This policy explains what personal information OmniPanda collects, why we collect it, who we share it with, and what you can do about it. It covers our website, our web app and our mobile apps. We have tried to write it in plain English rather than legal boilerplate.
1. Who is responsible for your data
Pandamensional Inc., a Delaware corporation at 103 Mint Pl, Athens, GA 30606, USA, operates OmniPanda and is the controller of the personal information described here. You can reach us about anything in this policy at info@pandamensional.ai.
2. The short version
- We collect what we need to run the Service: your account details, the brokerage data you connect, what you say to the AI assistant, and how you use the app.
- We use AI models to answer your questions and to manage a portfolio you enroll. To do that, the relevant content is sent to the AI providers we use.
- We never see or store your brokerage password, and we never see or store your full card number.
- We do not sell your personal information, and we do not share it for cross-context behavioural advertising.
- You can ask us for a copy of your data, ask us to correct it, or ask us to delete your account and your data.
3. What we collect
3.1 Information you give us
- Account information — your email address, your username, your password (stored only as a salted hash by our authentication provider), and, if you sign in with Google, the basic profile information Google returns.
- Profile and preferences — your display name if you set one, your settings, and your notification preferences.
- Your investor profile — your answers to our investor questionnaire, which covers your goals, time horizon, risk tolerance, investing experience, any constraints you want applied, and financial details the questionnaire asks about, such as income or asset ranges — plus the limits you set for an enrolled account.
- Content you create — chat messages, voice input, watchlists, strategies, notes, and any file or profile picture you upload.
- Support correspondence — the messages you send us, and the feedback and bug reports you submit.
- Early-access and waitlist details — if you give us your email address on our landing page before creating an account, we keep it so we can tell you when access opens.
3.2 Information from your brokerage, when you connect one
When you link a brokerage account, we and our connection providers receive, on your authorization:
- account details — institution, account type, account name, and a masked account number;
- balances, cash and buying power;
- positions, quantities, market values and cost basis where your brokerage provides it;
- order history, transaction history and other account activity; and
- the results of orders placed through OmniPanda.
We do not receive your brokerage username or password. The connection is made by you, at your brokerage, using a delegated sign-in. Under some privacy laws this brokerage data is sensitive personal information, and we treat it that way: we use it only to provide the Service you asked for, and we do not use it to profile you for advertising.
3.3 Information from your use of the Service
- Usage and events — pages and screens you open, features you use, buttons you press, searches you run, chats you start, backtests you run, portfolio runs that happen, and points you spend.
- Device and technical data — IP address, approximate location derived from it (city or region level, not precise GPS), browser and operating system, device type, app version, language, time zone, and crash and error reports including the diagnostic detail attached to them.
- Push notification tokens — if you use our mobile app and allow push notifications, we store a token for your device so we can deliver them, and we remove it when you sign out. The web app does not use push notifications.
- Cookies and similar technologies — see section 8.
3.4 Voice data
If you use voice mode, your microphone audio is captured in short segments and sent to be transcribed into text, and text replies are turned back into speech. The transcript becomes part of your chat history. Your microphone is not captured while voice mode is off, while the tab or app is in the background, or, unless you enable talk-over, while the assistant is speaking. We do not keep your audio after it has been transcribed. Voice mode is off until you turn it on, and your browser or device will ask you for microphone permission first. You can revoke that permission at any time.
3.5 Payment information
Payments are processed by Stripe. You enter your card details on Stripe's own hosted pages. We never receive, see or store your full card number, CVC or expiry. From Stripe we receive only what we need to run your subscription: a customer and subscription identifier, your plan, the status and amount of a payment, the card brand and last four digits, and the country and postal code Stripe returns for tax and fraud purposes.
3.6 What we do not collect
We do not open brokerage accounts, so we do not run identity verification and we do not ask for your Social Security number, a government identity document, or your bank login. We do not collect your brokerage password or precise GPS location. We do not seek special-category data such as health, biometric identifiers, race, religion, politics or sexual orientation, and we ask you not to put such information into chat — anything you do put there becomes part of your chat history.
4. Why we use your information
We use personal information for these purposes, and no others without telling you:
4.1 To provide the Service — create and secure your account, show you your accounts and positions, answer your questions, run backtests, produce and execute portfolio plans, place the orders you or your enrollment authorize, and keep your history.
4.2 To run AI features. Your chat messages, your voice transcript, the page context of what you are looking at, relevant parts of your investor profile, and relevant account data such as your positions and balances are sent to the AI models we use so they can answer you or produce a trade plan. We tell the models what they need for the task; we do not send them your password or your payment details. Our AI Disclosure explains this in more detail.
4.3 To operate your brokerage connection — establish it, keep it working, refresh it, read the data you authorized, and place and check orders.
4.4 To handle billing — subscriptions, renewals, point packs, invoices, tax, refunds, failed payments, and fraud prevention, through our payment processor.
4.5 To administer points — grants, spending, achievements, referrals, and abuse prevention.
4.6 To communicate with you — service, security, billing and legal messages; notifications you have enabled; answers to your support requests; and, if you have not opted out, occasional product news.
4.7 To keep the Service safe — authenticate you, detect and investigate fraud, abuse, market abuse and security incidents, enforce our terms, and protect you, us and others.
4.8 To improve the Service — understand which features are used and where they fail, diagnose crashes and errors, measure performance, and decide what to build. Wherever it is workable we do this with aggregated or de-identified data.
4.9 To improve our AI features — we do not allow the AI providers we use to train their general-purpose models on your content, and we do not sell your content to anyone for that purpose. We do review examples of AI output — and, where we need to, the conversation around it — to find and fix bugs and bad answers. We use aggregated or de-identified information to improve our prompts, our tools and our own testing.
4.10 To meet legal obligations — accounting and tax records, responding to lawful requests, and keeping the records the law requires us to keep.
5. Who we share it with
We do not sell your personal information. We share it only as described here.
5.1 Service providers who work for us, under contracts that limit them to our instructions:
- cloud hosting, storage, databases and logging — our infrastructure runs on Amazon Web Services;
- authentication — our sign-in and password handling;
- brokerage connection providers — SnapTrade, and a direct integration with Robinhood, to establish and operate the connections you authorize;
- market data and financial data providers — to supply quotes, charts, fundamentals, news and company data. Where we ask them for information about a symbol, we do not tell them who is asking;
- AI model providers — to process the content described in section 4.2, and to transcribe and synthesise speech for voice mode;
- payment processing — Stripe;
- email and push delivery, to send you messages;
- product analytics and error tracking — PostHog, to record usage events and to capture crashes and unhandled errors. When you are signed in we identify you to it with your account identifier and your email address, and we route its traffic through our own subdomain;
- productivity tools we use to run the business — for example, an email address you give us for early access is stored in a Google spreadsheet until we move it into our own systems.
5.2 Your brokerage and our connection providers, when we act on the authorization you gave — reading your account, placing an order, or checking its status.
5.3 At your direction. If you create a share link for a chat, that link is public: anyone who has it can read that conversation without signing in, including the assistant's replies, the tool results shown in it and your display name. It does not expose your email, your balances, your positions, your connected brokerages or your other chats — unless those details appear in the messages you shared. You can revoke a share link at any time.
5.4 For legal reasons. We may disclose information if we believe in good faith that we are required to by law, regulation, subpoena, court order or lawful request, or where disclosure is necessary to investigate a crime, to enforce our terms, or to protect the rights, property or safety of you, us or anyone else. Where we are allowed to tell you about such a request, we will.
5.5 In a corporate transaction. If we are involved in a merger, acquisition, financing or sale of assets, information may be transferred as part of it. If the new owner would use your information differently, we will tell you before that happens.
5.6 Aggregated or de-identified information that cannot reasonably identify you may be shared or published freely.
5.7 We do not share your personal information with advertising networks, data brokers or list brokers, and we do not share it for cross-context behavioural advertising or targeted advertising.
6. How long we keep it
6.1 We keep personal information for as long as your account is open and we need it to provide the Service.
6.2 When you delete your account, we delete or anonymise your personal information within 30 days, apart from what is described below.
6.3 We do not hold your tax records or your bank records. While your account is open we keep all of these, however old they are. After you delete your account we keep them for the periods below:
- transaction, order and portfolio-run records, including the orders OmniPanda placed or proposed for a brokerage account you connected and the enrollments behind them, because we need them for our own records, for dispute handling and to meet legal obligations. We keep these for at least seven years from the end of the year in which you deleted your account;
- billing records, for at least seven years from the end of the year in which you deleted your account, because our tax and accounting obligations require it;
- security, fraud and abuse records, for as long as needed to protect the Service; and
- anything we are under a legal hold to preserve.
6.4 Backups are rotated on a schedule, so a copy of deleted data can persist in a backup for a short period after deletion before it is overwritten.
6.5 Aggregated and de-identified data may be kept indefinitely, because it no longer identifies you.
7. Security
7.1 We protect your information with measures including: encrypted connections (HTTPS) for everything you send us; storage in our cloud provider's encrypted data stores; passwords held only as a hash by our authentication provider, never by us; short-lived session tokens; access to production systems limited to those who need it; logging and error monitoring; and a design in which your brokerage password and your card number never reach our systems at all.
7.2 No service is perfectly secure. You help by using a strong, unique password, keeping your devices updated and locked, and telling us immediately at info@pandamensional.ai if you suspect a problem with your account.
7.3 If a breach affects your personal information and the law requires us to notify you, we will, without undue delay.
8. Cookies and similar technologies
8.1 We use cookies and local browser storage for:
- essential purposes — keeping you signed in, keeping your session secure, and remembering the state of the app. These are required; the Service does not work without them.
- analytics — to understand how the Service is used and where it breaks, through our product analytics provider.
8.2 We do not use advertising cookies or third-party advertising pixels.
8.3 You can block or clear cookies in your browser, and you can block analytics in your browser or with an extension, but the Service will not work properly without the essential cookies. Analytics is on by default. We do not ask you for cookie consent, because we use cookies only to run the Service and to measure how it is used, and never for advertising.
8.4 We honour Global Privacy Control signals where we are required to, and we treat such a signal as a request to opt out of any sale or sharing.
8.5 Our mobile app does not use cookies. It uses your device's own identifiers and, if you allow notifications, a push token.
9. Your rights and choices
9.1 Everyone can:
- access the information we hold about you, and ask for a copy in a portable format;
- correct information that is wrong — much of it you can edit in the app;
- delete your account and the personal information associated with it (see section 10);
- disconnect a brokerage at any time from the Accounts page, which stops us reading that account;
- turn off marketing email using the unsubscribe link, push notifications in your device settings, and microphone access in your browser or device settings; and
- complain to us at info@pandamensional.ai, and to a data protection authority where you have one.
9.2 If you are in California (or a US state with a comparable law), you have the right to know the categories and specific pieces of personal information we collected, the categories of sources, our purposes, and the categories of third parties we disclosed it to; the right to delete; the right to correct; the right to limit our use of sensitive personal information; and the right to opt out of sale or sharing. We do not sell personal information and we do not share it for cross-context behavioural advertising, so there is nothing to opt out of — but you may still tell us to treat it that way. We will not discriminate against you for exercising a right. You may use an authorized agent; we will ask for proof of their authority.
9.3 If you live somewhere that gives you extra rights over your data, tell us what you want and we will honour whatever applies to you. Email info@pandamensional.ai and say where you live and what you are asking for.
9.4 How to exercise a right. Email info@pandamensional.ai from the address on your account, or use the in-app controls. We will verify that the request is really from you — usually by confirming control of your account email — and respond within the time the law allows: 45 days for a California request, extendable once by a further 45 days with notice. We answer every other request as quickly as we can, and within any deadline the law that applies to you sets. There is no charge, unless a request is excessive or repetitive.
9.5 Automated decision-making. OmniPanda's AI produces trade plans and, in Automatic mode, places trades in an account you enrolled, without a human reviewing each one. That is automation you switch on and can switch off, and you can see the reasoning for every run in your run history. We do not use automated decision-making to decide anything about your eligibility for credit, employment, insurance, housing or any other legal or similarly significant matter. If you want a human to look at what happened in a run, email us.
10. Deleting your account
10.1 You can delete your account and your personal information yourself, at any time, in the app or on the web: Settings → Profile → Delete account. How to delete your account walks through it and lists what we delete and what we keep. If you cannot sign in, email info@pandamensional.ai from the address on your account, and we will delete your account within 30 days.
10.2 We will verify the request, then delete or anonymise your personal information within 30 days, apart from the records described in section 6.3.
10.3 Deleting your OmniPanda account does not close your brokerage account, does not sell or move anything you hold, and does not cancel a subscription bought through an app store — cancel that in the store. Unused points are forfeited and are not refunded. We cannot restore a deleted account.
11. Children
The Service is for adults. You must be at least 18 to use it. We do not knowingly collect personal information from anyone under 18, and we do not direct the Service to children. If you believe a child has given us information, email info@pandamensional.ai and we will delete it.
12. Where your information is processed
12.1 We are based in the United States, and our systems run there, on Amazon Web Services. Our service providers may process information in the United States and in other countries.
12.2 The Service is offered to people in the United States. If you use it from somewhere else, your information is transferred to the United States and processed there.
13. Third parties with their own policies
Your brokerage, our brokerage connection providers, our payment processor and any site we link to have their own privacy policies, and their handling of your information is governed by those policies, not this one. We encourage you to read them. We are not responsible for what a third party does with information you give it directly.
14. Changes to this policy
We may update this policy. When we do, we will change the "Last updated" date at the top of this page. For a material change — a new purpose, a new category of sharing, or a meaningful reduction in your rights — we will give you notice by email or in the app before it takes effect. If you do not agree with a change, stop using the Service and delete your account.
15. Contact us
- Pandamensional Inc.
- 103 Mint Pl, Athens, GA 30606, USA
- info@pandamensional.ai
For a privacy request, please email from the address on your account and tell us what you want us to do.