Privacy Policy

1. Introduction

PandaCodeGen ("we," "us," or "our") operates pandacodegen.com and is the controller of personal information collected through this public website, its automated audit, its website assistant, and its inquiry forms. This notice explains how that information is handled when you visit the website, ask the assistant a question, request an audit, submit an inquiry, or enable an optional service.

This notice is not used to manufacture consent. Optional analytics, advertising and scheduling remain off until you make the relevant choice. Two things run for every visitor without waiting for that choice, because neither sets a cookie: Vercel Web Analytics, which counts page views, and a note in your browser of where your visit started. Both are explained in section 2.2. Project-specific processing is also described in the signed engagement documents where applicable.

2. Information We Collect

2.1 Information You Provide Directly

• Contact Information: Name, email address, phone number, company name, website URL, and business details when you fill out forms or contact us.
• Project Information: Details about your project requirements, budget, timeline, and current technology stack.
• Communication Data: Messages, files, and documents you send us through email, contact forms, or meetings.
• Payment Information: Billing details processed through secure third-party payment processors (we do not store credit card data).

2.2 Information Collected Automatically

• Page-View Counts (every visitor): Vercel Web Analytics loads on the live site for every visitor, without waiting for a cookie choice. For each page view it records the page address, the site that linked you here, your approximate location (country, region and city), and your device type, operating system and browser. It sets no cookies and stores nothing in your browser. To tell visitors apart for the day, Vercel makes a hash from the incoming request and discards it after 24 hours, so a visit can't be tied to you or matched with your visits on other days. We see the results only as totals.
• Where Your Visit Started (every visitor): When you first open a page, the site saves a short note in your browser's session storage under the name pcg_first_touch_source. It holds where you came from (a campaign tag in the link, the referring site or search engine, or “Direct”), the kind of source (for example search, social or an AI assistant), the address of that first page, and the time you arrived. The note stays in your browser and is deleted when you close the tab or window. It is sent to us only if you submit one of our inquiry forms: it then travels with your inquiry, along with the page you sent the form from, and reaches us in the inquiry email. If you don't submit a form, we never receive it.
• Usage Data: With analytics consent, Google Analytics and Microsoft Clarity record pages visited, time spent, click patterns, browser information, and aggregate form milestones such as started, progressed, abandoned, errored, or completed. Form-field values are not included in these analytics events.
• Device Information: Device type, operating system, IP address, and browser type where needed to deliver the site, protect it, or provide a service you enable.
• Cookies and Similar Technologies: We use necessary preference storage, the session-storage note described above, and, only with the applicable choice, analytics, advertising, scheduling, chat, and approximate-location technologies.

2.3 Free Website Audit Tool Data

Our homepage provides a free website audit tool. When you submit a URL through this tool, we collect and process the following information for the purpose of providing the audit and tracking tool usage:

• The URL You Submit: We pass it to Google PageSpeed Insights and run bounded internal checks to return the automated result. Google and our hosting infrastructure process the request under their own service terms.
• Approximate Geographic Location: Country, region, and city may be read from Vercel request headers for abuse monitoring and, when you request an emailed summary, included in the internal notification. The application does not place the raw IP address in that message.
• Audit Results: The response can include lab scores, detected platform, web-vital diagnostics, and issue findings. These are point-in-time automated estimates.
• Email Address (Optional): If you ask us to email the automated summary, your email, submitted URL, result, and coarse location are sent through our email provider to deliver the confirmation and notify us of the request.

You can use the audit tool without leaving an email. Do not submit a private, confidential, or unauthorized URL. We do not create a database of partially completed forms or receive the values entered into an unfinished form; consented analytics records only aggregate milestone and field-identifier events.

2.4 Website Assistant and Live Chat

If you use Ask PandaCodeGen, our server sends your question and recent conversation messages through Vercel AI Gateway to an AI model running on Google Cloud Vertex AI (currently xAI's Grok or Google's Gemini), which drafts an answer from selected pages on this website. The request can include up to eight recent messages, limited to 600 characters each. Every request asks for zero data retention, so it only goes to a provider that has agreed with Vercel not to keep it. If we change the model or provider, we will update this section first. The assistant is user-initiated.

When Hassan is available, the assistant panel offers "Chat with Hassan now". If you choose it, the questions you typed into the assistant, the messages you send in the chat and the page you started from are posted to a channel in our team's Slack workspace, which only our team can see, where Hassan reads and answers them. Slack (Slack Technologies, part of Salesforce) processes them for us, and they stay in that channel as a record of the conversation. Live chat sets no cookies; your browser keeps the conversation in session storage until you close the tab. Your questions to the assistant and its answers are also posted to that Slack workspace, with emails and phone numbers removed, so a founder can follow the conversation and join it in the same panel if that would help.

The panel keeps up to 20 recent messages in your browser's session storage so you can continue the conversation in that tab. Our server shares cached answers only for the three preset starter questions; it revalidates those answers after seven days. Custom questions and follow-up answers are not placed in that shared cache. If you choose to hand the conversation to our founders, your questions are copied into the contact form, and they reach us with your name and contact details only when you submit that form.

We keep a log of the questions asked and the answers given, so we can see which questions our pages don't answer yet and improve them. Email addresses and phone numbers are removed from each question before it is stored. The log also records the page you asked from and whether our pages had the answer. It doesn't record your IP address, browser details or any identifier that links your questions to you or to each other, but it keeps whatever else you type, so please leave out personal details. Each day's log is deleted 90 days after it was written.

Please do not include passwords, payment information, or confidential project details in a chat question. For a private discussion, contact the founders directly.

3. How We Use Your Information

• To respond to your inquiries and provide customer support.
• To process contracts and deliver web development services.
• To send you project updates, proposals, and service-related communications.
• To improve our website functionality and user experience.
• To send marketing communications (with your consent).
• To comply with legal obligations and protect our legal rights.
• To detect and prevent fraud or security breaches.

4. How We Share Your Information

We do not sell, trade, or rent your personal information. We may share information in the following circumstances:

• Service Providers: Vendors that help us host the site, count page views without cookies (Vercel Web Analytics), process email and payments, answer website-assistant questions through Vercel AI Gateway, deliver live-chat messages to our team through Slack, and deliver requested services.
• Optional Website Providers: When a provider is configured for the deployment and you allow its category, Google Analytics and Microsoft Clarity may provide analytics; Meta Pixel may provide advertising measurement; and Cal.com may provide scheduling.
• Advertising Measurement: When you send an enquiry through a form or the website assistant, our customer system may send Meta and Google a record that an enquiry happened. It includes coded (hashed) versions of your email address, phone number and name, your country and state, your IP address and browser details, the advertising click identifiers captured if you arrived from an ad, and, if you later become a client, the value of the project. Your message is not included. We do not send this for visitors in the EU, EEA, UK or Switzerland unless they have allowed marketing, or for anyone who has Global Privacy Control turned on or has used our opt-out form.
• Legal Requirements: When required by law, court order, or government request.
• Business Transfers: In case of merger, acquisition, or sale of assets.
• With Your Consent: We will share information only with your explicit permission.

5. Data Security

We use reasonable technical and organizational safeguards appropriate to the website, including encrypted transport, access controls, bounded requests, origin checks, rate limits, dependency checks, and data minimization. No transmission or storage method is completely secure, and this statement is not a guarantee against every incident.

6. Your Rights and Choices

• Access: You can request a copy of your personal data.
• Correction: You can request that we update or correct inaccurate information.
• Deletion: You can request deletion of your data (subject to legal obligations).
• Opt-Out: You can unsubscribe from marketing emails at any time.
• Opt Out of Sharing: You can ask us not to share information linked to your email address with advertising platforms, using our opt-out form.
• Data Portability: You can request your data in a portable format.

To exercise these rights, contact us at info@pandacodegen.com.

7. Cookies and Tracking Technologies

Optional browser technologies are off by default. The first-visit banner lets you accept all, reject optional services, or choose analytics, advertising, and functional services separately. You can change or withdraw a choice at any time with the persistent Cookie settings control at the lower-left of the site. We remember the selection for up to 180 days.

The categories are:

• Necessary: Local storage that records and applies your privacy choice.
• Analytics: Google Analytics and Microsoft Clarity.
• Advertising: Meta Pixel in your browser, only when you allow marketing. Enquiry measurement from our customer system is separate and is described in section 4.
• Functional: Cal.com scheduling.

Two things are not part of these choices and run for every visitor: Vercel Web Analytics, which counts page views without cookies, and the pcg_first_touch_source note in session storage, which records where your visit started and is sent to us only with an inquiry form you submit. Section 2.2 describes both.

See our Cookie Policy for the current inventory, purposes, and retention details. Browser settings provide an additional way to delete or block storage, but are not the only control available.

8. Third-Party Links

Our website may contain links to third-party websites. We are not responsible for the privacy practices of external sites. We encourage you to review their privacy policies before providing personal information.

9. Data Retention

We keep inquiry and project information only for the period needed to respond, administer an engagement, secure the service, resolve disputes, and meet legal or accounting duties. We periodically review whether identifiable records are still needed. Email, hosting, analytics, and scheduling providers may retain data under their configured retention periods. You may request deletion; legal, security, backup, and contractual exceptions can apply.

10. International Data Transfers

Website and communication providers may process information in countries other than the one where you live. Where transfer safeguards are legally required, the responsible contracting entity must use the appropriate provider terms or transfer mechanism; providing an inquiry is not treated as blanket consent to waive those protections.

11. Children's Privacy

Our services are not directed to individuals under 18 years of age. We do not knowingly collect personal information from children. If we become aware of such collection, we will delete the information promptly.

12. Changes to This Policy

We may update this Privacy Policy to reflect changes in our practices or legal requirements. We will post the revised policy and its effective date here and provide any additional notice the law requires. Where a new use requires consent, we will ask for that consent instead of relying on continued use of the website.

13. Contact Us

If you have questions about this Privacy Policy or our privacy practices, please contact us:

14. GDPR Rights (EU/UK Users)

If EU or UK data-protection law applies to the processing, the potential lawful bases include:

• Contractual necessity: To deliver the web development services you have engaged us for.
• Legitimate interests: Fraud prevention, service security, responding to ordinary business inquiries, counting page views without cookies, knowing which page or site led to an inquiry, and essential operations, subject to the required balancing assessment.
• Consent: For optional analytics, marketing, scheduling, chat, and related browser storage where consent is the applicable basis.
• Legal obligation: Compliance with applicable laws and regulations.

As an EEA or UK resident, you have the following rights under GDPR:

• Right to Access: Request a copy of the personal data we hold about you.
• Right to Rectification: Request correction of inaccurate or incomplete data.
• Right to Erasure: Request deletion of your personal data where there is no compelling reason for its continued processing.
• Right to Restrict Processing: Request that we limit how we use your data in certain circumstances.
• Right to Data Portability: Receive your personal data in a structured, machine-readable format.
• Right to Object: Object to processing based on legitimate interests or for direct marketing.
• Rights Related to Automated Decisions: We do not make solely automated decisions that significantly affect you.

To exercise these rights, contact us at info@pandacodegen.com. You also have the right to lodge a complaint with your local Data Protection Authority. UK residents may contact the Information Commissioner's Office (ICO) at ico.org.uk.