Privacy Policy

Panda AI (“Panda”, “we”, “us”) is a social scheduling product at trypandai.com. This policy explains what we collect when you use the site, the app, and our API, and how we use it.

Questions: [email protected]. Related documents: Terms of Use and Terms & Conditions.

Account. Email address, password (stored hashed), Google sign-in identifiers if you use Google, and whether your email is verified.

Workspace. Brand/project profiles, posts you draft or schedule, media you upload or generate, channel destinations, and connection status for X, LinkedIn, Discord, Slack, Facebook, Instagram, and Bluesky.

Connected networks. OAuth tokens and basic profile details those networks return (for example display name, username, workspace or server id, and the channel you pick). Tokens are stored encrypted and used only to publish on your behalf or to list destinations you choose. For Bluesky, you provide a handle and an app password. Panda exchanges that for a session and does not store the app password.

Billing. Plan, trial dates, usage meters (AI credits and published posts), and Stripe customer/subscription identifiers. Card details are handled by Stripe, not stored on our servers.

Mail. Product and billing messages. New accounts also receive marketing and product emails until you turn them off in Settings or use the unsubscribe link in a message.

Contact. If you use the contact form, we receive your name, email address, and message, and we send that message to [email protected].

Technical. Logs needed to run the service (time, path, status, request id). A session cookie and browser storage keep you signed in and remember your active brand. The installable app (PWA) stores a small amount of data on your device.

Product analytics. PostHog receives usage events such as pages viewed, actions in the product, and error reports. After you sign in we also send your account id and email so those events can be tied to the account. PostHog is hosted in the United States. We do not use this for third-party advertising.

We use this information to:

• Create and secure your account
• Draft, schedule, and publish posts to networks you connect
• Run Studio, captions, and other AI features you ask for
• Meter plans, trials, and billing
• Send transactional mail, and marketing mail until you turn it off
• Measure how the product is used and fix failures
• Prevent abuse and improve the product

We do not sell your personal information. We do not use your connected social accounts to post except when you schedule or publish through Panda.

If you use drafting, Studio, or similar features, the text and brand context you provide may be sent to our AI provider (currently OpenAI) to generate output. Do not put secrets, private customer data, or anything you cannot share with that provider into prompts. You are responsible for reviewing AI output before it is published.

We share data with processors only as needed to run Panda, including:

• Stripe, for payments and invoices
• OpenAI, for AI drafts you request
• Google, if you sign in with Google
• X, LinkedIn, Discord, Slack, Facebook, Instagram, and Bluesky, to connect and publish
• PostHog, for product analytics
• Email delivery (SMTP) for verification, billing, marketing, and contact-form messages
• Hosting, storage, and queue infrastructure that run the product

Those parties process data under their own terms. Publishing to a network means that network’s rules and privacy policy also apply to the post.

A notice at the bottom of the site asks you to accept this Privacy Policy and the Terms, or to decline. Accepting stores that you agree. Declining closes the notice. Either choice is saved in this browser so the notice does not appear again. You can still read this policy and the Terms from the footer.

We store the following on your device:

• A sign-in cookie and local storage for your session and active brand. These are required to run the product after you sign in.
• A preference cookie that remembers whether the sidebar is open.
• PostHog storage (a cookie and local storage) that identifies the browser for product analytics. This is set when you load the site, whether you accept or decline the notice.
• The notice choice itself, stored locally as accepted or declined.

We do not run third-party advertising cookies.

We keep account, post, media, and billing records while your account is open and as required for tax, dispute, and security purposes. You can disconnect a social network at any time in Settings. You can turn off marketing mail in Settings or via the unsubscribe link.

To delete your account and associated personal data, email [email protected]. We will complete deletion except where we must keep a limited record (for example invoices or abuse logs).

Depending on where you live, you may have rights to access, correct, export, or delete personal data, or to object to certain processing. Email us to exercise those rights. You can also lodge a complaint with your local data protection authority.

We encrypt social tokens at rest and use HTTPS in production. No method of transmission is perfectly secure. Infrastructure may be located in more than one country. By using Panda you understand your data may be processed outside your home country with appropriate safeguards for the service.

Panda is not directed at children under 18. We do not knowingly collect personal information from them.

We may update this policy. The date at the top will change. Continued use after an update means you accept the revised policy.