that we correct it.
- Right to withdraw consent and request deletion: You may withdraw your consent to our processing of your personal data and request deletion at any time. We will comply unless retention is required by law or necessary for ongoing legal proceedings.
To exercise any of these rights, email legal@doccouncil.org with your request and your Document Reference ID. We may require proof of identity before processing your request. There is no fee for making a data access request under the PDPO.
8. Cookies & Analytics
Counsel HK does not use analytics, tracking scripts, advertising cookies, or any form of behavioural tracking. Cloudflare may set strictly necessary session cookies for security and load-balancing purposes — these are essential to the operation of the platform and do not track you across sites.
We do not integrate with any third-party analytics services (such as Google Analytics) or advertising networks.
9. Data Security
We implement commercially reasonable technical and organisational measures to protect your data, including encryption at rest (AES-256) and in transit (TLS 1.3), access controls limiting data access to personnel who require it for service delivery, and automatic document purging on retention expiry. However, no method of electronic storage or transmission is entirely secure, and we cannot guarantee absolute security.
10. Changes to This Policy
We may update this Privacy Policy from time to time to reflect changes in our practices, technology, or legal obligations. The current version will always be available at doccouncil.org/privacy. Material changes will be communicated by email where we hold your contact details. Continued use of the platform after changes take effect constitutes acceptance.
11. Contact
For privacy enquiries, data access requests, or to report a concern:
- Email: legal@doccouncil.org
- Subject: Please include "Privacy" or "Data Request" in the subject line along with your Document Reference ID if applicable.
We aim to acknowledge all privacy-related correspondence within 2 business days. If you are not satisfied with our response, you may lodge a complaint with the Privacy Commissioner for Personal Data, Hong Kong (pcpd.org.hk).