Privacy Policy

1. Information We Collect

We collect information you provide directly when using Pangolin Creative, as well as information generated automatically through your use of the Service.

• Waitlist information: name, email address, and company name when you join our waiting list. We use this to contact you when invite slots open.
• Account information: name, email address, and password when your account manager invites you and you complete onboarding.
• Billing information: payment method details processed securely through Stripe. We do not store your full card number.
• Project content: creative briefs, brand assets, reference materials, and video files you upload or receive.
• Usage data: pages visited, features used, browser type, IP address, and device information. Logged for security and product improvement and accessible only to authorized personnel.
• Communications: messages sent through comments, support requests, and contact forms.

2. How We Use Your Information

We use the information we collect to provide, maintain, and improve the Service. Specifically:

• To create and manage your account and team memberships.
• To process payments and manage your subscription.
• To produce and deliver your video projects.
• To communicate with you about your account, orders, and service updates.
• To protect against fraud, abuse, and unauthorized access.
• To analyze usage patterns and improve the Service.

3. Data Sharing & Third Parties

We do not sell your personal information. We share data only with the following categories of service providers, solely to operate the Service:

• Stripe: Payment processing and subscription management. Stripe's privacy policy governs their handling of your payment data.
• Cloudflare: Security, bot protection (Turnstile), and content delivery.
• DigitalOcean: Cloud hosting and file storage (Spaces) for video deliverables.
• Email providers: Transactional emails (account verification, order notifications).

We may also disclose information when required by law, to protect our rights, or in connection with a merger or acquisition.

4. Data Retention

We retain your account information for as long as your account is active. Project files (videos, briefs, assets) are retained for 90 days after project completion or account closure, after which they are permanently deleted. Billing records are retained as required by tax and accounting regulations.

5. Your Rights

Depending on your location, you may have the following rights regarding your personal data:

• Access: Request a copy of the personal data we hold about you.
• Correction: Request correction of inaccurate or incomplete data.
• Deletion: Request deletion of your personal data (right to erasure / right to be forgotten).
• Portability: Request your data in a structured, machine-readable format.
• Objection: Object to processing of your data for certain purposes.
• Withdraw consent: Where processing is based on consent, you may withdraw it at any time.

To exercise any of these rights, contact us at privacy@pangolincreative.com. We will respond within 30 days.

For EU/EEA residents (GDPR): We process your data based on contractual necessity (to provide the Service), legitimate interest (to improve and secure the Service), and consent (for marketing communications). You have the right to lodge a complaint with your local data protection authority.

For California residents (CCPA): You have the right to know what personal information we collect, request its deletion, and opt out of any sale of personal information. We do not sell personal information.

6. Cookies & Tracking

We use only strictly-necessary cookies during Phase 1. Each one is essential to a feature you've asked for (logging in, staying logged in, keeping your form submissions safe), and removing it would break the Service. We do not use advertising or analytics tracking cookies in Phase 1.

Cookies in use:

• Session cookie — keeps you signed in and links your requests to your session. Cleared when you log out or your browser closes.
• CSRF protection cookie — protects every form submission against cross-site request forgery. Set by the Service and read back on each form post.
• Remember-me cookie — set only if you tick "Remember me" at login. Keeps you signed in across browser restarts; you can clear it by signing out.
• Stripe cookies — set by Stripe when you enter card details, used for payment security and fraud prevention. Governed by Stripe's privacy policy.
• Cloudflare Turnstile — set on public forms (waitlist, contact) to verify you're not a bot. No cross-site tracking. Governed by Cloudflare's privacy policy.

You can control cookie settings through your browser preferences. Disabling strictly-necessary cookies will prevent you from using parts of the Service that require login or form submission.

7. Security

We implement industry-standard security measures to protect your data, including encryption in transit (TLS/SSL), secure password hashing, two-factor authentication, and regular security reviews. While we strive to protect your information, no method of transmission over the Internet is 100% secure.

8. Children's Privacy

The Service is not intended for individuals under the age of 18. We do not knowingly collect personal information from children. If you believe a child has provided us with personal data, please contact us and we will promptly delete it.

9. International Data Transfers

Your information may be processed and stored in the United States, where our servers are located. If you are accessing the Service from outside the United States, your data will be transferred to and processed in the US. We ensure appropriate safeguards are in place for such transfers in compliance with applicable data protection laws.

10. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes via email or through a notice on the Service. Your continued use of the Service after such notification constitutes acceptance of the updated policy.

11. Contact

If you have questions about this Privacy Policy or our data practices, please contact us at privacy@pangolincreative.com or through our contact page.