Effective date: 16 April 2026
This policy explains how Panda collects, uses, stores, and shares personal data when you use our website and Service at panda.new.
We do not sell your data and we do not use your content to train AI models.
We process your personal data on the following grounds:
We share data only with service providers who process it on our behalf under binding agreements. We do not sell it.
| Provider | Data shared | Purpose |
|---|---|---|
| OpenAI, Inc. | Prompts and content you submit | AI app generation |
| Anthropic, PBC | Prompts and content you submit | AI app generation |
| Google LLC (Gemini) | Prompts and content you submit | AI app generation |
| Stripe, Inc. | Billing name, address, tokenised payment method | Payment processing |
| Twilio SendGrid | Email address and email content | Email delivery |
| Cloud infrastructure provider | Account and project data | Hosting and storage |
| Analytics provider | Anonymised usage events | Product analytics |
| Meta (Facebook) | Pixel identifiers (marketing cookies only) | Ad campaign measurement |
International transfers: several providers are US-based. Transfers are protected by UK International Data Transfer Agreements (IDTAs) or the ICO-approved Addendum to EU Standard Contractual Clauses. Copies available at privacy@panda.new.
Legal disclosures: we may share data if required by law or court order. Where permitted, we will notify you first.
Business transfers:if Panda is acquired or merges, data may transfer as part of that transaction. We will give at least 30 days' notice before your data becomes subject to a different privacy policy.
We use cookies under the Privacy and Electronic Communications Regulations 2003 (PECR). Strictly necessary cookies keep the Service running and cannot be disabled. Analytics and marketing cookies require your consent and can be managed via the cookie banner or your browser settings. Full details at panda.new/cookies.
We may retain anonymised or aggregated data that cannot identify you for longer periods.
We use encryption in transit (TLS 1.2+), encryption at rest (AES-256), hashed and salted passwords, and role-based access controls. No transmission over the internet is perfectly secure. If a breach is likely to affect your rights, we will notify the ICO within 72 hours and inform you promptly. Report vulnerabilities to security@panda.new.
Under the UK GDPR and Data Protection Act 2018 you have the right to access, correct, erase, restrict, or port your personal data, and to object to processing based on legitimate interests. All rights are free to exercise and we will respond within one calendar month.
To exercise any right, or to delete your account, email privacy@panda.new. You can also delete your account directly from your account settings.
Complaints:you can lodge a complaint with the Information Commissioner's Office at ico.org.uk or on 0303 123 1113. We'd welcome the chance to resolve things directly first.
California residents:you have additional rights under the CCPA/CPRA, including the right to know, delete, correct, and opt out of sale or sharing. We do not sell personal information. Contact privacy@panda.new with the subject line "CCPA Request".
Panda is not for children under 13. We do not knowingly collect data from anyone under 13. If you believe a child under 13 has signed up, email privacy@panda.new and we will delete the account promptly.
We will email you at least 30 days before any material change takes effect and display a notice in the app. The effective date at the top of this page reflects the current version.
Privacy enquiries: privacy@panda.new
Security disclosures: security@panda.new
We aim to acknowledge all enquiries within 5 business days.
Effective: 16 April 2026 | © 2026 Panda | Governed by the laws of England & Wales