Privacy Policy

MessengerPanda is a cloud-hosted email marketing automation platform developed and operated by Palladium Innovations. For the purposes of applicable data protection law, Palladium Innovations (operating as MessengerPanda) acts as:

• Data Controller for personal data relating to platform accounts (name, email address, billing information, and usage data).
• Data Processor for the subscriber contact lists and email addresses uploaded by you. You are the Data Controller for those individuals' data.

To contact us regarding privacy matters: support@z.messengerpanda.app

We collect the following categories of data:

Account Information

• Name and email address — provided at registration.
• Hashed password — stored using bcrypt (min. 12 rounds). We never store or transmit your plain-text password.
• Profile preferences — timezone, spam-score warning threshold, default double opt-in setting.

Usage Data

• Campaigns created, scheduled, and sent — including subject lines, from-address, and contact list references.
• Automation sequences and their configurations.
• Opt-in form definitions and submission counts.
• SMTP account configurations (credentials encrypted — see Section 4).
• Email delivery job records (recipient address, delivery status, send timestamp).

Technical and Device Data

• IP address at the time of account registration (used for GDPR consent audit trail when contacts are imported).
• Browser and device type for session management via JWT (stored in HTTP-only cookies by NextAuth).
• Server-side logs generated by Vercel and Supabase in the ordinary course of hosting (subject to their respective privacy policies).

We use the data we hold to:

• Provision, operate, and maintain your account and the features you access.
• Authenticate your identity and protect your account from unauthorised access.
• Process payments and manage your subscription tier via our payment processors.
• Enforce plan quotas and acceptable-use policies.
• Send you transactional emails — account verification, password reset, and billing receipts. We do not send marketing emails to users without separate, explicit opt-in consent.
• Investigate abuse reports and maintain platform integrity.
• Comply with legal obligations, including responding to lawful requests from governmental authorities.

We do not sell your personal data. We do not use your data for behavioural advertising. We do not use your contact lists or campaign content to train machine-learning models.

When you add an SMTP account (Brevo, Resend, AWS SES, Mailgun, SendGrid, Postmark, or a custom SMTP server), we apply AES-256-GCM field-level encryption to the password field before storing it in our PostgreSQL database (hosted on Supabase, EU-West-1 region).

The encryption key is a 32-byte secret stored as a Vercel environment variable — it is never committed to source control and is never transmitted to the database. Decryption occurs only inside isolated Vercel serverless function invocations at the precise moment an email job is dispatched, and the decrypted value is held in memory for the duration of that function's execution only.

Optional email-verification API keys (ZeroBounce, NeverBounce) that you supply in your profile settings are encrypted with the same algorithm and are used solely to validate contact email addresses during CSV import — they are never shared with any third party other than the respective verification service you have chosen.

When you import a contact list (via CSV upload or API), the following data may be stored:

• Subscriber email address, first name, and last name.
• Subscription status: subscribed, pending, unsubscribed,bounced, or complained.
• GDPR consent audit fields: consent method (import / form / API), consent timestamp, and the IP address of the action that created or confirmed the consent — all stored at your direction to assist your own compliance obligations.
• Tags assigned by you for segmentation purposes.

You are the Data Controller for your subscriber data. You are responsible for ensuring you have a lawful basis for processing each contact's data, for honouring their unsubscribe requests (which our platform enforces automatically via signed unsubscribe links), and for handling data-subject access requests from your subscribers.

We will never contact your subscribers directly, use their addresses for cross-platform targeting, or disclose their data to any third party except where required by law or as strictly necessary to deliver email (i.e., passing the recipient address to your chosen SMTP provider).

Email campaigns and automation sequences are delivered through a background queue system:

• Job persistence: Each email to be delivered is recorded as an EmailJob row in our PostgreSQL database. This record holds the recipient address, delivery status, and timestamp. It does not hold the full email body after delivery is complete.
• Distributed locking: We use Upstash Redis (hosted on AWS, EU-West-1) to maintain distributed job locks. Locks prevent duplicate sends when multiple serverless instances process the queue simultaneously. Lock keys contain only an internal job ID — they hold no personal data. Locks expire automatically within 120 seconds.
• In-transit encryption: All communication between our application servers, the database, and Upstash Redis is encrypted using TLS 1.2 or higher.

MessengerPanda injects tracking into outbound emails to help you measure campaign performance:

• Open tracking: A 1x1 transparent pixel image is appended to HTML emails. The image URL contains an internal job ID. When a recipient's email client loads the image, we record an open event and timestamp against that job.
• Click tracking: Outbound links are rewritten to pass through our redirect endpoint. When clicked, we record the click event, redirect the recipient to the original URL, and log the timestamp. We do not log the recipient's IP address on click events.
• Unsubscribe links: Every email includes an unsubscribe link signed with HMAC-SHA256. Clicking the link permanently updates the contact's status tounsubscribed and prevents all future sends to that address without requiring the recipient to be logged in.

Tracking data is attributed to your campaign and is visible only to you and platform administrators. It is not used for cross-user profiling or advertising.

MessengerPanda does not store payment card numbers or bank account details. Payments are processed by:

• Lemon Squeezy — for USD billing. See their Privacy Policy.
• Paystack — for NGN billing. See their Privacy Policy.

We store references returned by these processors (customer ID, subscription ID, plan code) to maintain your subscription status. Webhook payloads from these providers are verified using HMAC-SHA256 (Lemon Squeezy) or HMAC-SHA512 (Paystack) before any data is processed.

We use a minimal set of cookies strictly necessary to operate the Service:

• Session cookie (HTTP-only): Set by NextAuth to maintain your authenticated session. This cookie is HTTP-only and cannot be read by JavaScript, which protects it from cross-site scripting (XSS) attacks. It expires when you sign out or after 30 days of inactivity.

We do not set advertising cookies, cross-site tracking cookies, or third-party analytics cookies. The marketing pages of our website ("/", "/pricing", "/terms", "/privacy") do not require cookies.

We implement the following safeguards to protect your data:

• AES-256-GCM encryption for all SMTP passwords and third-party API keys stored in the database.
• HMAC-SHA256 signed unsubscribe tokens to prevent enumeration and forgery attacks.
• Edge middleware authentication on every protected route using stateless JWT tokens — no session data is stored server-side between requests.
• Row Level Security (RLS) enabled on all 19 tables in our Supabase PostgreSQL database. The PostgREST (REST API) layer has no access to any table. All database access occurs exclusively through our application server using a privileged direct connection.
• bcrypt (12 rounds) for all stored passwords.
• TLS 1.2+ in transit for all connections between application, database, Redis, and external SMTP providers.
• Regular dependency audits via npm audit.

No system is completely secure. If you discover a security vulnerability, please report it responsibly to support@z.messengerpanda.app before public disclosure.

To request deletion of your account and all associated data, email us at support@z.messengerpanda.app with subject line "Account Deletion Request". We will process your request within 30 days.

Depending on your location, you may have the following rights regarding your personal data:

• Right of Access: Request a copy of the personal data we hold about you.
• Right to Rectification: Request correction of inaccurate data.
• Right to Erasure ("Right to be Forgotten"): Request deletion of your data, subject to our legal retention obligations.
• Right to Data Portability: Request your data in a structured, machine-readable format.
• Right to Object: Object to our processing of your data for specific purposes.
• Right to Restrict Processing: Request that we limit how we use your data in certain circumstances.

To exercise any of these rights, email support@z.messengerpanda.app with "Privacy Request" in the subject line. We will respond within 30 days (or 45 days where permitted by applicable law). We may ask you to verify your identity before processing sensitive requests.

Note on your subscribers' rights: If one of your subscribers contacts us about their data, we will direct them to you as the responsible Data Controller for their information.

We use the following sub-processors in the delivery of the Service. Each sub-processor is bound by data processing agreements that require them to protect data to at least the same standard as this Policy:

* Your SMTP provider is determined by your account configuration and is not a sub-processor of MessengerPanda — you have a direct relationship with them.

Our primary database is hosted in Vercel's EU-West-1 (Ireland) region. If you are located outside the European Economic Area, your data is transferred to and stored in that region. When we use sub-processors located in the United States or elsewhere, we rely on Standard Contractual Clauses (SCCs) or the sub-processor's own GDPR compliance certification as the legal basis for the transfer.

The Service is not directed to children under the age of 13 (or 16 in the European Union). We do not knowingly collect personal data from children. If you believe we have inadvertently collected information from a child, please contact us immediately and we will delete it.

We may update this Privacy Policy periodically to reflect changes in our practices, legal obligations, or the features of the Service. When we make material changes, we will update the effective date at the top of this page. For significant changes affecting how we use your data, we will notify you by email where practicable.

We encourage you to review this Policy whenever you interact with the Service to stay informed about our data practices.

Questions about this Policy: support@z.messengerpanda.app