Privacy Policy

Effective date: 1 March 2026 · Last updated: October 2026

TIPME is a service operated by Arkitecna Hong Kong Ltd, Pioneer Centre, 18/F, 16–18A, 700 Nathan Rd., Kowloon, Hong Kong S.A.R. | Licence No. 78080919

1. Introduction

Arkitecna Hong Kong Ltd ("Arkitecna", "we", "us", or "our") operates the TIPME platform, including the website at tipme.it, the guest-facing payment screens, and the Business Dashboard (collectively, the "Platform").

This Privacy Policy explains what personal data we collect, why we collect it, how we use it, and your rights in relation to it. It applies to all users of the Platform, including venue partners ("Business Users"), their staff members ("Staff"), and end-users who interact with the guest-facing payment flow ("Guests").

By accessing or using the Platform, you acknowledge that you have read and understood this Privacy Policy. If you do not agree, please discontinue use of the Platform immediately.

2. Data Controller

The data controller for personal data processed through the Platform is:

Arkitecna Hong Kong Ltd
Pioneer Centre, 18/F, 16–18A
700 Nathan Road, Kowloon
Hong Kong S.A.R.
Licence Registration No.: 78080919
Email: tipme@arkitecna.com

For all privacy-related enquiries, including data access or deletion requests, please contact us at the email address above.

3. Data We Collect

3.1 Business Users (Venue Partners)

When a venue registers on TIPME, we collect:

• Full name and contact details (email, phone number)
• Business name, trading address, and VAT/registration number
• Stripe Connect account information (processed and stored by Stripe)
• Bank account details provided to Stripe for payout purposes
• Login credentials (email and hashed password)
• IP address and device information at time of registration and login
• Usage data: pages visited, features used, dashboard activity logs

3.2 Staff Members

Business Users may register their staff members on the Platform (Business Accounts). For each staff member, we store:

• Name and job role/title
• Profile photo (if uploaded by the Business User)
• Active/inactive status
• Aggregate feedback ratings associated with their profile

Important: Business Users are responsible for obtaining any necessary consent from their staff members before registering them on the Platform and before publishing their name, photo, and rating data on the guest-facing payment screen.

3.3 Guests (Tip Payers)

When a Guest interacts with the TIPME payment screen, we collect the minimum data necessary to process the tip:

• Payment data — processed exclusively by Stripe. TIPME never stores card numbers, CVVs, or full bank details.
• Tip amount and currency
• Star rating (1–5) and staff selection, if voluntarily provided
• Stripe PaymentIntent ID (for audit trail and idempotency purposes)
• IP address and basic device/browser metadata (for fraud prevention and rate limiting)

We do not collect Guest names, email addresses, or any identifying personal information. Feedback submitted by Guests is entirely anonymous.

3.4 Automatically Collected Data

We automatically collect the following data from all users:

• Log data: IP addresses, browser type, pages accessed, timestamps
• Device information: operating system, screen resolution, language settings
• Cookies and similar tracking technologies (see Section 9)
• Referral URLs and UTM parameters

4. Legal Basis for Processing

We process personal data on the following legal bases under applicable data protection laws, including the Hong Kong Personal Data (Privacy) Ordinance (Cap. 486) and, where applicable, the EU General Data Protection Regulation (GDPR):

5. How We Use Your Data

• To operate the Platform: processing tips, routing funds via Stripe, maintaining Business User accounts, generating QR codes.
• To provide the Feedback & Ratings feature: storing anonymous guest ratings, calculating staff performance statistics, displaying results in the Business Dashboard.
• To communicate with you: sending payment confirmations, account alerts, product updates, and (where consented) marketing emails.
• To improve the Platform: analysing usage patterns, diagnosing technical issues, and developing new features.
• To prevent fraud and abuse: rate limiting, verifying PaymentIntent IDs with Stripe, detecting suspicious activity.
• To comply with legal obligations: maintaining financial records, responding to lawful requests from authorities.

6. How We Share Your Data

6.1 Stripe

All payment processing is handled by Stripe, Inc. and its affiliates. When a Guest makes a tip, their payment details are sent directly to Stripe and governed by Stripe's Privacy Policy. TIPME receives only a PaymentIntent ID and transaction confirmation — never raw card data.

6.2 Infrastructure & Cloud Providers

We use trusted third-party infrastructure providers for hosting, database, file storage, and email delivery. These processors act on our instructions under data processing agreements and are not permitted to use your data for their own purposes.

6.3 Analytics

We may use anonymised and aggregated analytics tools to understand Platform usage. No personally identifiable information is shared with analytics providers in identifiable form.

6.4 Legal Disclosure

We may disclose personal data if required by law, regulation, court order, or governmental authority, or to protect the rights, safety, or property of Arkitecna, its users, or the public.

6.5 Business Transfers

In the event of a merger, acquisition, or sale of all or part of Arkitecna's assets, personal data may be transferred to the acquiring entity, subject to equivalent data protection obligations.

We do not sell, rent, or trade personal data to third parties for their own marketing purposes.

7. International Data Transfers

Arkitecna Hong Kong Ltd is incorporated in Hong Kong S.A.R. Your data may be processed on servers located in Hong Kong, the European Union, the United States, or other jurisdictions where our infrastructure providers operate.

Where data is transferred outside Hong Kong or outside the EEA (for EU-based users), we ensure appropriate safeguards are in place, including Standard Contractual Clauses or equivalent mechanisms recognised under applicable law.

8. Data Retention

9. Cookies & Tracking Technologies

We use the following types of cookies on the Platform:

• Essential cookies: Required for the Platform to function (authentication sessions, CSRF protection, payment flow state).
• Functional cookies: Remember your preferences (language, currency, display settings).
• Analytics cookies: Help us understand how the Platform is used (page views, session duration). Used in anonymised/aggregated form only.
• Marketing cookies: Only placed with your explicit consent, used to show relevant advertisements.

You may manage or withdraw cookie consent at any time via your browser settings or our cookie banner. Disabling essential cookies may impair Platform functionality.

10. Your Rights

Depending on your jurisdiction, you may have the following rights regarding your personal data:

• Right of Access: Request a copy of the personal data we hold about you.
• Right to Rectification: Request correction of inaccurate or incomplete data.
• Right to Erasure: Request deletion of your personal data, subject to legal retention obligations.
• Right to Restriction: Request that we limit processing of your data in certain circumstances.
• Right to Data Portability: Receive your data in a structured, machine-readable format (where applicable).
• Right to Object: Object to processing based on legitimate interests or for direct marketing purposes.
• Right to Withdraw Consent: Where processing is based on consent, withdraw it at any time without affecting the lawfulness of prior processing.

To exercise any of these rights, contact us at tipme@arkitecna.com. We will respond within 30 days. We may require identity verification before processing sensitive requests.

11. Data Security

We implement industry-standard technical and organisational measures to protect your data, including:

• TLS/HTTPS encryption for all data in transit
• Encryption at rest for sensitive database fields
• Hashed (bcrypt) password storage — plaintext passwords are never stored
• Role-based access controls limiting internal data access
• Regular security audits and vulnerability assessments
• Stripe PCI-DSS compliance for all payment data
• Rate limiting and fraud detection on all public endpoints

Despite these measures, no system is completely secure. In the event of a data breach that poses a risk to your rights and freedoms, we will notify affected users and relevant authorities as required by applicable law.

12. Children's Privacy

The Platform is not directed at individuals under the age of 18. We do not knowingly collect personal data from minors. If you believe we have inadvertently collected data from a minor, please contact us immediately at tipme@arkitecna.com and we will delete it promptly.

13. Third-Party Links

The Platform may contain links to third-party websites or services. We are not responsible for the privacy practices of those third parties. We encourage you to review their privacy policies before providing any personal data.

14. Changes to This Policy

We may update this Privacy Policy from time to time. When we make material changes, we will notify Business Users by email and/or by displaying a prominent notice on the Platform. The effective date at the top of this page will always reflect the most recent version. Continued use of the Platform after changes take effect constitutes acceptance of the updated policy.

15. Contact & Complaints

For any privacy-related questions or to exercise your rights, contact our privacy team:

Privacy Team — Arkitecna Hong Kong Ltd
Email: tipme@arkitecna.com
Address: Pioneer Centre, 18/F, 16–18A, 700 Nathan Rd., Kowloon, Hong Kong S.A.R.

If you are located in the EU/EEA and believe we have not adequately addressed your privacy concerns, you have the right to lodge a complaint with your local data protection supervisory authority.