Privacy Policy

Cai Comments is built privacy-first. This policy covers two places your information can live: the Cai Comments app that runs on your Mac or Windows PC, and this website (caicomments.com), where you create an account, obtain a licence, and download the app.

On your device: the Cai Comments app

1. Our privacy commitment

Cai Comments is built privacy-first. It is designed to work fully offline so that the sensitive information you record about students stays under your control.

2. Data stored on your device

All of your data (classes, students, notes, generated comments, and settings) is stored locally on your device. It is not stored on our servers because the app itself has no servers.

3. What the app does and does not send

The app does not collect, transmit, sell, or share your teaching data (classes, students, notes, comments, photos) with us or with anyone else. That is the promise, and nothing in the rest of this policy qualifies it.

What it does send, when you are online, is about your licence: it checks that your subscription is still active, and tells us its version number and platform (see section 10). Your work never leaves your device with it. If the app has had no connection at all for 90 days it will ask you to reconnect so it can check.

4. Student information

Information you enter about students is provided and controlled by you. You act as the data controller for that information and are responsible for handling it in line with your school's policies and applicable law.

5. On-device AI processing

Classification, transcription cleanup, question answering, and comment generation are performed by an AI model running on your device. The text being processed does not leave your device for these tasks.

6. Optional Connected AI

If you turn on Connected AI and supply your own subscription or API key, the relevant text is sent to that external provider so it can generate a response. That data is then handled under the provider's privacy policy, outside our control. This feature is off by default.

7. Microphone & voice notes

Voice notes are recorded only while you are actively recording and are converted to text on your device. The audio is processed locally for transcription and is not uploaded anywhere by the app.

8. No tracking or analytics

The app contains no advertising, no third-party trackers, and no usage analytics.

9. Deleting your data

You can remove individual notes, students, and classes at any time, or erase everything at once using "Delete All Data" in Settings. Deletion is permanent and cannot be undone.

On this website: your account & licence

To sell you a licence and deliver the app, this website runs a small account system. This is separate from the offline app, and it never handles your students' data. If your licence is a school or business licence, the licence holder can create additional logins (an email and password per team member); those are ordinary accounts covered by this policy.

10. What we collect, and why

When you create an account and place an order, we store only what's needed to run your account and licence:

• Your account email: to identify your account, verify it, and send you your download and licence.
• Your name: only if you choose to provide it.
• A securely hashed password: we store a one-way hash, never your actual password.
• Your order details: the product and status of your order, so we can approve it and grant your licence.
• Device details for your licence seats: when you sign in on a device, the app sends a device fingerprint plus basic device details (operating system and device name), and we record that sign-in's IP address. We use these only to manage and identify the devices your licence is active on, for example a school's shared licence. They are captured at sign-in only; we do not continuously track your device.
• Which version of the app a device is running: the app tells us its version number and platform (macOS or Windows) when they change. We use this to answer support questions without asking you to go and find the version, and to spot updates that failed to install. It records nothing about what you do in the app, and it never affects your licence.
• A one-way code identifying the computer, if you start a free trial: so that one trial belongs to one computer. It is a salted hash, and we cannot reverse it into a serial number, and it is used for nothing else.
• Billing details you give us for receipts: the name and address you want on your receipts, and a school's registered name and tax number where those apply.

11. Payments and your card

Your card details never reach us. When you pay, the card fields on our checkout page belong to our payment provider, Airwallex, and are shown inside their own secure frame. Your card number, expiry and security code go straight to them. They are never sent to our servers, never stored by us, and our own code cannot read them.

Airwallex processes the payment and tells us the result. From them we keep only what is needed to run a subscription: the card's brand, last four digits and expiry month (so we can show you which card is on file and warn you before it expires), and the identifiers Airwallex uses for you and for your saved card. Airwallex handles your card data as an independent controller under their own privacy policy, published on airwallex.com.

We also keep a one-way code derived from the card, supplied by Airwallex and hashed again by us. It cannot be turned back into a card number. Its only purpose is to stop the same card being used to buy and refund the software over and over.

Payments appear on your bank or card statement as AIOLOS SOLUTIONS LIMITED, the registered company behind Cai Comments (see section 19).

12. Receipts and invoices

Every payment produces a receipt, which we keep as a financial record. It carries the date, what you bought, the amount, your billing details and any tax note. You can view and print your receipts at any time from your account.

13. Support and contact messages

If you open a support ticket or write to us through the contact form, we store what you send (your name, your email address, and your message) so that we can answer it and refer back to it. Please don't include anything about a student: we never need it, and it should stay on your own device.

14. Email

We send transactional emails (email verification, password resets, receipts, and notices about your subscription such as a card about to expire or a payment that did not go through) through our email provider (Resend), acting on our behalf. We do not send marketing email, and we don't sell or share your email address.

15. Keeping the service secure

To protect the service from abuse (such as automated sign-up or sign-in attempts, or spam through the contact form), we briefly process technical information including your IP address for rate-limiting and sign-in protection. If you opt in, the app may send a scrubbed crash report, limited to the app name, version, and a technical detail string, to help us fix problems. Crash reports never contain student data.

16. Where your information is handled

Our website and servers run on Cloudflare's global network, and the information described above is stored in Cloudflare's databases and file storage. Payments are handled by Airwallex and email is sent by Resend. This means your account information may be processed outside the country you live in.

17. How long we keep things

• Your account and licence records: while your account exists, and then until you ask us to delete them.
• Receipts, invoices and payment records: seven years. We are required to keep financial records and cannot delete these on request, even when the rest of your account has gone.
• Support tickets and contact messages: while they are useful for supporting you, and then deleted.
• Rate-limiting and security records: a short rolling window, then overwritten.

18. Your rights, and deleting your data

You can ask us for a copy of the information we hold about you, ask us to correct it, or ask us to delete your account and its records. Write to us using the contact form and a person will deal with it.

One honest limit: we cannot delete your receipts and payment records until the seven years in section 17 have passed, because we are legally required to keep them. Everything else goes.

Changes & contact

19. Who we are, and how to contact us

Cai Comments is a product of Aiolos Solutions Limited, trading as Cai Comments, the company responsible for the information described in this policy.

Aiolos Solutions Limited
Hoi Yuen Road, Kwun Tong
KL, Hong Kong
Business Registration No. 75630515

Questions about your privacy? Send us a message and a person will answer.

20. Changes to this policy

We may update this Privacy Policy from time to time. The "last updated" date above shows when it last changed.