Privacy Policy
This policy explains how ThinkAsModel Limited (思模科技有限公司), a Hong Kong company (“we”, “us”), collects, uses, and protects your personal data when you use the alayo.ai website and the Alayo app. The principle up front: we collect the minimum data needed to operate, we run no third-party analytics, and we never sell personal data.
1. What we collect
- Presale list: the email address you provide when joining the presale list, plus your answers to two optional questions and the time of sign-up. This is stored in key-value storage with our infrastructure provider, Cloudflare.
- Purchase information (once checkout opens): billing and card details are collected and processed directly by the payment provider (Paddle or Stripe) and never pass through our servers; we receive only the order records needed for fulfillment (order and customer identifiers, license status), stored in a Cloudflare database.
- Email correspondence: whatever you write to [email protected].
- Site visits: this site uses no third-party analytics and no advertising cookies. It is hosted on Cloudflare Pages, and Cloudflare, as the infrastructure provider, may keep standard access logs (such as IP addresses) for security and operations. Page fonts are loaded from Google Fonts (fonts.googleapis.com / fonts.gstatic.com), so Google receives standard request metadata such as your IP address.
2. The Alayo app itself
Alayo is local-first: your files stay on your device unless you explicitly invoke an AI feature that needs selected content. The app requires no account. Before the first request using included Alayo AI credits, the app explains the transfer and asks for your consent.
- Your own key (BYOK): relevant content is sent directly from the app to the model endpoint you configured, under that provider’s terms. Your key stays in the macOS Keychain.
- Included Alayo AI: relevant file content, filenames, and instructions are relayed through our Cloudflare Worker to OpenRouter and the selected underlying model provider. We do not retain request bodies or model responses. We retain only metering and abuse-prevention metadata: a pseudonymous installation or license identity, feature type, routed model, token counts, cost and credit totals, timestamps, and short-lived IP rate-limit counters. Included credits require no account, are promotional, and are not sold.
3. How we use it
- To notify the presale list when checkout opens and share product progress (you can unsubscribe anytime);
- To process orders, issue licenses, and handle refunds;
- To answer your questions and support requests;
- To meet legal and accounting obligations.
That’s it. We will not use your email for marketing beyond the above, and we will not hand it to any third party for marketing.
4. Who we share it with
Only with the providers we need to operate, and only to the minimum extent required: payment providers (Paddle / Stripe), infrastructure providers (Cloudflare), and, when you use AI, the model providers described in Section 2. BYOK requests go to your configured endpoint; included Alayo AI requests pass through our Cloudflare relay to OpenRouter and an underlying model provider. Their terms and privacy policies apply to their processing. We may disclose data where the law requires it. We never sell personal data.
5. Data retention
Presale-list emails are kept until you unsubscribe or for a reasonable period after the presale ends; order and license records are kept as required by applicable law and accounting rules. Included-AI quota ledgers and balances are kept as needed to administer credits, prevent abuse, and reconcile provider charges; IP rate-limit counters are deleted after their short operational window. Request bodies and model responses are not retained by Alayo. Data past its retention period is deleted or anonymized.
6. International transfers
Our providers (Cloudflare, Paddle, Stripe, Google Fonts, OpenRouter, and underlying model providers) operate globally, so your data may be processed outside Hong Kong. A provider you configure through BYOK may likewise process content outside Hong Kong (see Section 2). We only use providers with industry-standard security safeguards.
7. Your rights
Under the Hong Kong Personal Data (Privacy) Ordinance (PDPO), you have the right to access and correct your personal data, and you may leave the presale list at any time (we will delete the corresponding list record). You may also request deletion of other personal data to the extent applicable law allows and it does not conflict with statutory retention duties such as accounting, dispute handling, or fraud prevention. Just email [email protected] and we will act promptly.
8. Changes to this policy
We may update this policy from time to time and will revise the “Last updated” date above; material changes will be announced on the Site or by email.
9. Language and contact
This policy is provided in English and Chinese; if the versions diverge, the English version prevails. Privacy questions: [email protected].