PandanPlanPlan your China trip, the Panda way.
Privacy Policy
Last updated: July 2026
PandaPlan ("we", "our", or "us") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, store, and protect your personal information when you use our AI-powered trip planning service at pandaplan.ai (the "Service"). Please read this policy carefully. By using the Service, you consent to the practices described in this policy.
1. Information We Collect
We collect only the minimum data necessary to provide and improve the Service: (a) Email address — if you choose to sign in for authentication and purchase management. (b) Trip preferences — cities, interests, travel dates, budget, travel style, and any free-text descriptions you provide. (c) Trip data — generated itineraries, day plans, POI selections, costs, and feedback. (d) Usage analytics — anonymous page views and feature interactions to help us improve. (e) Local storage data — we store your authentication token, language preference, trip preferences, and recent trip history in your browser's localStorage for seamless experience across sessions. (f) We do NOT collect payment card information. All payments are processed securely by Creem, our PCI-DSS compliant payment partner.
2. How We Use Your Data
We use your data only for the following purposes: (a) Authentication — to verify your identity when you sign in via email OTP. (b) Service delivery — to generate personalized trip itineraries using our AI engine and to save/load your trip data. (c) Sharing features — when you choose to make a trip public, to display it on the public gallery and generate shareable links. (d) Communication — to send transaction receipts, service updates, and respond to support inquiries. (e) Improvement — to analyze anonymous usage patterns and improve the Service. (f) We do NOT sell, rent, or share your personal data with third parties for their marketing purposes. We do NOT use your data for automated individual decision-making or profiling beyond trip generation.
3. Legal Basis for Processing (GDPR / UK GDPR)
If you are located in the European Economic Area (EEA) or the United Kingdom, our legal bases for processing your data are: (a) Consent — you have given clear consent for us to process your trip preferences for the purpose of generating itineraries. (b) Contract performance — processing is necessary to fulfill our service agreement with you (generate and deliver trip plans). (c) Legitimate interests — anonymous analytics help us improve the Service without impacting your privacy. You have the right to withdraw consent at any time by contacting us.
4. Data Storage, Retention & Security
Your data is stored on secure servers. We retain your data for as long as your account is active or as needed to provide the Service. Trip history stored in your browser's localStorage can be cleared at any time via your browser settings. Server-side data (email, trip data, payment records) is retained for legitimate business purposes (e.g., tax records for payments) and is deleted upon your request, subject to legal obligations. We implement industry-standard security measures including encryption in transit (TLS) and at rest.
5. Your Rights (GDPR, CCPA, LGPD, APPI, PIPA, PIPL)
Depending on your jurisdiction, you may have the following rights: (a) Right to Access — request a copy of the personal data we hold about you. (b) Right to Rectification — request correction of inaccurate data. (c) Right to Erasure ("Right to be Forgotten") — request deletion of your data, subject to legal retention requirements. (d) Right to Data Portability — request your data in a structured, machine-readable format. (e) Right to Object — object to processing based on legitimate interests. (f) Right to Restrict Processing — request restriction of processing in certain circumstances. (g) CCPA Rights (California) — right to know what personal information is collected, disclosed, or sold; right to opt out of sale; right to non-discrimination for exercising CCPA rights. We do not sell your personal information. (h) LGPD Rights (Brazil) — similar rights as GDPR plus right to review automated decisions. (i) APPI Rights (Japan) — right to request disclosure, correction, suspension of use, and deletion of personal data. (j) PIPA Rights (Korea) — right to consent, access, correction, deletion, and suspension of processing. (k) PIPL Rights (China) — right to know, decide, restrict processing, access, portability, correct, delete, and withdraw consent. To exercise any of these rights, contact us at privacy@pandaplan.app. We will respond within the timeframe required by applicable law (typically 30 days).
6. International Data Transfers
Your data may be transferred to and processed in servers located in countries outside your country of residence, including but not limited to the United States, Singapore, and Japan. When we transfer data from the EEA, UK, or Switzerland, we ensure adequate safeguards through Standard Contractual Clauses (SCCs) or equivalent mechanisms as required by applicable data protection laws.
7. Cookies & Local Storage
We use essential cookies and browser localStorage solely for authentication (session tokens), language preference, and trip preference persistence. We do NOT use tracking cookies, advertising cookies, or third-party cookies. You can clear localStorage data at any time via your browser settings, which will sign you out and remove locally stored trip history.
8. Third-Party Services
We integrate with the following third-party services: (a) Creem — payment processing. Creem's privacy policy applies to any information you enter in the payment modal. We do not transmit or store your payment card data. (b) Unsplash — background images displayed in trip previews (public CDN, no data shared). (c) Our backend API is hosted separately; all data transmission is encrypted. We do not use Google Analytics, Facebook Pixel, or any advertising networks.
9. Children's Privacy
The Service is not intended for individuals under the age of 16 (or the age of majority in your jurisdiction). We do not knowingly collect personal information from children. If you believe a child has provided us with personal data, please contact us immediately so we can delete it.
10. Changes to This Policy
We may update this Privacy Policy to reflect changes in our practices or legal obligations. We will notify users of material changes via email (if you have signed in) or through a notice on the Service. The "Last updated" date at the top indicates when this policy was last revised.
11. Contact Us
If you have any questions, concerns, or requests regarding this Privacy Policy or your data, please contact us at: Email: privacy@pandaplan.app. Address: PandaPlan, support team. We aim to respond within 15 business days.