Version 1.1 · Effective 25 October 2026

Privacy Policy

The data user and controller for this policy is DELI FIX LIMITED, a company incorporated in Hong Kong SAR. ninkr is the product name. This policy covers the public website at ninkr.ai and its authenticated Workspace. Workspace access is restricted to accounts approved by the operator.

The Personal Data (Privacy) Ordinance (Cap. 486) of Hong Kong is the primary framework used to write this policy. Where the EU GDPR, the UK GDPR, the Australian Privacy Act 1988 and the Australian Privacy Principles, or another mandatory privacy law applies to a person or to a processing activity, that law also applies. This policy does not claim that the operator complies with every privacy law in the world.

1. The public website

The homepage uses browser code for navigation and decorative effects. No analytics or advertising tag is configured. Google sign-in is available to approved accounts. Sign-in uses essential OAuth state and session cookies, marked HttpOnly, SameSite=Lax and Secure on HTTPS. The server may keep ordinary connection logs, including an address, time and requested page. There is no public self-registration.

2. Contact by email

The public site publishes [email protected] for a general question and [email protected] for a privacy question. A message sent to those addresses, and the address you write from, are kept so the operator can reply and keep a record of that reply. They are not used to build a marketing list. This site does not ask for marketing consent.

3. Workspace account

Workspace sign-in, when the operator has allowed an account, uses Google. The application stores the Google subject identifier, email address, display name, and picture URL for that allowed user. There is no public self-registration on this website. Account data is used to recognise the allowed user and to keep the session.

4. Workspace content

The Workspace can store the task you start, agent runs, and files you upload, so the task can continue. Uploaded files are stored on the application server. Content is used to carry out the task you started. It is not sold.

5. Application logs

The Workspace application writes operational logs, including request timing, to operate and protect the service. Those logs can contain technical identifiers. They are not a customer analytics product.

6. Purposes and bases

Under the Hong Kong Ordinance, personal data is collected for the purposes stated in this policy and is not used for a new purpose without the consent or other ground the Ordinance requires. Where the EU or UK GDPR applies, the operator relies on the steps needed to provide a service you asked for, on its legitimate interest in keeping the service secure and working where that interest is not overridden by your rights, and on a legal obligation where one applies. Where the Australian Privacy Principles apply, personal information is collected by lawful and fair means for those same purposes. A purpose that is not described here is not claimed.

7. Model providers

When a model API is configured, Workspace instructions, relevant uploaded-file content and retrieved information can be sent to the configured model API so the task can be carried out. Search queries can be sent to the configured search provider when live search is used. This policy does not claim that the provider never stores that text, never uses it to train a model, or deletes it immediately. The product does not set the provider’s training use.

Cloudflare provides the public network edge and Tunnel connection; it processes connection information and website requests as part of delivering and protecting the service. Account data is shared with Google for sign-in. Relevant task content is shared with a model provider when a model call is made. Search queries are shared with a search provider when live search is used. People who operate the service can access the systems that hold the data. Information is not sold. This policy does not publish a complete list of every vendor that may process data.

9. International transfers

The public website and Workspace application run on the product virtual machine in Sydney, reached through Cloudflare’s network. Cloudflare may process requests outside Australia. Google sign-in and configured model or search providers may process information in other locations. This policy does not claim that every copy of data stays in Australia or in Hong Kong. Where a transfer law applies, the operator handles the transfer as that law requires. A separate transfer agreement is not published on this page.

10. Retention and deletion

Information is kept while it is needed for the purpose stated in this policy, including operating the service, keeping a session, and answering a request. A Workspace session expires according to the application’s session lifetime. You may ask for deletion of account or Workspace information the operator holds. What can be deleted depends on what the product and backups can actually remove. This policy does not state a fixed number of days.

11. Security

Workspace sign-in and API interfaces are publicly reachable, but access to user content and actions requires an authenticated, approved account. Workspace sign-in, where it is offered, is limited to accounts the operator has allowed, and the session cookie is not readable by page scripts. This policy does not claim a security certification, a penetration-test result, or end-to-end encryption.

12. Cookies and analytics

No analytics script is configured. Essential session and OAuth cookies are used when you sign in. Session cookies are HttpOnly, SameSite=Lax and Secure on HTTPS. Short-lived state and return-path cookies protect Google sign-in. These cookies are used for authentication, not advertising.

13. Access, correction, and other rights

You may ask to see or correct the personal data the operator holds about you, and you may object to or restrict a use, or ask for erasure, where the law that applies to you gives that right. Under the Hong Kong Ordinance you may make a data-access or data-correction request. Where the GDPR or UK GDPR applies, you may also have the right to complain to a supervisory authority and, where the processing is based on consent, to withdraw that consent. Where the Australian Privacy Principles apply, you may ask for access or correction and may complain about a handling of your information. The operator will respond as the applicable law requires.

14. Children

The service is not offered as a product for children, and this website does not knowingly ask a child to create an account. A minimum age is not stated because the operator has not set one on this page.

15. Complaints and contact

Write a privacy question or a complaint to the operator at [email protected]. Where the Hong Kong Ordinance applies, you may also complain to the Office of the Privacy Commissioner for Personal Data. Where the EU or UK GDPR applies, you may complain to a supervisory authority. Where the Australian Privacy Act applies, you may complain to the Office of the Australian Information Commissioner.

16. Changes

A material change will be shown on this page with a new version and effective date. The version in force is the one stated at the top of this page.