Privacy Policy

This Privacy Policy explains how Pandora Technologies LLC ("Pandora", "we") handles personal information in connection with the Pandora Modules platform and the pandoramodules.com website (the "Service"). Pandora Technologies LLC is a South Carolina limited liability company within the Prestige Group of Companies.

1. Two roles: our data vs. your data

• As a controller — for the pandoramodules.com website, account signup, billing, and support, we decide how limited personal information (like your name, work email, and company) is used. This policy covers that.
• As a processor — for the data your organization puts into its tenant workspace (your CRM contacts, employees, tickets, documents, etc.), your organization is the controller and we process it on your instructions under the Data Processing Addendum. If you are an employee or contact of a Pandora customer, direct privacy requests to that customer.

2. Information we collect (as controller)

• Account & contact: name, work email, company name, and the password hash you set at signup (we never store your password in plaintext).
• Billing: plan and, for paid plans, billing contact and payment status. Card details are handled by our payment processor; we do not store full card numbers.
• Usage & logs: IP address, timestamps, pages/actions, and error diagnostics, used to operate, secure, and troubleshoot the Service.
• Support communications: messages you send us via contact forms or email.

3. How we use it

• To provide, secure, and support the Service and your account.
• To process signups, provisioning, and billing.
• To communicate about your account, service changes, and security matters.
• To detect, prevent, and investigate fraud, abuse, and security incidents.
• To comply with legal obligations.

We do not sell personal information, and we do not use Customer Data to train AI models. We do not serve third-party advertising.

4. Legal bases (EEA/UK, where applicable)

Where GDPR/UK GDPR applies, we rely on: performance of a contract (providing the Service); legitimate interests (securing and improving the Service, communicating with customers); consent (where required, e.g. certain communications); and legal obligation.

5. Sharing

We share personal information only with: (a) service providers/subprocessors that help us run the Service (hosting, email delivery, payment processing, AI API providers) under contract — see the current list in the DPA; (b) authorities when required by law or to protect rights and safety; and (c) a successor in a merger or asset sale, subject to this policy.

6. Cookies

We use strictly necessary cookies for authenticated sessions and security (for example, your login session and CSRF protection). We do not use third-party advertising or cross-site tracking cookies on the Service.

7. Security & retention

We protect data with encryption in transit, tenant isolation enforced at the database layer, encrypted storage of credentials, and access controls. See the Security page for detail. We keep account and billing information for as long as your account is active and as needed for legal, tax, and audit purposes; usage logs are retained on a rolling basis; and Customer Data is handled per the Terms and DPA (export window then deletion, with backups aging out on our standard rotation).

8. Your rights

Depending on where you live, you may have rights to access, correct, delete, or port your personal information, or to object to or restrict certain processing. To exercise a right regarding data we hold as a controller, contact us via pandoramodules.com/contact. For data held within a customer's tenant, contact that customer (we will assist them as their processor). We will not discriminate against you for exercising your rights.

9. International transfers

We operate in the United States. If you access the Service from outside the U.S., you understand your information will be processed in the U.S. Where required, transfers of EEA/UK personal data rely on appropriate safeguards such as the Standard Contractual Clauses (addressed in the DPA).

10. Children

The Service is for business use and not directed to children under 16; we do not knowingly collect their personal information.

11. Changes & contact

We may update this policy; material changes will be noticed in-product or by email, and the "Last updated" date will change. Privacy questions and requests: pandoramodules.com/contact — Pandora Technologies LLC, South Carolina, USA.