Version 1.3 · Last updated 18 October 2026
In short
- No cookies, no analytics, no advertising, no tracking, and no fonts or scripts loaded from third parties.
- Your sign-in, your Self-Assessment answers and your chat stay in your own browser.
- Questions to the assistant and matchmaking descriptions go once to our AI provider, xAI. We do not store them, and xAI does not train on them.
- We ask for your name, company and work email only when you request member access, and we never sell or share personal data for marketing.
1. Who is responsible
The GCC AI Hub at gcchk-ai.com is run by the AI Committee of the German Chamber of Commerce, Hong Kong. The committee is part of the Chamber, which is responsible for the personal data processed on this platform (the “data user” under Hong Kong law and the “controller” under the GDPR). In this policy, “we” and “us” mean the Chamber acting through the committee.
German Chamber of Commerce, Hong Kong
AI Committee, GCC AI Hub
2302, 23/F COFCO Tower, 262 Gloucester Road
Causeway Bay, Hong Kong
info@hongkong.ahk.de · +852 2526 5481
Requests about your personal data are handled by the Chamber’s Data Protection Officer at this address; please mark your message “GCC AI Hub privacy”.
This policy covers this platform only. When you write to the Chamber, attend its events or use its main website, the Chamber’s privacy policy applies.
2. Which laws apply
We are established in Hong Kong, and our handling of personal data follows the Personal Data (Privacy) Ordinance (Cap. 486, the “PDPO”) and its six Data Protection Principles.
Many of our members work with the EU General Data Protection Regulation (the “GDPR”), and we design the platform to its standard as well. Where the GDPR applies to our processing, we rely on these legal bases: our legitimate interest in running a secure, working platform for the Chamber’s members and in answering the questions you send us (Article 6(1)(f)); the membership relationship for the member features (Article 6(1)(b)); and consent for the listing of provider contact persons (Article 6(1)(a)).
3. What we process and why
The only form that asks for your name and email address is the request for member access. Personal data is processed only in the situations below. You never have to give us personal data: what you type into the assistant or matchmaking is up to you, and without a member account you can still use every public page.
Visiting any page
- Data
- Your IP address, the page requested, date and time, and the technical information your browser sends (such as browser type and referring page).
- Why
- To deliver the pages to you securely and to protect the platform against attacks and abuse.
- Where
- Our hosting provider, Vercel, processes it in its request logs and in its firewall, which counts requests per IP address to stop abuse such as password guessing. We do not use it to identify or profile you.
- How long
- The logs we can see are deleted after one day; the firewall’s counters last at most ten minutes. Vercel processes request data for its own security and operations under its privacy notice.
Asking the platform assistant
- Data
- The question you type, and your IP address (or, when you are signed in, a one-way code derived from your sign-in token) for the hourly question limit.
- Why
- To answer your question and point you to the right pages, and to keep the service from being abused.
- Where
- The question is sent once to xAI, whose AI model writes the answer. The conversation is kept in your browser tab only. See the AI Transparency Statement.
- How long
- We do not store questions. xAI may keep them for up to 30 days to investigate abuse (section 5). The IP address or code is held in server memory for at most one hour. The conversation in your browser is deleted when you close the tab.
Member account
- Data
- Your name, company, work email address, your role if you give it, and your password, which is stored only as a one-way hash and is never visible to us. With it: when you requested access, confirmed your email address, were approved and last signed in.
- Why
- To check that you work for a member company of the Chamber, to give you your own login, and to keep the accounts secure.
- Where
- Our sign-in provider, Supabase, keeps the account in its Seoul data centre. Once you have confirmed your email address, your request, with your name, company, role and email address, is emailed to the committee member who approves access; if your address is still unconfirmed after a day, that committee member is told, so they can send you a personal link from their own mailbox, and if your confirmed request still waits for a decision after two days, they are reminded once. Our emails to you (confirmation, approval, password reset) are sent through Resend. Your signed-in session is kept in your browser. To stop password guessing and floods of emails, our server counts sign-up, sign-in, password reset and confirmation requests per IP address and per email address; the email address is kept only as a one-way code. Supabase’s service logs record sign-in requests, including the IP address, for security.
- How long
- As long as you have member access. We delete your account when you ask us to, when we learn that your company has left the Chamber, or when a request is declined. Requests whose email address is not confirmed within 30 days are deleted automatically, unless the committee has already approved them. The request counters are held in our server’s memory for at most one hour. Supabase keeps its service logs for seven days, and a deleted account stays in its daily backups for up to seven days.
Matchmaking (members)
- Data
- The topic you choose, the description you add, and a one-way code derived from your sign-in token for the hourly request limit.
- Why
- To suggest member companies that fit your need.
- Where
- A description, if you add one, is sent once to xAI for analysis. A topic alone is matched on our server without AI.
- How long
- We do not store descriptions. xAI may keep them for up to 30 days to investigate abuse (section 5). The code is held in server memory for at most one hour.
Self-Assessment (members)
- Data
- Your answers and your result.
- Why
- So you can pause and continue, and see your result.
- Where
- In your browser only. Your answers are never sent to us. To compare your result, your browser fetches the anonymous benchmark from our server; your answers stay on your device.
- How long
- Until you choose “Start again” or “Retake”, sign out, or clear your browser data.
Provider contact persons
- Data
- The name of a contact person at a listed member company, with the company, its website and its AI offering.
- Why
- To connect members who look for AI support with member companies who provide it.
- Where
- Provided by the member companies to the Chamber with their consent to be listed. Contact persons are shown only to signed-in members, in the provider directory and in matchmaking results.
- How long
- As long as the company is listed. A contact person can ask to be removed at any time.
Use cases name the presenting company only with its written consent, and only for signed-in members. The HKU Research Project results are aggregates: they contain no company names or individual answers. Adding an event to your calendar creates the calendar file in your browser; nothing is sent to us.
We do not make automated decisions about you, we do not build profiles, and we do not use personal data for direct marketing.
4. Cookies and browser storage
The platform sets no cookies. It uses no analytics, advertising or social media tools, and it loads no fonts or scripts from other companies: our fonts are served from our own domain. If our hosting provider’s firewall suspects automated traffic, it may ask your browser to pass a security check and remember the result for one hour in a cookie, used only for that security purpose. To make the features you use work, it saves a few entries in your browser’s own storage, which never leave your device unless noted:
Kept until they expire or you clear them
- gcc-session
- Your signed-in member session (a short-lived access token and a token to renew it), sent to our server with requests for member content. Removed when you sign out.
- gcc-ai-assessment-v1
- Your Self-Assessment answers.
- gcc-view-override
- Remembers if a signed-in member switched to the public view.
Deleted when you close the tab
- gcc-chat-history-v1
- Your conversation with the assistant, so it survives following a suggested link.
- gcc-chat-open
- Whether the assistant panel is open.
Because these entries are strictly necessary for features you ask for, and nothing tracks you, we do not show a cookie banner. You can delete them at any time in your browser settings, or by signing out, which removes your Self-Assessment answers and your conversation with the assistant from this browser.
5. Service providers
We use four service providers that process personal data for us:
- Vercel Inc. (United States) hosts the platform, delivers the pages through its global network and runs our server functions in the United States, under its data processing addendum.
- xAI (United States) provides the AI model behind the assistant and the matchmaking description analysis, under its data processing addendum. It receives the text you type into these two features, together with our list of pages (assistant) or the published profiles of the listed member companies: company name, services and keywords, never contact persons or websites (matchmaking). It does not use that text to train its models, and it may keep it for up to 30 days to investigate suspected abuse before deleting it.
- Supabase Inc. (United States) runs our member accounts and sign-in, and stores the accounts in its Seoul data centre.
- Resend (United States) sends our emails: email confirmations, approval requests and decisions, and password resets.
Within the committee, only the member who approves access sees access requests. We do not sell personal data or pass it to anyone else, unless the law requires us to.
6. Transfers outside Hong Kong
Our service providers are based in the United States. Vercel runs our server functions there and may deliver pages from a location near you. xAI’s service may handle a request in the United States or in another region. Supabase stores member accounts in Seoul. We choose providers that commit by contract to protecting the data they process for us, and we send them only what each feature needs. Vercel is also certified under the EU-U.S. Data Privacy Framework.
7. How long we keep data
We keep personal data no longer than we need it. In practice, we store almost nothing: questions and descriptions are not stored, the data behind the hourly limits disappears from memory within an hour, and everything else sits in your own browser for the periods in section 4. Hosting logs are deleted after one day, and xAI deletes requests after at most 30 days, as described in sections 3 and 5. Provider listings are kept while the company is listed. Member accounts are kept while you have member access, and unconfirmed requests for 30 days at most; Supabase’s service logs and backups are deleted after seven days (section 3).
8. Security
All traffic is encrypted (HTTPS, enforced by the browser). Passwords are stored only as one-way hashes. Member content is released by our server only after it has checked a valid, signed sign-in token; it is never part of the public page code. Sign-in attempts and AI requests are rate limited, and access to our hosting and provider accounts is restricted to the people who run the platform.
No system is completely secure. If you find a weakness, please report it as described under “Reporting a security issue” in the Legal Notice. If a data breach affects you, we will inform you and, where appropriate, the Privacy Commissioner.
9. Your rights
Under the PDPO, you can ask whether we hold personal data about you, request a copy of it, and ask us to correct it. We answer data access and correction requests within 40 days. The PDPO allows us to charge a fee for a data access request that is not excessive; we will tell you before we charge anything.
Where the GDPR applies, you also have the right to erasure, to restriction of processing, to data portability, and to object to processing based on our legitimate interests. Where we rely on consent, you can withdraw it at any time with effect for the future.
You can also ask us at any time to delete your member account. To use any of these rights, write to info@hongkong.ahk.de. Since we store almost nothing that identifies you, we may not be able to link a request to any data; we will tell you if so.
You can complain to the Office of the Privacy Commissioner for Personal Data, Hong Kong. Where the GDPR applies, you can also complain to a data protection supervisory authority in the EU, in particular where you live or work. We would appreciate the chance to address your concern first.
10. Changes
We update this policy when the platform changes, for example before we introduce a new sign-in method or a new service provider. The version and date at the top show the current version. We will point out significant changes on the platform before they take effect.