Privacy Policy

Pango GY Co., Ltd. (the "Company", "we", "us") respects your privacy and is committed to protecting your personal data. This Privacy Policy explains what personal data we collect, how we use and share it, and the rights you have when you use the AI marketing and advertising assistant service "Pango Neuro" (the "Service") and accept this Privacy Policy during sign-up or continued use.

Article 1 (Who We Are)

The data controller responsible for your personal data is:

Article 2 (Personal Data We Collect)

We do not knowingly collect special categories of personal data (such as health or biometric data), and the Service is not designed for you to submit them. We do not collect or process national identification numbers, and we apply technical measures to detect, block, and delete them if they are entered into a prompt or other input.

Article 3 (Purposes and Legal Bases of Processing)

We process your personal data for the following purposes and, where the GDPR or similar laws apply, on the following legal bases.

Article 4 (Retention Periods)

When a retention period expires or the purpose of processing is achieved, we delete the data without undue delay using irreversible methods. Data that must be retained under applicable law is stored separately for the required period only.

Article 5 (How We Share Personal Data)

We do not sell your personal data. If you choose to allow advertising measurement, we may disclose the advertising measurement data described in Article 2 to the advertising partners listed below—Google Ads, Meta, and LinkedIn—only when the relevant measurement tag is enabled. Depending on applicable law, this disclosure may be considered sharing for cross-context behavioral advertising. We do not create website-visitor retargeting or matched audiences. We otherwise disclose personal data only as follows.

1. Service providers (processors) acting on our instructions:

We configure our monitoring provider to reduce the personal data it receives: we transmit your account identifier and the domain part of your email address (not the address itself), mask on-screen content in session replay, and redact email addresses and national identification numbers from error and AI-interaction records before transmission.

2. Independent controllers:

3. We may also disclose personal data where required by law, court order, or a lawful request by a public authority, or where disclosure is necessary to protect rights, safety, or property.

We use enterprise or API environments of our AI providers under which your data is not used to train their public models. The training of AI models that we ourselves develop and operate is governed by Article 19, and is carried out within infrastructure we manage and that of the processors listed above; no personal data is provided to any separate third party for that purpose.

Article 6 (International Data Transfers)

We are a company established in the Republic of Korea, and your personal data is stored on servers located in the Republic of Korea and, depending on the provider, in the United States or other locations listed in Article 5.

1. For users in the EU/EEA: the European Commission has adopted an adequacy decision for the Republic of Korea, so transfers of personal data from the EU/EEA to us in Korea are permitted without additional safeguards.
2. For transfers to providers in the United States and other third countries, we rely on appropriate safeguards such as standard contractual clauses or, where applicable, an adequacy framework covering the recipient.
3. You may request further information about the safeguards we use by contacting [email protected].
4. Where applicable law gives you a right to object to an international transfer, you may exercise it by contacting us. Because transfers to our AI, monitoring, and infrastructure providers may be necessary to provide requested features, objecting may limit or prevent use of those features.
5. If you allow advertising measurement, landing-page URL and referrer, IP address, browser and device information, cookies or similar identifiers, page-visit time, and sign-up-completed events may be transferred over HTTPS to Google LLC, Meta Platforms, Inc., and LinkedIn Corporation in the United States and other locations where they process data, but only through the measurement tags enabled for the applicable campaign. LinkedIn's conversion URL is limited to the sign-up path without query parameters or fragments. We use these transfers for advertising-visit and sign-up conversion measurement, attribution, reporting, and campaign optimization. Google states that conversion-measurement cookies such as _gcl_ last for 90 days; Google Ads reporting availability follows its published data-retention policy. Under Meta's applicable terms, Event Data may be retained for up to two years. LinkedIn states that direct identifiers are removed within seven days and pseudonymized data is deleted within 180 days. You may refuse or withdraw this transfer through the advertising measurement controls without losing access to the Service's core features.

Article 7 (Your Rights)

1. Subject to applicable law, you have the right to:

• Access the personal data we hold about you and receive a copy
• Correct inaccurate or incomplete personal data
• Delete your personal data, including the conversation history and attachments of the AI features
• Restrict or object to certain processing, including processing based on legitimate interests
• Object to the use of your data for AI model training and service improvement under Article 19, at any time and without affecting your use of the Service
• Receive your personal data in a portable format (data portability)
• Withdraw consent at any time, without affecting the lawfulness of processing before withdrawal

2. If you are in the EU/EEA or UK, you also have the right to lodge a complaint with your local supervisory authority.
3. If you are a California resident, you have the rights under the CCPA/CPRA to know, access, correct, and delete personal information, and the right not to be discriminated against for exercising your rights. We do not sell personal information. If applicable law treats the advertising measurement disclosure described in Article 5 as sharing, you may opt out by keeping advertising measurement disabled or withdrawing permission through the Service.
4. To exercise your rights, contact us at [email protected] or use the relevant settings within the Service. We respond within the time limits required by applicable law (and in any event within 10 business days in the ordinary course). We may need to verify your identity before acting on a request, and you may exercise your rights through an authorized agent where permitted by law.
5. Pseudonymized training data from which we can no longer identify you is not subject to access, correction, deletion, or restriction requests, because we cannot link it back to you. Article 19 explains how this works and how to object to its creation.

Article 8 (Cookies)

We use cookies and similar technologies to keep you signed in, remember your preferences, monitor service availability and performance, and analyze usage statistics. If you choose to allow advertising measurement, Google Ads, Meta, and LinkedIn may also use cookies or similar technologies to measure advertising visits, sign-up conversions, and campaign performance when their relevant tags are enabled. Their applicable terms may permit use of this data for ad delivery or personalization. We keep Google ad personalization disabled and do not create website-visitor retargeting or matched audiences. You may refuse or withdraw advertising measurement through the controls presented on the Service without losing access to core features. You can also refuse or delete cookies through your browser settings; some non-core features may be limited if cookies are disabled.

Article 9 (Data Security)

If a personal data breach occurs, we will notify the relevant supervisory authority and affected users as required by applicable law.

Article 10 (Children)

The Service is a business service intended for users who are at least 18 years old. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us and we will delete it.

Article 11 (Automated Decision-Making)

The Service provides AI-based analysis and recommendations. These outputs are for reference, and decisions that produce legal or similarly significant effects are not made solely by automated means. Where automated processing materially affects your rights or obligations, you may request an explanation, object, or request human review by contacting [email protected].

Article 12 (Changes to This Privacy Policy)

We may update this Privacy Policy to reflect changes in law or the Service. We will announce changes within the Service at least 7 days before they take effect, or at least 30 days in advance with individual notice for changes that are unfavorable to you.

Article 13 (Google API User Data)

Where you connect a Google service (such as Google Ads, Google Analytics 4, Search Console, or Tag Manager), we access user data through Google APIs. We share, transfer, or disclose that data only as follows.

Except as described above, we do not sell user data obtained through Google APIs to third parties and do not share it for advertising purposes. Our use and transfer of user data received from Google APIs complies with the Google API Services User Data Policy, including the Limited Use requirements.

Data obtained through Google Workspace APIs (such as Google Sheets, Google Docs, and Google Drive) is not used or transferred to develop, train, or improve AI or ML models, including data aggregated, anonymized, or derived from it, and is never converted into pseudonymized training data under Article 19. Data obtained through other Google APIs is not used to train or improve generalized or non-personalized models applied in common across other users or organizations; it is used only to provide and improve the Service for the relevant user and organization.

Article 14 (Contact)

For payment data processed by Paddle as Merchant of Record, you may also contact Paddle through the channels set out in Paddle's privacy policy (https://www.paddle.com/legal/privacy).

Article 15 (Connected Services and Platform Data)

The Service lets you connect external services that you choose and authorize. Available connections may change as the Service develops and currently include the following principal categories.

For all Connected Services:

• We access and process only the data within the permissions you grant.
• We do not sell data obtained from a Connected Service or disclose it for an unrelated third party's independent purpose.
• Processing by service providers and international transfers needed to provide requested features remain subject to Articles 5 and 6.
• We comply with the applicable API terms and data policies of each provider.
• Data for which use for AI model training or improvement is restricted under a provider's API terms or policies is excluded from the processing described in Article 19.
• You may disconnect a service through its account settings or by contacting us. Disconnection stops future access through that connection, subject to the provider's revocation process.
• If a new connection changes the categories of data collected, service providers used, or international transfer arrangements, we will update the relevant parts of this Privacy Policy.

Article 16 (Provider-Specific API Disclosures)

1. OpenAI. When you select or use a feature powered by OpenAI, we transmit only the data needed to fulfill your request. Under OpenAI's Services Agreement, Customer Content is not used to develop or improve OpenAI's services unless the customer explicitly agrees. OpenAI's API data controls describe default abuse-monitoring retention of up to 30 days; Responses API application state and uploaded files may be retained longer depending on the feature and deletion settings. See https://openai.com/policies/services-agreement/, https://developers.openai.com/api/docs/guides/your-data, and https://openai.com/policies/data-processing-addendum/.
2. Anthropic. When you select or use a feature powered by Claude, we transmit only the data needed to fulfill your request. We use Anthropic's commercial API, and data sent through that API is not used to train Anthropic's generative models. See https://www.anthropic.com/legal/commercial-terms, https://www.anthropic.com/legal/privacy, and https://www.anthropic.com/legal/aup.
3. xAI. When you select the Grok model, we transmit only the data needed to fulfill your request to SpaceXAI LLC. xAI does not train on API inputs or outputs without explicit permission. By default, encrypted API requests and responses are retained for 30 days for abuse or misuse auditing and then deleted; Zero Data Retention or a separately negotiated agreement may apply different handling. See https://x.ai/legal/terms-of-service-enterprise, https://docs.x.ai/developers/faq/security, https://x.ai/legal/data-processing-addendum, and https://x.ai/legal/privacy-policy.
4. Google (Gemini). When you select a Google model, we transmit only the data needed to fulfill your request to Google LLC. We use Google Cloud's enterprise generative AI service (currently the Gemini Enterprise Agent Platform, formerly Vertex AI), and data sent through it is not used to train Google's generative models. Logs kept to detect abuse or policy violations may be retained for up to 90 days within the region we select, and depending on the contract form may be excluded from such logging or not retained at all. We do not use free tiers whose submitted data is used to improve Google's products. See https://cloud.google.com/terms, https://cloud.google.com/terms/data-processing-addendum, https://docs.cloud.google.com/gemini-enterprise-agent-platform/models/abuse-monitoring, and https://policies.google.com/privacy.
5. Meta and TikTok. We access only data covered by the permissions you grant, do not sell API data or disclose it for an unrelated third party's independent purpose, and follow each provider's applicable platform terms and privacy policy.
6. Pinterest. The Service acts as an API relay and does not retain Pinterest content or API response data after fulfilling your request. During connection setup, the list of available ad accounts and OAuth credentials may be stored in encrypted temporary records for up to 15 minutes so that you can select an account without exposing credentials to your browser. We retain the selected ad account identifier and name and the encrypted OAuth access and refresh tokens needed to maintain the connection. When you disconnect Pinterest, those stored credentials are deleted without undue delay and the Service stops using them; you may separately revoke the authorization in Pinterest account settings. We do not resell or redistribute Pinterest content or Pinterest-derived data. The Service is not endorsed, sponsored by, or affiliated with Pinterest. See https://policy.pinterest.com/en/terms-of-service, https://policy.pinterest.com/en/privacy-policy, and https://developers.pinterest.com/terms/.

The statements above concern training by those providers of their own generative models. The training of AI models that we develop and operate is governed by Article 19 and is unaffected by them.

Article 17 (Deletion and Destruction)

1. We delete personal data without undue delay when the processing purpose is complete or the applicable retention period expires, except for data that must be retained by law.
2. Electronic records are deleted using methods designed to prevent recovery, and paper records are shredded or securely destroyed.
3. Data retained solely to meet a legal obligation is separated from actively used service data and is not used for another purpose.
4. When you request deletion of your AI conversation history or close your account, we destroy the corresponding original content and any identifier mapping information without undue delay. Pseudonymized training data is handled as described in Article 19.

Article 18 (Privacy Officer and Remedies)

You may contact us to exercise your rights or raise a privacy complaint. If you are in the Republic of Korea, you may also seek assistance from the Personal Information Infringement Report Center (https://privacy.kisa.or.kr, 118), the Personal Information Dispute Mediation Committee (https://www.kopico.go.kr, 1833-6972), the Supreme Prosecutors' Office, or the Korean National Police Agency. Users elsewhere may contact their local data protection authority.

Article 19 (Pseudonymized Data for AI Model Training and Service Improvement)

To improve the quality of the Service and its AI features, we may pseudonymize data generated in the course of your use of the Service and then process it for statistical purposes and scientific research, including industrial research.

1. Separation of original content and pseudonymized data

We store the original content we keep in order to provide the Service separately from the pseudonymized data used for service improvement and AI model training. What is used for training is not the original content but pseudonymized data, created by removing from the original, or replacing with substitute values, personally identifying information and information capable of identifying you or an advertiser. Pseudonymized data includes usage intent and type and extracted field values, together with pseudonymized conversation, request, and response content and tool execution records. We do not use original content that has not been pseudonymized as training data.

2. How we pseudonymize

• User, organization, and Workspace identifiers in usage records are replaced with arbitrary identifiers using irreversible methods such as key-based one-way functions. Where mapping information to the original identifiers is generated, it is held in a separate repository with segregated and minimized access rights.
• For unstructured data you enter freely, we remove personally identifying information such as names, email addresses, contact details, and account identifiers, along with information capable of identifying you or an advertiser, before composing the derived data.
• We do not collect or process national identification numbers, and we detect, block, and delete them if entered.

3. Scope

This Article applies to the AI analysis and conversational features, automatically executing features such as scheduled tasks, report and material generation features, and tool execution through an AI Client you connect via MCP. The detailed scope is as separately notified within the Service, and we may adjust or expand it in stages, giving notice within the Service.

4. Data excluded

Data for which use for AI model training or improvement is restricted under a third party's API terms or policies is excluded. In particular:

• Data obtained through Google Workspace APIs (Google Sheets, Google Docs, Google Drive, and the like) is not used or transferred to develop, train, or improve AI or ML models, including data aggregated, anonymized, or derived from it, and is never converted into pseudonymized training data. See Article 13.
• Data obtained through other Google APIs (Google Ads, Google Analytics, Search Console, Tag Manager, DV360, YouTube, and the like) is not used to train or improve generalized or non-personalized models applied in common across other users or organizations. It is used only to provide and improve the Service for the relevant user and organization.
• Other connected services are governed by the common principles in Article 15.

5. Relationship to your deletion rights

If you request deletion of your conversation history or close your account, we destroy the original content and any identifier mapping information without undue delay. Pseudonymized data from which specific individuals can no longer be identified is not subject to deletion requests. Where the GDPR applies, this reflects the position that we are not required to maintain, acquire, or process additional information solely in order to re-identify you for the purpose of complying with a request.

6. How to object, and what happens

You may object to the processing described in this Article at any time, through the settings within the Service or at [email protected]. Following an objection, we will not create pseudonymized training data from data generated thereafter. Data already pseudonymized before your objection is not subject to recall. Objecting places no restriction whatsoever on your use of the Service.

7. Relationship to third-party AI models

This Article concerns AI models that we develop and operate. The fact that data sent to external AI providers such as Anthropic, OpenAI, xAI, and Google is not used to train those providers' generative models is set out in Articles 5 and 16 and is unchanged by this Article.

8. Safeguards and records

We store pseudonymized data separately from additional information such as the keys used for pseudonymization and any mapping information, segregate and minimize access rights, and apply the technical measures necessary to ensure that one user's inputs and outputs are not exposed to other users in their original form. We keep records of the purposes of processing, the categories used, and the processing period. We do not process pseudonymized data in order to identify a specific individual, and if information capable of identifying a specific individual is generated during processing, we stop processing immediately and recall and destroy that information.

---

Google API Limited Use Compliance Statement

Pango Neuro's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Specifically, Pango Neuro:

• Only requests access to Google user data that is necessary for the features described in this application.
• Does not use Google user data for serving advertisements.
• Does not allow humans to read Google user data unless the user has given explicit permission, it is necessary for security purposes, or it is required by law.
• Does not use or transfer Google user data to develop, improve, or train generalized or non-personalized AI or ML models.
• Does not sell Google user data to third parties.