Privacy Policy

1. Who we are

PeoplePanda, Inc. ("PeoplePanda", "we", "us", or "our") operates the PeoplePanda platform at peoplepanda.ai. We are the data controller for personal data collected through our website and platform.

For questions about this policy, contact our Data Protection Officer at: privacy@peoplepanda.ai

2. Data we collect

Account and contact data

• Name, email address, and job title when you sign up or contact us
• Company name, size, and industry for your workspace
• Billing information processed securely through our payment provider (Stripe)

Platform usage data

• Feature usage, clicks, and navigation patterns to improve the product
• Error logs and performance data for reliability purposes
• Session information including browser type, IP address, and device type

Candidate data (on behalf of customers)

When you use PeoplePanda to screen candidates, you upload or sync candidate data to our platform. In this context, PeoplePanda acts as a data processor on your behalf, and you (the employer) remain the data controller responsible for that data.

• We process candidate CVs, cover letters, and application responses solely to provide the screening service
• We do not use candidate data to train our AI models without explicit consent
• Candidate data is retained for the period specified in your subscription agreement and deleted upon request

3. How we use your data

• To provide and improve the PeoplePanda platform and services
• To communicate with you about your account, updates, and support requests
• To send product updates and marketing communications (you can opt out at any time)
• To comply with legal obligations and enforce our terms
• To detect and prevent fraud, abuse, and security incidents
• To analyse aggregate, anonymised usage trends to improve our product

4. Legal basis for processing (GDPR)

• Contract performance: Processing necessary to deliver our services to you
• Legitimate interests: Product improvement, fraud prevention, and security
• Consent: Marketing communications, where required by law
• Legal obligation: Compliance with applicable laws and regulations

5. Data sharing and third parties

We do not sell, rent, or share your personal data with third parties for their own marketing purposes. We share data only as follows:

• Service providers: Trusted vendors (cloud infrastructure, analytics, payment processing) under strict data processing agreements
• Legal requirements: Where required by law, court order, or government authority
• Business transfers: In the event of a merger or acquisition, with appropriate notice to you

Our key sub-processors include AWS (cloud infrastructure), Stripe (payments), and Amplitude (anonymised analytics). A full sub-processor list is available on request.

6. Data retention

We retain account data for as long as your subscription is active plus 2 years after termination, to comply with legal obligations. Candidate data processed on your behalf is retained according to your subscription settings and deleted within 30 days of a deletion request.

7. Security

PeoplePanda is SOC 2 Type II certified. We implement industry-standard security measures including:

• All data encrypted in transit (TLS 1.2+) and at rest (AES-256)
• Regular penetration testing and vulnerability assessments
• Role-based access controls and audit logging for all data access
• Employee security training and background checks
• Incident response procedures with 72-hour breach notification as required by GDPR

8. Your rights

Depending on your location, you have rights including:

• Access: Request a copy of the personal data we hold about you
• Correction: Request that we correct inaccurate data
• Erasure: Request deletion of your personal data ("right to be forgotten")
• Portability: Receive your data in a structured, machine-readable format
• Objection: Object to processing based on legitimate interests
• Withdrawal of consent: Withdraw marketing consent at any time

To exercise any of these rights, email privacy@peoplepanda.ai. We will respond within 30 days.

9. Cookies

We use essential cookies to operate the platform, and optional analytics cookies to understand how users interact with our product. You can manage cookie preferences through your browser settings or our cookie banner. We do not use advertising or tracking cookies.

10. International transfers

PeoplePanda is incorporated in the United States. If you are located in the European Economic Area or United Kingdom, we transfer your data to the US under Standard Contractual Clauses approved by the European Commission.

11. Changes to this policy

We may update this policy from time to time. We will notify you of material changes by email and by posting the updated policy on this page with a new effective date. Your continued use of PeoplePanda after notification constitutes acceptance of the updated policy.