Who we are
Pandi (pandi.work and app.pandi.work) is run by the Pandi Team, based in the Dominican Republic. For the personal data described here, we are the data controller.
You can reach us at hello@pandi.work about anything in this policy.
This policy is written with the Dominican Republic’s Law 172-13 on the protection of personal data, the European Union and United Kingdom General Data Protection Regulation (GDPR), and United States privacy laws in mind.
What we collect
Your account
- Name, email and password. Your password is stored as a one-way hash, so nobody, including us, can read it.
- Google sign-in. If you use it, we receive your Google account ID, name and email. We never see your Google password.
- Invoice details you choose to add: occupation, city, phone number and a default invoice note. They are optional and only appear on the invoices you export. We don’t ask for or keep national ID numbers. If you added one before, we deleted it on 28 October 2026.
- Preferences: time zone, preferred currency, language, profile picture and its color, and your analytics choice.
- Your plan. Whether you’re on the Free or Pro plan, and for Pro the subscription status and renewal date. See Payments.
- Two-step verification, if you turn it on: an encrypted secret, your recovery codes (stored as hashes) and, if you ask us to remember a device, a cookie on that device.
What you add to Pandi
Clients and their contacts, income, expenses, services, time entries, boards and tasks, notes, calendar events, tags, and the images you attach to tasks. Images are re-encoded when you upload them, which removes hidden metadata such as GPS location.
Some of this is personal data about other people, like your clients’ names, emails and phone numbers. See Your clients’ data.
Google Calendar, if you connect it
When you connect Google Calendar, we keep:
- the email of the Google account you connected;
- an access token from Google, encrypted in our database, so Pandi can sync without asking you again;
- the names and colors of your calendars, and which ones you chose to show;
- a copy of the events from the calendars you chose: title, description, location, start and end time.
Pandi checks for changes about every 15 minutes. Google asks you to allow Pandi to see your calendar list and to see and edit your events. Today Pandi only reads them; it doesn’t change or delete anything in your Google Calendar. If we start adding events there, we’ll update this policy first.
When you hide a calendar, we delete its copied events. When you disconnect Google Calendar or delete your account, we delete the copied events and the token, and we ask Google to revoke Pandi’s access. You can also remove it at any time from your Google Account.
Pandi’s use of information received from Google APIs follows the Google API Services User Data Policy, including the Limited Use requirements. We use your Google Calendar data only to show your events in Pandi. We don’t sell it, use it for advertising, use it to train AI models, or let people read it, except with your permission, for security, or when the law requires it.
Payments
If you subscribe to Pro, Stripe handles the payment. Your card details go straight to Stripe and never reach our servers. We send Stripe your name, email and account ID, and we keep the Stripe customer ID, the subscription status and the renewal date. Stripe sends your receipts and keeps payment records under its own privacy policy.
How you use Pandi
- Activity. When you were last active, and one record for each day you used Pandi. We only use these for totals, such as how many people used Pandi this month.
- Analytics, only if you accept them. Amplitude records the pages you visit and the buttons you click, linked to a random device identifier rather than your name or email. Session recording is off. You can change your choice at any time in your profile.
- Error reports. When something breaks, Sentry receives technical details about the error, such as the page, the browser and where in our code it failed. We strip the values of database queries from these reports, and passwords are never included.
- Administrator actions. If an administrator suspends, bans, deletes or invites an account, we record the action, the email of the account involved and the administrator’s IP address, for security and accountability.
Feedback
Feedback you send from the app is anonymous. We store your message, its category, the kind of page you sent it from (for example /income/:id, never the actual income), the app version and your language, but not who sent it.
Emails
We only send the emails your account needs: address verification, password resets and invitations. If you subscribe to Pro, Stripe sends your receipts. We don’t send marketing emails.
Why we use it
| Purpose | Legal basis under the GDPR |
|---|---|
| Creating your account, providing Pandi’s features, syncing Google Calendar when you connect it and handling your subscription | Performance of our contract with you |
| Keeping Pandi secure, preventing abuse, fixing errors, recording administrator actions and counting usage | Our legitimate interest in keeping Pandi safe and working |
| Product analytics | Your consent, which you can withdraw at any time |
| Keeping payment and tax records when the law requires it | Legal obligation |
We don’t sell your personal data, we don’t share it for targeted advertising, and we don’t use it to make automated decisions that have legal or similarly significant effects on you.
Cookies and browser storage
| Name | What it’s for | How long |
|---|---|---|
refresh_token cookie |
Keeps you signed in. Essential. | 4 days, renewed while you use Pandi, or until you sign out |
mfa_device_token cookie |
Remembers a device you trust for two-step verification. Essential, and only set if you ask for it. | 30 days |
Browser storage (pandi.theme, pandi_language, pandi.sidebar_collapsed, pandi.privacy, pandi.usage_widget_open, pandi.whats_new_seen, pandi.fired_reminders, has_session, feedback drafts) |
Your preferences (such as privacy mode), the reminders and release notes you have already seen, and unsent feedback. Essential. | Until you clear it, sign out or send the feedback |
| App cache | If you install Pandi or open it again, your browser keeps a copy of the app’s code so it loads faster. It never stores your data. Essential. | Until a new version replaces it or you clear it |
| Amplitude cookies and storage | Analytics. Only set after you accept. | Until you withdraw consent or clear them |
The landing site at pandi.work doesn’t use cookies, analytics or third-party fonts.
Who processes it
The app and its database run on servers rented from our hosting provider. We also use these service providers, which process data on our behalf and only for these purposes.
| Provider | What for | Where |
|---|---|---|
| S3-compatible storage provider | Storing the images you attach to tasks | United States |
| Resend | Sending account emails | United States |
| Sentry | Error reports | United States |
| Amplitude | Analytics, only with your consent | United States |
| Signing in with Google and syncing Google Calendar, only if you use them | United States | |
| Stripe | Payments and receipts for the Pro plan, only if you subscribe | United States |
We may also disclose data when the law requires it, to protect the rights and safety of our users or others, or as part of a merger or sale of Pandi, in which case we’ll let you know first.
Shared boards. If you create a share link for a board, anyone with the link can see that board’s tasks, checklists and attachments until the link expires or you turn it off.
International transfers
Pandi is run from the Dominican Republic and several of our providers process data in the United States. Where the law requires it, we use appropriate safeguards for these transfers, such as the European Commission’s Standard Contractual Clauses.
How long we keep it
- Your account and everything in it: for as long as your account exists. When you delete your account, we delete it and all of its data straight away, including your images and your Google Calendar connection, and we cancel your Pro subscription.
- Payment records: Stripe keeps them for as long as tax and accounting laws require, also after you delete your account.
- Invitations: deleted with your account, or 30 days after they are accepted, revoked or expire.
- Daily activity records: 3 years.
- Records of administrator actions: for as long as they are needed for security and accountability.
- Error reports and analytics: kept by Sentry and Amplitude under their own retention settings. They aren’t linked to your name or email.
Your rights
Depending on where you live, you have the right to:
- Access your data and take a copy. In the app, Profile → Download my data gives you a file with your account and everything you’ve added. It’s in a machine-readable format (JSON), so you can also take it to another service.
- Correct it. You can edit your profile and everything you’ve added at any time.
- Delete it. Profile → Delete account deletes your account and all of its data immediately.
- Withdraw consent to analytics at any time in your profile. This doesn’t affect what was processed before.
- Object to or restrict processing based on our legitimate interests.
- Complain to a data protection authority. In the EU or UK, that’s the authority where you live or work.
If you live in the United States, you also have the right to know what we collect, to correct it, to delete it, and to opt out of its sale or sharing (we do neither), and we won’t treat you differently for using these rights.
For anything you can’t do in the app, write to hello@pandi.work. We’ll reply within 30 days, and may need to confirm that the request comes from you.
Your clients’ data
When you add information about your clients and their contacts, you decide what’s stored and why, and you’re responsible for having a lawful reason to keep it. We only process that data to provide Pandi to you. If one of your clients contacts us about their data, we’ll refer them to you.
Security
Data travels over encrypted connections (HTTPS). Passwords are hashed, two-step verification secrets and Google Calendar tokens are encrypted, session cookies can’t be read by scripts on the page, sign-in attempts are rate limited, and you can turn on two-step verification. No system is perfectly secure. If a breach affects your data, we’ll tell you and the relevant authorities as the law requires.
Children
Pandi is for people aged 18 and over. We don’t knowingly collect data from anyone younger. If you believe someone under 18 has an account, write to us and we’ll delete it.
Changes to this policy
When we change this policy, we’ll update the date at the top. For important changes, we’ll let you know in the app or by email before they take effect and, where needed, ask you to accept them again.
Contact
The Pandi Team · hello@pandi.work