Privacy Policy

Pango GY Co., Ltd. (the "Company", "we", "us") respects your privacy and is committed to protecting your personal data. This Privacy Policy explains what personal data we collect, how we use and share it, and the rights you have when you use the AI marketing and advertising assistant service "Pango Neuro" (the "Service") and accept this Privacy Policy during sign-up or continued use.

Article 1 (Who We Are)

The data controller responsible for your personal data is:

Article 2 (Personal Data We Collect)

We do not knowingly collect special categories of personal data (such as health or biometric data), and the Service is not designed for you to submit them.

Article 3 (Purposes and Legal Bases of Processing)

We process your personal data for the following purposes and, where the GDPR or similar laws apply, on the following legal bases.

Article 4 (Retention Periods)

When a retention period expires or the purpose of processing is achieved, we delete the data without undue delay using irreversible methods. Data that must be retained under applicable law is stored separately for the required period only.

Article 5 (How We Share Personal Data)

We do not sell your personal data. If you choose to allow advertising measurement, we may disclose the advertising measurement data described in Article 2 to the advertising partners listed below—Google Ads, Meta, and LinkedIn—only when the relevant measurement tag is enabled. Depending on applicable law, this disclosure may be considered sharing for cross-context behavioral advertising. We do not create website-visitor retargeting or matched audiences. We otherwise disclose personal data only as follows.

1. Service providers (processors) acting on our instructions:

We configure our monitoring provider to reduce the personal data it receives: we transmit your account identifier and the domain part of your email address (not the address itself), mask on-screen content in session replay, and redact email addresses and national identification numbers from error and AI-interaction records before transmission.

2. Independent controllers:

3. We may also disclose personal data where required by law, court order, or a lawful request by a public authority, or where disclosure is necessary to protect rights, safety, or property.

We use enterprise or API environments of our AI providers under which your data is not used to train their public models.

Article 6 (International Data Transfers)

We are a company established in the Republic of Korea, and your personal data is stored on servers located in the Republic of Korea and, depending on the provider, in the United States or other locations listed in Article 5.

1. For users in the EU/EEA: the European Commission has adopted an adequacy decision for the Republic of Korea, so transfers of personal data from the EU/EEA to us in Korea are permitted without additional safeguards.
2. For transfers to providers in the United States and other third countries, we rely on appropriate safeguards such as standard contractual clauses or, where applicable, an adequacy framework covering the recipient.
3. You may request further information about the safeguards we use by contacting pango_plat@pango-gy.com.
4. Where applicable law gives you a right to object to an international transfer, you may exercise it by contacting us. Because transfers to our AI, monitoring, and infrastructure providers may be necessary to provide requested features, objecting may limit or prevent use of those features.
5. If you allow advertising measurement, landing-page URL and referrer, IP address, browser and device information, cookies or similar identifiers, page-visit time, and sign-up-completed events may be transferred over HTTPS to Google LLC, Meta Platforms, Inc., and LinkedIn Corporation in the United States and other locations where they process data, but only through the measurement tags enabled for the applicable campaign. LinkedIn's conversion URL is limited to the sign-up path without query parameters or fragments. We use these transfers for advertising-visit and sign-up conversion measurement, attribution, reporting, and campaign optimization. Google states that conversion-measurement cookies such as gcl last for 90 days; Google Ads reporting availability follows its published data-retention policy. Under Meta's applicable terms, Event Data may be retained for up to two years. LinkedIn states that direct identifiers are removed within seven days and pseudonymized data is deleted within 180 days. You may refuse or withdraw this transfer through the advertising measurement controls without losing access to the Service's core features.

Article 7 (Your Rights)

1. Subject to applicable law, you have the right to:

• Access the personal data we hold about you and receive a copy
• Correct inaccurate or incomplete personal data
• Delete your personal data
• Restrict or object to certain processing, including processing based on legitimate interests
• Receive your personal data in a portable format (data portability)
• Withdraw consent at any time, without affecting the lawfulness of processing before withdrawal

2. If you are in the EU/EEA or UK, you also have the right to lodge a complaint with your local supervisory authority.
3. If you are a California resident, you have the rights under the CCPA/CPRA to know, access, correct, and delete personal information, and the right not to be discriminated against for exercising your rights. We do not sell personal information. If applicable law treats the advertising measurement disclosure described in Article 5 as sharing, you may opt out by keeping advertising measurement disabled or withdrawing permission through the Service.
4. To exercise your rights, contact us at pango_plat@pango-gy.com or use the relevant settings within the Service. We respond within the time limits required by applicable law (and in any event within 10 business days in the ordinary course). We may need to verify your identity before acting on a request, and you may exercise your rights through an authorized agent where permitted by law.

Article 8 (Cookies)

We use cookies and similar technologies to keep you signed in, remember your preferences, and analyze usage statistics. If you choose to allow advertising measurement, Google Ads, Meta, and LinkedIn may also use cookies or similar technologies to measure advertising visits, sign-up conversions, and campaign performance when their relevant tags are enabled. Their applicable terms may permit use of this data for ad delivery or personalization. We keep Google ad personalization disabled and do not create website-visitor retargeting or matched audiences. You may refuse or withdraw advertising measurement through the controls presented on the Service without losing access to core features. You can also refuse or delete cookies through your browser settings; some non-core features may be limited if cookies are disabled.

Article 9 (Data Security)

If a personal data breach occurs, we will notify the relevant supervisory authority and affected users as required by applicable law.

Article 10 (Children)

The Service is a business service intended for users who are at least 18 years old. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us and we will delete it.

Article 11 (Automated Decision-Making)

The Service provides AI-based analysis and recommendations. These outputs are for reference, and decisions that produce legal or similarly significant effects are not made solely by automated means. Where automated processing materially affects your rights or obligations, you may request an explanation, object, or request human review by contacting pango_plat@pango-gy.com.

Article 12 (Changes to This Privacy Policy)

We may update this Privacy Policy to reflect changes in law or the Service. We will announce changes within the Service at least 7 days before they take effect, or at least 30 days in advance with individual notice for changes that are unfavorable to you.

Article 13 (Google API User Data)

Where you connect a Google service (such as Google Ads, Google Analytics 4, Search Console, or Tag Manager), we access user data through Google APIs. We share, transfer, or disclose that data only as follows.

Except as described above, we do not sell user data obtained through Google APIs to third parties and do not share it for advertising purposes. Our use and transfer of user data received from Google APIs complies with the Google API Services User Data Policy, including the Limited Use requirements.

Article 14 (Contact)

For payment data processed by Paddle as Merchant of Record, you may also contact Paddle through the channels set out in Paddle's privacy policy (https://www.paddle.com/legal/privacy).

Article 15 (Connected Services and Platform Data)

The Service lets you connect external services that you choose and authorize. Available connections may change as the Service develops and currently include the following principal categories.

For all Connected Services:

• We access and process only the data within the permissions you grant.
• We do not sell data obtained from a Connected Service or disclose it for an unrelated third party's independent purpose.
• Processing by service providers and international transfers needed to provide requested features remain subject to Articles 5 and 6.
• We comply with the applicable API terms and data policies of each provider.
• You may disconnect a service through its account settings or by contacting us. Disconnection stops future access through that connection, subject to the provider's revocation process.
• If a new connection changes the categories of data collected, service providers used, or international transfer arrangements, we will update the relevant parts of this Privacy Policy.

Article 16 (Provider-Specific API Disclosures)

1. OpenAI. When you select or use a feature powered by OpenAI, we transmit only the data needed to fulfill your request. Under OpenAI's Services Agreement, Customer Content is not used to develop or improve OpenAI's services unless the customer explicitly agrees. OpenAI's API data controls describe default abuse-monitoring retention of up to 30 days; Responses API application state and uploaded files may be retained longer depending on the feature and deletion settings. See https://openai.com/policies/services-agreement/, https://developers.openai.com/api/docs/guides/your-data, and https://openai.com/policies/data-processing-addendum/.
2. Anthropic. When you select or use a feature powered by Claude, we transmit only the data needed to fulfill your request. We use Anthropic's commercial API, and data sent through that API is not used to train Anthropic's generative models. See https://www.anthropic.com/legal/commercial-terms, https://www.anthropic.com/legal/privacy, and https://www.anthropic.com/legal/aup.
3. xAI. When you select the Grok model, we transmit only the data needed to fulfill your request to SpaceXAI LLC. xAI does not train on API inputs or outputs without explicit permission. By default, encrypted API requests and responses are retained for 30 days for abuse or misuse auditing and then deleted; Zero Data Retention or a separately negotiated agreement may apply different handling. See https://x.ai/legal/terms-of-service-enterprise, https://docs.x.ai/developers/faq/security, https://x.ai/legal/data-processing-addendum, and https://x.ai/legal/privacy-policy.
4. Google (Gemini). When you select a Google model, we transmit only the data needed to fulfill your request to Google LLC. We use Google Cloud's enterprise generative AI service (currently the Gemini Enterprise Agent Platform, formerly Vertex AI), and data sent through it is not used to train Google's generative models. Logs kept to detect abuse or policy violations may be retained for up to 90 days within the region we select, and depending on the contract form may be excluded from such logging or not retained at all. We do not use free tiers whose submitted data is used to improve Google's products. See https://cloud.google.com/terms, https://cloud.google.com/terms/data-processing-addendum, https://docs.cloud.google.com/gemini-enterprise-agent-platform/models/abuse-monitoring, and https://policies.google.com/privacy.
5. Meta and TikTok. We access only data covered by the permissions you grant, do not sell API data or disclose it for an unrelated third party's independent purpose, and follow each provider's applicable platform terms and privacy policy.
6. Pinterest. The Service acts as an API relay and does not retain Pinterest content or API response data after fulfilling your request. During connection setup, the list of available ad accounts and OAuth credentials may be stored in encrypted temporary records for up to 15 minutes so that you can select an account without exposing credentials to your browser. We retain the selected ad account identifier and name and the encrypted OAuth access and refresh tokens needed to maintain the connection. When you disconnect Pinterest, those stored credentials are deleted without undue delay and the Service stops using them; you may separately revoke the authorization in Pinterest account settings. We do not resell or redistribute Pinterest content or Pinterest-derived data. The Service is not endorsed, sponsored by, or affiliated with Pinterest. See https://policy.pinterest.com/en/terms-of-service, https://policy.pinterest.com/en/privacy-policy, and https://developers.pinterest.com/terms/.

Article 17 (Deletion and Destruction)

1. We delete personal data without undue delay when the processing purpose is complete or the applicable retention period expires, except for data that must be retained by law.
2. Electronic records are deleted using methods designed to prevent recovery, and paper records are shredded or securely destroyed.
3. Data retained solely to meet a legal obligation is separated from actively used service data and is not used for another purpose.

Article 18 (Privacy Officer and Remedies)

You may contact us to exercise your rights or raise a privacy complaint. If you are in the Republic of Korea, you may also seek assistance from the Personal Information Infringement Report Center (https://privacy.kisa.or.kr, 118), the Personal Information Dispute Mediation Committee (https://www.kopico.go.kr, 1833-6972), the Supreme Prosecutors' Office, or the Korean National Police Agency. Users elsewhere may contact their local data protection authority.

---

Google API Limited Use Compliance Statement

Pango Neuro's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Specifically, Pango Neuro:

• Only requests access to Google user data that is necessary for the features described in this application.
• Does not use Google user data for serving advertisements.
• Does not allow humans to read Google user data unless the user has given explicit permission, it is necessary for security purposes, or it is required by law.
• Does not use or transfer Google user data to develop, improve, or train generalized AI or ML models.
• Does not sell Google user data to third parties.