Privacy Policy

Last updated: November 3, 2026

1. Who we are

PandaPrism ("we", "us") provides review-management software for local businesses. This policy explains what data we collect and what we do with it. Contact: support@pandaprism.com.

2. Data we collect

Account data

When you sign up we collect your name, email address, and password (stored as a one-way hash — we never see it), plus your business name, locations, and billing details (processed by Stripe; card numbers never touch our servers). If you sign in with Google we receive your name, email address, and Google user ID from Google.

Review data

When you connect a review source we sync the reviews the platform makes available: reviewer name, star rating, review text, timestamps, and any replies you publish. This data comes from platforms you connect (Google Business Profile, Trustpilot, Facebook). We do not collect reviews from platforms you have not connected, and we never scrape.

Usage data

We log how the Service is used for billing and reliability: credit usage (SMS, email, AI drafts), campaign activity, report generation, and basic technical logs (IP address, timestamps) used for security and abuse prevention.

3. What we use it for

• to run the Service: syncing and displaying your reviews, drafting replies, sending review-request campaigns, and generating Panda Insights reports;
• to bill you correctly and keep your account secure (including rate-limiting login and password-reset attempts);
• to improve reliability — never to sell, rent, or share your data for advertising.

4. Hosting

The Service is hosted in the EU region of our hosting provider (Railway). Your data stays within the EU unless a platform you connect requires otherwise.

5. Third parties

Data only flows where you connect it:

• Stripe — payment processing (billing details only);
• Google — review sync and OAuth sign-in, only if you connect or sign in with Google;
• Trustpilot — review sync, only if you connect it;
• Meta (Facebook) — review sync, only if you connect a Facebook Page.

We do not sell data to anyone, and we do not send your data to third parties that are not listed here.

6. Retention

We keep account and review data while your account is active, plus a short grace period afterward in case you reactivate. Billing records are kept as long as accounting law requires. Security logs are rotated on a short cycle.

7. Deletion when you cancel (GDPR erasure)

When you cancel, we keep your account data for the grace period above and then delete it. You can request full deletion of your personal data at any time under GDPR Article 17 by emailing support@pandaprism.com from your account email — we confirm identity and erase your data within 30 days. Disconnecting a review source removes its stored credentials and stops future syncs.

8. Cookies and sessions

We use a single session cookie to keep you logged in (12-hour idle expiry), plus short-lived security cookies for OAuth and CSRF protection during sign-in flows. We do not use advertising or cross-site tracking cookies.

9. Your rights

Depending on where you live (in particular under the GDPR) you have the right to access, export, correct, and delete your personal data, and to object to or restrict certain processing. To exercise any of these rights, email support@pandaprism.com from your account email; we reply within 30 days. Data you export is provided in a common, machine-readable format.

10. Security

Passwords are hashed with bcrypt; API keys and tokens are encrypted at rest; sessions are HTTP-only and secure in production; email transport is encrypted. No system is perfect — if you suspect a breach of your account, change your password and contact us immediately.

11. Changes to this policy

We will announce material changes in the app or by email before they take effect.