Privacy Policy — PinkPanda Assistant

PinkPanda ("we", "us") operates PinkPanda Assistant, an AI assistant that acts on behalf of our business clients to manage their calendar and store their files. This policy explains what data the service accesses, how it is used, and the rights you have over it.

1. Who this applies to

PinkPanda Assistant is configured per client and accesses only the Google account of the client who explicitly authorizes it(the "User"). We do not access any account without the User's OAuth consent.

2. Data we access (Google account data)

With the User's authorization, PinkPanda Assistant accesses, only for that User's own account:

• Google Calendar (.../auth/calendar) — to read availability and create, update, move, or delete the User's appointments at the User's request.
• Google Drive — files created by the app (.../auth/drive.file) — to upload and attach the User's session summaries / documents that the assistant itself creates, and to read those same files. The app does notaccess other files in the User's Drive.

We request only these scopes. We do not request access to Gmail, contacts, or the User's full Drive.

3. How we use the data

Solely to provide the service the User asked for: managing the User's calendar and storing/attaching the User's session summaries. The data is used on the User's behalf, within the User's own Google account.

4. Google API Limited Use disclosure

PinkPanda Assistant's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Specifically, data obtained via Google APIs is:

• not sold, and not used for advertising;
• not used to train generalized / AI models;
• not read by humans, except (a) with the User's consent, (b) for security or to comply with law, or (c) where the data is aggregated / anonymized for internal operations.

5. Sharing & sub-processors

We do not sell or share Google account data. Limited, contractually-bound sub-processors support the service: our cloud hosting provider (isolated per-client infrastructure) and our AI model provider, which operates under a Data Processing Addendum and does not train on the data. Each client's data is isolated from every other client's.

6. Storage, retention & security

Data is processed on per-client isolated infrastructure, encrypted in transit and at rest, and stored in the User's own Google account(we hold a scoped access token, not a copy of the User's files). We retain operational data only while the service is active for the User. Access tokens are revocable by the User at any time.

7. Your rights / revoking access

The User may revoke PinkPanda Assistant's access at any time via Google Account → Security → Third-party access, or by contacting us. On revocation, the assistant immediately loses access to the User's data.

8. Children

The service is for businesses and is not directed to children under 16.

9. Changes

We may update this policy; material changes will be posted here with a new "Last updated" date.

10. Contact

Questions or requests: hello@pinkpanda.co.il · PinkPanda · Israel.