Privacy Policy

M.M. KIMA DEVELOPMENT LTD, a company registered in Cyprus, operating under the trade name PandAi7 ("Company," "we," "us," or "our"), is committed to protecting your privacy and handling your data responsibly.

This Privacy Policy explains how we collect, use, disclose, store, and protect information when you visit our website, use our platform, or interact with any of our services, including website generation, hosting, AI-powered editing, and related communications (collectively, the "Services").

This Privacy Policy should be read alongside our Terms of Service, which govern your use of the Services. Terms defined in the Terms of Service have the same meaning when used in this Privacy Policy.

By accessing or using our Services, you acknowledge that you have read and understood this Privacy Policy. If you do not agree with our data practices, please do not use the Services.

We collect information through the following methods:

• Directly from you: When you create an account, use the AI editor, upload content, subscribe to a plan, or contact us.
• From publicly available sources: We collect business information from public directories, mapping services, and business listing platforms to generate websites. This information is already publicly accessible.
• Automatically: Through cookies, server logs, and similar technologies when you interact with the Platform. This includes usage data, device information, and IP addresses.
• From third-party services: We may receive information from our service providers, including payment confirmation from payment processors, business data from mapping and directory APIs, and verified profile information from third-party identity providers (Google or LinkedIn) when you choose to sign in through those services.

We use the information we collect for the following purposes:

• To generate, deploy, and host your business website
• To provide AI-powered content editing and modification features
• To authenticate your identity and provide secure access to your account
• To process subscriptions, Add-on activations, Edit Pack purchases, domain registrations, and other transactions
• To send transactional communications, including authentication emails, subscription reminders, and service notifications
• To monitor and enforce compliance with our Terms of Service and Acceptable Use policy, including automated and manual screening of website content for prohibited or unlawful material
• To detect, prevent, and address abuse, fraud, and security issues
• To improve, maintain, and optimize our Services and Platform
• To comply with legal obligations and respond to lawful requests

As a company registered in the European Union (Cyprus), we process personal data in accordance with the General Data Protection Regulation (GDPR). The legal bases for our processing activities are:

• Performance of a contract: Processing necessary to deliver the Services you have subscribed to, including website generation, hosting, AI editing, and account management.
• Legitimate interests: Processing necessary for our legitimate business interests, including improving our Services, ensuring platform security, detecting abuse, and generating a preview website from publicly available business information when a visitor requests one. We balance these interests against your rights and freedoms, taking into account the limited nature of the publicly available business data used and the ability to request correction or removal at any time.
• Consent: Where required, we obtain your consent before processing your data for specific purposes. You may withdraw your consent at any time by contacting us or using the opt-out mechanisms provided.
• Legal obligation: Processing necessary to comply with applicable laws, regulations, or legal processes to which we are subject.

We do not sell your personal information. We may share your information with the following categories of third parties, solely for the purposes described in this Privacy Policy:

• AI service providers: Content you submit through AI features may be sent to third-party AI model providers for processing.
• Payment processors: Transaction and billing information is shared with our payment provider to process subscriptions and purchases.
• Cloud infrastructure providers: Your data is stored and processed on servers operated by third-party cloud hosting providers.
• Business data and mapping providers: We query third-party APIs to discover publicly available business information. Business data from these providers is used transiently during website generation and is not permanently stored on our servers. During the preview window, business photographs may be served directly from third-party content delivery networks. Upon subscription, these are replaced with Customer-provided imagery.
• Email and messaging providers: We use third-party services to deliver authentication emails and service notifications.
• Third-party identity providers: When you choose to sign in with Google or LinkedIn, your browser is redirected to that provider to complete authentication. We share the minimum information required to initiate the sign-in exchange; the provider returns a verified email address, name, profile picture URL, and locale. We do not share your usage data or any other account content with these identity providers.
• Analytics: We operate a self-hosted, cookie-free analytics service (Umami) on our own infrastructure. Aggregated visit data (page, referrer, coarse geography, browser and device type) is not shared with any external analytics vendor.
• Domain registrars and DNS providers: When you purchase a domain, registration details are shared with our third-party domain registrar to complete the registration. Domain routing and SSL data is shared with our DNS and CDN provider.
• Legal and regulatory authorities: We may disclose information where required by law, legal process, or government request, or where necessary to protect our rights, safety, or property.

In the event of a merger, acquisition, or sale of assets, your information may be transferred to the acquiring entity, subject to the same privacy protections described in this policy.

The Company is registered in Cyprus (European Union) and operates internationally. Your information may be transferred to, stored, and processed in countries outside of your country of residence, including countries outside the European Economic Area (EEA).

Where we transfer personal data outside the EEA, we ensure that appropriate safeguards are in place in accordance with GDPR requirements, such as standard contractual clauses approved by the European Commission, adequacy decisions, or other lawful transfer mechanisms.

Our third-party service providers, including AI model providers, cloud infrastructure, and payment processors, may process data in various jurisdictions. We require that these providers maintain appropriate levels of data protection consistent with this Privacy Policy and applicable law.

We retain your information for as long as necessary to fulfill the purposes described in this Privacy Policy, unless a longer retention period is required by law. Specifically:

• Preview website data (non-subscribers): Generated preview websites are retained for a short window (currently 48 hours; the exact duration is published via the Platform) and are then permanently deleted. No archive is retained for non-subscribers. If you later wish to subscribe, we will regenerate a fresh website from your business information; your prior preview cannot be recovered. Preview websites are configured not to be indexed by search engines — they are served with directives that exclude them from search results, sitemaps, and search-engine archives, and links shared on social platforms display a generic “Pending subscription” preview card rather than the underlying business details. Real business name, photographs, and other identifying details appear in search results and social previews only after the Customer completes the post-payment confirmation step.
• Paid but not yet confirmed (awaiting completion): Upon subscription payment, temporary third-party preview data (including business-listing data and imagery) is removed, and the website displays a generic “awaiting completion” page — containing no business details — until the Customer completes the post-payment confirmation step. During this period we send transactional setup-reminder emails. Content the Customer subsequently provides is retained for the duration of the subscription.
• Active subscription website data: Retained for the duration of your active subscription.
• Cancelled subscription website data: Upon cancellation, your website is placed in an archived state at the end of your paid billing period and retained for up to 365 days, during which you may reactivate your subscription to restore the site with your edits intact. After 365 days, the archived website and its content are permanently deleted.
• Post-deletion summary record: When a preview website is deleted we retain a minimal technical record of it — the web address it used, its business category, the design selections made, language settings, and counts of any edits or support messages. This record contains no business name, address, phone number, opening hours, or photographs. Where the preview was created from a business listing, that listing's identifier is retained so a fresh website can be generated on request. Personal data captured alongside the record (such as the IP address that created the preview) is removed after a short retention period.
• AI interaction data: Prompts and generated content follow the same retention as the underlying website (preview window or archive window).
• Pre-subscription edit submissions: Visitor-submitted text edits, photo uploads, and queued AI drafts described in Section 2.10 are retained for up to 7 days from submission and are permanently deleted thereafter, whether or not they were ever applied.
• Payment, invoice, and tax records: Retained as required by applicable financial and tax regulations (typically 6–7 years), independently of subscription status.
• Communication records: Records of transactional communications and opt-out preferences are retained to honor your communication preferences.
• Outbound email records: We keep a log of the transactional emails we send, recording the recipient, subject, message type, delivery status, and timestamps. Where diagnostic logging is enabled, the log also stores the rendered message body, which can include the contents of the email itself — such as a sign-in link, a verification code, or a message submitted through a website contact form. These records are purged on a rolling schedule.
• Audit logs: Account activity and security events are retained in accordance with configured log-retention policies, which may be shorter than the periods above.

When data is no longer required, it is securely deleted or anonymized. You may request deletion of your personal data at any time, subject to our legal obligations and legitimate business needs.

We implement appropriate technical and organizational measures to protect your information against unauthorized access, alteration, disclosure, or destruction. These measures include:

• Encryption of data in transit using TLS/SSL protocols
• Secure database storage with access controls
• Passwordless authentication (see Section 2.2) — no passwords are collected or stored; sign-in uses single-use, time-limited magic-link tokens or a verified third-party identity provider
• Regular monitoring for security threats and vulnerabilities
• Access to personal data restricted to authorized personnel on a need-to-know basis

While we strive to protect your information, no method of transmission or storage is completely secure. We cannot guarantee absolute security of your data. If you become aware of a security breach affecting your account, please contact us immediately.

Under the General Data Protection Regulation (GDPR) and applicable data protection laws, you have the following rights regarding your personal data:

• Right of access: You have the right to request a copy of the personal data we hold about you.
• Right to rectification: You have the right to request correction of inaccurate or incomplete personal data.
• Right to erasure: You have the right to request deletion of your personal data, subject to our legal obligations and legitimate interests.
• Right to restrict processing: You have the right to request that we limit the processing of your personal data in certain circumstances.
• Right to data portability: You have the right to receive your personal data in a structured, commonly used, and machine-readable format.
• Right to object: You have the right to object to the processing of your personal data based on legitimate interests, including for direct marketing purposes.
• Right to withdraw consent: Where processing is based on consent, you have the right to withdraw your consent at any time.
• Rights regarding automated decision-making: We use automated tools, including AI, to screen website content for material that violates our Terms of Service or Acceptable Use policy. If suspected prohibited content is detected, your website may be placed under a temporary hold and taken offline pending review by our team; a permanent removal is never made by automated means alone. You have the right not to be subject to a decision based solely on automated processing that produces legal or similarly significant effects, and to obtain human review of, express your view on, or contest any such hold by contacting us.

To exercise any of these rights, please contact us. We will respond to your request within thirty (30) days. If we are unable to fulfill your request, we will explain why.

You also have the right to lodge a complaint with the Office of the Commissioner for Personal Data Protection in Cyprus, or with the supervisory authority in your country of residence.

We use a small number of cookies on our Platform. Cookies are small text files stored on your device that help us provide and secure our Services.

Analytics: Our self-hosted analytics system does not set cookies or use cross-site tracking identifiers. Section 6 describes what it records and confirms that no third-party analytics provider is used; Section 12.1 describes what Customers receive about visits to their own websites.

We do not use advertising cookies or cross-site tracking. Essential cookies cannot be disabled as they are required for the Platform to function; disabling them will prevent you from signing in. You can clear cookies at any time through your browser settings.

If we introduce non-essential analytics, advertising, or retargeting cookies in the future, we will update this Policy and, where required, request consent before those technologies are used.

PandAi7 hosts websites for Customers under Company-controlled domains, subdomains, or URL paths, including pandai7.com. When a visitor accesses a Customer Website hosted through PandAi7, we process technical information necessary to deliver, secure, maintain, and measure the website. This may include IP address, browser and device information, referrer, pages visited, timestamps, security logs, and similar technical data.

For website content, business communications, contact forms, booking requests, customer inquiries, reviews, menus, pricing, offers, and other business-specific interactions, the Customer is responsible for determining what information is collected from visitors and how it is used. In those cases, the Customer may act as the data controller, and PandAi7 may act as a service provider or processor providing hosting and platform services.

Visitors should review the legal pages and privacy notices published on the relevant Customer Website. Questions about the Customer’s products, services, business practices, refund policies, appointments, bookings, or visitor-submitted information should be directed to the Customer unless the issue concerns PandAi7’s platform, security, abuse, or hosting operations.

Our Services are designed for businesses and are not directed at individuals under the age of 18. We do not knowingly collect personal data from children. If we become aware that we have inadvertently collected personal data from a child, we will take steps to delete such data promptly. If you believe that we have collected information from a child, please contact us.

We may update this Privacy Policy from time to time to reflect changes in our practices, Services, or applicable law. Updated versions will be posted on this page with a revised "Last updated" date.

For material changes that significantly affect how we handle your personal data, we will notify you via email or through the Platform no less than thirty (30) days before the changes take effect. The updated Privacy Policy will apply from its effective date. Where required by law, we will request consent or provide additional notice before applying material changes to processing activities.

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:

For GDPR-related inquiries, you may also contact the Office of the Commissioner for Personal Data Protection in Cyprus at www.dataprotection.gov.cy.