Privacy Policy

This Privacy Policy explains how PandaSuite, 40 rue Alexandre Dumas, 75011 Paris, France, processes personal data when you visit pandasuite.com, create an account, use the PandaSuite service, contact us, or interact with content created with PandaSuite.

Introduction

We process personal data in a transparent and limited way so that PandaSuite can provide its website, no-code creation platform, support, security, and related services. This Policy applies to visitors, prospects, account users, customers, and, where relevant, end users of content published through PandaSuite.

This Policy is intended to describe PandaSuite's public data processing practices. Customer projects may contain additional personal data chosen by the customer; in that situation, the customer remains responsible for informing its own end users.

Controller

The controller is PANDA SUITE, a société à responsabilité limitée registered with the Paris trade and companies register under number 504 817 578, whose registered office is at 40 rue Alexandre Dumas, 75011 Paris, France ("PandaSuite"). PandaSuite acts as data controller when it determines why and how personal data is processed for its website, accounts, commercial relationship, support, analytics, security, and service administration.

PandaSuite may also act as processor when a customer uses the service to host, publish, or otherwise process customer content and end-user data on the customer's instructions. In that case, the customer is the controller of that content and data, and PandaSuite processes it to provide the contracted service.

Data We Process

Depending on how you use PandaSuite, we may process the following categories of personal data:

• Identity and contact data: name, email address, organization, role, country, and information you provide when creating an account or contacting us.
• Account and service data: login details, subscription status, workspace settings, project metadata, activity related to your account, and communications about the service.
• Billing and transaction data: billing contact details, invoices, purchase history, payment status, and transaction references when you buy a paid product or subscription.
• Usage and analytics data: pages viewed, events, device and browser information, approximate location derived from technical data, feature usage, survey responses, and session information collected through our measurement tool, PostHog. On the public website, no measurement cookie is set without your consent; before you choose or if you decline, the audience is measured anonymously: pages viewed, time spent, scrolling, clicks and load speed.
• Technical and security data: IP address, logs, identifiers, cookie choices, traffic routing information, errors, and data needed to secure and deliver the website and service.
• Support and communications data: messages, attachments, feedback, requests, answers typed in the contact forms of this website, newsletter sign-ups, and any information you choose to send to PandaSuite.
• Customer content and end-user data: content uploaded, created, hosted, or published by customers, and any personal data included in that content or collected from end users through customer projects.

When a field is required to open an account, place an order or answer a request, we say so; without it we may be unable to provide that service.

Where the data comes from: from you, when you fill in a form, create an account, use the service or write to us; automatically, from your use of the website and the service; from another user of your organization who invites you to a project; and from our providers about the transactions and messages they handle for us (for example the status of a payment). We do not buy personal data.

Purposes and Legal Bases

We process personal data only when we have a valid legal basis under applicable data protection law:

• Contract: to create and manage accounts, provide the service, process subscriptions and purchases, deliver customer projects, answer support requests, and send service communications.
• Legitimate interests: to secure the website and service, prevent abuse, improve features, understand product usage, maintain business records, establish or defend legal claims, and communicate with professional users, provided those interests are not overridden by your rights.
• Consent: to place or read non-essential cookies, enable measurement features that require browser storage, send optional marketing communications, or process data for another purpose that requires consent. You may withdraw consent at any time.
• Legal obligations: to comply with accounting, tax, consumer, security, data protection, and other legal requirements.
• Customer instructions: when PandaSuite acts as processor for customer content and end-user data, we process that data on the customer's documented instructions and for the purpose of providing the service.

Recipients and Processors

We share personal data only with recipients who need it for the purposes described in this Policy, including PandaSuite personnel, service providers, professional advisers, public authorities where legally required, and customers where data relates to their own projects.

The service providers below process personal data on PandaSuite's behalf, under contracts that limit what they may do with it. Card details are entered on Stripe's pages and never reach PandaSuite. Where PandaSuite acts as processor for a customer, these providers are its sub-processors within the meaning of the Data Processing section of the Terms and Conditions.

The third parties named in the Cookie Policy also receive your IP address and technical data, and act under their own privacy policies: YouTube (Google Ireland Limited) and Vimeo (Vimeo.com, Inc., United States) when you play an embedded video; jsDelivr and rsms.me when a page loads the form scripts or the font they serve. PandaSuite answers for the loading it triggers and the provider for what it does next; you may exercise your rights with either of us.

International Transfers

PandaSuite is based in France, but some recipients and processors may process personal data in other countries. Where personal data is transferred outside the European Economic Area or another jurisdiction with similar transfer rules, we rely on appropriate safeguards: adequacy decisions of the European Commission (including the EU-US Data Privacy Framework for providers certified under it) or the standard contractual clauses, together with contractual commitments and technical measures. You can ask for information on the safeguards applied to a given provider, including a copy of the standard clauses (redacted where necessary), by writing to [email protected].

Retention

We keep personal data only for as long as necessary for the purposes described in this Policy, unless a longer period is required or permitted by law:

• Account and service data, including the projects of the account, is kept while the account is active, then deleted from PandaSuite's own systems 30 days after the account is closed; we keep a minimal record of the deletion (account identifier, email address, dates) as proof that it was done. Copies held in backups expire with the backup cycle.
• One exception: French law requires hosting providers to keep certain data about the authors of published content. PandaSuite may keep such data (the identity of the account, connection data) for the period the law sets, and uses it only to answer the judicial or administrative authorities entitled to request it.
• When an account is deleted, we also ask the providers listed in this policy that still hold data about it to delete that data. Records we must keep by law are the exception: invoices and payment records stay at Stripe for the legal accounting period.
• Billing, transaction, tax, and accounting records are kept for the legal retention periods that apply to those records.
• Support and commercial communications are kept for the time needed to handle the request, maintain the customer relationship, and protect PandaSuite's rights.
• Security logs, technical records, and cookie consent choices are kept for limited operational periods appropriate to their purpose; the cookie choice itself is asked again after six months.
• Session recordings are deleted 90 days after they are made. Product analytics events are kept for 25 months at most.
• Customer content and end-user data processed on a customer's behalf is retained according to the customer's instructions, account settings, contractual terms, and deletion requests.

Your Rights

Depending on your location and the legal basis for the processing, you may have the right to request access to your personal data, rectification of inaccurate data, erasure, restriction of processing, objection to processing, and data portability. Where processing is based on consent, you may withdraw that consent at any time without affecting processing carried out before withdrawal.

You may exercise your rights by contacting [email protected] . Requests are free of charge; we answer within one month, extendable as the GDPR allows for complex requests, and we may need to verify your identity before responding. You may object to direct marketing at any time, without giving a reason. We pass on rectifications, erasures and restrictions to the recipients of the data unless this proves impossible or disproportionate, and tell you which recipients were informed if you ask; when you ask us to erase your data, we delete it from our systems and ask the providers listed above to do the same where they still hold it. If your request relates to customer content or end-user data for which PandaSuite acts as processor, we may direct you to the relevant customer or handle the request on that customer's instructions.

You also have the right to lodge a complaint with the French data protection authority, the CNIL, or with your local data protection authority.

Under Article 85 of the French Data Protection Act, you may give directives on the retention, erasure and communication of your personal data after your death, and designate a person to carry them out. Directives concerning PandaSuite may be sent to [email protected]; you may amend or revoke them at any time. In the absence of directives, your heirs may exercise certain rights, in particular to close your account.

PandaSuite does not take decisions producing legal effects concerning you, or similarly significantly affecting you, based solely on automated processing.

Users Outside the EU

PandaSuite is a French company and applies the GDPR to everyone whose data it processes. If you live in a country or state with its own data protection law (for example the United Kingdom, Switzerland, Brazil or a US state), you may have similar rights under that law, where it applies to PandaSuite: exercise them through the same contact, we handle them the same way, and you may also complain to your local authority. PandaSuite does not sell personal data.

If you are in Brazil and the Lei Geral de Proteção de Dados (LGPD) applies, you can ask us to confirm that we process your data and for simplified access, which we give without delay, and for a complete statement, which we provide within the deadline the LGPD sets (fifteen days, extended as its regulator allows for small companies). [email protected] is the communication channel the LGPD requires, in place of a designated data protection officer, and you may complain to the ANPD.

Security

We use technical and organizational measures designed to protect personal data against unauthorized access, disclosure, alteration, and loss. These measures may include access controls, role-based permissions, encryption in transit, monitoring, backup practices, vendor review, and the security features of our infrastructure providers.

No online service can be guaranteed to be perfectly secure. You are responsible for keeping your account credentials confidential and for configuring customer projects appropriately for your own audience.

Cookies

PandaSuite uses cookies and similar technologies for necessary website operation, security, consent management, and measurement. Necessary cookies are set by PandaSuite and by Cloudflare, which protects the website. Measurement relies on PostHog: without your consent, the audience is only measured anonymously; measurement cookies are set only if you accept them.

When you sign in to your PandaSuite account (the dashboard and the editor), PandaSuite links product usage events and errors to your account. We use them to operate, secure, troubleshoot and improve the contracted service, to support you, and to tailor our communications with you, such as onboarding emails or a contact from our team. These events are linked to your account whatever your cookie choice, but no measurement cookie or storage is placed on your device unless you have accepted cookies in the cookie banner. Your sessions are recorded only if you have accepted cookies, with what you type in form fields masked. Your choice is saved on your account, applies on all your devices, and you can change it at any time from "Cookie preferences". This relies on PandaSuite's legitimate interest as the service provider, is never used for advertising, and you may object by writing to [email protected].

For details about cookie categories, purposes, choices, and retention, please read our Cookie Policy.

Changes

We may update this Privacy Policy to reflect changes to PandaSuite, legal requirements, or our processing practices. The updated version will be published on this page with a new update date. If a change materially affects your rights or how we process personal data, we will take appropriate steps to inform you.

Contact

For privacy questions or to exercise your rights, contact [email protected] . You may also write to PandaSuite, 40 rue Alexandre Dumas, 75011 Paris, France.