1. Who is responsible for your data
FURNDECO FURNITURE LIMITED (Hong Kong) is the data user responsible for your personal data under the Personal Data (Privacy) Ordinance (Cap. 486) (“PDPO”), and the controller for the purposes of the EU and UK General Data Protection Regulation where those apply. Company details are on our Legal Information page. Privacy questions: support@furndecofurniture.shop (subject “Privacy”).
2. What we collect
| Data | When | Why | How long we keep it |
|---|---|---|---|
| Email address | You sign in or subscribe | Create your account, send sign-in links, receipts and service notices | While your account is open, then 30 days |
| Plan, billing dates, monthly image count | You use a plan | Provide your allowance and manage your subscription | While your account is open, then 30 days |
| Payment records (amount, date, last four card digits, country) | You pay | Process payments, refunds, tax and accounting | 7 years, as Hong Kong tax law requires business records to be kept |
| Generation settings (room, style, colour, extras text) | You press Generate | Produce the image and apply our content rules | Not stored after the request completes |
| Free-plan counter cookie | You generate without signing in | Count your 3 free images | Up to 40 days |
| Technical logs (IP address, browser type, time) | You visit the site | Security, fraud prevention, fixing errors | 30 days |
| Messages you send us | You email or call | Answer you and keep a record of support | 2 years after the conversation ends |
Images you make are not stored on our servers. The finished file is assembled in your browser and downloaded to your device. Nookly has no photo upload feature. We do not use your text or images to train AI models, and we don't sell or rent personal data.
3. Our six data protection principles
We follow the six Data Protection Principles of the PDPO:
- Purpose and manner of collection. We collect only what we need for the purposes above, lawfully and fairly, and tell you at the point of collection in our Personal Information Collection Statement.
- Accuracy and retention. We keep data accurate and no longer than the periods listed above.
- Use. We don't use your data for a new purpose without your express and voluntary consent. We don't send marketing emails unless you opt in.
- Security. Data is encrypted in transit (HTTPS with HSTS) and at rest by our hosting providers; access is limited to people who need it.
- Openness. This policy and our PICS are public.
- Access and correction. You can ask for a copy of your data and ask us to correct it. We respond within 40 days, as the PDPO requires.
4. Legal bases (EU and UK users)
- Contract: running your account, plan, payments and image generation.
- Legal obligation: keeping payment and tax records.
- Legitimate interests: security logs, preventing abuse and fraud, and enforcing our content rules.
- Consent: optional cookies and any marketing emails. You can withdraw consent at any time.
5. Who we share data with
We share personal data only with service providers who process it for us under contract, and only as much as they need:
- Website hosting and content delivery
- Account database and sign-in email delivery
- PCI DSS-compliant payment processing
- The AI image model provider, which receives the generation settings (never your email or name)
- Professional advisers and authorities where the law requires
6. Transfers outside Hong Kong
Some providers process data outside Hong Kong, including in the United States and the European Union. We follow the PCPD's Guidance on Cross-border Data Transfer, including its recommended model contractual clauses, as a matter of practice. For data about people in the EU or UK, we rely on adequacy decisions or the European Commission's Standard Contractual Clauses and the UK International Data Transfer Addendum.
7. Your rights
Everyone can ask us to access, correct or delete their personal data. Depending on where you live, you may also have the right to:
- restrict or object to processing, and receive your data in a portable format (EU / UK);
- know what data we collect, ask us to delete it and not be discriminated against for exercising your rights (California and other US states). We do not sell or share personal information for cross-context behavioural advertising;
- withdraw consent at any time, without affecting earlier processing.
Email support@furndecofurniture.shop. We may ask you to confirm you control the account email. Deleting your account removes your email and plan data within 30 days, except payment records we must keep by law.
8. Complaints
Please tell us first so we can fix it. You can also complain to the Office of the Privacy Commissioner for Personal Data, Hong Kong (PCPD). If you are in the EU or UK, you may complain to your local data protection authority, such as the UK Information Commissioner's Office.
9. Data breaches
Hong Kong does not currently require breach notification. We will notify the PCPD and affected people anyway where a breach creates a real risk of harm, and we will meet any notification duties that apply under other laws, such as the GDPR.
10. Children
Nookly is not directed at children under 16 and we don't knowingly collect their personal data. If you believe a child has given us data, contact us and we will delete it.
11. Cookies
See our Cookie Policy. We use essential cookies only, unless you allow optional ones.
12. Changes
Hong Kong's data protection law is under review. We will update this policy if the requirements change, and we will email account holders about material changes before they take effect.