Privacy Policy

• Account details: your email address, which is how you sign in (we use one-time email links, so we never hold a password).
• Your blog: blog name, subdomain, custom domain (if you add one), posts and drafts, titles, SEO fields, and images you upload or generate.
• Dictation audio: when you hold the panda to dictate, audio from your microphone is streamed to our speech-to-text provider to be turned into text. We do not store the audio.
• AI requests: when you use an AI feature (the panda assistant, rewrite, SEO, drafts, cover images), the relevant text from your post and your request.
• Usage records: which AI feature you used and how many tokens it took, to enforce fair-use limits and control costs.
• Technical data: IP address, browser and device information in server logs, and a bot-check result when you sign in. Your published blog's visitors generate the same kind of server logs.

We don't collect payment details (the service is currently free), and we don't use analytics, advertising or tracking tools.

• To create your account, sign you in and keep your session secure.
• To store, edit and publish your blog, including on your subdomain or custom domain.
• To provide the AI, dictation and voice features you choose to use.
• To prevent abuse, spam and bots, enforce our Terms and keep the service running.
• To send you essential service emails (sign-in links and important notices about your account).
• To comply with law and respond to valid legal requests.

We process your data on the basis of your consent, given when you sign up and when you choose to use a feature, and for the legitimate uses the DPDP Act permits (such as complying with law). You can withdraw consent at any time by deleting your account (see section 6); this doesn't affect processing that already happened.

We never sell or rent your personal data. We share it only with service providers that help us run Panda Speaks, and only what each one needs:

• OpenAI (USA): text for AI writing features, and descriptions for AI cover images. Under OpenAI's API terms, this data is not used to train their models by default.
• ElevenLabs (USA/EU): microphone audio while you dictate, for speech-to-text.
• Resend (USA): your email address, to deliver sign-in emails.
• Cloudflare (global): the Turnstile bot check on the sign-in page, which processes browser and device signals.
• Our hosting provider: the server and backups where your account and blog are stored.

We may also disclose data if required by law, a court order or a lawful request from a government authority, or to protect the rights, safety or property of our users, the public or us.

Published content is public. Anything you publish on your blog can be read, copied and indexed by anyone, including search engines. Drafts stay private to you.

Some of our providers process data outside India, mainly in the United States and the European Union. The DPDP Act allows these transfers except to countries the Government of India restricts; we will stop any transfer that becomes restricted. We choose providers that commit to protecting data with appropriate security safeguards.

• Your account and blog: for as long as your account exists.
• Deleted posts and images: removed from the live service straight away.
• Backups: nightly copies are kept for 14 days and then overwritten, so deleted data leaves them within 14 days.
• AI usage records and server logs: only as long as needed for limits, security and debugging.
• Dictation audio: not stored by us.

You can ask us to:

• tell you what personal data we hold about you and how we use it (access);
• correct or complete inaccurate data (most of it you can edit yourself in the dashboard);
• delete your account and personal data (erasure), and withdraw consent;
• give you a copy of your posts (portability);
• nominate someone to exercise these rights if you die or become unable to; and
• resolve a complaint about how we handle your data (grievance redressal).

Email vaibhav777@gmail.com from the address you sign in with. We'll respond within 30 days, and delete accounts within 30 days of a verified request. If you're in the EU, UK or California, you have equivalent rights under the GDPR, UK GDPR or CCPA, and this is how to exercise them too.

If you're not satisfied with our response, you can complain to the Data Protection Board of India, or to your local data protection authority.

We use only essential cookies: the session cookies that keep you signed in. The browser's local storage remembers small preferences on your device, such as whether the panda's voice is on. Cloudflare Turnstile may use similar technologies to tell people from bots. We don't use advertising or analytics cookies, so there's nothing to opt out of.

We use encryption in transit (HTTPS) everywhere, keep databases off the public internet, restrict administrative access, and keep regular backups. No system is perfectly secure; if a breach affects your personal data, we will notify you and the Data Protection Board of India as the law requires.

Panda Speaks is for people aged 18 and over. We don't knowingly collect data from anyone under 18. If you believe a child has signed up, email vaibhav777@gmail.com and we will delete the account.

We'll update this page when our practices change and change the date at the top. If a change is significant, we'll tell you by email or in the dashboard before it takes effect.

For any privacy question, request or complaint, contact our Grievance Officer under the IT Rules, 2021 and the DPDP Act:

Vaibhav Vashishtha, Grievance Officer, Panda Speaks
Email: vaibhav777@gmail.com
New Delhi, India

We acknowledge complaints within 24 hours and aim to resolve them within 15 days. See also our Terms of Service.