Privacy Policy · PandaWorld

This Privacy Policy explains how PandaWorld ("we", "us") collects, uses, stores and shares your personal data when you use our service. We comply with the Ghana Data Protection Act, 2012 (Act 843).

1. Data we collect

We collect the following categories of personal data:

Account data: email address, name, authentication identifiers — collected through Clerk when you sign up or sign in.
Jumia connection data: your Jumia Vendor Center store name, seller ID, shop ID, app ID, app secret, OAuth access and refresh tokens, and country. Sensitive credentials (tokens and app secret) are encrypted at rest using AES-256-GCM.
Product data: images, titles, descriptions, prices, categories, attributes, and variant details you create or upload to PandaWorld.
Payment data: subscription status, billing period, transaction references. The card or mobile-money details themselves are collected and stored by Paystack — we never see or store them.
Usage data: server logs (API requests, error traces, performance metrics) collected by Vercel for service operation and abuse prevention.

2. Why we collect it (legal basis)

Contract performance: We process your data to deliver the Service you signed up for — running AI analysis, polishing images, pushing listings to Jumia, billing your subscription.
Legitimate interests: keeping the Service secure (logging, abuse prevention, rate limiting), improving model output quality, supporting you when something goes wrong.
Legal obligation: keeping payment records for tax and accounting purposes.
Consent: when you connect Jumia via OAuth you consent to us holding your access and refresh tokens. You can revoke this any time via Settings → Integrations → Disconnect.

3. Third parties we share data with

We rely on third-party processors to operate the Service. We only share the minimum data each one needs:

Clerk (clerk.com) — identity and authentication. Stores your email, name, sign-in method.
Supabase (supabase.com) — database, file storage, and authentication backing store. Stores your listings, encrypted Jumia tokens, and product images.
Google (Gemini API) — AI provider for text generation, image analysis, and image generation. Product images and prompts you submit are sent to Google for processing. Per Google's API terms, your data is NOT used to train Google's models.
PhotoRoom (photoroom.com) — image polish (background removal, white background, drop shadow). Receives the product images you choose to polish.
Paystack (paystack.com) — payment processor. Receives your card or mobile-money details directly; we receive only the transaction reference and status.
Jumia Vendor Center (jumia.com) — receives the listings you push, plus your OAuth- authorised actions on your store.
Vercel (vercel.com) — hosting and edge compute provider. Sees all incoming requests and server logs.

We do not sell your data, share it with advertisers, or use it for cross-context behavioural advertising.

4. How long we keep your data

Account data: for as long as your account is active. After account deletion, we keep a minimal record for 30 days to handle disputes and chargebacks, then permanently delete.
Product images: until you delete the listing or close your account. On closure, deleted after the 30-day grace period.
Jumia tokens: until you disconnect Jumia, delete your account, or the tokens expire and are not refreshed.
Payment records: 7 years from the date of the transaction, as required for tax and accounting purposes under Ghanaian law.
Server logs: typically 30-90 days, depending on Vercel's retention defaults.

5. Your rights

Under the Ghana Data Protection Act, 2012, you have the right to:

Access — request a copy of the personal data we hold about you.
Correct — fix data that is inaccurate or incomplete. Most account fields are editable directly in the app.
Delete — request deletion of your account and all associated data. Use Settings → Account → Delete account, or email support. Some data (tax records, fraud-prevention logs) may be retained where law requires.
Restrict or object — to specific processing activities. Contact us via support.
Portability — receive your listing data in a machine-readable format. The in-app Export listings feature provides a CSV/XLSX download.
Withdraw consent — disconnect Jumia any time from Settings → Integrations. Your AI analysis and listings stay intact; only the Jumia push capability is removed.

To exercise any of these rights, contact us via the in-app support button or email help.pandaworldai@gmail.com. We respond within 30 days.

6. Data security

We take reasonable technical and organisational measures to protect your data, including:

AES-256-GCM encryption of OAuth tokens and app secrets at rest.
TLS for all data in transit between you, our servers, and third parties.
Server-side rate limiting on expensive routes.
Magic-byte validation of uploaded images (we reject files that don't match their declared type).
Server-side input validation on all write endpoints.
Least-privilege database credentials (only our server reads or writes — your data is not exposed to client-side code).

No system is 100% secure. If we become aware of a data breach affecting your personal data, we will notify you without undue delay via email.

7. International transfers

Some of our processors (Clerk, Vercel, Google, PhotoRoom, Supabase) operate outside Ghana. By using the Service you consent to your data being transferred internationally where necessary for service operation. We rely on the standard contractual clauses and equivalent safeguards offered by each provider.

8. Children

The Service is not intended for users under 18. We do not knowingly collect personal data from anyone under 18. If you believe we have inadvertently collected such data, contact us and we will delete it.

9. Changes to this Policy

We may update this Policy from time to time. Material changes will be communicated via email or an in-app notice at least 14 days before they take effect. The "Last updated" date at the top of this page tracks revisions.

10. Contact

Questions about this Policy or about how your data is handled? Reach us via the WhatsApp support button inside the app, or email help.pandaworldai@gmail.com. To make a formal complaint about data handling, you may also contact Ghana's Data Protection Commission at dataprotection.org.gh.

Notice: This document is a draft template. Before launching publicly, have it reviewed by a Ghana-qualified lawyer to confirm compliance with the Data Protection Act, 2012 (Act 843) and to nominate a Data Protection Officer if your processing volume requires one.