Privacy Policy

This Privacy Policy explains how Panda Pelican Development LLC (“PandaAuth”, “Panda Key System”, “we”, “us”) collects, uses, stores, and protects personal data. We are committed to handling your data in accordance with the Philippine Data Privacy Act of 2012 (Republic Act No. 10173), its Implementing Rules and Regulations, and the issuances of the National Privacy Commission (NPC), in addition to other data-protection laws that may apply to you.

Our role

• For your account and your direct use of our platform, we act as the Personal Information Controller (PIC).
• When a developer uses our platform to run their own key system, we process their end-users’ data (such as HWIDs and keys) on that developer’s behalf. Here the developer is the PIC and we act as a Personal Information Processor (PIP).

Because our service is international, your personal data may be processed on infrastructure and by service providers located outside the Philippines. We remain accountable for that data and require comparable levels of protection wherever it is processed.

We collect information through direct interactions and automated technologies to provide a secure and optimized experience.

Information You Provide Directly:

• Account details (username, email address, password).
• Profile information and user preferences.
• Authentication keys and API credentials.
• Payment information (processed securely through certified third-party payment gateways).

Automated Security & Technical Data:

• Network & Device Data: IP addresses, browser configurations, operating system details, and User-Agent strings.
• Device Fingerprinting / HWID: Unique device and hardware identifiers used strictly for anti-fraud measures and authentication verification.
• Usage Data: Interaction metrics, access times, and analytics related to your use of our platform.

Sensitive Personal Information:

We do not intentionally collect “sensitive personal information” as defined by the Data Privacy Act (for example: government-issued identifiers, health, religion, ethnicity, or information about offenses). Please do not submit such information to us.

We leverage the collected data to maintain a secure environment and deliver high-quality services. Your information is used to:

• Provide, operate, and maintain our core services and infrastructure.
• Process transactions, manage your account, and deliver requested features.
• Conduct rigorous security validation, detect anomalies, and protect against fraudulent, unauthorized, or illegal activity.
• Send critical technical notices, security alerts, and support communications.
• Analyze usage patterns to continuously improve our user interface and system performance.
• Comply with legal, regulatory, accounting, and tax obligations.

Consistent with Section 12 of the Data Privacy Act, we process personal information only where at least one of the following lawful bases applies:

• Consent: you have given your consent (for example, when you register or enable an optional feature).
• Contract: processing is necessary to provide the service you requested and to fulfil our agreement with you.
• Legal obligation: processing is required to comply with the law (e.g., tax, accounting, lawful requests).
• Legitimate interests: processing is necessary for our legitimate interests, primarily fraud prevention, abuse mitigation and platform security, balanced against your rights and freedoms.
• Vital interests: processing is necessary to protect someone’s life or safety.

Where we rely on consent, you may withdraw it at any time (see “Your Rights as a Data Subject”). Withdrawal does not affect processing already carried out, or processing that rests on another lawful basis.

We retain personal data only for as long as necessary to fulfil the purposes described in this Policy, or as required by law (Data Privacy Act, Section 11):

• Account data: retained while your account is active. Inactive accounts are warned, then suspended, and permanently deleted approximately three (3) months after suspension.
• Transaction & billing records: retained for the period required by applicable tax, accounting, and legal obligations.
• Security & access logs: retained for a limited period for fraud prevention and platform integrity, then deleted or anonymized.
• Keys & HWIDs: retained for the lifetime of the relevant key/whitelist entry and removed when it expires or is deleted.

When you delete your account, we erase or irreversibly anonymize your personal data, except where we are legally required to retain certain records.

Our platform utilizes Artificial Intelligence (AI) and machine learning technologies to enhance system capabilities, automate workflows, and improve your user experience.

• Data Processing: AI models may process your usage data and inputs to provide personalized features, intelligent analytics, and automated system responses.
• Data Protection: Your personal information is not used to train public foundational AI models without your explicit consent.
• Third-Party Providers: When utilizing third-party AI APIs, we enforce strict data processing agreements to ensure your data is immediately discarded after processing.

In line with Section 20 of the Data Privacy Act, we implement reasonable and appropriate organizational, physical, and technical security measures to protect your personal information against accidental or unlawful destruction, alteration, disclosure, or unauthorized access. These include:

• Encryption of credentials (passwords are hashed) and encryption of sensitive tokens at rest and in transit.
• Role-based access controls and the principle of least privilege.
• Optional two-factor authentication (2FA) and one-time-password verification.
• Continuous monitoring, anomaly detection, and routine security review.

While we strive to use commercially acceptable means to protect your data, no method of transmission or electronic storage is 100% secure, and we cannot guarantee absolute security.

We do not sell, rent, or trade your personal information. We may share your data only under the following specific circumstances:

• With your explicit consent.
• To comply with valid legal obligations, court orders, or regulatory requirements.
• To protect the rights, property, and safety of our platform, our users, or the public.
• With trusted third-party service providers who assist in our operations, bound by confidentiality and data-protection agreements.

Categories of service providers:

• Payment processing (e.g., PayPal).
• Authentication & sign-in (e.g., Google, Discord).
• Communications and email delivery.
• AI providers, only when you use AI features.
• Script-protection / obfuscation providers.

International transfers: some of these providers and our infrastructure are located outside the Philippines. Where personal data is transferred abroad, we remain accountable for its protection and take steps to ensure it receives a comparable level of protection, consistent with the Data Privacy Act.

Under the Data Privacy Act (Sections 16 and 18), you have the following rights over your personal data:

• Right to be informed about how your data is collected and processed.
• Right to access and obtain a copy of your personal data.
• Right to rectification of inaccurate or outdated information.
• Right to erasure or blocking of your data (subject to legal retention requirements).
• Right to object to or restrict certain processing, including direct marketing.
• Right to data portability: to receive your data in a structured, commonly used, electronic format.
• Right to damages for harm caused by inaccurate, unlawful, or unauthorized processing.
• Right to withdraw consent at any time, subject to legal or contractual restrictions.
• Right to file a complaint with the National Privacy Commission (see “Contact” below).

You can exercise many of these rights directly from your account settings (update your profile, change your password, or delete your account). For any other request, contact our Data Protection Officer using the details below. We will respond within a reasonable period and may ask you to verify your identity first.

Our platform is intended for developers and is not directed at children. We do not knowingly collect personal data from a minor without the consent of a parent or legal guardian, as required by the Data Privacy Act.

Developers who use PandaAuth to operate key systems for end-users (who may include minors) are responsible for obtaining any consent required from minors’ parents or guardians under applicable law. If you believe we hold a minor’s personal data without proper consent, please contact us and we will delete it promptly.

If you have any questions, concerns, or requests regarding this Privacy Policy, your personal data, or to exercise your rights, please contact our Data Protection Officer (DPO):

• Data Protection Officer, Panda Pelican Development LLC
• Email: [email protected]
• Discord: https://new.pandadevelopment.net/discord

If you believe your data-privacy rights have been violated and we have not resolved your concern, you may lodge a complaint with the National Privacy Commission (NPC) of the Philippines:

• Website: https://privacy.gov.ph
• Email: [email protected]