Payback+ — Personal Information Collection Statement and Privacy Policy Statement
This Privacy Policy Statement explains how PAYBACK TECH LIMITED ("Payback+", "we", "us", or "our") collects, uses, holds, shares, retains, and otherwise handles personal data when you use the Payback+ mobile application and related services (the "App").
We are committed to handling personal data in accordance with the Personal Data (Privacy) Ordinance (Cap. 486) of Hong Kong ("PDPO"), where applicable.
This Privacy Policy Statement describes our general policies and practices in relation to personal data. We may also provide additional personal information collection statements or in-app notices at or before the time personal data is collected for specific features or purposes.
By using the App, you acknowledge that you agree and provide consent that your personal data will be handled by Payback+ as described in this Personal Information Collection Statement and Privacy Policy Statement.
We collect personal data that is reasonably necessary to provide, operate, maintain, support, secure and improve the App and its related features.
A. Information You Provide
You may provide personal data to us when you:
create or access an account;
complete onboarding;
add friends, create or join shared expense flows, or use reminders, settlement, assistant-style, bill tracking, due date, income organization, or related App features;
contact us for support or other inquiries; or
otherwise submit information through the App.
Depending on how you use the App, this may include:
your nickname, display name, or other profile information you choose to provide within the App;
your preferred payment method or settlement-related details that you choose to provide;
shared expense records, reminders, settlement records, bill records, due date entries, income entries, and related information you choose to input into the App;
messages, feedback, or support requests you send to us; and
your email address or other contact details if you choose to provide them, including when you contact us and request a reply.
B. Authentication and Account Access Data
Payback+ may use third-party sign-in providers, such as Apple, Google, or Facebook, together with authentication service providers, to authenticate users and help operate account access.
In connection with that authentication process, we may receive limited personal data from the relevant sign-in provider or authentication service, depending on the provider and your settings or permissions. This may include your email address, basic account identifier, or other limited profile or authentication-related information made available for sign-in and account operation purposes. We do not use your third-party sign-in name or profile photo to pre-fill onboarding, and we do not store your third-party password.
C. Device, Technical, and Usage Data
We may automatically collect personal data and other technical information reasonably necessary to operate, secure, maintain, and improve the App, such as:
device and app-related identifiers;
push notification tokens;
log, diagnostic, crash, and performance data; and
technical usage data relating to App functionality, reliability, and security, feature usage, and service performance.
D. Shared Expense, Friend, and Group Data
Because the App is designed to support coordination, reminders, and shared expense experiences between users, we may collect and generate records relating to your approved friends, groups, shared expense activities, reminders, settlements, and related interactions within the App.
This may include personal data contained in shared records and limited relationship or interaction data that is reasonably necessary to operate, support, secure, and improve these App features.
We may provide additional personal information collection statements, just-in-time notices, or in-app explanations at or before the time personal data is collected for specific features, functions, or purposes.
At the relevant point of collection, we may explain, where applicable:
what personal data is being collected;
the purpose or purposes for which the personal data is collected and will be used;
whether it is obligatory or voluntary for you to provide the personal data;
the consequences if you do not provide any personal data that is marked as obligatory;
the classes of persons to whom the personal data may be transferred or disclosed; and
how you may request access to or correction of your personal data.
Unless otherwise indicated at the relevant point of collection:
personal data that is required for account creation, authentication, security, core App functionality, or the provision of a requested feature may be marked as mandatory or obligatory; and
personal data requested for profile completion, personal organisation, optional payment method display, optional income tracking, optional bill tracking, optional due date tracking, or other optional features may be marked as optional or voluntary.
If you do not provide personal data that is marked as mandatory or obligatory, we may be unable to create your account, provide the relevant feature, respond to your request, or otherwise deliver the relevant part of the App or service to you.
This Privacy Policy Statement sets out our general policies and practices. Where a specific personal information collection statement or in-app notice applies to a particular feature or collection point, that notice should be read together with this Privacy Policy Statement.
We may use personal data for the following purposes:
to create, authenticate, and manage accounts;
to provide, operate, maintain and support the App and its shared expense, reminder, settlement, bill tracking, due date, income tracking, and related App features;
to support onboarding and user preferences or configuration settings;
to communicate with you in relation to your account, including where follow-up is reasonably needed in response to support requests or inquiries;
to send service-related messages and notifications, including reminders, bill alerts, due date notifications, and other notifications based on your settings and use of the App;
to maintain security, detect or investigate misuse, prevent fraud or unauthorized activities, and enforce our Terms & Conditions;
to troubleshoot issues, monitor performance, and maintain or improve App reliability, functionality, security, and stability;
to analyze usage patterns, feature interactions, and service performance for internal analytics, service improvement, product development, and user experience improvement;
to support assistant-like, automated, recommendation, reminder, and workflow-related features within the App;
to provide, operate, and support optional personal organization, income tracking, bill tracking, due date, and reminder-related features within the App;
to send bill reminders, due date alerts, and related service notifications based on information and settings you choose to provide;
to conduct analytics, internal research, and product or service improvement; and
to comply with applicable legal or regulatory requirements; and
to establish, exercise, or defend legal claims, and to protect our rights, users, and services.
If you contact us through the App, we may use the contact information available to us, including an email address you provide or an account-related email address associated with your sign-in method, to respond where appropriate. We may not respond to every submission, including general suggestions or feedback, where follow-up is not reasonably necessary.
We do not use personal data for direct marketing purposes unless we have provided any notice and obtained any consent required under applicable law.
We do not sell your personal data.
We may disclose or transfer personal data only to the extent reasonably necessary for the purposes described in this Privacy Policy Statement, including the operation of the App, the services it depends on, legal or regulatory compliance, security, and business continuity.
A. With Other Users
Because Payback+ is a shared expense and coordination app, personal data and related records that you create, input, or choose to share may be visible to relevant users within the App, such as your approved Payback+ friends, group participants, or users involved in the same expense, reminder, bill, due date, settlement, or related workflow.
Where you choose to provide payment method or settlement-related details, those details are intended to be visible only within the relevant shared expense, settlement, or related in-app context to the applicable approved Payback+ friends, group participants, or splitters involved in that flow, and not to users generally across the App.
B. With Service Providers and Data Processors
We may disclose personal data to service providers, contractors, cloud providers, analytics providers, crash reporting providers, authentication providers, infrastructure providers, notification delivery providers, data processors or sub-processors that provide services to us or on our behalf, only to the extent reasonably necessary for the operation, maintenance, support, security, or improvement of the App.
These may include providers of the following services:
user authentication and account access services;
cloud hosting, storage, and infrastructure services;
analytics, diagnostics, crash reporting, and performance monitoring services;
push notification and communications delivery services;
customer support or technical support services; and
professional advisory, audit, or compliance support services.
Where applicable, such parties are required to process personal data only for authorised purposes and subject to appropriate contractual or operational safeguards.
C. For Legal, Regulatory, Security, and Protection Purposes
We may disclose personal data to relevant persons, professional advisers, regulators, law enforcement agencies, courts, tribunals, or other public authorities where reasonably necessary to:
comply with applicable law, regulation, legal process, or lawful request;
enforce our Terms & Conditions or other applicable agreements;
detect, investigate, prevent, or address fraud, misuse, security issues, or technical issues; or
protect the rights, property, safety, or interests of PAYBACK TECH LIMITED, or others.
D. Business Transfers or Corporate Transaction
If PAYBACK TECH LIMITED is involved in or proposes to be involved in a merger, acquisition, financing, restructuring, sale of assets, transfer of business, or similar corporate transaction, personal data may be disclosed or transferred to relevant parties as reasonably necessary in connection with that transaction, subject to applicable legal requirements.
We retain personal data for as long as reasonably necessary to fulfil the purposes for which the data is collected or subsequently used, unless a longer retention period is required or permitted under applicable law.
The retention period for personal data may vary depending on the nature of the data, the purpose for which it is used, operational and security needs, the sensitivity of the data, and applicable legal, regulatory, accounting, or compliance requirements.
We may retain personal data for purposes including:
providing, operating, maintaining, and supporting the App;
maintaining shared expense records, reminders, bill tracking records, due date records, settlement records, and related historical records;
handling user support, service improvement, internal administration, and security;
complying with legal or regulatory obligations;
establishing, exercising, or defending legal claims;
resolving disputes; and
enforcing our Terms & Conditions and protecting our rights, services, and users.
If you request deletion of your account, we will take reasonable steps to delete, de-identify, or de-activate personal data associated with your account within a reasonable period, , subject to the retention needs and exceptions described in this Privacy Policy Statement We generally aim to process account deletion requests within 30 days.
If you request deactivation of your account, your account may be disabled from active use within the App. If you later sign in again using the same sign-in method or account credentials associated with that account, we may treat that sign-in as a request to reactivate the account, subject to our then-current operational processes.
Before processing an account deletion request or other sensitive account-related request, we may require reasonable identity verification, including re-authentication through the relevant sign-in provider or other reasonable verification steps.
We may retain certain personal data after account deletion where reasonably necessary for one or more of the following purposes:
preserving shared expense history, balances, settlement context, or related records for other users;
maintaining system integrity, audit trails, security, fraud prevention, or backup processes;
complying with legal or regulatory obligations;
resolving disputes; or
establishing, exercising, or defending legal claims, or enforcing our Terms & Conditions and protecting our rights, services, and users.
Where account-related records remain necessary in a shared expense or historical record context, relevant information may continue to appear to relevant users within that context, but the deleted account will no longer function as an active account.
Personal data may also remain in secure backup systems for up to 90 days before being overwritten or deleted in the ordinary course.
If you deactivate your account, your account may be disabled from active use within the App. If you later sign in again using the same sign-in method or account credentials associated with that account, we may treat that sign-in as a request to reactivate the account, subject to our then-current operational processes.
If you delete your account, your account access will be disabled or terminated, subject to our operational processes. If you request deletion of your account, your access to the account will be disabled or terminated in accordance with our operational processes. Subject to applicable retention requirements and the limitations described in this Privacy Policy Statement, we will take reasonable steps to delete or de-identify personal data associated with your account within a reasonable period. Once deletion is completed, your account and associated personal data will not be recoverable.
Because Payback+ involves shared expense records and coordination between users, deleting an account may not automatically remove historical shared records, reminders, settlement context, or related entries that have already been created, shared, or relied on by other relevant users.
Where continued retention of certain records is reasonably necessary to avoid affecting the records of other users, those records may remain visible within the relevant shared context. Profile image uploads associated with a deleted account may be removed or no longer displayed as active profile images. Certain limited identifying elements, such as a name or historical identifier already embedded in a shared record, may remain within that historical context where reasonably necessary to preserve the integrity and usability of the record for other relevant users.
We may also retain information in de-identified, or aggregated form where it no longer identifies an individual and where such retention is reasonably necessary for internal analytics, service improvement, security, compliance, or operational purposes.
We may use push notification tokens and related technical information to send reminders, bill alerts, due date notifications, operational notifications, service messages, and other app-related communications based on your settings, device permissions, and use of the App.
If you no longer wish to receive push notifications, you may manage notification permissions through your device or application settings, subject to device and operating system functionality.
We take reasonable administrative, technical, and organizational measures designed to help protect information under our control from unauthorized access, loss, misuse, alteration, or disclosure.
However, no method of electronic storage, transmission, or processing is completely secure, and we cannot guarantee absolute security.
Access to certain information may be available to authorized personnel, service providers, or support personnel on a need-to-know basis where reasonably necessary for support, maintenance, operations, security, compliance, or related business purposes.
Personal data may be transferred to, stored in, processed in, or accessed from jurisdictions outside Hong Kong, including where our service providers, data processors, infrastructure providers, or support operations are located.
Where personal data is transferred outside Hong Kong,we will take reasonable steps to ensure that the personal data continues to be protected by safeguards appropriate to the circumstances and handled in a manner consistent with applicable data protection requirements.
Subject to applicable law and the requirements of the Personal Data (Privacy) Ordinance (Cap. 486) of Hong Kong, you may have the right to request access to and correction of your personal data held by us.
You may also, depending on the circumstances and subject to our operational processes and applicable legal or regulatory requirements:
update certain account information within the App, where that functionality is available;
choose whether to provide certain optional personal data;
manage notification permissions through your device settings;
request deactivation or deletion of your account; and
contact us through the in-app "Contact Us" function regarding privacy-related questions or requests.
We may need to verify your identity and evaluate the scope of your request before taking action.
Requests for access to or correction of personal data should be made by contacting us using the contact details set out below. We may require sufficient information to identify you and the personal data to which your request relates. We will handle such requests in accordance with applicable legal requirements.
Some personal data may not be corrected, deleted, or erased immediately, or at all, where retention is reasonably necessary for shared record integrity, legal or regulatory compliance, dispute handling, security, audit purposes, or other legitimate operational purposes permitted by law.
Privacy Contact
If you have any questions about this Privacy Policy Statement or wish to make a request relating to your personal data, you may contact us at:
PAYBACK TECH LIMITED
Email: info@paybacktech.com
Address: UNIT 1104A, 11/F, KAI TAK COMM BUILDING, NO. 317-319 DES VOEUX RD CENTRAL, HONG KONG
The App is not directed to children under the age of 13, and we do not intend to knowingly collect personal information directly from children under 13 through the App.
If you believe a child under 13 has provided personal information to us, please contact us so that we can take reasonable steps to review and address the matter.
If stricter age-related requirements apply under the laws of your jurisdiction, you must use the App only in compliance with those laws.
We may update this Privacy Policy from time to time.
If we make material changes, we may provide notice through the App or by other reasonable means. Your continued use of the App after the effective date of an updated Privacy Policy constitutes your acknowledgment of the updated version, to the extent permitted by applicable law.
If you have questions, concerns, or requests regarding this Privacy Policy Statement or our handling of personal data, you may contact us at:
PAYBACK TECH LIMITED
Email: info@paybacktech.com
Address: UNIT 1104A, 11/F, KAI TAK COMM BUILDING, NO. 317-319 DES VOEUX RD CENTRAL, HONG KONG
You may also contact us through the in-app "Contact Us" function.