Privacy Policy

1. Who we are and our role

This Privacy Policy is issued by Lever Data Solutions Limited, a company incorporated in Hong Kong trading as “Checkafy” (“Checkafy”, “we”, “our” or “us”), with its registered office at Unit 231, 2/F, Building 16W, Hong Kong Science Park, Pak Shek Kok, Hong Kong.

We provide two products to brands, retailers, distributors and agencies across the Asia-Pacific region:

• Checkafy, a retail data service. We collect publicly available product listing data from retailer and marketplace websites, match products across retailers, and deliver the data as structured reports (Base Report Layer), dashboards (Dashboard Layer) and a natural-language chat for querying the data (Chat BI Layer).
• Debrief (trydebrief.ai), an AI market research agent. It asks third-party AI models questions about a customer’s brand, category, products and competitors and reports on their answers.

Together these are the “Services”. This Policy covers our website (www.checkafy.com), the demo and access request forms on it, the Services (including the Debrief application at trydebrief.ai), and our dealings with customers, prospects, suppliers and job applicants.

1.1 Our role

• Data user / controller. For website, enquiry, marketing, account, billing and recruitment data, and for public market data we collect ourselves (section 5), Checkafy decides how and why personal data is processed. We are the “data user” under the Personal Data (Privacy) Ordinance (Cap. 486) of Hong Kong (the “PDPO”) and the controller or equivalent under other laws.
• Processor / data intermediary. Where a customer gives us personal data to process for it under its Customer Agreement (for example, personal data in files or lists it uploads, or in a Debrief scope, brief or question despite our request in section 2.3 not to include any), we act as the customer’s processor, data intermediary or entrusted party and process that data only on the customer’s documented instructions. The customer’s own privacy notice governs that data, and requests about it should go to the customer first. We will assist our customers in responding.

The Services are for business use only. This Policy is not directed at consumers.

2. Personal data we collect

2.1 Demo and access request forms

When you use the demo request or request-access form on our website we collect:

• Your name, email address and company name
• Your job role and company type (for example brand, retailer, distributor or agency)
• The countries or markets you sell in and the product or products you are interested in
• Optionally, your phone or WhatsApp number, your company size, the areas of interest you select, the number of products you want to track, the brand you want analysed, and any message you write
• Whether you ticked the optional, unticked box agreeing to receive marketing communications
• The page you submitted the form from, the referring page, and any campaign parameters in the link you followed (for example “utm_source” or “utm_campaign”), so we know which of our pages or campaigns led to your enquiry
• Technical data that your browser sends when submitting the form, such as your IP address and browser information, which our hosting provider processes to deliver the request

Fields marked as required are needed for us to respond. Everything else, including the marketing box, is optional. Your submission is sent to our team as an internal email summary; we do not send an automatic reply. Our form-processing logs record only whether a submission succeeded or failed, not what you entered.

2.2 Customer, account and service data

• Names, work contact details, job titles and login credentials of customer users
• Billing contacts, billing addresses, tax identifiers, purchase order and payment references
• Usage and log data from the Services (for example, features used, reports and dashboards viewed, Debrief runs started, IP addresses and access times)
• Questions your users ask in Chat BI, which are processed to generate answers
• Support requests, scope documents, instructions and correspondence

2.3 Debrief scopes, questions and reports

To run Debrief, a customer’s users enter a scope: brand, category, products, markets, competitors and an objective, and optionally a brief (for example brand website, target customer, price positioning, sales channels, key messages, brand story and product specifications) and up to 20 questions of their own. Debrief generates consumer-style questions from the scope and sends them to third-party AI models (section 6). We keep a record of each run: the scope, every question sent, every answer received, the report and token usage.

A Debrief scope is business information about brands, products and markets. Please do not include personal data in a scope, brief or question (for example, names, contact details or other information about identifiable customers, employees or influencers). Anything you include is sent to the AI providers described in section 6 and kept in the run record. AI answers can occasionally name individuals (for example, a company founder or a person quoted on a website); those names are kept as part of the run record.

2.4 Other correspondence and recruitment

• Information you include when you email us, speak to us or meet us at events
• Supplier and partner contact details needed to manage our relationship
• CVs, cover letters and interview notes if you apply for a role

2.5 Website visits

Our website is a static site served through a content delivery network. When you visit it, your browser sends standard technical information (such as IP address, browser type, the page requested and the time of the request) to our hosting and delivery providers, and our icon font is fetched from Google’s servers (see section 11).

We keep these access logs, and our pages also send a few small usage events to our own servers: a page was viewed, a link to the demo form was clicked, the demo form was started, and the demo form was sent. Each event records the page, the name of the website you came from and any campaign tags in the link you followed. It never includes anything you type into a form. We use the logs and events to see how people find the website, which pages lead to demo requests and where visitors stop, so we can improve it. Our reports show counts, not individual visitors. We estimate the number of unique visitors each day from IP address and browser details, without cookies. We do not send these events if your browser signals Do Not Track or Global Privacy Control. We do not use cookies, advertising pixels or third-party analytics services on the website.

2.6 Public market data

Checkafy collects publicly available product listing data from retailer and marketplace websites, currently mainly in Hong Kong and Thailand (“Market Data”). Market Data includes product details and images, prices and promotions, stock status, sales counts and ratings; the name, rating and type of marketplace sellers; and, on some sources, customer reviews, including the review author’s name as displayed, the rating, the review text and its date. Market Data is business information about products and channels. Some of it can identify an individual, most often where a marketplace seller trades under their own name or a review is posted under a real name. Section 5 explains how we handle this.

2.7 Sensitive data

We do not ask for, and ask you not to send us, sensitive personal data (for example, identity card numbers, health, biometric, financial account, religious or political information) unless it is genuinely required for a specific purpose that we have explained to you.

3. Purposes and legal bases

We use personal data only for the purposes below or directly related purposes. The PDPO does not use “legal bases”, but several other laws in our region do (section 13), so we list the basis we rely on.

Providing personal data is voluntary. If you do not provide data we need, we may be unable to respond to you, provide the Services or consider your application.

4. Direct marketing

This section is our notice under Part VIA of the PDPO and similar laws in the region.

• Kinds of personal data: your name, email address, company name, job role, company type, country or market, and areas of interest.
• Classes of marketing subjects: the Checkafy retail data service (reports, dashboards and Chat BI); Debrief AI visibility research; product updates and new features; events, webinars and industry research relating to retail, e-commerce and AI visibility.
• Channels: email, and occasionally telephone or messaging apps where you have given us that number for this purpose.

We will not use your personal data for direct marketing unless you have given your consent. On our website, consent is given only by ticking the separate, optional marketing box on the demo request form. The box is unticked by default and you can submit the form without ticking it. We do not provide or sell personal data to any third party for its own direct marketing.

You can withdraw your consent at any time, free of charge, by using the unsubscribe link in any marketing email or by writing to info@checkafy.com. We will stop within a reasonable time and keep a minimal suppression record (your email address and the date of your request) so that we do not contact you again. Service messages about an account you hold are not marketing and will continue.

5. Public listing data: sellers and reviewers

Our customers use Checkafy to track prices, promotions, availability, assortment and ratings across retailers and marketplaces. To do this we collect Market Data from public product listings, which can include the names, ratings and type of marketplace sellers and, on some sources, the names of review authors as they appear publicly.

• Why: it is in the legitimate interests of Checkafy and our customers to understand how products are sold, priced, rated and reviewed in public channels. Where a law exempts personal data that the individual has made publicly available, we rely on that exemption.
• Limits: we collect seller information at the level of the public listing (for example, a seller or storefront name, its rating and seller type). We do not seek out private contact details, build profiles of individual consumers, or use review-author names for any purpose other than displaying review content in context. We de-identify or drop review-author names where they are not needed.
• Use by customers: customers receive Market Data for their own analysis. Our Terms require them to handle any personal data in it lawfully and not to use it to harass or unlawfully profile anyone.
• Your choices as a seller or reviewer: if you are an individual seller or review author and believe we hold your personal data, you can write to info@checkafy.com to ask what we hold, correct inaccurate data, or object to our processing. We will review each request against the purposes above and applicable law, and tell you the outcome. Where appropriate we will also tell the relevant customer about a correction.

6. Automated processing and AI

The Services use automated systems, including machine-learning and AI models. Checkafy uses them to collect, match and classify Market Data and, in Chat BI, to interpret your users’ questions and generate answers from the collected data. Debrief uses them to generate questions, obtain the answers that third-party AI models give, analyse those answers and write reports.

6.1 Debrief’s AI providers

When Debrief runs, its questions are sent, with live web search enabled, to five third-party AI models: OpenAI’s ChatGPT (through OpenRouter), Google’s Gemini (through Google Vertex AI, with Google Search grounding), DeepSeek and Alibaba Cloud’s Qwen (both through OpenRouter), and ByteDance’s Doubao. OpenRouter is a routing service and may send DeepSeek requests to DeepSeek itself or to third-party inference hosts. The answers are analysed with Google Gemini and OpenAI models; Amazon Web Services Bedrock is used as a fallback, and Microsoft Azure OpenAI may optionally be used.

• Google and OpenAI (OpenAI through OpenRouter) receive the full scope and brief as well as the questions.
• DeepSeek, Alibaba Cloud (Qwen), ByteDance (Doubao) and any host that OpenRouter routes their requests to receive the generated questions and the customer’s own questions, which contain brand, product, competitor and market names, but not the full brief.
• Amazon Web Services Bedrock and Microsoft Azure OpenAI, when used, receive the same content as the analysis step they perform.

We select providers and settings under which our API inputs are not used to train their models, where the provider offers that option. Some providers, and hosts that OpenRouter routes requests to, process content under their own terms, which vary and may allow them to retain it. We cannot guarantee how every such host handles content, which is a further reason not to include personal data in Debrief scopes, briefs or questions.

6.2 AI-generated outputs

Chat BI answers and Debrief reports are generated by AI and can be inaccurate or incomplete. They are business information about products, brands and markets, designed to support our customers’ own decisions. Checkafy does not make decisions that produce legal or similarly significant effects on individuals based solely on automated processing.

7. Disclosure and service providers

We do not sell personal data. We disclose it only to:

• Service providers that process data on our instructions under written confidentiality and data-protection terms (see the table below)
• Third-party AI model providers, which receive Debrief questions and scope content as described in section 6.1, some of them under their own terms (also listed in the table below)
• Our customers, to the extent Market Data delivered through the Services contains seller or review-author names
• Professional advisers (legal, accounting, audit, insurance) where reasonably necessary
• A purchaser or successor in a merger, acquisition, financing or sale of all or part of our business, bound by this Policy
• Courts, regulators and law-enforcement bodies where required by law or a lawful request, or where necessary to establish, exercise or defend legal claims or protect the safety and rights of any person

A current list of the providers that process customer personal data is available to customers on request.

8. International transfers

We are based in Hong Kong and serve customers across the Asia-Pacific region. Personal data may be processed in Hong Kong; the United States, where our form processing, email delivery, Debrief hosting and run archive, and several of our AI providers operate; mainland China, where DeepSeek, Alibaba Cloud (Qwen) and ByteDance (Doubao) answer Debrief questions; and other countries where our service providers, the hosts OpenRouter routes requests to, or delivery networks operate, including Singapore, Japan, Australia and member states of the European Union.

Debrief questions sent to DeepSeek, Alibaba Cloud (Qwen) and ByteDance (Doubao) are transferred to and processed by providers in mainland China. We limit what those providers receive to the generated questions and the customer’s own questions (section 6.1), and ask customers not to include personal data in them.

Where we transfer personal data across borders we take reasonable steps to ensure it is protected to a standard comparable to this Policy, including, for providers that act on our instructions, written contracts that restrict use to those instructions and require appropriate security, and, where a local law requires, standard contractual clauses, transfer impact assessments or your consent. Section 13 explains country-specific transfer requirements.

9. Retention

We keep personal data only as long as needed for the purposes in this Policy and to meet legal, accounting and dispute-resolution requirements. Our standard periods are:

When data is no longer required, we delete it or irreversibly anonymise it.

10. Security and data breaches

We use technical and organisational measures appropriate to the nature of the data, including encryption in transit, encrypted private storage for Debrief run records, access limited to staff and providers who need it, access logging, and staff confidentiality obligations. No system is completely secure, and we cannot guarantee the security of data sent to us over the internet.

If we become aware of a data breach affecting personal data, we will contain and assess it promptly. Where a breach is likely to cause real risk of harm, we will notify affected individuals and the relevant regulators, including the Privacy Commissioner for Personal Data in Hong Kong, and meet any mandatory notification deadlines under the laws described in section 13. Where we are acting as a processor, we will notify the affected customer without undue delay so that it can meet its own obligations.

11. Cookies and third-party resources

Our public website does not set cookies for analytics, advertising or tracking, and does not use advertising pixels or third-party analytics services. It sends the usage events described in section 2.5 to our own servers as a small image request, which uses no cookie. To attach to a demo request, if you make one, the page you came from and the campaign tags in your first link, your browser keeps them in session storage until you close the tab. The Services’ login areas, including the Debrief application, may use strictly necessary cookies or similar storage to keep you signed in and secure.

Our website loads its icon font from Google’s servers, which means your browser sends your IP address and browser details to Google when you visit. Google processes that data under its own privacy policy. Our text fonts are served from our own website.

If we decide to add analytics or marketing cookies, or a third-party analytics service, we will update this Policy first and, where the law requires, ask for your consent before setting them.

Our website may link to third-party websites. Their privacy practices are governed by their own policies.

12. Your rights (Hong Kong)

Under the PDPO you may:

• Ask whether we hold personal data about you and request a copy (a “data access request”)
• Ask us to correct personal data that is inaccurate (a “data correction request”)
• Ask about our policies and practices and the kinds of personal data we hold
• Ask us to stop using your personal data for direct marketing, at any time and free of charge

You may also ask us to delete personal data or to withdraw a consent you have given. We will do so where we no longer need the data for the purpose for which it was collected, subject to our legal retention obligations.

Send requests to info@checkafy.com. We may need to verify your identity before acting. We will respond to data access and data correction requests within 40 days of receipt; if we cannot comply within that time, we will tell you in writing, with reasons, and comply as soon as practicable. We may charge a fee that is not excessive for complying with a data access request, and will tell you the amount before we proceed. We do not charge for correction requests or marketing opt-outs.

If you are not satisfied with our response, you may complain to the Office of the Privacy Commissioner for Personal Data, Hong Kong (www.pcpd.org.hk).

13. If you are located in…

Hong Kong law is our primary framework, but data-protection laws in other markets may also apply to our processing of your personal data. Where they do, you have the additional rights and protections below. To exercise any right, write to info@checkafy.com. We will verify your identity and respond within the period the applicable law requires. Where your request relates to data we process for a customer, we will refer it to that customer and help them respond. The summaries below are not exhaustive and do not limit any right you have by law.

14. Children

The Services are for business users and are not directed at anyone under 18. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, contact us and we will delete it.

15. Changes to this Policy

We may update this Policy from time to time, for example when we change providers or add features. The current version is always on this page with its “Last updated” date. We will notify customers of material changes by email or through the Services, and where a change requires your consent (for example, new marketing uses or non-essential cookies), we will ask for it before it applies to you.

16. Contact and Data Protection Officer

Our Data Protection Officer handles questions, requests and complaints about this Policy or our handling of personal data:

• Data Protection Officer, Lever Data Solutions Limited (trading as Checkafy)
• Email: info@checkafy.com
• Address: Unit 231, 2/F, Building 16W, Hong Kong Science Park, Pak Shek Kok, Hong Kong

If this Policy is translated, the English version prevails to the extent permitted by local law.