Privacy Policy

1. Data Controller

The data controller for the Service is:

• Legal name: [LEGAL COMPANY NAME]
• Registered address: [REGISTERED ADDRESS]
• Privacy contact: legal@pandada.ai
• Data Protection Officer: [DPO NAME / "Not currently appointed"]

2. Information We Collect

2.1 Information you provide.

• Account information: email address, display name, company name (if provided), and a hashed password. We never receive or store your plaintext password.
• Payment information: transaction amount, plan, payment status and transaction reference. We do not store full card numbers — card data is handled by the payment processor (see Section 5).
• Documents and content: files you upload for translation, translation settings, and glossary terms you create.
• Communications: emails and support tickets you send to us.

2.2 Information collected automatically.

• Device and network data: IP address, user agent, device type, browser, timezone.
• Usage data: pages viewed, documents translated, feature usage, quota consumption, session duration.
• Log data: request timestamps, error logs and performance data.

3. How We Use Your Information and Our Legal Bases

We may aggregate or de-identify data for statistics; such data cannot be linked back to you.

4. Document Handling

Your documents are your property.

• Documents are processed only to produce the translation you requested.
• Documents are encrypted in transit using TLS and deleted from our systems after translation completes.
• We never use your documents to train AI models.
• Documents are transmitted to our AI model provider (DeepSeek) solely for the translation request, under their applicable data processing terms.
• Translation history is retained for your own access for 30 days and can be deleted sooner at any time.

5. Cookies and Tracking Technologies

Analytics tools in use: [INSERT ANALYTICS TOOL AND LINK TO ITS PRIVACY POLICY, e.g. Google Analytics — Google Privacy Policy]. We do not use advertising cookies or cross-site behavioural advertising.

You can adjust your preferences through your browser settings or by clearing local storage.

6. Sharing and Disclosure

We do not sell your personal information, including as defined by the CCPA. We share data only with the following categories of recipient:

• Waffo Pancake — our PCI-DSS compliant payment processor. Payment card data is handled exclusively by Waffo Pancake and is never stored on our servers. Waffo Pancake also acts as our billing platform.
• Creem — retained as a secondary payment channel, used for subscription billing where applicable.
• DeepSeek — AI model provider. Document content is sent to DeepSeek solely to perform the translation you requested, and is processed under DeepSeek's applicable data terms.
• Service providers — cloud infrastructure, email delivery, analytics and error monitoring, all bound by confidentiality obligations.
• Professional advisers and authorities — where required by law, court order or competent regulator.
• Corporate transactions — in connection with a merger, acquisition or sale of assets, with prior notice and continued protection of your obligations.
• With your consent — for any other purpose you have expressly agreed to.

List any analytics or error-monitoring sub-processors you actually use here: [INSERT SUB-PROCESSOR LIST].

7. Data Security

• Encryption in transit: TLS/HTTPS for all data transmission.
• Encryption at rest and password hashing: sensitive data is encrypted; passwords are hashed and never stored in plaintext.
• Access control: least-privilege access, restricted to personnel who need it.
• Content moderation: automated checks and human review to enforce our Acceptable Use Policy.
• Periodic review: regular security auditing of dependencies and configuration.

In the event of a personal data breach affecting your rights, we will notify you and the relevant supervisory authority without undue delay and where feasible within 72 hours of becoming aware of it.

8. Data Retention

9. Your Rights

To exercise any of the following rights, contact us at legal@pandada.ai. We will respond within 30 calendar days.

If you believe we have not handled your data properly, you have the right to lodge a complaint with your local data protection authority.

10. Marketing Communications

Where you have consented, we may send product and service marketing emails. You may unsubscribe at any time using the link in the email, by disabling marketing in your account settings, or by contacting us. Unsubscribing does not affect service-essential notices such as billing, security or policy updates.

11. International Transfers

Our servers and service providers may be located in countries other than your own. Where personal data is transferred internationally, we rely on appropriate safeguards, including:

• data processing agreements incorporating the EU Standard Contractual Clauses (SCC);
• transfers only to recipients offering an equivalent level of protection;
• adequacy decisions where applicable.

List your primary hosting regions here: [INSERT HOSTING REGIONS, e.g. EU, United States].

12. Children's Privacy

The Service is intended for users aged 18 and over. We do not knowingly collect information from children. If you believe a child has provided us with personal information, contact us at legal@pandada.ai and we will delete it promptly.

13. Third-Party Links and Services

The Service may contain links to third-party sites or integrate with third-party services. This Policy applies only to information we collect directly, and we are not responsible for third-party data practices. Please review their policies before use.

14. Changes to This Policy

We will notify you of material changes at least 15 days in advance by platform notice or to your registered email address, and will update the "Last updated" date above. Continued use after the effective date constitutes acceptance.

15. Contact Us

• Privacy contact: legal@pandada.ai
• Customer support: support@pandada.ai
• Legal name: [LEGAL COMPANY NAME]
• Postal address: [REGISTERED ADDRESS]
• Support hours: Monday to Friday, 09:00–18:00 UTC+8