Privacy Policy

We use the information we collect exclusively to provide and improve the Panomara service. Specifically:

• To authenticate your account and maintain your session.
• Google API data is used only to generate client reports within your Panomara account. It is never used for advertising, profiling, or any purpose unrelated to producing those reports.
• To send transactional emails such as password resets or subscription receipts.
• To detect and prevent fraud, abuse, or security incidents.
• To improve Panomara’s features and performance through aggregated, anonymized analytics.

Our use of data obtained from Google APIs complies with the Google API Services User Data Policy, including the Limited Use requirements.

We do not sell your data. Ever.

We do not sell, rent, trade, or otherwise transfer your personal information or your clients’ marketing data to any third party for commercial purposes.

We share information only in these limited circumstances:

• Supabase — our database and authentication provider. Data is stored in Supabase-managed PostgreSQL instances with encryption at rest.
• Paddle — our payment processor. Receives only the billing information necessary to process your subscription.
• Resend — our transactional email provider. Receives your email address to deliver account emails.
• Legal requirements — if required by law, court order, or to protect the rights and safety of Panomara or its users.

All sub-processors are contractually required to maintain appropriate data security and to use data only for the purposes for which it was shared.

Panomara’s use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Specifically:

• Google API data is used only to provide and improve Panomara’s client reporting features — the stated purpose for which you granted access.
• We do not use Google API data to develop, improve, or train generalized AI or machine learning models.
• We do not allow humans to read your Google API data unless you have explicitly requested support that requires it, or we are required to do so for security or legal reasons.
• We do not transfer Google API data to third parties except as necessary to provide the service (sub-processors listed above), and never for advertising purposes.

You can revoke Panomara’s access to your Google accounts at any time without affecting your Panomara account:

1. 1. Go to your Google Account permissions page.
2. 2. Find “Panomara” in the list of connected apps.
3. 3. Click Remove access.

After revoking access, any connected integrations in Panomara will stop syncing data. Existing report data already pulled will remain in your account unless you choose to delete it. You can also disconnect individual integrations from within the Panomara dashboard under each client’s Integrations tab.

We retain your account data for as long as your account is active. If you cancel your account, we will delete your personal information and associated report data within 30 days, except where we are legally required to retain it longer (e.g., billing records for tax purposes, which are retained for 7 years).

Google API data cached for reports is retained only as long as your account is active. You may request early deletion at any time by contacting us.

We protect your data using industry-standard security practices:

• All data in transit is encrypted using TLS 1.2 or higher.
• Data at rest is encrypted in our Supabase-managed database.
• OAuth tokens are stored encrypted and never exposed in logs or error messages.
• Row-level security (RLS) policies ensure strict data isolation — agency A can never access agency B’s data.
• Portal passwords are stored using secure one-way hashing.

No system is 100% secure. If you discover a security vulnerability, please contact us immediately at security@panomara.io.

Depending on your location, you may have the following rights regarding your personal data:

• Access — request a copy of the personal data we hold about you.
• Correction — ask us to correct inaccurate or incomplete data.
• Deletion — request that we delete your account and associated data.
• Portability — request your data in a machine-readable format.
• Objection — object to certain types of processing, including marketing communications.

To exercise any of these rights, email us at hello@panomara.io. We will respond within 30 days.

Panomara uses a minimal number of cookies:

• Authentication cookies — required to maintain your logged-in session. These are httpOnly, secure, and expire when your session ends or after 7 days of inactivity.
• Portal session cookies — short-lived cookies set when a client logs into their portal.

We do not use advertising cookies, tracking pixels, or third-party analytics scripts on dashboard pages. The public marketing site (panomara.io) may use privacy-respecting analytics.

Panomara is not directed at children under 16. We do not knowingly collect personal information from anyone under 16. If you believe a child has provided us with personal information, contact us and we will delete it promptly.

We may update this Privacy Policy from time to time. When we make material changes, we will notify you by email or by displaying a notice in the Panomara dashboard at least 14 days before the changes take effect. Continued use of Panomara after the effective date constitutes acceptance of the updated policy.

We encourage you to review this page periodically. The “Last updated” date at the top reflects the most recent revision.

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:

We aim to respond to all privacy-related inquiries within 5 business days.