Privacy Policy

Last updated: 28 October 2026

1. Overview

Winko ("the Service") is operated by SmartClinic AI HK Limited ("the Company", "we", "us"). It lets businesses manage their WhatsApp, Facebook Messenger, Instagram and website chat messages in one place, with AI replies, Facebook and Instagram comment auto-replies, broadcast messages, coupon codes, contact management, bookings, forms, payment tracking, a product catalogue and reports.

This Privacy Policy explains how we collect, use, store and protect the personal data of businesses that use the Service and their staff, customers who contact those businesses through these channels (including visitors who use a business's website chat), and people who send us an enquiry through this website.

For the personal data of customers and website visitors, the business using the Service is the Data User, and the Company acts as a Data Processor that handles the data only on that business's instructions. Businesses should give their customers a Personal Information Collection Statement in line with the Personal Data (Privacy) Ordinance, and a business that adds the chat to its website should also describe it in that website's privacy policy.

2. Data We Collect

2.1 Customer data (processed for businesses)

When a customer chooses to message a business that uses the Service through WhatsApp, Facebook Messenger or Instagram, we process the following for that business:

  • The customer's WhatsApp phone number, or the Messenger or Instagram scoped ID provided by Meta
  • The customer's display name and Instagram username (provided by Meta)
  • Messages exchanged between the customer and the business, including text and the photos, documents, voice messages and stickers either side sends
  • Message sent, delivered and read status
  • Tags, notes and coupon codes set by the business, and the customer's consent or opt-out status for promotional messages

Depending on the features the business uses, we also process for that business:

  • Booking details, such as the service, date, time and status
  • Content customers submit through forms
  • Payment records, such as the amount, due date and status; if the business collects payment through Stripe, card and other payment details are handled by Stripe directly and we do not receive or store them
  • Customer satisfaction ratings
  • Ad identifiers provided by Meta when a customer starts a conversation from a Facebook or Instagram ad
  • The content of voice messages that staff choose to convert to text

If a business turns on Comment Replies, then when a customer comments on the business's Facebook Page posts, or on its Instagram posts, Reels or live videos, and the comment matches a rule the business set, we also process for that business: the comment text, the commenter's Facebook name or Instagram username and the scoped ID provided by Meta, the ID of the post, and the content and result of the automatic private message and public reply. Comments that match no rule are not stored.

2.2 Website chat visitors (processed for businesses)

A business can add the Service's chat box to its own website. When a visitor uses that chat, we process the following for the business:

  • Messages exchanged between the visitor and the business
  • The name, phone number and email the visitor chooses to give (all optional)
  • The address of the web page where the visitor started the chat
  • A random identifier that the chat creates in the visitor's browser storage (localStorage), so the visitor can continue the same conversation later; we store only a hashed form of it
  • The IP address needed for rate limiting to prevent abuse, processed only in an irreversibly encrypted form; the original IP address is not stored

The chat does not use cookies, does not track visitors across other pages or websites, and loads no advertising or analytics tools. Visitors can clear their browser's site data at any time to remove the identifier; the chat then starts a new conversation.

2.3 Business and staff data

The business name, staff names and login emails, passwords stored as hashes, the names and IDs of connected WhatsApp numbers, Facebook Pages and Instagram professional accounts, and the template images, stickers and product details the business uploads.

We also keep:

  • Login records: the time and result of each login or failed login, with the IP address and browser or device details
  • Activity log: important actions staff take on the platform, such as changing settings, adding or deleting data, sending broadcasts and replying to customers, with who did it and when

2.4 Website enquiries

When you submit the enquiry form on this website, we collect the name, company or brand, email, phone number, current setup, message volume, preferred channels and message you enter, and whether you agree to receive promotional information. To prevent abuse, we also record the time of submission and your IP address in an irreversibly encrypted form.

3. How We Use Data

3.1 Providing the Service

  • Showing customer messages in the business's inbox so its staff can read and reply to them
  • Automatically answering enquiries from customers and website chat visitors using information the business has approved, and passing other enquiries to the business's staff
  • Sending broadcast messages and coupon codes, on the business's instructions, to customers who have agreed to receive them; customers may opt out at any time. Images attached to broadcast templates are uploaded to Meta for approval and delivery
  • Providing the business with reports such as delivery, read and coupon-use figures

3.2 Facebook Messenger and Instagram data

  • We access direct messages that customers send to the business's Facebook Page or Instagram professional account, and the business's replies.
  • If the business turns on Comment Replies, we read the list of recent posts of that Page or Instagram account (only so the business can choose which posts a rule applies to; post content is not stored) and customers' comments on its posts, Reels or live videos. When a comment matches a rule, we send one private message to the commenter for the business (at most one per comment) and, if the business chose to, post one public reply under that comment in the name of the Page or account.
  • Apart from those public replies set up by the business, we do not publish any content on the business's behalf, do not edit or delete other people's comments, and do not access friend lists or other profile data.
  • This data is used only for the purposes above. It is never used for advertising or profiling, never sold or transferred to third parties, and never shared with other businesses.
  • A business can turn off Comment Replies or disconnect its Page or Instagram account at any time; we then stop receiving new messages and comments for that account.

3.3 Website enquiries

We use enquiry details only to contact you about your enquiry and send a quote. We send product updates and offers only if you tick the box to agree, and you can opt out at any time by emailing us.

3.4 Login records, activity log and system logs

Login records and the activity log are used to keep accounts secure, detect unusual logins, and let the business find out which staff member did what if something goes wrong. Only the business's owner account can view them. We also use system logs for security, abuse prevention and service maintenance.

4. Storage and Security

The Service's database is in Google Cloud Platform's Hong Kong region and protected by encrypted transmission (TLS). Each business's data is stored separately, and staff can only see data belonging to their own business. Access tokens used to connect WhatsApp, Facebook and Instagram are encrypted before storage.

Some processing, such as AI language processing and message delivery, may take place on servers outside Hong Kong. We apply reasonable technical safeguards, including encrypted transmission and access controls, to protect such data.

5. Retention

  • Service data is generally deleted within 90 days after a business stops using the Service, except where the law requires longer retention. A business may also request earlier deletion.
  • Conversation content between customers and the business, and the comment text and names in Comment Replies records, are deleted according to the chat retention period the business sets (6 months to 3 years, 2 years by default).
  • Photos, documents, voice messages and sticker files exchanged between customers and the business are deleted 365 days after they are sent by default; the business can set this period anywhere from 30 to 3,650 days. After deletion the conversation keeps only a record of the message (for example "Photo"), not the file itself.
  • When a customer unsends a message, its content is erased from our systems.
  • Login records and the activity log are kept for 1 year and then deleted automatically.
  • The encrypted IP values used to prevent abuse of the website chat are normally deleted automatically after 1 day.
  • Website enquiries are kept for up to 24 months after submission and then deleted automatically.

6. Service Providers

  • Meta Platforms, Inc.: WhatsApp Business Platform, Messenger Platform and Instagram messaging APIs, for sending and receiving messages
  • Google Cloud Platform: computing, database and file storage, and AI language processing
  • Google Workspace: email, including internal notifications of website enquiries
  • Cloudflare, Inc.: hosting of this website, the business web interface and the website chat script
  • Resend: system emails, such as account verification, password resets and notifications

Each provider handles data under its own privacy policy.

If a business chooses to connect other services, such as Stripe, SHOPLINE, Zapier or Google Calendar, we exchange the data needed with that service according to the business's settings (for example payment status, products, contacts or bookings). These services are arranged between the business and its provider, and the provider handles the data under its own privacy policy. The keys a business uses to connect them are encrypted before storage.

7. Data Sharing

We never sell or rent personal data, and we never share data between businesses. Data may only be accessed or disclosed:

  • To comply with applicable law, court orders or lawful requests from government authorities
  • To protect the legitimate rights of the Company, businesses or others, for example to prevent abuse of the Service
  • On the instructions of the business, as the Data User

8. Your Rights

Under Hong Kong's Personal Data (Privacy) Ordinance (Cap. 486), you generally have the right to access and correct personal data we hold about you, to request deletion (subject to legal retention requirements), and to opt out of promotional messages at any time.

Facebook and Instagram users can remove the Service's access under "Apps and Websites" in Facebook settings. To delete stored data, see our Data Deletion instructions.

Customers and website chat visitors may also contact the business that serves them, and we will help the business respond.

9. Changes to This Policy

We may update this policy to reflect changes in law, technology or our business. Material changes will be announced on this website, and the "Last updated" date above will change.

10. Contact Us

SmartClinic AI HK Limited
Email: [email protected]