Privacy Policy

This Privacy Policy applies to Pandli's website, marketplace, support channels, and related services (the “Service”). “Pandli,” “we,” “us,” and “our” refer to the operator of the Service. It does not replace the privacy policies of Stripe, Google, social-media platforms, or other services you choose to use with Pandli.

Pandli connects businesses and other campaign sponsors (“Brands”) with people who create promotional content (“Creators”). The information we handle depends on your role and how you use the Service.

We may collect the following categories of information:

• Account information. Email address, authentication identifiers, selected marketplace role, account status, acceptance of our terms, and account creation and activity timestamps.
• Google sign-in information. If you use Google to sign in, Google and our authentication provider provide basic account information such as your Google account identifier, name, email address, and profile image. Pandli does not request access to your Google contacts, Drive files, or the ability to post as you.
• Campaign and contract information. Campaign briefs, content requirements, platforms, payout amounts, deadlines, location scope or ZIP code, claims, approvals, revisions, refunds, disputes, and related communications and audit records.
• Creator content and proof. Social-media usernames, public post URLs, notes, screenshots, images, videos, and other proof submitted to demonstrate completion of a contract. Private-account proof may be reviewed by the relevant Brand and authorized Pandli personnel, but is not published in Discover.
• Payment and verification status. Stripe account, customer, transaction, transfer, payout, refund, and dispute identifiers; amounts; status; timestamps; and whether Stripe requires action. Stripe collects and controls card, bank, tax, identity, KYC, and payout details under its own privacy policy. Pandli is designed not to store raw card or bank numbers, SSNs, or identity-document contents.
• Support and waitlist information. Your email address, selected role, messages, screenshots, and any other information you choose to send when you join a waitlist or contact support. Do not send passwords, SSNs, identity documents, bank details, or one-time codes to support.
• Device, usage, and security information. IP address, browser and device information, pages and features used, request and event timestamps, referring URLs, authentication and session events, error information, and security logs collected by Pandli and our hosting and infrastructure providers.

We receive information:

• directly from you when you register, create or accept work, submit proof, or contact us;
• from other marketplace participants when they fund, review, approve, dispute, or report activity;
• from Google when you choose Google sign-in;
• from Stripe about payment, verification, refund, dispute, and payout events;
• from public social-media pages and content URLs submitted through Pandli; and
• automatically from browsers, devices, security systems, hosting providers, and service logs.

We use information to:

• create and secure accounts, authenticate users, and enforce marketplace roles;
• operate contracts, campaign funding, reviews, notifications, refunds, and Creator payouts;
• verify submitted work and show eligible public completed work in Discover;
• provide support and communicate about accounts, contracts, payments, and Service updates;
• detect fraud, abuse, unsafe content, policy violations, and security incidents;
• debug, maintain, analyze, and improve the Service;
• enforce our Terms and protect users, Pandli, and the public; and
• comply with law, payment-network rules, tax obligations, and valid legal requests.

Pandli may send contract requirements, submitted URLs and usernames, and uploaded proof to Google Cloud's Vertex AI service to help identify missing disclosures, required mentions or hashtags, mismatches, or possible manipulation. AI output is an advisory signal. A Brand or authorized reviewer makes the final approval and payment decision; Pandli does not use AI alone to authorize a payout.

We may disclose information in these circumstances:

• Marketplace participants. Brands and Creators receive the contract, submission, review, and payment-status information needed to perform and manage their work. Public post content from eligible paid contracts may appear in Discover.
• Service providers. We use providers including Supabase for authentication, database, and file storage; Stripe for payments and connected accounts; Vercel for website hosting; Google Cloud for API hosting and AI-assisted proof review; Resend for transactional email; and Google for optional sign-in. These providers process information to deliver their services to Pandli and under their own terms and privacy commitments.
• Social platforms. Public Instagram, TikTok, or YouTube content may be displayed using those platforms' embedded players. Loading an embed may send the platform your IP address, device information, the page you viewed, and cookies or similar identifiers under that platform's privacy policy.
• Legal, safety, and integrity purposes. We may disclose information when reasonably necessary to comply with law or valid legal process; investigate fraud, abuse, disputes, or security incidents; enforce agreements; or protect the rights and safety of Pandli, our users, or others.
• Business changes. Information may be disclosed as part of due diligence or transferred in connection with financing, a merger, acquisition, reorganization, bankruptcy, or sale of all or part of the business, subject to appropriate safeguards.
• At your direction. We may disclose information when you request or consent to it.

Pandli does not sell personal information for money and does not share personal information for cross-context behavioral advertising. We do not use third-party advertising trackers to build advertising profiles across unrelated services.

Pandli uses browser storage and similar technologies that are necessary to keep you signed in, protect sessions, remember essential state, and prevent abuse. Google, Stripe, and embedded social platforms may use their own cookies or similar technologies when you interact with their services. You can restrict browser storage or cookies, but authentication, payments, embeds, or other Service features may stop working correctly.

Links to third-party websites and public social posts are governed by those third parties' policies. Pandli does not control their privacy or security practices.

We retain information for as long as reasonably necessary to provide the Service and for legitimate business purposes such as security, dispute resolution, financial reconciliation, tax and accounting, enforcing agreements, and legal compliance. Retention periods vary based on the type of record and why it is needed.

You may request account deletion through Settings when available or by emailing support. An account without marketplace or payment history may be deleted. If an account has contracts, payments, disputes, or other records we must preserve, we may deactivate the account and retain the necessary records. We may also retain backups for a limited period and records required to prevent fraud or comply with law.

Pandli uses administrative, technical, and organizational safeguards intended to protect information, including access controls, row-level database restrictions, private proof storage, encrypted network connections, webhook verification, and restricted service credentials. No system is perfectly secure, and we cannot guarantee that information will never be accessed, lost, or misused.

Pandli and its providers may process information in the United States and other countries. Those locations may have privacy laws different from the laws where you live. Where required, we rely on appropriate legal mechanisms for cross-border processing.

Depending on where you live, you may have the right to request access to or a copy of your personal information, correct inaccurate information, delete information, restrict or object to certain processing, or receive portable data. You may also have the right to appeal a denied request and to receive equal service without unlawful discrimination for exercising a privacy right.

To submit a privacy request, email support@pandli.com from the email associated with your Pandli account and describe your request. We may ask for information reasonably necessary to verify your identity and protect your account. An authorized agent may submit a request where permitted by law, subject to verification of the agent's authority and the user's identity.

You can disconnect Google sign-in through your Google account, but doing so does not automatically delete your Pandli account or records. You can also manage a connected payout account through Stripe's interfaces.

California residents may have rights to know the categories, sources, purposes, and recipients of personal information; request specific information; correct inaccuracies; request deletion, subject to exceptions; opt out of sale or sharing; and not receive discriminatory treatment for exercising those rights.

In the preceding 12 months, the categories of personal information Pandli has collected are described in Section 2. The sources, purposes, and categories of recipients are described in Sections 3, 4, and 6. Pandli has not sold personal information or shared it for cross-context behavioral advertising. Because we do not engage in those activities, Pandli does not offer a separate “Do Not Sell or Share” link. Submit California requests using the email method in Section 10.

We do not knowingly use or disclose sensitive personal information for purposes that require a separate right to limit under California law. Stripe independently collects identity, financial, and verification information needed to provide its services.

Pandli is for people who are at least 18 years old and legally able to enter a contract. We do not knowingly collect personal information from children. If you believe a child has provided information to Pandli, contact us so we can investigate and take appropriate action.

We may update this Privacy Policy as Pandli and applicable requirements change. We will post the updated policy here and revise its effective date. When a change is material, we may also provide notice through the Service or by email.

Questions, privacy requests, and concerns can be sent to support@pandli.com. Please do not include passwords, SSNs, identity documents, complete payment-card or bank details, or one-time codes in an email.

For more information about key providers, see the Supabase Privacy Policy, Stripe Privacy Policy, Google Privacy Policy, and Vercel Privacy Policy.