Pandada AI

GDPR overview

Pandada AI acknowledges the GDPR without documenting it in any depth. Section 8 of the privacy policy, effective 12 October 2025, states that users in the European Union and California hold additional rights under the GDPR and the CCPA, namely access, correction, deletion and export; section 6 adds account deletion, portability and opting out of marketing communications. Rights are exercised by emailing contact@pandada.ai, with no dedicated form and no named data protection officer. International transfers outside the user's country of residence are acknowledged with appropriate safeguards that are never specified: no standard contractual clauses, no named transfer mechanism. No EU representative under Article 27 is published, and no registered company name or postal address appears anywhere on the site. The terms are governed by Delaware law, with disputes settled by AAA arbitration.

Who owns the data?

Section 7 of the terms leaves ownership with the user. You keep all rights to the files you upload, and you own the reports, charts and other outputs generated from your content. Uploading grants the publisher only a limited licence to process and store that material, solely in order to provide the service, and the home-page FAQ repeats the point in plain words: you retain full ownership. In the other direction, the service itself and the publisher's own content remain the property of Pandada AI, which grants you a limited, non-exclusive right of use for as long as your account remains open.

Reuse rights

Because you own both your uploads and the outputs, you can reuse the reports, charts and cleaned tables freely, for any purpose, without asking permission. On the publisher's side, section 3 of the privacy policy limits processing to running and maintaining the service, handling uploads and generating reports, improving and personalising the experience, sending update and support messages, detecting technical or security incidents, and meeting legal obligations or enforcing the terms. Prompts and uploaded data may be handled by third-party AI providers, which are not named but are said to be bound by strict confidentiality agreements, and by unnamed third-party cloud hosts. Stripe receives payment details directly and the publisher does not store full card numbers. Section 5 is explicit that personal information is not sold. Disclosure remains possible under legal obligation, in a merger, acquisition or asset sale, or with your explicit consent, for instance when you share a conversation publicly. The publisher states that customer data is never used to train AI models.

Data retention & training

Hosting summary

The publisher says very little. Section 5 of the privacy policy states only that third-party cloud hosting providers are used to store data securely: no provider is named, and no country or region is declared. Section 4 adds encryption in transit and at rest, with security measures described as meeting industry standards, while section 8 acknowledges that data may be transferred outside the user's country of residence under appropriate safeguards that are never detailed. Section 10 of the terms disclaims any guarantee of absolute security. Two points need separating from that. First, the /compare marketing page asserts EU servers: an isolated claim, absent from the privacy policy and found on a page whose other statements are demonstrably wrong. Second, a network observation rather than a company statement, the domain's A record (3.165.190.76) geolocates to Zurich, Switzerland, on AS16509 Amazon.com; that is an AWS edge node, which indicates where the service is delivered from and not where data is stored. No hosting jurisdiction can be established from what the site publishes.