Privacy Policy

Pango GY Co., Ltd. (the "Company", "we", "us") respects your privacy and is committed to protecting your personal data. This Privacy Policy explains what personal data we collect, how we use and share it, and the rights you have, when you use the AI marketing and advertising assistant service "Pango Neuro" (the "Service") through our international (non-Korean) sign-up flow.

If you signed up through the Korean-language sign-up flow, the Korean Privacy Policy (개인정보처리방침) applies to you instead of this Privacy Policy.

Article 1 (Who We Are)

The data controller responsible for your personal data is:

Article 2 (Personal Data We Collect)

We do not knowingly collect special categories of personal data (such as health or biometric data), and the Service is not designed for you to submit them.

Article 3 (Purposes and Legal Bases of Processing)

We process your personal data for the following purposes and, where the GDPR or similar laws apply, on the following legal bases.

Article 4 (Retention Periods)

When a retention period expires or the purpose of processing is achieved, we delete the data without undue delay using irreversible methods. Data that must be retained under applicable law is stored separately for the required period only.

Article 5 (How We Share Personal Data)

We do not sell your personal data, and we do not share it for cross-context behavioral advertising. We disclose personal data only as follows.

1. Service providers (processors) acting on our instructions:

We configure our monitoring provider to reduce the personal data it receives: we transmit your account identifier and the domain part of your email address (not the address itself), mask on-screen content in session replay, and redact email addresses and national identification numbers from error and AI-interaction records before transmission.

2. Independent controllers:

3. We may also disclose personal data where required by law, court order, or a lawful request by a public authority, or where disclosure is necessary to protect rights, safety, or property.

We use enterprise or API environments of our AI providers under which your data is not used to train their public models.

Article 6 (International Data Transfers)

We are a company established in the Republic of Korea, and your personal data is stored on servers located in the Republic of Korea and, depending on the provider, in the United States or other locations listed in Article 5.

1. For users in the EU/EEA: the European Commission has adopted an adequacy decision for the Republic of Korea, so transfers of personal data from the EU/EEA to us in Korea are permitted without additional safeguards.
2. For transfers to providers in the United States and other third countries, we rely on appropriate safeguards such as standard contractual clauses or, where applicable, an adequacy framework covering the recipient.
3. You may request further information about the safeguards we use by contacting pango_plat@pango-gy.com.

Article 7 (Your Rights)

1. Subject to applicable law, you have the right to:

• Access the personal data we hold about you and receive a copy
• Correct inaccurate or incomplete personal data
• Delete your personal data
• Restrict or object to certain processing, including processing based on legitimate interests
• Receive your personal data in a portable format (data portability)
• Withdraw consent at any time, without affecting the lawfulness of processing before withdrawal

2. If you are in the EU/EEA or UK, you also have the right to lodge a complaint with your local supervisory authority.
3. If you are a California resident, you have the rights under the CCPA/CPRA to know, access, correct, and delete personal information, and the right not to be discriminated against for exercising your rights. We do not sell or share personal information as defined by the CCPA/CPRA.
4. To exercise your rights, contact us at pango_plat@pango-gy.com or use the relevant settings within the Service. We respond within the time limits required by applicable law (and in any event within 10 business days in the ordinary course). We may need to verify your identity before acting on a request, and you may exercise your rights through an authorized agent where permitted by law.

Article 8 (Cookies)

We use cookies and similar technologies to keep you signed in, remember your preferences, and analyze usage statistics. You can refuse or delete cookies through your browser settings; some features of the Service may be limited if cookies are disabled. We do not use cookies for cross-site behavioral advertising.

Article 9 (Data Security)

If a personal data breach occurs, we will notify the relevant supervisory authority and affected users as required by applicable law.

Article 10 (Children)

The Service is a business service intended for users who are at least 18 years old. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us and we will delete it.

Article 11 (Automated Decision-Making)

The Service provides AI-based analysis and recommendations. These outputs are for reference, and decisions that produce legal or similarly significant effects are not made solely by automated means. Where automated processing materially affects your rights or obligations, you may request an explanation, object, or request human review by contacting pango_plat@pango-gy.com.

Article 12 (Changes to This Privacy Policy)

We may update this Privacy Policy to reflect changes in law or the Service. We will announce changes within the Service at least 7 days before they take effect, or at least 30 days in advance with individual notice for changes that are unfavorable to you.

Article 13 (Google API User Data)

Where you connect a Google service (such as Google Ads, Google Analytics 4, Search Console, or Tag Manager), we access user data through Google APIs. We share, transfer, or disclose that data only as follows.

Except as described above, we do not sell user data obtained through Google APIs to third parties and do not share it for advertising purposes. Our use and transfer of user data received from Google APIs complies with the Google API Services User Data Policy, including the Limited Use requirements.

Article 14 (Contact)

For payment data processed by Paddle as Merchant of Record, you may also contact Paddle through the channels set out in Paddle's privacy policy (https://www.paddle.com/legal/privacy).

---

Google API Limited Use Compliance Statement

Pango Neuro's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Specifically, Pango Neuro:

• Only requests access to Google user data that is necessary for the features described in this application.
• Does not use Google user data for serving advertisements.
• Does not allow humans to read Google user data unless the user has given explicit permission, it is necessary for security purposes, or it is required by law.
• Does not use or transfer Google user data to develop, improve, or train generalized AI or ML models.
• Does not sell Google user data to third parties.