Data Processing, GDPR & Retention

For account, billing and platform data, Panzoe Technologies acts as the data controller. For content you sync from connected services into your workspace, we process it on your instructions to provide the Services.

• Contract performance — providing the platform, assistants, briefings and integrations you enable.
• Consent — connecting Google/Microsoft accounts (granted via OAuth and revocable anytime), optional analytics cookies, marketing communications and push notifications.
• Legitimate interests — securing the platform, preventing abuse, and aggregate product improvement.
• Legal obligation — tax, accounting and lawful-request compliance.

• Account & workspace data — retained while your account is active; permanently deleted on account deletion.
• Connected-account tokens & synced content — retained while the integration is connected; removed on disconnect-and-purge or account deletion.
• AI conversations & memory — retained while your account is active so assistants keep context; you can delete conversations, individual memories or all memory at any time; everything is deleted with your account.
• Research, documents & creative work — retained while your account is active so you can access your work; individually deletable in-app; deleted with your account.
• Delegated jobs & recurring monitors — job plans and outputs retained while your account is active; recurring monitors can be paused or deleted anytime; all deleted with your account.
• AI diagnostic logs — routing metadata about AI requests (model used, status — not your message content) retained for reliability monitoring; deleted with your account.
• Audit and security logs — up to 24 months, for security and compliance.
• Payment records — minimum 7 years (Canadian tax law), held as transaction records only (never card numbers).
• Feedback — retained while relevant to product development; anonymised or deleted on request.

Panzoe operates from Canada, which the European Commission recognises as providing adequate protection under PIPEDA. Some processors (see /legal/subprocessors) operate in the United States; transfers to them rely on appropriate safeguards including Standard Contractual Clauses and, where applicable, the EU-U.S. Data Privacy Framework.

Access, rectification, erasure, portability, restriction and objection are described with practical steps in /legal/data-rights. Requests: privacy@panzoe.ai — we respond within 30 days.