Privacy Policy

Effective Date: 1 February 2026

Last Updated: 11 February 2026

1. Introduction

OCLauncher ("we", "us", "our") is a service operated by Fav Limited, a company incorporated in Hong Kong SAR. We provide AI agent deployment and management services on Cloudflare's edge network ("the Service").

This Privacy Policy explains how we collect, use, disclose, and safeguard your personal data when you use our website at oclauncher.com and the Service. It applies to all users regardless of location, and has been prepared to comply with:

The Personal Data (Privacy) Ordinance (Cap. 486, Laws of Hong Kong) ("PDPO")
The General Data Protection Regulation (EU) 2016/679 ("GDPR") for users in the European Economic Area, United Kingdom, and Switzerland

By creating an account or using the Service you acknowledge that you have read and understood this Privacy Policy.

2. Data Controller

OCLauncher
Hong Kong SAR
Email: privacy@oclauncher.com

For enquiries regarding this policy or your personal data rights, contact us at the email address above.

3. Personal Data We Collect

3.1 Account Data

When you create an account, we collect:

Name — your display name
Email address — used for login and account communications
Password — stored as a cryptographic hash (never in plain text)
Profile image URL — if provided via Google OAuth

3.2 Authentication Data

If you sign in with Google OAuth, we receive:

Your Google account identifier
OAuth access and refresh tokens (used solely to maintain your session)
Your Google profile name and email

3.3 Session Data

For each active session, we store:

IP address — for security monitoring and abuse prevention
User agent — browser/device identification
Session token — a random cryptographic token

3.4 Billing Data

Payment processing is handled entirely by Stripe, Inc. We do not store credit card numbers or full payment details. We retain only:

Stripe customer ID and subscription ID (references to your Stripe account)
Subscription status, billing period, and renewal dates

3.5 Service Usage Data

When you use the Service, we collect:

Instance metadata — sandbox identifiers, provisioning status, error messages
Event logs — instance lifecycle events (creation, destruction, status changes)
API keys — if you provide your own Anthropic API key ("BYOK"), it is encrypted using AES-GCM 256-bit encryption before storage

3.6 Automatically Collected Data

Our infrastructure provider (Cloudflare) automatically collects standard HTTP request data:

IP addresses, request timestamps, HTTP headers
These logs are retained by Cloudflare for up to 72 hours

4. Cookies and Similar Technologies

We use a limited number of cookies, all of which are first-party:

Cookie	Purpose	Type	Duration
`better_auth.session_token`	User authentication	Essential	Session / 7 days
`PARAGLIDE_LOCALE`	Language preference	Functional	1 year
`promo_code`	Promotional campaign attribution	Functional	Session
`cookie_consent`	Records your cookie consent decision	Essential	1 year

4.1 Analytics and Marketing Technologies

If you accept cookies via our consent banner, we load the following third-party scripts:

Google Tag Manager (GTM) — a tag management system that may load additional analytics or marketing tags as configured. GTM itself does not collect personal data, but tags deployed through it may do so.
Meta Pixel (Facebook Pixel) — tracks page views and conversion events (e.g. sign-up, purchase) to measure the effectiveness of advertising campaigns on Meta platforms.

These technologies are only loaded after you provide explicit consent via the cookie banner. If you reject cookies, no tracking scripts are loaded and no data is shared with Google or Meta. You can change your decision at any time by clearing the cookie_consent cookie from your browser.

5. How We Use Your Data

We process your personal data for the following purposes:

Purpose	Legal Basis (GDPR)	PDPO Basis
Provide and operate the Service	Contract performance (Art. 6(1)(b))	DPP1 — directly related purpose
Process payments via Stripe	Contract performance (Art. 6(1)(b))	DPP1 — directly related purpose
Authenticate your identity	Contract performance (Art. 6(1)(b))	DPP1 — directly related purpose
Security monitoring and abuse prevention	Legitimate interest (Art. 6(1)(f))	DPP1 — directly related purpose
Remember language preference	Legitimate interest (Art. 6(1)(f))	DPP3 — functional cookie
Analytics and advertising measurement (GTM, Meta Pixel)	Consent (Art. 6(1)(a))	DPP3 — consent via cookie banner

We do not use your data for profiling, automated decision-making, or direct marketing.

6. Third-Party Service Providers

We share personal data with the following categories of processors:

6.1 Cloudflare, Inc. (Infrastructure)

Our Service is hosted on Cloudflare's global network (Pages, Workers, D1, R2, Durable Objects). Cloudflare processes request data as part of providing hosting and CDN services.

6.2 Stripe, Inc. (Payments)

Payment processing is handled by Stripe. When you subscribe, your email address and user identifier are shared with Stripe to create your billing account. Stripe may send you payment-related emails directly.

6.3 Google LLC (OAuth Authentication)

If you sign in using Google, we use Google's OAuth 2.0 service. Google receives your authentication request; we receive your profile information as described in Section 3.2.

6.4 Google Fonts (Typography)

We load fonts from Google Fonts. When your browser requests font files, Google receives your IP address and standard HTTP request headers.

6.5 Google Tag Manager (Analytics)

If you consent to cookies, we use Google Tag Manager to manage analytics and marketing tags. GTM may share page view data, device information, and conversion events with Google.

6.6 Meta Platforms, Inc. (Advertising Measurement)

If you consent to cookies, we use the Meta Pixel to measure the effectiveness of advertising campaigns. The pixel may share page view data, conversion events, and browser metadata with Meta.

6.7 Anthropic, PBC (AI Processing)

Your AI agent instances communicate with Anthropic's API. Prompts and responses sent to and from your AI agent are processed by Anthropic in accordance with their usage policies. If you use BYOK mode, your API key is transmitted directly to Anthropic.

7. International Data Transfers

OCLauncher is operated from Hong Kong. Your data may be processed on servers located in various regions through Cloudflare's global network. For users in the EEA/UK, we rely on:

Standard Contractual Clauses (SCCs) where applicable to our sub-processors
Cloudflare's Data Processing Addendum which includes SCCs
Stripe's data processing agreement with SCCs

8. Data Retention

Account data — retained for the duration of your account, deleted upon account termination
Session data — expired sessions are deleted automatically; IP addresses and user agents are purged with the session record
Billing data — Stripe references retained for the period required by applicable tax and accounting regulations (up to 7 years)
Instance data — deleted when you destroy an instance or when your subscription ends
Infrastructure logs — Cloudflare retains request logs for up to 72 hours

9. Your Rights

9.1 Under the PDPO (Hong Kong)

Under the Personal Data (Privacy) Ordinance, you have the right to:

Request access to the personal data we hold about you (Data Access Request)
Request correction of inaccurate personal data (Data Correction Request)

Requests may be subject to a reasonable fee as permitted under the PDPO. We will respond within 40 days.

9.2 Under the GDPR (EEA/UK)

If you are located in the EEA, UK, or Switzerland, you additionally have the right to:

Access — obtain a copy of your personal data
Rectification — correct inaccurate data
Erasure — request deletion of your data ("right to be forgotten")
Restriction — restrict processing in certain circumstances
Portability — receive your data in a structured, machine-readable format
Objection — object to processing based on legitimate interests
Withdraw consent — where processing is based on consent

We will respond within 30 days. To exercise any of these rights, contact privacy@oclauncher.com.

You also have the right to lodge a complaint with a supervisory authority in your country of residence.

10. Data Security

We implement appropriate technical and organisational measures to protect your data:

All connections are encrypted via TLS (HTTPS)
Passwords are hashed using industry-standard algorithms
User-provided API keys are encrypted at rest using AES-GCM 256-bit encryption
Authentication tokens are cryptographically random
Each user's AI sandbox is fully isolated from other users
Database access is restricted to authenticated application workers

11. Children's Privacy

The Service is not directed to individuals under the age of 16. We do not knowingly collect personal data from children. If you believe we have inadvertently collected such data, please contact us and we will delete it promptly.

12. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be communicated by posting the updated policy on this page with a revised "Last Updated" date. Continued use of the Service after changes constitutes acceptance.

13. Contact Us

If you have questions about this Privacy Policy or wish to exercise your data rights:

OCLauncher
Email: privacy@oclauncher.com
Hong Kong SAR