luckpandaWho we are
This policy explains how LuckPanda ("we", "us") handles personal data when you use luckpanda.app, our web app, API, MCP server and free tools. For the operator's details, see our terms of service. Contact us about privacy at support@luckpanda.app.
When you use LuckPanda for your business, two kinds of personal data are involved:
- Data about you as our user, such as your email address. For this, we decide how it is used (we are the controller, or the data fiduciary under India's DPDP Act).
- Personal data inside your business records, such as your clients' names, emails and addresses on invoices. For this, you decide what to collect and why, and we process it on your instructions to provide the service (we act as your processor).
What we collect
| Data | Examples | Where it comes from |
|---|---|---|
| Account data | Email address, display name | You, when you sign in |
| Business data | Company details, tax numbers, clients, products, documents, payments recorded, books | You, and people or agents you authorise |
| Guest drafts | The content of drafts made without signing in, linked to a random guest ID | You, in the free tools |
| Billing data | Subscription plan, status, billing country, payment status | Dodo Payments, our merchant of record |
| Support chat | Messages you type into the support chat, and any contact details you choose to share | You |
| Technical data | IP address, browser and device type, pages requested, error logs, timestamps | Your browser, via our hosting provider |
| Email data | Delivery status of emails we send for you or to you | Our email provider |
We do not receive or store your full card or bank details for subscriptions: Dodo Payments handles them.
Why we use it
- To provide the service: sign you in, store and show your data, generate documents, send emails you ask us to send, and process API and MCP requests. Legal basis under GDPR: performance of our contract with you.
- To bill for paid modules and keep billing records. Basis: contract and legal obligation.
- To keep the service secure and prevent fraud and abuse. Basis: legitimate interests.
- To answer support requests, including through the support chat. Basis: contract, or legitimate interests if you are not yet a customer.
- To improve the service using aggregated usage and error information. Basis: legitimate interests.
- To meet legal obligations, such as tax record-keeping and responding to lawful requests.
Under India's Digital Personal Data Protection Act, 2023, we process your personal data on the basis of your consent given when you sign up and use the service, or for legitimate uses the Act allows.
We do not sell personal data, and we do not use it for advertising.
AI features
The support chat on our website sends your messages to a large language model provider, OpenRouter, which routes them to the model that generates a reply. Do not type sensitive information into the chat. AI agents you connect through our API or MCP server act with the permissions you give them, and what they read and do is recorded in your audit log.
Who we share it with
We use these service providers (processors) to run LuckPanda. Each may only use data to provide its service to us.
| Provider | What it does | Data involved |
|---|---|---|
| Cloudflare | Hosting, database, network, security | All data stored in and passing through the service |
| Dodo Payments | Merchant of record for subscriptions: checkout, payments, tax, subscription invoices | Billing details, email, country |
| Our email delivery provider | Sends sign-in links, notifications and documents you send | Recipient email addresses and email content |
| OpenRouter | Large language model routing for the support chat | Chat messages |
We may also disclose data where the law requires it, to protect our rights or users' safety, or as part of a sale or reorganisation of our business, in which case this policy continues to apply.
International transfers
Cloudflare operates a global network, and our other providers may process data outside your country, including in the United States. Where data protection law requires it, transfers rely on safeguards such as the European Commission's standard contractual clauses and the UK addendum to them.
How long we keep it
- Account and business data: for as long as your account or business is active. When you delete your business or account, we delete its data from the live service within 30 days, and from backups as they expire.
- Guest drafts: 30 days from the last change, unless you sign in and save the draft to a business.
- Billing records: as long as tax and accounting law requires us to keep them.
- Support chat: for as long as needed to handle your request and improve support, unless you ask us to delete it.
- Technical logs: for a short period, usually days or weeks, for security and debugging.
You are responsible for keeping your own business records for as long as the law requires you to. Export them before deleting your account.
Cookies
We use two cookies, both necessary for the service to work:
| Cookie | Purpose | Duration |
|---|---|---|
| lp_sid | Keeps you signed in | Up to 30 days |
| lp_guest | Links drafts you make without signing in to your browser | Up to 30 days |
We do not use advertising or cross-site tracking cookies. Because these cookies are strictly necessary, we do not ask for consent to them.
Your rights
Depending on where you live, you have rights over your personal data.
Under the GDPR and UK GDPR, you can ask to access, correct or delete your data, to restrict or object to our use of it, and to receive it in a portable format. Where we rely on consent, you can withdraw it at any time. You can complain to your data protection authority, such as the Information Commissioner's Office in the UK.
Under India's DPDP Act, 2023, you can ask for a summary of the personal data we process and who we have shared it with, ask us to correct, complete, update or erase it, withdraw consent, nominate someone to exercise your rights if you die or become incapable, and use our grievance redressal process. If you are not satisfied with our response, you can complain to the Data Protection Board of India.
You can export and delete much of your data yourself in the app. For anything else, email support@luckpanda.app. We will respond within the time the law requires, usually within 30 days. If the data is in another business's records, for example you are a client of a LuckPanda user, we will refer your request to that business.
Security
Data is encrypted in transit, access is limited to people who need it, sign-in uses one-time email links, and API keys are stored hashed. No system is perfectly secure; if a breach affects your personal data, we will notify you and the authorities as the law requires.
Children
LuckPanda is a business service and is not meant for anyone under 18. We do not knowingly collect children's data.
Changes
We will post any changes here and update the date at the top. If a change is significant, we will tell you by email or in the app before it takes effect.
Contact and grievances
For privacy questions, requests or grievances, email support@luckpanda.app.