Privacy Policy

Last Updated: May 24, 2026

Effective Date: May 24, 2026

Panda App ("we," "our," "us," or "Panda") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, safeguard, and process your personal information when you use the Panda mobile application, website, services, APIs, and associated financial features (collectively, the "Panda Platform").

The Panda Platform offers a multi-faceted digital asset and financial ecosystem, including:

Wallet Services (Digital and Cryptocurrency Wallet architectures)
Peer-to-Peer (P2P) Trading Platforms
Cryptocurrency Exchange & Transaction Services
Virtual Cards (Prepaid/debit payment card provisions integrated with card networks)

Please read this Privacy Policy carefully. If you do not agree with the terms of this Privacy Policy, please do not access or use the Panda Platform.

1. Information We Collect

To provide our multi-functional wallet, exchange, and financial services, we must collect information that identifies, relates to, describes, or could reasonably be linked, directly or indirectly, with a specific user or device ("Personal Data").

A. Information You Provide to Us

Account Registration Information: Full name, email address, phone number, date of birth, username, and password.
Identity Verification (KYC/AML) Data: To comply with global financial regulations (including Anti-Money Laundering, Counter-Terrorism Financing, and virtual asset service provider mandates), we or our third-party identity partners collect:
- Government-issued identification documents (e.g., passport, national ID card, driver's license).
- Biometric data (e.g., facial geometry scans from your "selfie" or video verification to prevent identity theft).
- Proof of address documentation (e.g., utility bills, bank statements).
- Tax identification numbers or source of wealth declarations (where legally required).
Financial and Transaction Information:
- Connected bank account details, credit/debit card numbers, and billing addresses.
- Virtual Card transaction records, card balances, and merchant details.
- Public blockchain wallet addresses (non-custodial or custodial generated keys).
P2P Trading Data:
- Communications between buyers and sellers in the P2P chat interface.
- Order books, trade details, dispute resolution submissions, and payment receipts.

B. Information Automatically Collected

Device and Technical Data: IP address, unique device identifiers (e.g., IMEI, Android ID, IDFA), device model, operating system version, browser type, mobile carrier, and system performance metrics.
Usage and Interaction Logs: App launches, screen views, feature interactions, button clicks, transaction speeds, and error logs.
On-Chain / Blockchain Public Data: When you execute operations on public networks via the Panda App, we analyze publicly available blockchain data (timestamps, transaction hashes, smart contract interactions, gas fees, and token balances).

C. Information Collected via Permissions

We will explicitly request your permission before accessing specific device modules:

Camera: Required for scanning QR codes (wallet addresses), capturing KYC identification documents, and completing facial recognition checks.
Biometrics (FaceID/TouchID): Accessed locally on your device to authorize app unlocks and transaction approvals; we never store your raw biometric data on our servers.
Contacts: Optional permission to allow you to easily send crypto or P2P funds to individuals in your address book.

2. How We Use Your Information

We process your Personal Data based on legal foundations, including contractual performance, legal obligations, and legitimate business interests. Specifically, we use your data to:

Operate Core Services: Process transactions, manage your digital and crypto wallets, issue and fund Virtual Cards, and facilitate P2P order matching and settlements.
Ensure Regulatory Compliance: Meet international and local Anti-Money Laundering (AML), Know Your Customer (KYC), and Sanctions screening obligations (e.g., FinCEN, MiCA, OFAC check matches).
Prevent Fraud and Ensure Security: Detect and mitigate anomalous transfers, account takeovers, fraudulent card charges, and malicious app deployments.
Provide Customer Support: Investigate app performance issues, resolve P2P escrow disputes, and address user inquiries.
Optimize Platform Architecture: Analyze aggregated telemetry data to improve app responsiveness, optimize transaction routing, and refine UI flows.

3. How We Share and Disclose Your Information

Panda does not sell your Personal Data. We only share your data under the following circumstances:

A. Third-Party Service Providers and Partners

We share relevant subsets of your data with verified third parties who execute technical or regulated functions on our behalf:

Identity Verification Providers: Specialized entities that run facial matching and government database verifications for KYC purposes.
Virtual Card Issuers and Banking Partners: Core financial institutions, card networks (e.g., Visa, Mastercard), and payment processors responsible for processing virtual card loads, clearings, and authorizations.
Cloud Infrastructure Providers: Secure, encrypted database and hosting environments (e.g., AWS, Google Cloud).
Analytics and Error Reporting Tools: Services that log non-identifiable technical performance data (e.g., Firebase, Sentry).

B. Legal and Regulatory Disclosures

We may disclose your Personal Data if we believe it is reasonably necessary to:

Comply with a subpoena, court order, regulatory audit, or valid law enforcement request.
Protect the safety, property, or legal rights of Panda, our users, or the public.
Address or resolve systemic fraud, cybersecurity vulnerabilities, or P2P escrow exploitation.

C. On-Chain Transparency

Important Note on Blockchain Data: By design, cryptocurrency transactions and interactions with smart contracts are broadcast to public ledgers. These public records include wallet addresses and transaction values. Once broadcast, this data is public and immutable; it cannot be deleted or modified by Panda.

4. International Data Transfers

The Panda Platform operates globally. Personal Data collected in one jurisdiction may be transferred to, stored, and processed in countries where our infrastructure or partners reside (including the United States, the European Economic Area, and other global hubs).

When transferring data across international borders, we implement recognized legal frameworks, including Standard Contractual Clauses (SCCs), to guarantee that your data receives an equivalent tier of protection as mandated by your local regulations.

5. Data Security and Retention

A. Security Implementations

Panda employs advanced technical and organizational guardrails to isolate and defend your Personal Data:

Encryption: Data is encrypted both in transit (using TLS 1.3) and at rest (using AES-256 protocols).
Private Key Safeguards: For custodial wallet functions, security architectures (such as Multi-Party Computation or Secure Enclaves) isolate private keys. For non-custodial implementations, Panda never sees or stores your seed phrase or private keys.
Access Control: Internal data access is granted strictly on a "least-privilege" basis, requiring multi-factor authentication (MFA) and continuous logging.

B. Retention Thresholds

We retain your Personal Data only as long as your account remains active or as required to meet strict legal and regulatory baselines. Financial regulations and anti-money laundering frameworks typically obligate us to retain your KYC documentation and transaction records for five (5) to seven (7) years following the termination or closure of your Panda account.

6. Your Privacy Rights and Choices

Depending on your geographical residency (such as the European Economic Area under GDPR, or California under the CCPA/CPRA), you possess distinct legal rights regarding your Personal Data:

Right to Access/Portability: You can request a structural readout of the Personal Data we hold about your identity.
Right to Rectification: You may update or correct inaccurate or incomplete elements of your account profile.
Right to Erasure ("Right to Be Forgotten"): You can request that we delete your Personal Data. Please note that this right is legally superseded by our mandatory compliance retention windows for financial and transaction histories.
Right to Restrict or Object: You can object to the processing of your data for direct marketing or profiling behaviors.

To exercise any of these rights, or to submit a request regarding your account data, please contact our Data Protection Officer at dpo@pandaex.co.

7. Play Store and Operating System Compliance

A. Play Store Privacy Declarations

In accordance with Play Store Connect guidelines, this app links the following data types to your explicit identity for App Functionality and Compliance metrics:

Contact Information (Email, Phone)
Financial Information (Payment Data, Transaction Logs)
Identifiers (Device ID, User ID)
Usage Data (Product Interactions)

B. Google Play Account Deletion Requirement

Panda provides a clear, frictionless pathway for users to initiate account closures. You may initiate account and associated data erasure requests directly within the Account Settings section of the Panda App or by visiting our web-based deletion portal at https://panda.app/delete-account.

8. Changes to This Privacy Policy

We reserve the right to revise this Privacy Policy at any time to accurately reflect protocol changes, regulatory updates, or feature additions to the Panda ecosystem. If we introduce material updates, we will notify you through an in-app alert, push notification, or email update prior to the effective date of the changes. Your continued interaction with the platform following an update implies your confirmation of the revised policy.

9. Contact Us

If you have any questions, concerns, or technical inquiries regarding this Privacy Policy or our treatment of your data, please reach out to us at:

Panda App Privacy Team: no-reply@pandaex.co
Data Protection Officer: dpo@pandaex.co