Privacy Policy

1. Information We Collect

We collect information you provide directly when using Pango Creative, as well as information generated automatically through your use of the Service.

• Waitlist information: name, email address, and company name when you join our waiting list. We use this to contact you when invite slots open.
• Invitation information: when you're invited to Pango, we record the name, email address, and company provided by your organization's contact or our team — along with any gifted videos or welcome discount attached to your invitation — before you first sign in. If you never claim the invitation, you can ask us to delete this record.
• Account & profile: your name, email address, and password (stored only in hashed form), and optionally a mobile phone number and profile photo.
• Agreement records: when you accept our terms (including any supplemental terms presented in the Service), we record that acceptance and when it happened.
• Billing: your subscription plan and billing history. Payments are processed by our payment provider, Stripe; we don't store your full card number — only enough to show you which card is on file.
• Project content: creative briefs, brand assets, reference materials, comments, and video files you upload or receive.
• Usage & device data: pages visited, features used, browser type, IP address, and device information. Logged for security and product improvement and accessible only to authorized personnel.
• Communications: messages sent through comments, support requests, and contact forms.

We do not use third-party advertising or analytics trackers, and we do not buy personal information about you from data brokers.

2. How We Use Your Information

We use the information we collect to provide, maintain, and improve the Service. Specifically:

• To create and manage your account and team memberships, and to authenticate you.
• To process payments and manage your subscription.
• To produce, review, and deliver your video projects, and store your files.
• To communicate with you about your account, orders, and service updates.
• To protect against fraud, abuse, and unauthorized access, and to enforce our Terms and Acceptable Use Policy.
• To comply with legal, tax, and accounting obligations.

3. Cookies & Tracking

We use only strictly-necessary cookies. Each one is essential to a feature you've asked for (logging in, staying logged in, keeping your form submissions safe), and removing it would break the Service. We do not use advertising or analytics tracking cookies.

Cookies in use:

• Session cookie — keeps you signed in and links your requests to your session. Cleared when you log out or your browser closes.
• CSRF protection cookie — protects every form submission against cross-site request forgery. Set by the Service and read back on each form post.
• Remember-me cookie — set only if you tick "Remember me" at login. Keeps you signed in across browser restarts; you can clear it by signing out.
• Stripe cookies — set by Stripe when you enter card details, used for payment security and fraud prevention. Governed by Stripe's privacy policy.
• Cloudflare Turnstile — set on public forms (waitlist, contact) to verify you're not a bot. No cross-site tracking. Governed by Cloudflare's privacy policy.

You can control cookie settings through your browser preferences. Disabling strictly-necessary cookies will prevent you from using parts of the Service that require login or form submission.

4. How We Share Information — Service Providers

We don't sell your personal information. We share it only with the service providers that help us operate the Service, each of which processes it on our behalf and only as needed to provide the Service. These fall into the following categories:

• Payment processing (Stripe) — to bill your subscription. Your card data is held by the processor; we receive only limited details such as the card brand and last four digits.
• Hosting & file storage — to run the Service and store your uploads and delivered videos.
• Security & bot protection — to protect our forms and accounts.
• Email delivery — to send transactional and service email.
• AI production tools — to help produce your videos, using the materials you submit (see Section 5).

The specific providers we use are listed on our Subprocessors page. We may also disclose information when required by law, to protect our rights or the safety of others, or in connection with a merger or acquisition (with notice as required by law).

5. AI Tools & Your Content

We use third-party AI tools to help produce your videos, which may involve sharing the materials you submit (such as briefs and brand assets) with those tools. The AI tools we use are configured not to use your content to train their models, and we instruct our team not to put your confidential materials into general-purpose AI tools that might.

6. Data Retention

We keep your information for as long as your account is active. You can delete a project before it enters production; once you delete it, it is permanently removed and we do not retain deleted jobs. For projects that have entered production or been delivered, you may request deletion as described in Section 8. When your account is closed, we may delete your data.

Teams that received only gifted videos and never subscribed may be deleted — including their projects and delivered videos — after 12 months of inactivity, with at least 30 days' notice.

Some records are kept longer where we have a legal or business need — for example, invoices and payment records for tax and accounting. If we delete or anonymize your account, we may retain records of past projects and comments in anonymized or pseudonymized form for legitimate business, audit, and legal purposes; these no longer identify you. We are not a backup service, so please keep your own copies of anything important.

7. Data Security

We protect personal information with technical and organizational measures, including:

• encryption in transit (TLS) between your browser and the Service;
• hashed passwords — we never store passwords in readable form;
• two-factor authentication by emailed one-time code (required for our staff; available to customers);
• bot protection on public and authentication forms, and rate limiting and lockouts on sign-in;
• access-controlled file storage — files move directly between your browser and our storage provider using short-lived signed links that expire;
• encrypted sessions, role-based access controls within teams, and security and activity logging.

No method of transmission or storage over the Internet is 100% secure, and we can't guarantee absolute security.

8. Your Rights

Depending on your location, you may have the following rights regarding your personal data:

• Access: Request a copy of the personal data we hold about you.
• Correction: Request correction of inaccurate or incomplete data.
• Deletion: Request deletion of your personal data (right to erasure).
• Portability: Request your data in a structured, machine-readable format.
• Objection: Object to processing of your data for certain purposes.
• Withdraw consent: Where processing is based on consent, you may withdraw it at any time.

To exercise any of these rights, contact us at hello@pangocreative.com. We will respond within 30 days and won't discriminate against you for exercising your rights. Note that some transactional messages — security codes, billing notices, and account-critical emails — are necessary to provide the Service and can't be turned off while your account is active.

For EU/EEA & UK residents (GDPR): We process your data based on contractual necessity (to provide the Service), legitimate interest (to improve and secure the Service), legal obligation (tax and accounting), and consent (where requested). You have the right to lodge a complaint with your local data protection authority.

For California residents (CCPA/CPRA): You have the right to know what personal information we collect, request its deletion or correction, and opt out of any sale or sharing of personal information. We do not sell or share personal information for cross-context behavioral advertising.

9. International Data Transfers

Your information may be processed and stored in the United States, where our servers are located, and by our service providers in other countries. If you are accessing the Service from outside the United States, your data will be transferred to and processed in the US. Where required, we rely on appropriate safeguards (such as Standard Contractual Clauses) for these transfers in compliance with applicable data protection laws.

10. Children's Privacy

The Service is not intended for individuals under the age of 18, and we do not knowingly collect personal information from children. If you believe a child has provided us with personal data, please contact us and we will promptly delete it.

11. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes via email or through a notice on the Service and update the date above. Your continued use of the Service after the effective date constitutes acceptance of the updated policy.

12. Contact

If you have questions about this Privacy Policy or our data practices, please contact us at hello@pangocreative.com or through our contact page.